Crypto ATM / kiosk operator in Bahrain

CBB — Crypto-Asset Service Provider licensing (4 categories), prudential supervision — first MENA jurisdiction with comprehensive crypto framework (2019)

CBB Rulebook Volume 6 — Crypto-Asset Module (2019) — Comprehensive crypto exchange, custody, brokerage, advisory licensing. Shariah-compliant crypto product guidance available.

VASP: CASP License from CBB: Category 1 (Exchange): BHD 100,000 (~$265K USD) + BHD 50,000 reserve. Category 2 (Brokerage): BHD 25,000. Category 3 (Custodian): BHD 100,000 + BHD 50,000 reserve. Category 4 (Advisory): BHD 25,000. 3-6 months. CBB pragmatic and accessible.

Virtual asset service providers in Bahrain are regulated under the Central Bank of Bahrain Rulebook, specifically through the Crypto-Asset (CRA) Module in Volume 6 (Capital Markets), which sets out licensing categories, prudential, conduct, technology, and ongoing compliance requirements for crypto-asset service providers operating in or from Bahrain, alongside cross‑referenced modules (e.g., AML/CFT, outsourcing, conduct) in the wider CBB Rulebook.

Module RA (Risk Management Module) - Specifically, RA-6 Virtual Asset Regulatory Framework: This module (introduced in 2019) is the cornerstone of VA regulation in Bahrain. It provides specific licensing requirements, operational standards, technological governance, and crucial AML/CFT measures tailored for VASPs. It categorizes virtual assets and defines various VASP activities (e.g., exchange, custody, portfolio management, advisory).

Module FC (Financial Crime) sets out core AML/CFT requirements for specific categories of CBB licensees, with separate FC Modules issued in different CBB Volumes (e.g., for conventional banks, Islamic banks, insurance licensees). VASPs, where regulated by the CBB, must comply with those FC provisions expressly applicable to their licensee category, including requirements on CDD, EDD, suspicious transaction reporting, record‑keeping, and internal controls, rather than a single generic FC module covering all CBB licensees uniformly.

Identification and Verification:

Obtain name, permanent address, date of birth, nationality, and an official identification number (e.g., CPR/National ID, passport number).

Verify identity using reliable, independent source documents (e.g., government-issued photo ID, passport) and proof of address (e.g., utility bill).

Legal Entities (Companies, Partnerships, etc.):

Identify and verify the identity of the beneficial owner(s) (any natural person owning or controlling 10% or more of shares/voting rights, or otherwise exercising control).

Regulatory requirements concerning the “purpose and intended nature of the business relationship” are no longer treated as a one‑time, static checkbox but as a continuing, risk‑based customer due diligence obligation that must be understood, reassessed, and updated over the life of the relationship, in conjunction with beneficial ownership and ongoing transaction monitoring.

Understand the purpose and intended nature of the business relationship or the occasional transaction.

The regulation regarding 'Source of Funds and Source of Wealth (SoF/SoW)' in Bahrain has been updated, reflecting more robust risk assessment methodologies.

Bahraini law and Central Bank of Bahrain (CBB) regulations require financial institutions, including VASPs, to comply with UN Security Council sanctions and with Bahrain’s own AML/CFT and terrorism‑financing measures, which include domestic designations and restrictions. This framework obliges institutions to freeze assets and prohibit transactions involving individuals and entities designated under applicable UN resolutions and corresponding Bahraini laws, ministerial orders, and CBB directives, not just UN lists alone.

Under the Central Bank of Bahrain Rulebook, Volume 6 (Capital Markets), the relevant sanctions/terrorism‑financing obligation is contained in Module AML: Anti‑Money Laundering & Combating of Financial Crime, not in a separate Module FC. The Module AML imposes requirements on Capital Market Service Providers to implement effective AML/CFT measures in line with FATF recommendations, including compliance with applicable UN Security Council resolutions on terrorism, proliferation, and related asset freezing; however, there is no Section FC‑1.1.1 (UN Sanctions) in a Volume 6 'Module FC (Financial Crime)' as cited.

Mandatory Screening: Licensed VASPs must screen all customers (initial onboarding and ongoing), beneficial owners, and transactions against:

Risk-Based Approach (FATF Recommendations): VASPs must implement a risk-based approach to customer due diligence (CDD). Higher-risk jurisdictions (e.g., those identified by FATF as having strategic AML/CFT deficiencies) will trigger enhanced due diligence measures. If the risks cannot be mitigated, the VASP may choose to restrict or prohibit business relationships with customers or transactions originating from/destined for such regions.

Travel Rule: The CBB has implemented the FATF's "Travel Rule," requiring VASPs to obtain and transmit originator and beneficiary information for crypto transfers above a certain threshold. This enhances the ability to identify cross-border transactions involving high-risk jurisdictions or sanctioned entities.

Fines (can be substantial).

Suspension or revocation of the VASP's license.

Imprisonment for individuals found responsible for serious AML/CFT breaches, including facilitating sanctioned transactions.

Confiscation of assets.

CBB Law (Law No. 64 of 2006): Grants the CBB powers to impose administrative sanctions and refer criminal offenses to the Public Prosecution.

Law No. 4 of 2001 (as amended) concerning the Prevention and Prohibition of the Laundering of Money and Financing of Terrorism: Defines criminal offenses and associated penalties.

VASP Best Practice: Given the interconnectedness of the crypto ecosystem and the potential for severe penalties, prudent VASPs in Bahrain handling international transactions or onboarding international clients will incorporate OFAC, EU, and other major international sanctions lists into their screening processes.

Non-compliance with OFAC sanctions can lead to secondary sanctions, loss of access to the USD clearing system, and reputational damage for any entity (including a VASP) facilitating transactions with sanctioned parties, regardless of its location. Similarly, EU sanctions have extraterritorial reach in certain circumstances.

Outcome: Received a Crypto-Asset Service Provider license. This is not an enforcement action but demonstrates the active regulatory environment.