Bahrain -- Custody Regulations Regulatory Overview

Bahrain, through its Central Bank of Bahrain (CBB), has been one of the pioneering jurisdictions in the MENA region to establish a comprehensive regulatory framework for crypto-asset activities. The primary regulation governing crypto-asset custody is found within the CBB Rulebook Volume 6 – Capital Markets, specifically Module CRY: Crypto-Asset Platform Operators.

Here's a breakdown of Bahrain's cryptocurrency/digital asset custody regulations:

Central Bank of Bahrain (CBB) Regulatory Framework

• Regulatory Body: Central Bank of Bahrain (CBB)
• Core Regulation: CBB Rulebook Volume 6 – Capital Markets, Module CRY: Crypto-Asset Platform Operators.
  • URL: You can access the CBB Rulebook and specific modules from the CBB website. Navigate to "Rulebooks" and then select "CBB Rulebook Volume 6 – Capital Markets" to find Module CRY.
    • CBB Rulebooks Main Page: https://www.cbb.gov.bh/rulebooks/
    • Note: Direct PDF links can change with updates, so it's best to navigate from the main rulebook page.

1. Custodial License Requirements

To offer crypto-asset custody services in Bahrain, an entity must be licensed by the CBB as a "Crypto-Asset Platform Operator" and specifically hold a Class 4 Custody License.

• Module Reference: CRY-1.1.1, CRY-1.2.1, CRY-1.3.1
• Key Requirements:
  • Authorization: Obtain a license from the CBB.
  • Legal Entity: Must be incorporated in Bahrain.
  • Fit & Proper: Directors and senior management must meet CBB's "fit and proper" criteria (EN-1.2.1).
  • Minimum Capital: Maintain adequate financial resources. For a Class 4 (Custody) license, the minimum paid-up capital is BD 50,000 (approx. USD 132,600), plus additional operational risk capital requirements based on a risk assessment (CR-1.3.1).
  • Operational Requirements: Robust systems, controls, risk management, and internal audit functions (GR-1.1.1, GR-1.1.2, RM-1.1.1).
  • Business Plan: Submit a detailed business plan, including operational procedures for custody, security measures, and disaster recovery plans.

2. Segregation of Client Assets Rules

The CBB has stringent rules to ensure client assets are protected and segregated from the custodian's own assets.

• Module Reference: CRY-5.1.1 to CRY-5.1.5
• Key Rules:
  • Absolute Segregation: Crypto-asset platform operators must ensure that client crypto-assets are held separate from their own crypto-assets and are clearly identifiable as client assets (CRY-5.1.1).
  • No Commingling: Client crypto-assets must not be commingled with the operator's proprietary assets (CRY-5.1.2).
  • Trust Arrangement: Client crypto-assets must be held in trust for the clients (CRY-5.1.3).
  • Prohibition on Use: Operators are prohibited from using client crypto-assets for their own account or for the benefit of any other client without explicit, written client consent and regulatory approval (CRY-5.1.4).
  • Reconciliation: Regular reconciliation of client crypto-assets with internal records is mandated (CRY-5.1.5).

3. Insurance/Bonding Requirements

Crypto-asset platform operators are required to maintain adequate insurance coverage.

• Module Reference: CRY-1.4.1
• Key Requirements:
  • Adequate Coverage: A crypto-asset platform operator must maintain adequate insurance coverage to cover risks associated with the safekeeping of client assets, including cyber security risks, theft, and operational failures (CRY-1.4.1).
  • The CBB expects the coverage to be commensurate with the scale and nature of the operator's business and the value of assets under custody. Specific monetary amounts are not typically fixed in the rulebook but are assessed on a case-by-case, risk-based approach.

4. Cold Storage Mandates

The CBB mandates robust security measures for crypto-asset custody, specifically addressing cold storage.

• Module Reference: CRY-4.2.1, CRY-4.2.2
• Key Mandates:
  • Robust Security: Operators must implement robust security measures for the custody of crypto-assets (CRY-4.2.1).
  • Significant Proportion in Cold Storage: This includes the use of cold storage (offline storage) for a significant proportion of client assets (CRY-4.2.1).
  • Policy & Procedures: Operators are required to have documented policies and procedures for determining the appropriate proportion of assets to be held in cold storage, taking into account factors such as asset type, liquidity needs, and the overall risk profile (CRY-4.2.2).
  • Key Management: Secure key generation, storage, and management procedures are also critical (CRY-4.2.3).

5. Qualified Custodian Definitions

In Bahrain's framework, the concept of a "qualified custodian" is inherently tied to the CBB's licensing process for Crypto-Asset Platform Operators.

• Module Reference: Module CRY establishes the requirements.
• Definition: A "qualified custodian" in Bahrain, for the purpose of crypto-assets, is essentially a financial institution or entity that has obtained a Class 4 Custody License from the Central Bank of Bahrain under Module CRY. By meeting the stringent licensing requirements (capital, governance, operational controls, security, segregation, etc.), the CBB deems the entity "qualified" to provide crypto-asset custody services. The CBB itself is the "qualifying" authority.

6. Pending Custody Legislation

Bahrain's CBB has been proactive in establishing its regulatory framework, and Module CRY is already quite comprehensive. Rather than significant pending new legislation that would overhaul the custody rules, the CBB tends to update and refine existing modules based on market developments, technological advancements, and international best practices (like FATF guidance).

• Continuous Updates: The CBB's approach is to regularly review and update its rulebooks. Any amendments or new directives would be communicated through CBB circulars or updates to the relevant modules (e.g., updates to Module CRY).
• Focus on Evolution: The focus is more on the evolution and enhancement of the existing framework to address emerging risks and foster responsible innovation, rather than a complete legislative overhaul. Therefore, operators should always refer to the latest version of Module CRY on the CBB website.

Disclaimer: This information is for general guidance only and does not constitute legal advice. Regulations can change, and specific interpretations may vary. Entities considering operating in Bahrain's crypto-asset space should always consult with qualified legal and regulatory professionals familiar with Bahraini law and CBB regulations.