Kuwait CMA Strengthens Corporate Governance Framework under Decision No. 56 of 2026

Authors: Tarek Yehya, Partner // Lama Abou Ali, Counsel // Sara Awaly, Associate

BACKGROUND

In a recent update to Kuwait’s corporate governance framework, the Capital Markets Authority (the “CMA”) issued Decision No. 56 of 2026 (the “Decision”), amending certain provisions of Module Fifteen (Corporate Governance) of the CMA Executive Bylaws.

The Decision was issued on 6 May 2026 and published in the Official Gazette on 10 May 2026. It came into force from the date of its issuance. Companies subject to Module Fifteen are required to regularize their position from the date of issuance of the Decision and no later than 31 December 2026, except for the following: (i) the amended independent director requirements, which apply upon the election of a new board after the expiry of the current board’s term, at the first ordinary general assembly convened for this purpose after at least three months from the date of issuance of the Decision; and, (ii) the amended requirements relating to the forms required to be submitted through the CMA’s governance system on its electronic portal, which apply from the date of issuance of the Decision.

SCOPE OF APPLICATION

Module Fifteen applies to companies listed on the Exchange and to shareholding companies licensed by the CMA, whether listed or unlisted, subject to certain exclusions. These exclusions include entities subject to the supervision of the Central Bank of Kuwait, listed companies subject to the supervision of the Insurance Regulatory Unit, and non-Kuwaiti companies listed on the Exchange at the time Module Fifteen was issued.

Under the new update, the Decision extends the exclusions to branches of foreign companies where the parent company is subject to corporate governance requirements in its home jurisdiction that are materially equivalent to those applicable under Module Fifteen. This addition addresses a gap where foreign branches were caught by Module Fifteen despite being subject to comparable governance standards elsewhere.

KEY AMENDMENTS

Comply or Explain

The amended rules under the Decision replace the previous framework, under which companies could disclose departures from corporate governance requirements in relatively general terms. In practice, that approach left room for broad explanations that did not always identify the specific rule being departed from, the reasons for non-compliance, or the corrective steps being taken.

Now, where a company departs from any governance requirement, it must notify the CMA and provide a structured explanation. That explanation must:

– identify the specific article number from which the company has departed;

– explain the reasons for the departure;

– describe the corrective measures being taken; and

– state the expected timeline for remediation.

The Decision further aligns the board’s responsibilities with the enhanced “Comply or Explain” framework. Where a company departs from any corporate governance requirement, the annual company report must state the reasons for the departure, using the CMA-prescribed template through the CMA’s electronic portal.

In practice, boards must ensure that governance policies and procedures covering the company’s governance framework, risk management, internal controls, performance indicators and reporting obligations are not only adopted, but implemented, monitored and evidenced. Any non-compliance with Module Fifteen rules must be properly identified, explained and remediated through a clear corrective action plan.

This materially changes the operation of the “Comply or Explain” concept. While justified departures remain possible, the CMA amended rules make clear that compliance is the expected standard, and any departure must be specifically justified and supported.

Independence Criteria for Board Members

Under the CMA corporate governance rules, a board member is considered independent where they are able to exercise judgment and take decisions freely, without being subject to any impediment, personal interest, pressure or influence. The board of a listed company or CMA-licensed company must comprise at least 20%  independent members, provided that the number of independent members does not exceed half the board.

The Decision broadens the independence test for board members and places greater emphasis on relationships across the wider group, stakeholders, and related-party structure, rather than assessing independence by reference to the company alone. A member’s independence may be compromised where the member owns 5% or more of the shares of the company for which they are nominated, or of another company within its group, or acts as a representative of such shareholder. The test also now captures family relationships up to the second degree, rather than only first-degree relationships, with board members or executive management of the company, any group company, or the company’s principal related parties.

In addition, a member will not be considered independent where they serve on the board, or now form part of the executive management, of any group company or related party; are employed by the company, any group company or stakeholder; or represent a legal person holding a controlling interest in the company. The Decision also strengthens the conflict-of-interest analysis by capturing direct or indirect interests held by the independent member, or their first-degree relatives, in contracts or projects with the company or its group during the member’s term. Finally, the Decision introduces a tenure-based limitation, whereby independent members may not serve for more than two consecutive terms unless there has been a break of at least three consecutive years, after which they may be re-nominated.

In practice, companies will need to conduct a broader and more detailed independence assessment before nominating independent directors, including reviewing shareholdings, family relationships, group roles, employment links, stakeholder connections, related-party interests, contractual exposure and tenure.

Finally, a new standalone requirement was introduced requiring independent members to possess qualifications, experience, and technical skills appropriate for the company’s activities and their role.

The Decision also reinforces the ongoing nature of the independence assessment. Independent board members must submit an annual declaration to the nomination and remuneration committee confirming that they continue to satisfy the applicable independence criteria, and must promptly notify the committee if they cease to qualify as independent.

Board Meetings

The Decision also updates the rules on board meetings and aligns them more closely with the standards under the Kuwait Companies Law. As previously established, the board must organize periodic meetings and determine in advance the matters to be discussed during the year. The rules confirm that boards must hold at least 6 meetings annually, with at least 1 meeting every quarter.

Importantly, the Decision expressly provides that resolutions passed by circulation will not count towards the minimum number of required board meetings. Companies therefore cannot rely on written resolutions to satisfy the annual meeting threshold and should ensure that a proper board calendar is adopted at the start of each financial year.

Risk Management and Internal Audit Functions

The Decision makes clear that companies may engage an external party to perform risk management and internal audit tasks where they do not have sufficient internal resources, provided that the external party has the required technical competence and expertise. This is not a new concept and is consistent with the outsourcing framework under Module Five of the CMA bylaws.

However, outsourcing should not replace the company’s obligation to maintain a properly established risk and internal audit function. The company must still have a risk and internal audit department or unit, with clear reporting lines, board oversight and audit committee supervision. In practice, any outsourcing arrangement should be documented as external support to the risk and internal audit function, rather than a substitute for the function itself.

Investor Relations and Shareholder Communication

The Decision expands the requirements relating to investor relations and shareholder communication. As previously established, companies subject to the rules of Module Fifteen must maintain an investor relations unit responsible for providing shareholders, current and prospective investors, and other stakeholders with accurate, timely, and sufficient information on the company.

The Decision clarifies that the investor relations unit must have an appropriate level of independence and should report to executive management, including, for example, the chief executive officer, deputy chief executive officer, or chief financial officer. Its responsibilities include introducing the company’s activities, vision, strategy, and financial performance; responding to shareholder and investor inquiries; facilitating shareholder participation and voting at general assemblies; and publishing information relating to material events or developments.

Internal Control Report

The Decision introduces a more specific timing requirement for the Internal Control Report, which assesses the effectiveness of the company’s internal control systems and procedures. The report must be reviewed by the relevant office, department, or internal audit unit within 90 days from the end of the company’s financial year.

Technology and Corporate Governance Disclosure

The Decision reinforces the requirement for companies to develop and rely on their information technology infrastructure for disclosure and communication purposes.

Companies must expand their use of technology to communicate with shareholders, investors, and stakeholders, including by establishing a dedicated corporate governance section on the company’s website. At a minimum, the Decision clarifies that this section should include at a minimum the details of: the company’s profile, vision, mission and business; management structure; board members; chief executive officer and executive management; ownership structure, including unlisted subsidiaries and affiliates; annual financial statements for at least the last five years, where applicable; annual governance reports; general assembly materials for at least the last three years, where applicable; investor relations contact details; the approved dividend distribution policy; and company contact information.

CMA Electronic Portal and Governance Forms

The Decision formalizes the submission of governance-related forms through the CMA’s electronic portal, iFSAH. iFSAH is the CMA’s electronic filing and disclosure portal through which CMA-licensed entities and licensed funds must submit their disclosures and periodic reports in their capacity as CMA-licensed companies or funds.

Under the Decision, the required governance forms will be made available through iFSAH, and companies must complete and submit them within the prescribed timeframe through the same portal. These forms include, among others, the governance compliance follow-up form, which must be submitted annually within no more than 10 business days from 30 June of each year, and the form confirming satisfaction of the corporate governance report requirements, which must be submitted together with a copy of the corporate governance report and the auditor’s report before the annual general assembly.

HOW WE CAN HELP

Meysan’s corporate and regulatory team regularly advises listed companies, licensed entities, and boards on corporate governance, disclosure, and regulatory compliance matters. Drawing on our experience with CMA requirements and market practice, we assist clients in assessing the practical implications of new regulatory developments, identifying governance gaps, and implementing the required updates within the applicable transitional periods.

For further information on assessing the practical impact of the Decision, identifying governance gaps, or implementing the required updates, please contact: