Most Kuwaiti e-commerce projects budget for KNET the way they budget for a shipping plugin: a line item near the end, half a day of work, install it and go live. Then the launch slips three weeks and nobody can say why. The developer is waiting on the bank. The bank is waiting on the merchant.
The delay is almost never the code. KNET is not an integration you complete. It is an approval you are granted, and the thing being approved is your website. Read what the agreement actually asks for and those three weeks stop being a mystery: they are a checklist you could have finished before anyone opened an editor.
What follows is drawn from the KNET payment gateway agreement that Commercial Bank of Kuwait publishes in full. Article numbers below are from that document. Other member banks word their agreements differently in places, but the substance is the same, because the obligations underneath come from the scheme and from the card networks rather than from any one bank.
You do not apply to KNET. Your bank applies for you.
Get this straight first, because it decides who you call when something breaks. KNET operates the national switch. You sign a merchant agreement with a member bank, and that bank sponsors your application and submits it. Your pricing, your settlement account, your gateway credentials and every problem you will ever have sit with that bank’s merchant services desk.
So if you do not yet have a business account at a member bank, that is task one, not task nine. It is the longest lead time in the whole sequence and it is entirely outside your developer’s control.
The documents a bank will ask for are consistent across the market:
- a valid Commercial Registration from the Ministry of Commerce and Industry
- the sector licence covering what you actually sell
- the lease agreement for your premises
- a business account at the sponsoring bank
- for an online merchant, HTTPS on a valid certificate
Expect roughly seven to fifteen working days from a complete file to an activated gateway. Note what that list is: four of the five items are company paperwork you either have or do not. Only one touches the website, and it is not what delays projects.
The clause that actually decides whether you are approved
Annex 1, section 11 of the agreement lists what must be visible on the merchant’s site. Read it as a checklist, because that is exactly how it gets used when your file is reviewed:
- a complete description of the goods and services being sold
- customer service contact details, both an email address and a telephone number
- return, refund and cancellation policies
- the delivery policy
- country of origin, and any export restrictions
- a privacy statement
- a clear statement of when the amount is debited from the cardholder’s account
- how orders are fulfilled
- a statement describing the security controls protecting the buyer’s personal data
- a prompt encouraging the customer to keep the transaction receipt
Count how many of those ten are engineering. One, at a stretch. The other nine are decisions somebody in the business has to make and sentences somebody has to write. On most projects, nobody has been asked to make them, because they were never on anyone’s task list.
That is the three weeks. The developer finishes on Tuesday and the company spends the rest of the month deciding what its refund window is, who answers the support phone, and whether it ships to Saudi Arabia. None of that is difficult. It is just nobody’s job until the bank makes it somebody’s job.
Three clauses that change what you build
You may not charge the customer for paying
Article 5.2 is unambiguous: the merchant may not impose a fee on the cardholder for using any payment method. The “KNET fee: 250 fils” line that appears at checkout on a great many Kuwaiti stores is a breach of the agreement the store signed.
If your margin depends on recovering that cost, recover it in the price of the product, not in a surcharge at the last step. That is a pricing decision, and it needs to be made before the checkout is built, because a checkout designed around a surcharge line looks wrong once the line is deleted.
You may not collect money for somebody else
Article 3.7 prohibits collecting payments on behalf of third parties without the bank’s written approval. Read that carefully if what you are building is a marketplace, a booking platform that takes money for independent providers, or a store that drop-ships under other people’s names. Those are all third-party collection.
This is a design constraint, not a paperwork problem, and it is the single most common reason a Kuwaiti marketplace build has to be restructured late. Settle it in the first week, in writing, with the bank.
The disputes are yours, entirely
Annex 1, section 6 puts full responsibility for any dispute about goods, services, delivery or timing on the merchant. The bank is not a buffer between you and an unhappy customer. It is the party that will debit you and ask you to prove your side.
Which means your order records, delivery confirmations and written policies are not administrative clutter. They are the evidence. A store that cannot produce a timestamped record of what was ordered, what was promised and when it shipped loses chargebacks it should win.
Two more clauses are worth knowing before you sign. Article 5.1 lets the bank amend fees on ninety days written notice, so the rate you are quoted is not permanent. And Article 10.1.5 terminates the agreement if you process nothing for six months, which quietly catches seasonal businesses that trade for one month a year.
Security, stated plainly
The agreement requires SSL of at least 128 bits (Article 3.2) and compliance with the Payment Card Industry Data Security Standard (Annex 1, section 7). Annex 1, section 8 makes the merchant liable for damage caused by negligence in protecting cardholder data.
The practical reading of all that is one sentence: do not touch card numbers. Use the hosted payment page so the card details are entered on the bank’s domain and never reach your server. Do not store a card number anywhere, including in a log file, an order export or an email to yourself. Every serious PCI problem I have been asked to clean up in Kuwait started as a debug log that somebody forgot about.
Direct with the bank, or through an aggregator
There is a second route. Payment service providers such as MyFatoorah, Tap and UPayments hold the merchant relationship themselves, expose one modern API and settle to your account. Onboarding is faster, the developer experience is better, and you get card schemes and KNET behind a single integration.
What you give up is the direct rate and a degree of control. You are also letting somebody else collect money on your behalf, which is the arrangement Article 3.7 exists to govern. That is fine when the provider is licensed for it, and worth confirming rather than assuming.
My rule of thumb: a single merchant selling its own goods at modest volume should start with an aggregator and renegotiate direct later. Serious volume, or a model that pays out to other parties, should go direct and have the third-party conversation up front. Either way, compare what the banks publish — Gulf Bank sets out its merchant solutions — and the switch itself is documented at the KNET payment gateway portal.
When the money actually arrives
Annex 1, section 12 puts settlement on the following day, and Article 4.3 requires that any transaction the bank withholds is released within twenty-four hours at most. So plan cash flow on next business day, not on instant. On a Thursday sale in a Kuwaiti weekend that is a longer wait than it sounds, and it is the kind of detail that matters if you are funding stock from revenue.
The supervisory framework moves, and the Central Bank of Kuwait is where to check the current position rather than a vendor’s summary of it.
The order I would do this in
- Open the business account and confirm the Commercial Registration and sector licence are current. This is the long pole.
- Write the six documents — returns, refunds, cancellation, delivery, privacy, security — before the developer starts. They are a morning’s work for someone who knows the business, and a month’s delay for someone who does not.
- Decide the surcharge question and price accordingly.
- Settle whether you are collecting for anyone else, in writing, with the bank.
- Build the checkout on the hosted page, storing no card data anywhere.
- Submit, and expect seven to fifteen working days.
Done in that order, KNET stops being the thing that delays your launch. It becomes the last easy step, because everything it asks for already exists.
This is the failure mode I described in how to read a website proposal in Kuwait: the expensive part of a build is rarely the part the quote itemises. If you are planning a store, the Amazon checkout and trust lessons applied to Kuwait sit alongside this, and the platform decisions are in optimizing WordPress for Kuwaiti audiences.
If you want the payment side designed properly before anything is built, that is part of what I do as a web consultant in Kuwait, and it sits inside the wider website design and build work.
Frequently asked questions
Can I add a KNET fee to the customer’s total?
No. Article 5.2 of the merchant agreement prohibits charging the cardholder any fee for using a payment method. A surcharge line at checkout puts you in breach of the agreement you signed. If the cost needs recovering, build it into the product price instead.
Do I need a Kuwaiti partner or a Kuwaiti-owned company?
Not for KNET itself. What the bank requires is a valid Commercial Registration, the relevant sector licence and a business account with it. Both Kuwaiti nationals and expatriate business owners obtain merchant facilities on that basis. Ownership rules for your company come from company law, not from the payment scheme.
How long does approval take?
Roughly seven to fifteen working days once the bank has a complete file. The variable is almost never the bank. It is how long the merchant takes to produce the policies and the website content the agreement requires, which is why writing those first shortens the whole project.
Can I run a marketplace with multiple vendors on KNET?
Only with the bank’s written approval. Article 3.7 prohibits collecting payments on behalf of third parties without it. This is the clause that forces late redesigns on marketplace builds, so raise it in the first conversation rather than after the platform is built.
Do I need PCI certification to sell online in Kuwait?
The agreement requires PCI DSS compliance, but the practical scope depends on how you handle card data. Use the hosted payment page, so card numbers are entered on the bank’s domain and never touch your systems, and your obligations shrink to the simplest self-assessment level. Take card numbers on your own server and the burden becomes serious.