Remote VASP serving residents in Bahrain

CBB — Crypto-Asset Service Provider licensing (4 categories), prudential supervision — first MENA jurisdiction with comprehensive crypto framework (2019)

VASP: CASP License from CBB: Category 1 (Exchange): BHD 100,000 (~$265K USD) + BHD 50,000 reserve. Category 2 (Brokerage): BHD 25,000. Category 3 (Custodian): BHD 100,000 + BHD 50,000 reserve. Category 4 (Advisory): BHD 25,000. 3-6 months. CBB pragmatic and accessible.

CUSTODY: Category 3 Crypto Custodian license — BHD 100,000 minimum capital + BHD 50,000 reserve. Client asset segregation. Minimum insurance.

EXCHANGE: Category 1 Crypto Exchange license — BHD 100,000 minimum capital + BHD 50,000 reserve. Rain Financial was first licensed exchange. Valued as regulatory testbed for GCC.

Legal Entity: Must be incorporated in Bahrain.

Absolute Segregation: Crypto-asset platform operators must ensure that client crypto-assets are held separate from their own crypto-assets and are clearly identifiable as client assets (CRY-5.1.1).

No Commingling: Client crypto-assets must not be commingled with the operator's proprietary assets (CRY-5.1.2).

Trust Arrangement: Client crypto-assets must be held in trust for the clients (CRY-5.1.3).

Significant Proportion in Cold Storage: This includes the use of cold storage (offline storage) for a significant proportion of client assets (CRY-4.2.1).

Bahraini law and Central Bank of Bahrain (CBB) regulations require financial institutions, including VASPs, to comply with UN Security Council sanctions and with Bahrain’s own AML/CFT and terrorism‑financing measures, which include domestic designations and restrictions. This framework obliges institutions to freeze assets and prohibit transactions involving individuals and entities designated under applicable UN resolutions and corresponding Bahraini laws, ministerial orders, and CBB directives, not just UN lists alone.

Under the Central Bank of Bahrain Rulebook, Volume 6 (Capital Markets), the relevant sanctions/terrorism‑financing obligation is contained in Module AML: Anti‑Money Laundering & Combating of Financial Crime, not in a separate Module FC. The Module AML imposes requirements on Capital Market Service Providers to implement effective AML/CFT measures in line with FATF recommendations, including compliance with applicable UN Security Council resolutions on terrorism, proliferation, and related asset freezing; however, there is no Section FC‑1.1.1 (UN Sanctions) in a Volume 6 'Module FC (Financial Crime)' as cited.

Mandatory Screening: Licensed VASPs must screen all customers (initial onboarding and ongoing), beneficial owners, and transactions against:

UN Sanctions Lists: Specifically the Consolidated List maintained by the UNSC 1267/1989/2253 ISIL (Da'esh) & Al-Qaida Sanctions Committee and the UNSC 1988 Taliban Sanctions Committee List, as well as other relevant UN sanctions lists.

National Sanctions Lists of Bahrain: This includes lists of designated terrorists and terrorist organizations issued by the Kingdom of Bahrain's competent authorities.

Ongoing Monitoring: Screening is not a one-time event. VASPs must conduct ongoing monitoring to identify if existing clients or parties to transactions subsequently appear on sanctions lists.

Risk-Based Approach (FATF Recommendations): VASPs must implement a risk-based approach to customer due diligence (CDD). Higher-risk jurisdictions (e.g., those identified by FATF as having strategic AML/CFT deficiencies) will trigger enhanced due diligence measures. If the risks cannot be mitigated, the VASP may choose to restrict or prohibit business relationships with customers or transactions originating from/destined for such regions.

Travel Rule: The CBB has implemented the FATF's "Travel Rule," requiring VASPs to obtain and transmit originator and beneficiary information for crypto transfers above a certain threshold. This enhances the ability to identify cross-border transactions involving high-risk jurisdictions or sanctioned entities.

Travel Rule adopted — threshold: BHD 500

Fines (can be substantial).

Suspension or revocation of the VASP's license.

Imprisonment for individuals found responsible for serious AML/CFT breaches, including facilitating sanctioned transactions.

Confiscation of assets.

Obtain name, permanent address, date of birth, nationality, and an official identification number (e.g., CPR/National ID, passport number).

Legal Entities (Companies, Partnerships, etc.):

Identify and verify the identity of the beneficial owner(s) (any natural person owning or controlling 10% or more of shares/voting rights, or otherwise exercising control).

Understand the purpose and intended nature of the business relationship or the occasional transaction.

Assess and, on an ongoing risk‑based and event‑driven basis, reassess the customer’s risk profile using collected and updated customer information, including beneficial ownership information, as part of the institution’s customer due diligence obligations.

OFAC (the U.S. Department of the Treasury’s Office of Foreign Assets Control) and the European Union each operate their own, separate sanctions regimes; there is no dedicated OFAC sanctions program targeting Bosnia and Herzegovina, and EU sanctions are adopted and enforced under EU law rather than by OFAC.

While Bahraini law does not directly mandate compliance with OFAC or EU sanctions for entities purely operating within Bahrain and not involving US or EU persons/funds, in practice, due to the global nature of financial services and cryptocurrencies, most VASPs operating internationally or dealing with international partners will screen against these lists.

VASP Best Practice: Given the interconnectedness of the crypto ecosystem and the potential for severe penalties, prudent VASPs in Bahrain handling international transactions or onboarding international clients will incorporate OFAC, EU, and other major international sanctions lists into their screening processes.

A crypto-asset platform operator should maintain appropriate risk management and, where required by its business model, adequate insurance or equivalent financial protections for client-asset safekeeping risks such as cyber incidents, theft, fraud, and operational failures; current U.S. regulatory guidance emphasizes safe-and-sound operations and broader risk controls rather than a universal standalone insurance mandate.

Note: Finding an official, up-to-date English translation of Law No. 4 of 2001 online can be challenging; its provisions are incorporated into the CBB Rulebook's requirements.