Bahrain -- AML/CFT Compliance Regulatory Overview
Methodology
AI-generated synthesis from web search results.
Limitations
- AI-generated content -- not reviewed by human expert
- Source URLs not independently verified
Bahrain has been a pioneer in the GCC region in establishing a regulatory framework for virtual assets (VAs), aiming to foster innovation while mitigating the inherent risks of money laundering and terrorist financing (ML/TF). The Central Bank of Bahrain (CBB) has adopted a comprehensive approach that aligns with the Financial Action Task Force (FATF) Recommendations.
Here's a detailed breakdown of the AML/KYC requirements for Cryptocurrency/Virtual Asset Service Providers (VASPs) in Bahrain:
Supervisory Authority
The Central Bank of Bahrain (CBB) is the sole regulatory and supervisory authority responsible for licensing and overseeing Virtual Asset Service Providers (VASPs) in Bahrain. The CBB enforces its regulations, including AML/CFT requirements, through its comprehensive Rulebook and direct supervision.
- Central Bank of Bahrain (CBB) Official Website: https://www.cbb.gov.bh/
- CBB Rulebook: https://www.cbb.gov.bh/cbb-rulebook/
AML/CFT Legislation and Regulatory Framework
Bahrain's AML/CFT framework for VASPs is built upon general national AML laws and specific CBB regulations for virtual assets.
Primary AML/CFT Legislation:
- Law No. (4) of 2001 with respect to the Prevention and Prohibition of the Laundering of Money (as amended): This is Bahrain's overarching anti-money laundering law, which defines ML/TF offenses and imposes obligations on financial institutions (including VASPs, as they are deemed FIs under CBB regulations) to report suspicious transactions.
- Decree Law No. 54 of 2018 with respect to Combating Terrorism Financing: This law specifically addresses the financing of terrorism.
CBB Rulebook Modules (Specific to VASPs): The CBB Rulebook sets out the detailed requirements that all CBB licensees, including VASPs, must adhere to.
- Module RA (Risk Management Module) - Specifically, RA-6 Virtual Asset Regulatory Framework: This module (introduced in 2019) is the cornerstone of VA regulation in Bahrain. It provides specific licensing requirements, operational standards, technological governance, and crucial AML/CFT measures tailored for VASPs. It categorizes virtual assets and defines various VASP activities (e.g., exchange, custody, portfolio management, advisory).
- Module FC (Financial Crime Module): This module sets out the general AML/CFT requirements applicable to all CBB licensees. VASPs must comply with all relevant sections of Module FC, which covers CDD, EDD, STR, record-keeping, and internal controls.
- Other Relevant Modules: Other modules like RM (Remuneration Module), HC (High-Level Controls Module), and relevant directives are also applicable.
These regulations are designed to align with the FATF's updated guidance on Virtual Assets and Virtual Asset Service Providers.
Customer Due Diligence (CDD) Requirements
VASPs in Bahrain must implement robust CDD procedures for all customers and transactions. These are outlined in Module FC and reinforced in Module RA-6.
Identification and Verification:
- Natural Persons:
- Obtain name, permanent address, date of birth, nationality, and an official identification number (e.g., CPR/National ID, passport number).
- Verify identity using reliable, independent source documents (e.g., government-issued photo ID, passport) and proof of address (e.g., utility bill).
- Legal Entities (Companies, Partnerships, etc.):
- Obtain legal name, legal form, proof of existence (e.g., certificate of incorporation), names of directors and authorized signatories, registered address, and details of principal business activity.
- Identify and verify the identity of the beneficial owner(s) (any natural person owning or controlling 25% or more of shares/voting rights, or otherwise exercising control).
- Understand the ownership and control structure.
- Natural Persons:
Purpose and Nature of Relationship:
- Understand the purpose and intended nature of the business relationship or the occasional transaction.
- Assess the customer's risk profile based on this information.
Source of Funds and Source of Wealth (SoF/SoW):
- VASPs must perform due diligence on the source of funds and, where appropriate, the source of wealth, particularly for high-value transactions, high-risk customers, or when there are suspicions of ML/TF. This is especially critical for virtual assets due to their pseudonymous nature.
Ongoing Monitoring:
- Regularly review existing customer information and update it as necessary.
- Conduct ongoing monitoring of transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.
- Pay close attention to complex, unusually large transactions, and all unusual patterns of transactions that have no apparent economic or lawful purpose.
Enhanced Due Diligence (EDD): EDD must be applied in specific circumstances, including but not limited to:
- Politically Exposed Persons (PEPs): For customers identified as PEPs, their family members, or close associates.
- High-Risk Jurisdictions: Customers from or transacting with countries identified as high-risk by the FATF or CBB.
- High-Risk Business Activities: For customers engaged in activities deemed high-risk by the VASP or CBB.
- Unusual or Large Transactions: Transactions that are particularly complex, unusually large, or exhibit unusual patterns.
- Use of Mixers/Tumblers or Privacy Coins: Transactions involving these technologies should trigger EDD due to their inherent anonymity features.
- Cross-border Virtual Asset Transfers: The CBB's Module RA-6 specifically highlights the need for heightened scrutiny for international transfers.
The "Travel Rule": As per FATF Recommendation 16 and incorporated into CBB regulations, VASPs must comply with the "Travel Rule" for virtual asset transfers above a certain threshold (typically equivalent to USD/EUR 1,000). This means VASPs must:
- Obtain and hold required originator information (sender's name, account number/wallet address, physical address, national ID number, date and place of birth).
- Obtain and hold required beneficiary information (receiver's name, account number/wallet address).
- Transmit this information to the beneficiary VASP (or to the beneficiary if they are not a VASP).
- Take reasonable measures to verify the identity of their customers (originator or beneficiary).
Suspicious Transaction Reporting (STR) / Suspicious Activity Reporting (SAR)
VASPs, like all financial institutions in Bahrain, have a legal obligation to report any actual or attempted transactions that they suspect might be related to money laundering or terrorist financing.
Reporting Obligation:
- VASPs must establish and maintain systems to detect and report suspicious transactions.
- Any employee who knows or suspects that funds are proceeds of a crime or are related to terrorist financing must report their suspicions internally to the VASP's Money Laundering Reporting Officer (MLRO).
- The MLRO, after due consideration, must submit an STR to Bahrain's Financial Intelligence Unit (FIU).
No Tipping-Off:
- It is strictly prohibited to inform the customer or any third party that an STR has been filed or that an investigation is underway.
Timeliness:
- STRs must be submitted promptly, without delay, once suspicion has been formed.
Indicators of Suspicion for VAs:
- Unusual or complex virtual asset transactions that do not make economic sense.
- Structuring of transactions to avoid thresholds.
- Frequent and rapid transfers of virtual assets, especially to and from multiple addresses.
- Transactions involving mixers, tumblers, or privacy coins without legitimate justification.
- Large deposits of virtual assets followed by immediate withdrawal.
- Customer refusal to provide requested CDD information or providing inconsistent information.
- Transactions linked to identified illicit activities or sanctioned entities/individuals.
- Rapid changes in transaction patterns or sudden increases in activity without explanation.
Record-Keeping Obligations
VASPs must maintain comprehensive records to assist in investigations and demonstrate compliance.
Duration:
- All customer identification data, transaction records, and business correspondence must be retained for at least five years following the termination of the business relationship or after the date of an occasional transaction.
- Records of STRs and any internal suspicious activity reports must also be kept for at least five years.
Types of Records:
- CDD Records: Copies of identification documents, verification data, beneficial ownership information, and risk assessments.
- Transaction Records: Details of all virtual asset transactions, including dates, amounts, types of virtual assets, sender and receiver wallet addresses (or other identifiers), and any associated fiat currency conversions.
- Internal Policies and Procedures: Records of all AML/CFT policies, procedures, and internal control manuals.
- Training Records: Documentation of all AML/CFT training provided to staff.
- Audit Reports: Records of internal and external AML/CFT audit findings.
- STRs: Copies of all suspicious transaction reports filed.
Accessibility:
- Records must be kept in a manner that allows for easy retrieval by the CBB or other competent authorities upon request.
In summary, Bahrain's CBB has established a robust and comprehensive AML/KYC framework for VASPs, treating them as financial institutions subject to strict regulatory oversight. Compliance requires a deep understanding of the CBB Rulebook, particularly Modules RA-6 and FC, and a commitment to implementing advanced systems for customer due diligence, transaction monitoring, and suspicious activity reporting, fully aligning with international standards set by FATF.
Source Data
Bahraini law and Central Bank of Bahrain (CBB) regulations require financial institutions, including VASPs, to comply with UN Security Council sanctions *and* with Bahrain’s own AML/CFT and terrorism‑financing measures, which include domestic designations and restrictions. This framework obliges institutions to freeze assets and prohibit transactions involving individuals and entities designated under applicable UN resolutions and corresponding Bahraini laws, ministerial orders, and CBB directives, not just UN lists alone.
Under the Central Bank of Bahrain Rulebook, Volume 6 (Capital Markets), the relevant sanctions/terrorism‑financing obligation is contained in Module AML: Anti‑Money Laundering & Combating of Financial Crime, not in a separate Module FC. The Module AML imposes requirements on Capital Market Service Providers to implement effective AML/CFT measures in line with FATF recommendations, including compliance with applicable UN Security Council resolutions on terrorism, proliferation, and related asset freezing; however, there is no Section FC‑1.1.1 (UN Sanctions) in a Volume 6 'Module FC (Financial Crime)' as cited.
The Central Bank of Bahrain’s crypto‑asset regulations are set out in Volume 6 (Capital Markets) of the CBB Rulebook, primarily in the Crypto‑Asset (CRA) Module, and are now complemented by an additional Stablecoin Issuance and Offering (SIO) Module in the same volume for stablecoin‑specific activities.
OFAC (the U.S. Department of the Treasury’s Office of Foreign Assets Control) and the European Union each operate their own, separate sanctions regimes; there is no dedicated OFAC sanctions program targeting Bosnia and Herzegovina, and EU sanctions are adopted and enforced under EU law rather than by OFAC.
While Bahraini law does not *directly* mandate compliance with OFAC or EU sanctions for entities purely operating within Bahrain and not involving US or EU persons/funds, in practice, due to the global nature of financial services and cryptocurrencies, most VASPs operating internationally or dealing with international partners will screen against these lists.
Non-compliance with OFAC sanctions can lead to secondary sanctions, loss of access to the USD clearing system, and reputational damage for any entity (including a VASP) facilitating transactions with sanctioned parties, regardless of its location. Similarly, EU sanctions have extraterritorial reach in certain circumstances.
**VASP Best Practice:** Given the interconnectedness of the crypto ecosystem and the potential for severe penalties, prudent VASPs in Bahrain handling international transactions or onboarding international clients will incorporate OFAC, EU, and other major international sanctions lists into their screening processes.
**Mandatory Screening:** Licensed VASPs must screen all customers (initial onboarding and ongoing), beneficial owners, and transactions against:
**UN Sanctions Lists:** Specifically the Consolidated List maintained by the UNSC 1267/1989/2253 ISIL (Da'esh) & Al-Qaida Sanctions Committee and the UNSC 1988 Taliban Sanctions Committee List, as well as other relevant UN sanctions lists.
**National Sanctions Lists of Bahrain:** This includes lists of designated terrorists and terrorist organizations issued by the Kingdom of Bahrain's competent authorities.
**Ongoing Monitoring:** Screening is not a one-time event. VASPs must conduct ongoing monitoring to identify if existing clients or parties to transactions subsequently appear on sanctions lists.
**Technology Solutions:** VASPs are expected to use reliable technology solutions for efficient and accurate screening.
**Sanctions Compliance:** Transactions involving jurisdictions subject to comprehensive UN (and implicitly, OFAC/EU) sanctions (e.g., Iran, North Korea, Syria, certain regions of Russia) are effectively prohibited due to sanctions regimes. VASPs must block or reject such transactions and report them.
**Risk-Based Approach (FATF Recommendations):** VASPs must implement a risk-based approach to customer due diligence (CDD). Higher-risk jurisdictions (e.g., those identified by FATF as having strategic AML/CFT deficiencies) will trigger enhanced due diligence measures. If the risks cannot be mitigated, the VASP may choose to restrict or prohibit business relationships with customers or transactions originating from/destined for such regions.
**Travel Rule:** The CBB has implemented the FATF's "Travel Rule," requiring VASPs to obtain and transmit originator and beneficiary information for crypto transfers above a certain threshold. This enhances the ability to identify cross-border transactions involving high-risk jurisdictions or sanctioned entities.
Imposition of specific conditions on the VASP's license.
Suspension or revocation of the VASP's license.
Imprisonment for individuals found responsible for serious AML/CFT breaches, including facilitating sanctioned transactions.
**CBB Law (Law No. 64 of 2006):** Grants the CBB powers to impose administrative sanctions and refer criminal offenses to the Public Prosecution.
**Law No. 4 of 2001 (as amended) concerning the Prevention and Prohibition of the Laundering of Money and Financing of Terrorism:** Defines criminal offenses and associated penalties.
**URL for CBB Law:** CBB Law No. 64 of 2006 (See Part 5, Offences and Penalties)
*Note: Finding an official, up-to-date English translation of Law No. 4 of 2001 online can be challenging; its provisions are incorporated into the CBB Rulebook's requirements.*
**United Nations Security Council Consolidated List:** This list is universally applied by Bahrain.
**URL:** UN Security Council Consolidated List
**Kingdom of Bahrain's National Terrorism Lists:** Bahrain maintains national lists of individuals and entities designated as terrorists or terrorist organizations, in accordance with **Law No. 54 of 2006 regarding the Proscription of Terrorist and Terrorist Entities**. Financial institutions, including VASPs, are required to screen against these lists. These lists are typically disseminated to regulated entities through CBB circulars.
*Note: These lists are not publicly published online in a single consolidated database for easy public access, but rather communicated confidentially to licensed institutions by the CBB or other competent authorities.*
**Adopted:** Yes, the principles of the FATF Travel Rule are adopted and integrated into Bahrain's regulatory framework for Crypto-Asset Service Providers (CASPs) licensed by the CBB. While not explicitly termed "Travel Rule" in every section, the requirements for originator and beneficiary information collection and transmission are mandated.
**Legislation/Guidance:** The primary regulatory framework is the **CBB Rulebook, Volume 6 – Capital Markets, Crypto-assets (CA) Module**.
**URL:** CBB Rulebook Volume 6 (Capital Markets) (Navigate to the Crypto-assets (CA) Module within this volume).
The CBB issues a range of regulatory instruments—including binding directives, circulars, guidance notes and other measures such as institution‑specific liquidity add‑ons—that complement and implement its rulebook within a broader, multi‑tiered supervisory framework.
The CBB's comprehensive regulatory framework for crypto-assets came into effect in **2019**. This framework included stringent AML/CFT obligations for CASPs, encompassing requirements aligned with the Travel Rule principles.
The CBB's AML/CFT requirements generally align with international standards. For the FATF Travel Rule, the general threshold is typically **USD/EUR 1,000** or equivalent for transactions involving at least one unhosted wallet, or in jurisdictions where such a threshold is applied.
For VASP-to-VASP transfers, the expectation is generally that required originator and beneficiary information must accompany the transfer regardless of amount, with CBB applying a risk-based framework for additional checks and handling of higher-risk cases.
The CBB's CA Module requires CASPs to conduct Customer Due Diligence (CDD) and ongoing monitoring, which would necessitate collecting originator and beneficiary information for virtually all transactions processed by a licensed VASP.
The CBB's framework covers all entities licensed as **Crypto-Asset Service Providers (CASPs)**. The CA Module defines various regulated crypto-asset activities, including:
Dealing in crypto-assets as a principal
Dealing in crypto-assets as an agent
Acting as a crypto-asset custodian
Any entity performing these activities and licensed by the CBB is subject to the AML/CFT requirements, including those aligning with the Travel Rule.
**Collect Information:** Obtain and hold accurate and meaningful originator and beneficiary information for all crypto-asset transfers. This includes:
Originator Information: Name, physical address, national identity number (or customer identification number), and the crypto-asset wallet address or account identifier.
Beneficiary Information: Name, physical address, and the crypto-asset wallet address or account identifier.
**Transmit Information:** Ensure that the collected information "travels" with the transaction to the beneficiary VASP, or is made available upon request. This implies secure and reliable methods for data transfer between CASPs.
**Verify Information:** Implement measures to verify the identity of their customers (both originators and beneficiaries) in accordance with CDD requirements.
Store Records: Maintain records of all transactions and the associated originator/beneficiary information for at least five years, as per CBB AML/CFT requirements.
**Monitor and Report:** Implement robust transaction monitoring systems to identify suspicious transactions and report them to the Financial Intelligence Directorate (FID) of Bahrain.
**Risk-Based Approach:** CASPs must have a comprehensive risk assessment framework to identify, assess, and mitigate AML/CFT risks, which informs the level of due diligence and information collection required.
Monetary Fines: Substantial financial penalties imposed on the CASP and/or its senior management.
Administrative Sanctions: Public reprimands, warnings, and specific directives to rectify deficiencies.
Restrictions on Operations: Imposing limitations on business activities or specific transactions.
**Suspension or Revocation of License:** For serious or repeated breaches, the CBB can suspend or revoke a CASP's operating license, effectively forcing them to cease operations.
**Individual Accountability:** Senior management and board members can be held personally accountable and face individual sanctions, including disqualification from holding similar positions.
**Referral for Criminal Prosecution:** In cases of severe AML/CFT breaches or suspected criminal activity, the CBB can refer cases to the Public Prosecution for criminal investigation and prosecution under Bahrain's AML/CFT laws (e.g., Law No. (4) of 2001 with respect to the prevention and combating of money laundering and terrorism financing, as amended).
5 fact(s) collected but awaiting source verification. View in explorer →
Sources & Attribution
This article was generated by SearXNG+LLM .
Primary Sources
Edit History
This article is maintained by AI research workers and reviewed by human editors. Learn about our methodology →