The Industrial Bank of Kuwait maintains and implements an effective and risk-based Anti-Money Laundering , Counter-Terrorist Financing and Counter Proliferation Financing (AML/CFT/CPF) compliance framework, designed to prevent and detect any attempted or actual misuse of the Bank’s products, services, delivery channels, or systems for the purposes of money laundering, terrorist financing, or proliferation financing.

1) Regulatory & Legal Compliance

We confirm that the Bank’s AML/CFT/CPF framework is established and operated in full compliance with applicable laws and regulatory requirements in the State of Kuwait, including but not limited to:

• Kuwaiti AML/CFT/CPF Law No. (106) of 2013, and its amendments and implementing regulations
• Relevant Ministerial Resolutions, circulars, and enforcement instructions issued by competent authorities
• Central Bank of Kuwait (CBK) AML/CFT/CPF instructions, regulations, and supervisory expectations applicable to banks and financial institutions
• Reporting obligations and requirements of the Kuwait Financial Intelligence Unit (KFIU), including submission of suspicious transaction reports and related disclosures in accordance with the prescribed format and timelines

2) Alignment with International Standards

We confirm that the Bank aligns its AML/CFT/CPF program with internationally recognized standards and best practices, including:

• Financial Action Task Force (FATF) Recommendations
• A risk-based approach that is consistent with global expectations on customer due diligence, beneficial ownership transparency, and ongoing monitoring

3) Governance, Oversight & Accountability

We confirm that AML/CFT/CPF governance within the Bank is supported through:

• Active oversight by the Board of Directors and Senior Management
• A properly established and independent AML Compliance function
• Clearly defined roles and responsibilities including the appointment of a competent AML Compliance Officer / MLRO (AMLRO) with appropriate authority, independence, and access to information required to perform the role effectively

4) Risk-Based Approach (RBA)

We confirm that the Bank applies a documented and risk-based approach across its activities, including:

• Enterprise-wide AML/CFT/CPF risk assessment covering customers, products, services, geographies, and channels
• Risk classification methodologies supported by measurable criteria and periodic review
• Enhanced due diligence measures for higher-risk relationships, including PEPs, high-risk industries, and higher-risk jurisdictions

5) Customer Due Diligence (CDD) & KYC

We confirm that the Bank applies adequate KYC/CDD controls throughout the customer lifecycle, including:

• Customer identification and verification
• Identification and verification of beneficial owners and controlling parties
• Collection of customer profile and purpose of relationship
• Ongoing review and updating of customer records based on risk and material changes

6) Transaction Monitoring & Detection

We confirm that the Bank has established effective monitoring measures designed to detect unusual or suspicious activity through:

• Transaction monitoring aligned with customer risk profile and expected activity
• Alert management, investigation procedures, and escalation controls
• Strong documentation and audit trails supporting decision-making and actions taken

7) Sanctions & Targeted Financial Sanctions (TFS)

We confirm that the Bank applies controls to comply with applicable sanctions obligations and targeted financial sanctions, including:

• Screening of customers, beneficial owners, and related parties
• Screening of transactions where applicable
• Escalation and reporting mechanisms consistent with Kuwait requirements and CBK expectations
• Immediate action when a match is confirmed, including freezing/holding procedures as applicable under law and regulatory guidance

8) Suspicious Transaction Reporting (STR)

We confirm that the Bank has clear and effective procedures for identifying, escalating, and reporting suspicious activities, including:

• Internal escalation by staff
• Independent review and decision-making by AML function / AMLRO
• Timely submission of Suspicious Transaction Reports (STRs) to the KFIU
• Maintaining confidentiality and compliance with the prohibition of tipping-off

9) Record Keeping & Documentation

We confirm that the Bank maintains comprehensive AML/CFT/CPF records in line with Kuwaiti legal and regulatory retention requirements, including:

• KYC/CDD documents
• Transaction records
• Investigations, alerts, STR-related supporting information
• Training, audit, and governance documentation

10) Training, Awareness & Culture

We confirm that the Bank promotes an AML/CFT/CPF compliance culture supported by:

• Mandatory AML/CFT/CPF training programs for all relevant staff
• Specialized training for higher-risk functions
• Periodic evaluation of training effectiveness

11) Independent Testing & Continuous Improvement

We confirm that the Bank’s AML/CFT/CPF program is subject to ongoing improvement through:

• Independent testing and periodic reviews (Internal Audit and/or external reviews where applicable)
• Prompt remediation of identified deficiencies
• Continuous enhancement of policies, procedures, monitoring scenarios, and control effectiveness in line with emerging risks and regulatory expectations

Declaration

Based on the above, we confirm that The Industrial Bank of Kuwait maintains an AML/CFT/CPF compliance framework that is appropriate, effective, risk-based, and in alignment with Kuwait regulatory requirements, CBK guidelines, FATF standards, and KFIU reporting obligations.