Does Kuwait require banks to prepare for quantum computing risk?

Yes, as a binding requirement. The Central Bank of Kuwait's Cyber-security and Operational Resilience Framework (CORF), Section 7.1.4, contains four sub-clauses that all use "shall," requiring regulated entities to adopt quantum-resistant cryptographic algorithms, periodically assess cryptographic practices, develop a quantum readiness strategy with its own timelines, and test quantum-resistant algorithms before deployment.

What deadline does CBK set for quantum-safe migration?

None. This is the central gap in CORF's quantum-readiness clause: it requires regulated entities to develop a strategy that itself includes migration timelines and milestones, but CBK does not set a date of its own. The deadline, in effect, is whatever each institution decides when it writes its own required strategy.

Does CORF name specific post-quantum algorithms?

No. CORF's 389 pages contain neither "post-quantum" nor "PQC" as a formal defined term, and no reference to ML-KEM, ML-DSA, or any other specific algorithm. The mandate requires quantum-resistant cryptography generally, without specifying which standard satisfies it.

Does Kuwait require a cryptographic inventory or CBOM?

Not explicitly. CORF requires regulated entities to assess "critical systems and data at risk" and "third-party dependencies" as part of their quantum readiness strategy, which in practice requires knowing where cryptography runs across an organization's systems and vendors -- but the document never uses the term "cryptographic inventory" or "CBOM."

Who does Kuwait's quantum-readiness mandate apply to?

CBK-regulated entities -- banks, insurers, exchanges, and other financial institutions under the central bank's supervision. CITRA, Kuwait's telecom and ICT regulator, has published no PQC-specific requirement of its own, so the mandate's reach stops at the financial sector.

Has CBK published a model quantum readiness strategy for institutions to follow?

Not as part of CORF. The framework requires each regulated entity to develop its own strategy, including its own timelines and milestones, rather than adopting a central bank-issued template. Chapter 3 of CORF does define named emerging-technology workforce roles -- "Quantum Security Engineer" and "Quantum-safe Cryptography Engineer" -- as a capability-maturity reference point.

pqckuwaitcbkcorffinancial-servicesmandate

Kuwait's Banks Are Already Required to Have a Quantum Strategy. Most Don't Know What's In It.

CBK's Cyber-security and Operational Resilience Framework binds every regulated financial entity to four 'shall' clauses on quantum readiness -- with no deadline, no named algorithm, and the obligation to write their own migration plan from scratch.

PQC Security EditorialOctober 18, 20264 min read

If you run compliance for a Kuwaiti bank, you are already required by binding regulation to have a quantum readiness strategy. The regulation that requires it doesn't tell you what should be in it, by when, or using which algorithm -- it tells you to go figure that out and write it down.

Four clauses, all of them binding

The Central Bank of Kuwait's Cyber-security and Operational Resilience Framework (CORF) devotes Section 7.1.4, "Other Emerging Technologies (Quantum Computing, 5G, etc.) Security," to quantum readiness. Unlike most national PQC guidance, which hedges with "should" or "recommends," all four of CORF's operative sub-clauses use "shall":

"7.1.4.1. Regulated Entities shall start considering the implications of the threats which will eventually be posed by quantum computing, by starting to adopt quantum-resistant cryptographic algorithms.

7.1.4.2. Regulated Entities shall periodically assess cryptographic practices to ensure resistance to quantum computing capabilities.

7.1.4.3. Regulated Entities shall develop a quantum readiness strategy, prioritizing the transition to quantum-resistant cryptographic algorithms across all systems and processes, while also addressing broader risks posed by quantum computing. The strategy shall include timelines and milestones for cryptographic migration, assessment of critical systems and data at risk, third-party dependencies, and operational preparedness.

7.1.4.4. Regulated Entities shall test and validate quantum-resistant cryptographic algorithms in testing environments to ensure compatibility and performance prior to deployment."

That's a genuine mandate, not a recommendation dressed up in formal language. CORF's Chapter 3 toolkit reinforces it with named workforce roles -- "Quantum Security Engineer" and "Quantum-safe Cryptography Engineer" -- among its defined emerging-technology specialisms, and a capability heat-map table uses "quantum-safe" and "quantum-resistant" indicators as maturity criteria elsewhere in the document.

The clause that makes compliance hard to pin down

Here's what makes CORF unusual compared to roadmap-style regulation from the EU, UK, or US: it doesn't set a deadline. Clause 7.1.4.3 requires each regulated entity to develop its own quantum readiness strategy, and that strategy must include its own timelines and milestones. CBK isn't deferring the deadline to a future announcement -- it's delegating the deadline-setting itself to each institution.

In practice, that means two banks in the same CBK-regulated population could have compliant strategies with completely different target years, because CORF never specifies one. A regulator reviewing compliance can ask "do you have a strategy with timelines," but can't point to a central bank-issued date to check it against.

The same gap applies to algorithms. CORF never mentions "post-quantum cryptography" or "PQC" as a formal term across its 389 pages, and names no specific standard -- not ML-KEM, not ML-DSA, not any NIST or other algorithm family. "Quantum-resistant cryptographic algorithms" is the operative phrase throughout, left for each institution to interpret.

What the mandate assumes you already have

Clause 7.1.4.3's required strategy has to include "assessment of critical systems and data at risk" and "third-party dependencies." Read plainly, that's asking for something close to a cryptographic inventory -- you can't assess which systems are at risk from quantum computing without knowing where your cryptography actually runs, in your own code and in your vendors' products. CORF never uses the words "cryptographic inventory" or "CBOM," but the practical requirement is there regardless of the label.

This is the part most regulated entities will find hardest, not because it's conceptually difficult, but because most organizations genuinely don't have a current, accurate answer to "where does RSA or ECC run across our systems" without doing the work to find out. CORF assumes that answer exists before the strategy can be written.

Where the mandate stops

CITRA, Kuwait's telecom and ICT regulator, has published no PQC-specific requirement of its own. CORF's binding force reaches CBK-regulated financial entities -- banks, insurers, exchanges -- and no further. If you're a Kuwaiti organization outside the financial sector, nothing in Kuwaiti regulation currently requires quantum readiness of you, even though the same "harvest now, decrypt later" risk applies regardless of sector.

What to do with this

If you're a CBK-regulated entity, "shall" is not conditional language, and CORF gives you no deadline to point to as "not yet" -- the absence of a central-bank-set date doesn't mean the obligation is optional, it means you're the one who has to set it. The strategy document itself is the first deliverable your institution owes, and it can't be written honestly without the underlying inventory work: a real accounting of where cryptography runs across your own systems, your vendors, and your infrastructure.

The Kuwait country page tracks CORF's quantum-readiness clause with its primary source.

Frequently asked questions

Does Kuwait require banks to prepare for quantum computing risk?: Yes, as a binding requirement. The Central Bank of Kuwait's Cyber-security and Operational Resilience Framework (CORF), Section 7.1.4, contains four sub-clauses that all use "shall," requiring regulated entities to adopt quantum-resistant cryptographic algorithms, periodically assess cryptographic practices, develop a quantum readiness strategy with its own timelines, and test quantum-resistant algorithms before deployment.
What deadline does CBK set for quantum-safe migration?: None. This is the central gap in CORF's quantum-readiness clause: it requires regulated entities to develop a strategy that itself includes migration timelines and milestones, but CBK does not set a date of its own. The deadline, in effect, is whatever each institution decides when it writes its own required strategy.
Does CORF name specific post-quantum algorithms?: No. CORF's 389 pages contain neither "post-quantum" nor "PQC" as a formal defined term, and no reference to ML-KEM, ML-DSA, or any other specific algorithm. The mandate requires quantum-resistant cryptography generally, without specifying which standard satisfies it.
Does Kuwait require a cryptographic inventory or CBOM?: Not explicitly. CORF requires regulated entities to assess "critical systems and data at risk" and "third-party dependencies" as part of their quantum readiness strategy, which in practice requires knowing where cryptography runs across an organization's systems and vendors -- but the document never uses the term "cryptographic inventory" or "CBOM."
Who does Kuwait's quantum-readiness mandate apply to?: CBK-regulated entities -- banks, insurers, exchanges, and other financial institutions under the central bank's supervision. CITRA, Kuwait's telecom and ICT regulator, has published no PQC-specific requirement of its own, so the mandate's reach stops at the financial sector.
Has CBK published a model quantum readiness strategy for institutions to follow?: Not as part of CORF. The framework requires each regulated entity to develop its own strategy, including its own timelines and milestones, rather than adopting a central bank-issued template. Chapter 3 of CORF does define named emerging-technology workforce roles -- "Quantum Security Engineer" and "Quantum-safe Cryptography Engineer" -- as a capability-maturity reference point.