Kuwait Decree-Law No. 10 of 2026: the website and app checklist, article by article

Kuwait's new e-commerce law, Decree-Law No. 10 of 2026 regulating the digital commerce sector, sets rules that every online store and app has to build in. We read the full Arabic text and its explanatory memorandum, then turned each obligation into a build item. This is a technical guide written by a software team, not legal advice. Confirm licensing and legal decisions with a Kuwaiti lawyer.

Where the law stands on 27 September 2026

The decree-law was signed on 22 February 2026, according to the text on lawskw.com. A GLA & Company briefing published by Chambers and Partners says it appeared in the Official Gazette (Kuwait Al-Youm) on 1 March 2026. It has 45 articles in 10 chapters, and the Ministry of Commerce and Industry (MOCI) is the regulator (Arts. 6 and 7).

Two articles decide when its obligations apply:

• Article 44: the minister issues the executive regulations within one year of the law's publication in the Official Gazette.
• Article 45: the law is applied one month after the executive regulations are published in the Official Gazette.

As of 27 September 2026, we could not find published executive regulations on MOCI's list of ministerial decisions or on lawskw.com. If they are unpublished, Article 45's one-month countdown has not started. Read literally, Article 44 sets a deadline of about 1 March 2027.

That does not make the law a dead letter. lawskw.com lists it as "ساري" (in force), and MOCI already cites its Articles 6 and 7 as the legal basis for Decision 109. Ask your lawyer which obligations you should treat as live today.

Why some sources say "six months"

The explanatory memorandum says six months after publication; the enacted Article 45 says one month after the executive regulations. Some early coverage, including a Times Kuwait report from 2 March 2026, repeated the six-month figure. Plan against the article text.

Decision 109 is not the executive regulations

Ministerial Decision 109 of 2026 was issued on 8 July 2026 and published in Kuwait Al-Youm issue 1799 on 12 July 2026. It regulates intermediary platforms that display, take and deliver consumer orders, and required licensed platforms to adjust their licences, and parties to existing contracts to amend them, before 1 September 2026. It is not the regulation Article 45 waits for. If you also sell through delivery apps, the decision caps what the platform can charge you; our e-commerce solutions page covers those limits.

On 27 September 2026, local press reported that the Administrative Court annulled Article 15 of the regulation attached to Decision 109 (its administrative sanctions), finding that the minister had exceeded his powers. The report does not say whether the ruling is final.

Who the law covers

Article 1 defines digital commerce broadly: any activity carried out wholly or partly through technical means to deal in goods or services, advertise them, or exchange data about them. A "store" is any website, platform or app that displays or sells products or supplies digital services.

Two more definitions widen the net. A "provider" is any trader or professional working in digital commerce, so a consultant who sells services online is covered. A "consumer" is any natural or legal person who buys through technical means, so sales to companies count too. The definition does not exclude social media, and Article 18 refers to social media accounts registered with MOCI, so Instagram and WhatsApp sellers should assume they are in scope.

Article 3 comes first: nobody may work in digital commerce before registering in MOCI's records for the sector. Article 8 leaves the forms, conditions and fees of registration to a ministerial decision. For the practical steps of licensing, gateway approval and launch, see our guide on how to start an online store in Kuwait.

The article-by-article checklist

Store disclosures (Art. 10)

Show the trade name, the register and its number, and every contact channel in the footer or an "About the seller" page. Keep them in one settings record so the website, app and invoice read the same data. Article 10 ends with "any other data the executive regulations specify", so expect the list to grow.

Checkout: all-in price and a review screen (Arts. 11, 16 and 29)

Article 11 asks for the final price including extra fees such as delivery. Article 29 adds that delivery costs, options and times must be disclosed, with no extra logistics charge unless it was set in advance.

In practice:

• Calculate delivery before the payment page.
• Show the offer's end date next to any discounted price.
• Link the return policy from the product page and the checkout.
• Add a review screen to change quantities, address and delivery before paying. Article 16 lets the customer cancel or amend the affected part of an order when the system offers no way to correct errors.

The Arabic e-invoice (Art. 12)

As soon as the contract is concluded, the provider must send the consumer an electronic invoice in Arabic. Another language may appear alongside it. The invoice must show the price, the total including all fees, the delivery date and place, and the payment method.

For example, a hypothetical perfume store that emails an English-only order confirmation would need an Arabic right-to-left invoice template, Arabic product names in the catalogue and a delivery-date field the system actually fills. Any electronic means that fits the executive regulations is allowed, so email, SMS or WhatsApp may all work. Store the invoice as a numbered document, because Article 24 requires you to keep it.

Delays, withdrawal and refunds (Arts. 14 and 17)

Article 17 lets the consumer withdraw within 14 days of receiving a product, or exchange or return it, provided it is in the same condition. The refund goes back by the same payment method, or another method both sides agree, at no extra cost. Metals, goods and valuables named by ministerial decision have a 24-hour window instead.

Article 17 excludes returns when:

• the consumer has used the product or service;
• the product was made to the consumer's order or specification;
• the product perishes quickly, expires soon, or by its nature cannot be returned;
• the service is accommodation, transport, food or entertainment for a set date or period;
• a software download was completed;
• a digital card's activation code was delivered;
• any other case the executive regulations add.

Put that list in your data model as a return category on each product, so the storefront shows the right policy and the return form rejects ineligible items. A more generous policy of your own is always allowed.

Article 14 requires timely notice of any delay that materially affects the order. The customer may cancel for a refund if delivery runs more than 14 days past the agreed date, unless you agreed another period. Store the promised date on every order, message the customer when it slips, and flag orders 14 days past it.

Payments (Art. 28)

Payment methods must be simple, transparent and non-discriminatory, in line with Central Bank of Kuwait (CBK) instructions. You may deal only with payment providers licensed by the CBK. You may not charge the consumer an extra fee for paying electronically unless the CBK approved it in advance and the fee is stated clearly in the contract terms.

The surcharge ban does not wait for the law to apply. CBK Circular No. 2/RB, RBA, RK/600/2025 (Arabic), dated 30 September 2025, requires all local banks and payment providers to write into their merchant agreements that the merchant may not charge the end customer in Kuwait any fee or extra amount for paying electronically, whatever the method, and to act against merchants who do, including suspending the service.

The CBK keeps two registers, e-payment service providers and e-money service providers. Check your provider on both, or confirm it is a CBK-licensed bank, before you sign. Our guide to payment gateways in Kuwait compares the licensed options, and the KNET integration guide covers the local debit network.

Records and complaints (Arts. 13, 23 and 24)

Article 24 is more than "keep a backup". Documents must be kept in the form sent or received, on secure media, with source, destination, date and place, and stay readable whatever system you move to. Customers can ask for their own records, so build an append-only archive with metadata, exportable per customer.

Electronic signatures and the sandbox (Arts. 25, 26 and 31)

Article 25 requires every provider to obtain MOCI's prior licence for its electronic signature. The text does not say whether this applies to providers that never sign electronically, so confirm your position with a lawyer. Article 26 requires you to report any misuse of your signature to MOCI as soon as you learn of it. Article 31 lets innovators whose product current rules do not cover apply to MOCI for a supervised test environment. All three are on Article 39's criminal list.

Security (Arts. 15 and 32)

Articles 15 and 32 require providers to follow the National Cyber Security Center's measures and Kuwait's cybersecurity standards, and to update data protection regularly. The law lists no specific controls. Until the regulations do, our suggested baseline is HTTPS everywhere, patched dependencies, least-privilege admin access, two-factor login for staff, and reviewable logs. If you are also choosing where to host customer data, read our note on Kuwait data residency and cloud rules.

Ads and promotions (Arts. 18 to 22)

An ad must show the provider's name, the price, a clear description and contact details; ads from MOCI-registered social accounts may link to the official account instead. MOCI can order a non-compliant ad fixed within 24 hours and then block the store (Arts. 19 and 20). Promotions must state their conditions (Art. 22).

Penalties: criminal and administrative

Article 39 sets imprisonment of up to one year and a fine of KD 1,000 to KD 10,000, or either one, for anyone who breaches Articles 3, 15, 23, 24, 25, 26, 28, 31 or 32. The same applies to false registration data, offering illegal products, and refusing to carry out a decision of the dispute settlement committee. Penalties double for repeat offences.

Other breaches, such as of Articles 10 or 12, go to two MOCI committees (Arts. 33 to 38), which can impose a financial penalty under a penalties regulation the minister issues, or order a fix by a deadline (Arts. 7 and 34 to 36). The violations committee can block a store for up to 30 days, and committee decisions are final and enforceable unless a court rules otherwise (Art. 38). Courts may confiscate the tools and proceeds of a crime and, if the owner knew, close the store for up to a year (Art. 40). A company's actual manager faces the same penalties if they knew of the breach and either their failure in their duties contributed to it or they gained a personal benefit from it (Art. 41). Settlement is possible until a final judgment (Art. 42).

What the law does not say

Some guides add requirements we could not find in the text. The decree-law does not mention Hijri dates on invoices, tax registration, or a rule that data must be stored inside Kuwait. It does not set a registration fee or a minimum capital. Where the law is silent, Article 4 applies Kuwait's existing legislation. The preamble cites, among others, the Consumer Protection Law (No. 39 of 2014), the Electronic Transactions Law (No. 20 of 2014, as amended by Decree-Law No. 148 of 2025) and Law No. 2 of 1995 on discounted sales and promotion, so check that last one before running a sale.

A practical build order

1. Confirm your registration position with MOCI and your lawyer (Art. 3).
2. Move payments to a CBK-licensed provider (Art. 28) and remove any payment surcharge, which a CBK circular of 30 September 2025 already bans.
3. Add the disclosure block and the all-in checkout with a review step (Arts. 10, 11, 16, 29).
4. Build the Arabic invoice as a numbered, stored document (Art. 12).
5. Add return categories, a return request flow, refunds and delay alerts (Arts. 14, 17).
6. Set up the records archive and the complaints log with their retention rules (Arts. 13, 23, 24).
7. Ask your lawyer whether you need MOCI's e-signature licence, and if you sign documents electronically, get the signature licensed first (Art. 25).
8. Write down your security baseline and patching schedule (Arts. 15, 32).
9. Re-check the list when the executive regulations are published.

If you would rather have one team handle the site, the app and the integrations, our website development service starts from KD 799, and the final quote depends on scope.