An overview of the regulation of virtual assets in Bahrain

Virtual asset laws and regulations in Bahrain

Regulation of virtual assets and offerings of virtual assets in Bahrain

Regulation of VASPs in Bahrain

Regulation of other crypto-related activities in Bahrain

Other relevant regulatory information

Pending litigation and judgments related to virtual assets in Bahrain (if any)

Government outlook on virtual assets and crypto-related activities in Bahrain

Advantages of setting up a VASP in Bahrain

1. Virtual asset laws and regulations in Bahrain

Bahrain’s regulations for cryptocurrency businesses have evolved since 2017, and the country is now seen as a pioneer in the Middle East region for its cryptocurrency and blockchain regulations The Central Bank of Bahrain (CBB) has established clear framework for licensing and regulation of crypto-asset services. The framework deals with licensing, governance, minimum capital, risk management, AML/CFT, conflicts of interest, business conduct, safeguarding und clients’ money, and cybersecurity for crypto-asset services. The regulatory framework is internationally based, with a focus on best practices that particularly relate to money laundering risk-based approach. The country has also established a regulatory sandbox for new and innovative Fintech products, including those related to digital assets.

In March 2023, the CBB issued amendments regarding crypto-assets following a consultation process with industry stakeholders, to cater to the ongoing developments in the crypto-assets markets and comply with the industry’s best practices. The amendments also describe the requirements for safeguarding the client’s assets to provide a higher level of protection to the investor.

What is considered a virtual asset in Bahrain?

In Bahrain, a virtual asset is defined as a digital representation of value that can be digitally traded and functions as a medium of exchange, unit of account, or store of value. It does not have legal tender status in any jurisdiction and is neither issued nor guaranteed by a jurisdiction.

The CBB has categorises virtual assets into four main types: Payment Tokens, Utility Tokens, Asset Tokens, and Hybrid Tokens. Combined they are called as ‘Accepted Crypto Assets’. The CBB has the power to evaluate whether a crypto-asset is appropriate for trading before accepting it as an ‘Accepted Crypto Asset’.

1. Payment Tokens: These are akin to cryptocurrencies, like Bitcoin, and are intended to be used as a means of payment for acquiring goods or services or for value transfer. They are usually decentralised and do not confer any claims on their issuer.
2. Utility Tokens: These provide access to a specific application or service but are not accepted as a means of payment for other applications. They do not represent a claim on the issuer.
3. Asset Tokens: These are more aligned with traditional securities as they represent assets such as equity or debt claims on the issuer. Asset Tokens promise a share in future company earnings or capital flows, analogous to equities, bonds, or derivatives.
4. Hybrid Tokens: These have features of one or more of the other token types.

What are the relevant laws and regulations?

The table given below is a comprehensive list of the regulatory framework for virtual assets in Bahrain. It includes information on the various regulations and guidelines that govern the use of virtual assets in the country.

Who do such laws and regulations apply to?

The laws and regulations related to virtual assets in Bahrain apply to any individual or entity that engages in the business of virtual assets services, including trading, dealing, advisory, or portfolio management services in accepted crypto-assets, either as principal, agent, custodian or as a crypto-asset exchange within or from Bahrain.

Additionally, these laws and regulations also apply to any platform operator who creates or administers crypto-assets, publishes or uses software for the production or mining of crypto-assets, and runs a loyalty program.

Who are the relevant regulatory authorities in relation to virtual assets in Bahrain?

The relevant regulatory authorities in relation to virtual assets in Bahrain include:

1. CBB: The CBB is responsible for regulating and overseeing the provision, use, and exchange of virtual assets in Bahrain. It has issued the CRA under its Capital Markets Rulebook, which regulates various digital assets services conducted in and from Bahrain.
2. Bahrain Monetary Agency (BMA): The BMA was the central bank of Bahrain until it was succeeded by the CBB on September 7, 2006. The BMA was responsible for various regulatory tasks, including the issuance of currency, oversight of financial institutions, and the implementation of monetary policy.

What are the penalties for breaches of virtual asset laws and regulations in Bahrain?

If an entity or individual breaches the virtual asset laws and regulations in Bahrain, they may be subject to various penalties, including monetary fines, revocation of license, and even imprisonment, depending on the severity of the breach. The penalties and punishment for virtual asset-related offenses are explained in the regulations issued by the Central Bank of Bahrain, under its Rulebook Volume 6.

The penalties for offenses related to virtual assets can range from monetary fines up to BHD 100,000 in some cases, revocation of licenses, and imprisonment. For instance, if an entity or an individual receives compensation for providing unlicensed virtual asset services, they may be fined up to BHD 50,000. Operating a crypto-asset exchange without a valid license may lead to imprisonment for a period of up to five years or a fine of up to BHD 500,000.

Furthermore, a sentence of imprisonment and/or a maximum fine of BHD 30,000 may be imposed on the perpetrator who has unlawfully accessed an IT system. Also, an imprisonment sentence and/or maximum fine of BHD 1,00,000 may be imposed on the perpetrator who uses encryption in order to commit or conceal any of the crimes provided for in the Law or any other law.

2. Regulation of virtual assets and offerings of virtual assets in Bahrain

Are virtual assets classified as ‘securities’ or other regulated financial instruments in Bahrain?

In Bahrain, virtual assets are not generally classified as ‘securities’ or other regulated financial instruments. However, the CBB provides a regulatory framework that can classify certain virtual assets as financial instruments depending on their characteristics and usage.

1. Payment Tokens: These are typically treated as virtual assets and not classified as securities. They are regulated under the CRA for their use in payments, trading, and transfers.
2. Asset/ Security Tokens: If a virtual asset exhibits characteristics similar to traditional securities (e.g., representing shares, bonds, or other investment instruments), it may be classified as a security and subjected to relevant securities regulations under the CBB’s oversight.
3. Utility Tokens: Tokens providing access to a product or service are generally not considered securities but are regulated as virtual assets under the CRA rules.

Are stablecoins and NFTs regulated in Bahrain?

1. Stablecoins: Stablecoins in Bahrain are regulated under the framework provided by the CBB. Stablecoins are digital currencies designed to minimise price volatility by pegging their value to a stable asset, like the US dollar or other traditional currencies.

   Regulatory framework: The CBB’s CRA applies to stablecoins, similar to other virtual assets. This module consists of licensing requirements, operational standards, and compliance obligations for entities dealing with stablecoins. Entities offering stablecoin-related services, such as issuance, trading, or custodial services, must obtain a license from the CBB and adhere to regulations concerning minimum capital requirements, cybersecurity, and client asset protection.

   Compliance requirements: Licensed entities must implement Anti-money laundering and counter-terrorism financing (AML/CTF) measures. Regular reporting and auditing are mandatory to ensure transparency and regulatory compliance. Stablecoin issuers must maintain sufficient reserves of the pegged asset to back the value of the issued stablecoins.

2. NFTs: NFTs are unique digital tokens that represent ownership of a specific asset or piece of content, such as art, music, or in-game items. Currently, there are no specific regulations in Bahrain that directly address NFTs.However, NFTs may fall under the broader umbrella of the CBB’s crypto-asset regulatory framework. Additionally, other laws and regulations in Bahrain, such as those related to intellectual property rights, consumer protection, AML/CFT, may also apply to NFTs and their creation, sale, and use.

Are decentralised finance (DeFi) activities (e.g. lending virtual assets) regulated in Bahrain?

DeFi activities, including lending virtual assets, are regulated in Bahrain under the comprehensive regulatory framework established by the CBB. The CBB has issued detailed guidelines for DeFi and virtual assets, which include licensing requirements, minimum capital requirements, measures to safeguard client assets, technology standards, cybersecurity requirements, risk management requirements, reporting, notifications and approval requirements, conduct of business obligations, and rules for the prevention of market abuse and manipulation. These regulations are explained in the CRA under the CBB’s Capital Markets Rulebook.

The CRA regulate various digital asset services conducted in and from Bahrain, including dealing, broking, advisory, portfolio management, providing custody, and operating a digital assets exchange. Entities and individuals engaged in DeFi activities such as trading, dealing, advisory, or portfolio management services held in virtual assets either as principal, agent, custodian, or as a crypto-asset exchange within or from Bahrain must obtain a ‘Bahrain Crypto Asset Service Provider License’ from the CBB. These regulations also cover the practices and guidelines for lending, borrowing, and other DeFi activities, including requirements for minimum capital, risk management, standards of business conduct, and avoiding conflicts of interest. Furthermore, the regulations include measures required for safeguarding client or customer interests and managing cybersecurity risks.

Are there any restrictions on issuing or publicly offering virtual assets in Bahrain?

The CBB has implemented comprehensive regulations to govern the issuance and public offering of virtual assets in Bahrain. These regulations, explained in the CRA under its Capital Markets Rulebook. Following are the restrictions/requirements in relation to public offering of virtual assets in Bahrain:

1. Licensing requirements: Entities wishing to issue or publicly offer virtual assets in Bahrain must obtain a license from the CBB. The licensing process ensures that only qualified and compliant entities can operate in the market. The CBB requires detailed documentation and preliminary assessments to determine the eligibility of applicants.
2. Minimum capital requirements: To ensure financial stability, entities issuing or publicly offering virtual assets must meet minimum capital requirements set by the CBB. These requirements help cover potential losses and maintain the financial health of the entities.
3. Measures to safeguard client assets: Entities must implement robust measures to safeguard client assets, including maintaining separate accounts for client assets, ensuring the security and integrity of client data, and implementing comprehensive risk management procedures.
4. Technology standards: The CBB mandates that entities meet specific technology standards to manage and store virtual assets.
5. Cybersecurity requirements: To protect against cyber threats, entities must adhere to stringent cybersecurity requirements set by the CBB.
6. Risk management requirements: Entities are required to implement an extensive risk management system to identify, assess, and manage risks associated with virtual assets. Effective risk management is essential to mitigate potential risks and ensure the stability of the financial system.
7. Reporting, notifications, and approval requirements: Entities must report and notify the CBB about various activities, including the issuance and public offering of virtual assets, and any changes to their operations or management. This ensures ongoing compliance and allows the CBB to monitor the activities of licensed entities effectively.
8. Conduct of business obligations: Entities must comply with conduct of business obligations, ensuring they operate fairly and transparently. This includes not engaging in activities that could harm the stability and integrity of the financial system.
9. Prevention of market abuse and manipulation: To maintain market integrity, entities must prevent market abuse and manipulation. They are required to implement measures that prevent activities which could distort the market or harm its stability.

Are there any exemptions to the restrictions on issuing or publicly offering of virtual assets in Bahrain?

In Bahrain, while there are comprehensive regulations governing the issuance and public offering of virtual assets, certain activities are exempt from these restrictions as outlined by the CBB in the CRA under its Capital Markets Rulebook:

1. Creation and mining of crypto assets: Activities related to the creation or mining of crypto assets are not considered regulated services. This includes the development and dissemination of software used for creating or mining crypto assets​​.
2. Loyalty programs: Virtual assets issued as part of a loyalty or rewards program, where tokens are earned through engagement or purchases, are typically exempt. These tokens are not treated as investments and are used within a specific ecosystem or platform​​.
3. Software development: The development and use of software for creating or mining crypto assets do not fall under the regulated services category. This means that developers creating software tools for the crypto industry are generally exempt from needing a license​​.
4. Activities deemed non-regulated by the CBB: The CBB has the discretion to determine and exempt any other activity or arrangement that it does not consider as undertaking regulated crypto-asset services. This provides flexibility for the CBB to adapt to new developments and technologies in the crypto space​​.
5. Private offerings: If the offering is private and targets a small number of sophisticated investors rather than the general public, it might be exempt from full public offering regulations.
6. Small-scale offerings: Offerings below a certain monetary threshold may be exempt from extensive regulatory requirements, making it easier for smaller projects to raise funds.

3. Regulation of VASPs in Bahrain

Are VASPs operating in Bahrain subject to regulation?

VASPs operating in Bahrain are regulated and must comply with the requirements laid down in the regulatory framework issued by the CBB. CBB has been providing regulations to oversee and manage the ‘Regulated crypto-asset services’ in Bahrain with a view to becoming the region’s premier FinTech center. The regulatory framework also permits foreign entities already operating in other countries to apply for a cryptocurrency license with Bahrain and can operate in the country as an ‘overseas crypto asset service licensee’ after complying with the requirements of Bahrain company registration.

The regulatory framework sets out rules for the provision of ‘Regulated crypto-asset services’. ‘Regulated crypto-asset services’ are defined as the conduct of any or any combination of the following types of activities:

1. Reception and transmission of orders: The reception from a client of an order to buy and/or sell one or more accepted crypto-assets and the transmission of that order to a third party for execution;
2. trading in accepted crypto assets as an agent;
3. trading in accepted crypto assets as a principal;
4. portfolio management;
5. investment advice; and
6. crypto-asset custody.

The CBB only allows Crypto-asset service licensees (and overseas crypto-asset service licensees) to provide services relating to ‘Accepted Crypto Assets’. The CBB has the power to evaluate whether a crypto-asset is appropriate for trading before accepting it as an ‘Accepted Crypto Asset’. The CBB takes into account various factors, including but not limited to, the security, traceability/monitoring, resolution mechanisms, geographical distribution, connectivity, market demand/volatility, type of distributed ledger used, the applicable consensus algorithm of the distributed ledger, innovation and practical applicability/functionality, and whether the crypto-asset has been traded on any darknet marketplaces.

Are VASPs providing virtual asset services from offshore to persons in Bahrain subject to regulation in Bahrain?

Yes, VASPs providing virtual asset services from offshore to persons in Bahrain are subject to regulation in Bahrain. According to the regulatory framework issued by the CBB, foreign entities that are already operating in other countries can apply for a crypto-asset license in Bahrain and operate in the country as an ‘overseas crypto asset service licensee’ after complying with the requirements of Bahrain company registration. These entities are subject to the same requirements and regulations as a Bahraini joint stock company providing regulated crypto-asset services.

Here are a few examples of VASPs that are providing virtual asset services from offshore to persons in Bahrain:

1. Binance, which is one of the largest cryptocurrency exchanges in the world, has obtained a license from the Central Bank of Bahrain to operate as an “overseas crypto asset service licensee” in Bahrain.
2. BitOasis, which is a Dubai-based cryptocurrency exchange, has also obtained a license from the Central Bank of Bahrain to operate as an “overseas crypto asset service licensee” in Bahrain. BitOasis provides virtual asset trading and storage services to customers in the Middle East and North Africa region, including Bahrain.

What are the main requirements for obtaining licensing / registration as a VASP in Bahrain?

The CBB provides licenses to VASPs under four categories, which are as follows:

1. Type 1 Crypto Asset License: This license is required for VASPs that provide custody services and hold a customer’s cryptocurrencies. The minimum required capital is BHD 200,000. The annual licensing fee is 0.25% of the licensee’s operational expenses, with a minimum of BHD 2,000 and a maximum of BHD 35,000.
2. Type 2 Crypto Asset License: This license is required for VASPs that provide exchange services or trading platforms that match buyers and sellers. The minimum required capital is BHD 50,000. The annual licensing fee is 0.25% of the licensee’s operational expenses, with a minimum of BHD 2,000 and a maximum of BHD 25,000.
3. Type 3 Crypto Asset License: This license is required for VASPs that provide brokerage services to clients and make investments on their behalf. The minimum required capital is BHD 50,000. The annual licensing fee is 0.25% of the licensee’s operational expenses, with a minimum of BHD 2,000 and a maximum of BHD 25,000.
4. Type 4 Crypto Asset License: This license is required for VASPs that provide advisory services related to cryptocurrencies, including research and analysis of cryptocurrencies. The minimum required capital is BHD 50,000. The annual licensing fee is 0.25% of the licensee’s operational expenses, with a minimum of BHD 2,000 and a maximum of BHD 25,000.

Each category has its own specific requirements that VASPs need to meet to be eligible for licensing:

1. VASPs are required to be registered as a legal entity in Bahrain, either as a Bahraini Joint Stock Company or as an overseas company registered in Bahrain.
2. They must have a clear and detailed business plan that outlines proposed operations, personnel, risk management, and compliance program.
3. VASPs must maintain a compliance program to prevent money laundering, terrorism financing, and other financial crimes, rooted in the FATF Standards.
4. They must have a suitable organisational structure, administrative procedures, and internal controls.
5. VASPs must maintain adequate capital reserves, cybersecurity policies, and documentation policies and procedures, as well as meet other relevant requirements.
6. The application for a VASP license must include:
   • Business plan covering expertise, technology, marketing, resources, outsourcing, financials;
   • risk assessment;
   • compliance manual;
   • details on client asset handling, custodians, complaints;
   • information on directors, executives, shareholders;
   • auditor and authorised representative details;
   • proposed safeguards for data protection and client assets; and
   • additional requirements apply for custody and exchange services to demonstrate capability to protect client assets.
7. Application Process: The application process involves:
   • Obtaining commercial registration from the Ministry of Industry and Commerce;
   • applying for the VASP license from the CBB, which takes approximately 60 days;
   • submitting notarised and legalised or apostilled foreign documents; and
   • paying the application fee, which ranges from BD 2,000 to BD 12,000 annually depending on the license category.

What are the main ongoing requirements for VASPs regulated in Bahrain?

The CBB has implemented a comprehensive set of ongoing requirements for VASPs to ensure compliance. Here are the main requirements:

1. Client asset protection (CRA 8.1 Client Protection): VASPs are required to implement measures to protect client assets, including keeping client assets in separate accounts from the company’s own assets, ensuring the security and integrity of client data, and regularly reconciling client accounts and conducting audits to prevent misappropriation of assets.
2. Risk management (CRA-6.1 Risk Management): VASPs must have a risk management system in place. They need to identify, assess, and manage risks associated with their operations, implement policies and procedures to mitigate these risks, and regularly review and update their risk management strategies.
3. Technology and Cybersecurity (CRA 5.1 Technology Governance and Cyber Security): The CBB issued mandates under CRA to meet requirements for licensing, minimum capital, client asset safeguarding, cybersecurity, risk management, AML/CFT compliance, and business conduct. VASPs must use cybersecurity controls, including multi-factor authentication, encryption, secure storage, and incident response plans.The Law on Combating Cybercrime (2014) criminalises offenses like illegal access, data and system interference, and IT fraud, with penalties up to 10 years imprisonment and fines up to BHD 200,000.The Personal Data Protection Law (2018) governs data collection, processing, storage, and transfer, requiring consent, security measures, data access, and appointing data protection officers, with violations fined up to 20,000 Bahraini Dinars.The National Cybersecurity Framework by the National Cyber Security Center (NCSC) includes cybersecurity governance, technical controls, incident response, and audit requirements, with sector-specific controls for banking, insurance, and payments.
4. Reporting and Notifications (CRA 10.1 Reporting, Notifications and Approvals): VASPs are required to regularly report to the CBB and notify them of significant changes. This includes providing periodic reports on their financial status, operational activities, and compliance with regulatory requirements, and notifying the CBB of any significant changes in management, business operations, or control structures.
5. Conduct of Business (CRA 12.1 Conduct of Business Obligations): VASPs must conduct their business in a fair and transparent manner. They must ensure that their operations do not harm the stability and integrity of the financial system, avoid conflicts of interest and operate ethically, and provide clear and accurate information to their clients about their services and associated risks.
6. Prevention of Market Abuse (CRA 13.1 Prevention of Market Abuse and Manipulation): VASPs must take steps to prevent market abuse and manipulation. They should implement measures to detect and prevent activities that could distort the market or harm its stability and ensure transparent and fair-trading practices.
7. Compliance with AML/CFT Regulations (CRA 4.4 Dealing with Clients and AML/CFT Requirements): VASPs must comply with Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) regulations. This involves implementing AML/CTF policies and procedures, conducting due diligence on clients to prevent money laundering and terrorist financing, and reporting suspicious activities to the relevant authorities.
8. Custody Requirements (CRA 8.1 Custody Requirements): VASPs that hold customer funds or cryptocurrencies are subject to additional regulatory requirements pertaining to custody and safeguarding these assets.
9. Internal Controls and Record Keeping (CRA 4.2 Auditors and Accounting Standards): VASPs must put in place internal controls and processes to ensure the integrity of their business operations and maintain accurate and complete records of their transactions.
10. Supervision and Monitoring (CRA 11.1 Information Gathering by the CBB): VASPs are subject to ongoing supervision and monitoring by the CBB. This includes periodic onsite inspections and audits to ensure compliance with regulations and requirements.

4. Regulation of other crypto-related activities in Bahrain