Self-custodial wallet / non-custodial software in Bahrain

CBB — Crypto-Asset Service Provider licensing (4 categories), prudential supervision — first MENA jurisdiction with comprehensive crypto framework (2019)

VASP: CASP License from CBB: Category 1 (Exchange): BHD 100,000 (~$265K USD) + BHD 50,000 reserve. Category 2 (Brokerage): BHD 25,000. Category 3 (Custodian): BHD 100,000 + BHD 50,000 reserve. Category 4 (Advisory): BHD 25,000. 3-6 months. CBB pragmatic and accessible.

CUSTODY: Category 3 Crypto Custodian license — BHD 100,000 minimum capital + BHD 50,000 reserve. Client asset segregation. Minimum insurance.

Evidence fact bh.licensing.cbb-rulebook-volume-6-crypto-asset-module not found (may have been renamed).

Core regulation for crypto-asset services (including custody and platform-type activities) is set out in CBB Rulebook Volume 6 – Capital Markets, primarily in the Crypto-Assets Module (CRA), with additional specialised modules such as the Stablecoin Issuance and Offering (SIO) Module governing specific activities like stablecoin issuance and offerings.

Module RA (Risk Management Module) - Specifically, RA-6 Virtual Asset Regulatory Framework: This module (introduced in 2019) is the cornerstone of VA regulation in Bahrain. It provides specific licensing requirements, operational standards, technological governance, and crucial AML/CFT measures tailored for VASPs. It categorizes virtual assets and defines various VASP activities (e.g., exchange, custody, portfolio management, advisory).

Mandatory Screening: Licensed VASPs must screen all customers (initial onboarding and ongoing), beneficial owners, and transactions against:

Travel Rule: The CBB has implemented the FATF's "Travel Rule," requiring VASPs to obtain and transmit originator and beneficiary information for crypto transfers above a certain threshold. This enhances the ability to identify cross-border transactions involving high-risk jurisdictions or sanctioned entities.

Risk-Based Approach (FATF Recommendations): VASPs must implement a risk-based approach to customer due diligence (CDD). Higher-risk jurisdictions (e.g., those identified by FATF as having strategic AML/CFT deficiencies) will trigger enhanced due diligence measures. If the risks cannot be mitigated, the VASP may choose to restrict or prohibit business relationships with customers or transactions originating from/destined for such regions.

Identification and Verification:

Obtain name, permanent address, date of birth, nationality, and an official identification number (e.g., CPR/National ID, passport number).

Verify identity using reliable, independent source documents (e.g., government-issued photo ID, passport) and proof of address (e.g., utility bill).

Legal Entities (Companies, Partnerships, etc.):

Obtain legal name, legal form, proof of existence (e.g., certificate of incorporation), names of directors and authorized signatories, registered address, and details of principal business activity.

Identify and verify the identity of the beneficial owner(s) (any natural person owning or controlling 10% or more of shares/voting rights, or otherwise exercising control).

Regulatory requirements concerning the “purpose and intended nature of the business relationship” are no longer treated as a one‑time, static checkbox but as a continuing, risk‑based customer due diligence obligation that must be understood, reassessed, and updated over the life of the relationship, in conjunction with beneficial ownership and ongoing transaction monitoring.

The regulation regarding 'Source of Funds and Source of Wealth (SoF/SoW)' in Bahrain has been updated, reflecting more robust risk assessment methodologies.

Assess and, on an ongoing risk‑based and event‑driven basis, reassess the customer’s risk profile using collected and updated customer information, including beneficial ownership information, as part of the institution’s customer due diligence obligations.