Bahrain Crypto License: CBB Categories, Capital & Sandbox

A Bahrain crypto license is a Central Bank of Bahrain authorization to provide regulated crypto-asset services in or from the Kingdom of Bahrain. It is granted under Module CRA in CBB Rulebook Volume 6, which sets four licence categories, minimum paid-up capital of BD 25,000 to BD 300,000, and a 60-calendar-day CBB decision.

Bahrain was one of the earliest movers in the Gulf to write a dedicated rulebook for crypto-asset firms. For founders, exchange operators and compliance officers weighing where to license, that maturity matters: the rules are specific, the capital ladder is published, and the decision clock is defined. This guide sets out the CBB framework precisely, with the rule numbers that make it citable, and explains how the separate CBB Regulatory Sandbox differs from a full licence. For the wider picture, see our best countries for a crypto license comparison and how Bahrain fits within the global VASP licensing explained framework.

Bahrain crypto licensing at a glance

Crypto is regulated in Bahrain by the Central Bank of Bahrain (CBB) under Module CRA (Crypto-asset) in CBB Rulebook Volume 6, Capital Markets. A licence is mandatory for anyone providing regulated crypto-asset services in or from Bahrain. Firms choose one of four categories, with minimum capital from BD 25,000 to BD 300,000, and the CBB decides within 60 calendar days of a complete file.

Who regulates crypto in Bahrain (the CBB)

The Central Bank of Bahrain administers crypto licensing through Module CRA, housed in Volume 6 (Capital Markets) of its rulebook. The CRA module was first issued in February 2019, making Bahrain an early mover among Gulf and global jurisdictions, and was amended through 2022, with a stablecoin module consultation opened in November 2024. The CBB also runs a separate FinTech and Innovation unit that operates the Regulatory Sandbox, described later in this guide.

What this guide covers

This guide walks through the full decision funnel a licence applicant faces: what counts as a regulated crypto-asset service, the four CBB categories and their constraints, the minimum-capital ladder, the application and annual fees, the process and 60-day decision, and the AML and custody obligations. It also draws a clear line between the direct CRA licence and the CBB Regulatory Sandbox, which are two distinct tracks that should not be confused.

What counts as a regulated crypto-asset service in Bahrain

A CBB licence is mandatory for any person undertaking regulated crypto-asset services in or from the Kingdom of Bahrain under CRA-1.1.18. The threshold question is whether your activity falls inside the regulated list in CRA-1.1.6 or sits within the exclusions in CRA-1.1.7. The module applies only to "accepted crypto-assets" that the CBB has assessed and approved.

Regulated services (CRA-1.1.6)

Under CRA-1.1.6, a regulated crypto-asset service includes any of the following:

• Reception and transmission of orders.
• Execution of orders on behalf of clients.
• Dealing on own account.
• Portfolio management.
• Crypto-asset custodian (safeguarding, storing and holding crypto-assets).
• Investment advice.
• Operating a crypto-asset exchange.
• Acting as a digital token advisor.

If your business model touches any of these, you are inside the licensing perimeter and must pick a category.

What is excluded (CRA-1.1.7)

The CBB carves out several activities that are not regulated crypto-asset services under CRA-1.1.7: creating or administering a crypto-asset; developing or using software to create or mine a crypto-asset; loyalty programmes; and anything the CBB deems not to constitute the service. These exclusions matter because they keep token issuers, miners and reward-scheme operators from over-applying the licence requirement to activities the CBB does not regulate as crypto-asset services.

"Accepted crypto-assets" only (CRA-4.3)

Module CRA applies only to "accepted crypto-assets," meaning those the CBB has assessed for suitability and approved under CRA-4.3. Assets outside the accepted list cannot be offered in regulated services. The current enumerated list of accepted crypto-assets and approved digital tokens is not published in the rule text reviewed here, so applicants should confirm the live list with the CBB before structuring a product around a specific asset.

The four CBB crypto licence categories

A person picks one of four licence categories by activity under CRA-1.1.8. The permitted services in CRA-1.1.9 to CRA-1.1.17 climb from advice only at Category 1 to operating a full exchange at Category 4, and the minimum-capital ladder rises in step. The categories below replace the vague labels that older guides used with the actual CBB structure.

Category 1: advice and order transmission

A Category 1 firm may carry out reception and transmission of orders and provide investment advice. It must not hold client assets or money, and it may not operate an exchange (CRA-1.1.10). This is the lightest category, suited to advisers and introducers that never take custody.

Category 2: agency, custody and portfolio management

A Category 2 firm may trade as agent, provide portfolio management, act as a crypto-asset custodian and give investment advice. It may hold and control client assets and money, but it must not deal as principal or operate an exchange, per CRA-1.1.9 to CRA-1.1.17. This category fits brokers and custodians acting purely on behalf of clients.

Category 3: adds principal dealing

A Category 3 firm covers everything Category 2 does, and adds trading as principal. It may trade as agent and as principal, provide portfolio management, hold custody and give advice, and it may hold client assets and money. It still must not operate an exchange under CRA-1.1.9 to CRA-1.1.17.

Category 4: operating a crypto-asset exchange

Only a Category 4 firm may operate a licensed crypto-asset exchange, and the category also covers custody and acting as a digital token advisor. The exchange must not trade against its own proprietary capital or carry out matched principal trading (CRA-1.1.16). Category 4 is the route for venue operators, and it connects directly to the rules on operating a licensed crypto exchange.

Combining and constraining activities

Licensees may combine two or more permitted services within their category where there is no conflict of interest, under CRA-1.1.23. Category 1, 2 and 3 firms must not structure themselves so as to look like an exchange: no public order book and no price discovery, per CRA-1.1.26 and CRA-1.1.27. That boundary keeps the exchange privilege exclusive to Category 4.

Minimum capital and fees for a Bahrain crypto licence

Minimum paid-up capital ranges from BD 25,000 for a Category 1 licence to BD 300,000 for a Category 4 licence, set by CRA-3.1.2. On top of capital, applicants pay a non-refundable BD 100 application fee at submission and an annual licence fee of 0.25% of relevant operating expenses, bounded by category floors and caps. Capital must be paid-up, unimpaired by losses, and deposited into a Bahrain-licensed retail bank.

Minimum paid-up capital by category (CRA-3.1.2)

The paid-up capital ladder, from CRA-3.1.2, is as follows. Capital must be unimpaired by losses and paid into a retail bank licensed in Bahrain (CRA-3.1.1).

Indicative US-dollar conversions sometimes circulate (the Bahraini Dinar is broadly pegged near USD 2.65), but they are not CBB figures and should be treated as non-authoritative. Always work from the BHD figures in the rulebook. To put these against other jurisdictions, compare crypto license costs across countries.

Application and annual fees (CRA-1.5, CRA-1.6)

The application fee is a non-refundable BD 100, payable at submission under CRA-1.5.1. The annual licence fee is 0.25% of relevant operating expenses, subject to category floors and caps set in CRA-1.6.3, and the first annual fee equals the floor, payable when the licence is issued (CRA-1.6.10).

When the CBB can require additional capital

The minimums are floors, not ceilings. The CBB may require additional capital above the category minimum at its discretion under CRA-3.1.3 and CRA-3.1.4, based on factors such as asset composition, liquidity profile, transaction volume and the range of product types offered. Applicants planning higher-risk or higher-volume models should budget for the possibility of a capital uplift on top of the published minimum.

How to apply for a CBB crypto licence (process and timeline)

Applying for a CBB crypto licence means submitting a written application in the prescribed form, paying the BD 100 fee, and waiting for a formal CBB decision within 60 calendar days of a complete file under CRA-1.1.21. The outcome can be a grant, a grant with conditions, or a refusal, and the applicant must meet the CRA-2 minimum criteria by the grant date and on an ongoing basis.

Step-by-step CBB application

1. Apply in writing to the CBB in the prescribed form. Under CRA-1.1.19, the file includes a business plan specifying the business type, application forms for all shareholders and subsidiaries, and application forms for all controlled functions.
2. Pay the BD 100 application fee on submission (CRA-1.5.1).
3. CBB review. The CBB assesses the file against the licensing criteria.
4. Formal decision within 60 calendar days of a complete file in acceptable form (CRA-1.1.21). The outcome is granted, granted with conditions, or refused with grounds and an appeal route (CRA-1.1.20).
5. Meet the CRA-2 criteria by the date of grant and on an ongoing basis (CRA-1.1.22), with minimum capital deposited in a Bahrain retail bank (CRA-3.1.1).

How long CBB approval takes (the 60-day clock)

The CBB issues a formal decision within 60 calendar days of receiving a complete application in acceptable form, per CRA-1.1.21. That clock starts only once the file is complete. The real-world total elapsed time, including drafting the business plan, gathering documents and responding to CBB queries, is longer and is not defined by the CBB. Any "six to nine month" total you see quoted is a vendor estimate, not a CBB figure.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, with no commitment. Book a Call

The CBB Regulatory Sandbox (a separate route)

The CBB Regulatory Sandbox is a separate framework from Module CRA, run by the CBB FinTech and Innovation unit, that lets fintech and crypto firms test innovative solutions in a controlled space before meeting full regulatory and capital requirements. Per the current CBB sandbox page, the testing window is up to 12 months, the application fee is BD 100, and the CBB decides within 15 calendar days. It is a distinct track, not a stage of the licence flow.

What the sandbox is and who qualifies

The sandbox is a controlled testing environment for genuinely innovative fintech and crypto solutions. To qualify under the CBB sandbox criteria, an applicant must show innovation that addresses a market gap or is sufficiently different, identifiable customer benefit supported by evidence, identification and mitigation of risks including business continuity, compliance with customer due diligence and AML/CFT obligations, and protection of customer-information confidentiality. It suits firms with an unproven model that want to validate it before committing full capital.

Sandbox timeline and fee

Applicants apply through an online platform and pay a non-refundable BD 100 fee. The CBB issues a formal decision within 15 calendar days under the sandbox framework, and the testing period runs up to 12 months from authorisation, with an extension available on request with 30 days advance notice, decided case by case. Note that some older legal commentary framed the window as 9 months plus a 3-month extension; the current CBB page states 12 months, which is the figure used here.

Does the sandbox guarantee a full licence?

No. The sandbox is a test phase, and a full CRA licence is a separate authorisation. The current CBB sandbox page does not set out a guaranteed graduation pathway from sandbox to licence. Plan the sandbox as "test, then apply," not "test, then automatically receive." A firm that completes a sandbox test still has to file a full CRA application and meet every CRA-2 criterion to be licensed.

Direct licence or sandbox first: how to choose

Choosing between the direct CRA licence and the sandbox comes down to how proven your model is and how ready you are to commit capital and build full compliance. The two routes share the BD 100 fee but differ sharply in commitment: a direct licence asks for the full category capital and a complete compliance build up front, while the sandbox lets you test first within a controlled window.

When the direct CRA licence fits

The direct route suits firms with an established or well-understood business model, the category capital already in hand, and a clear view of which of the four categories applies. If you know you will operate an exchange (Category 4) or deal as principal (Category 3) at scale, there is little to gain from a test phase, and a direct application puts you on the 60-day decision clock once your file is complete.

When the sandbox fits

The sandbox fits novel or unproven models where you want to validate product-market fit, technology and compliance design before locking up the full category capital. It lowers the initial commitment, gives you up to 12 months of controlled live testing, and lets you build evidence of customer benefit and risk control that strengthens a later full CRA application. Just remember it does not guarantee that licence.

AML, KYC and client-asset protection

Bahrain applies strict anti-money-laundering rules to crypto firms under CRA-7, read with Module AML, and requires client assets to be segregated and safeguarded under CRA-8. Enhanced due diligence is mandatory on all customers, simplified customer due diligence is prohibited, and client money and crypto-assets must be held separately from the licensee's own funds. These obligations sit at the heart of the AML and KYC compliance requirements a Bahrain licensee must build.

AML and CDD obligations (CRA-7)

Under CRA-7, read with Module AML, a Bahrain crypto licensee must:

• Ensure all clients maintain a bank account with a Bahrain-licensed retail bank or an overseas retail bank supervised by a CBB-acceptable regulator (CRA-7.1.1).
• Apply full Module AML obligations, treating crypto services as carrying money-laundering and terrorist-financing risk.
• Conduct enhanced due diligence on all customers and counterparties; simplified CDD is not permitted (CRA-7.1.3).
• Refuse to onboard charities and religious, sporting, social, cooperative or professional societies as clients (CRA-7.1.4).
• Keep records in line with Module AML, chapter AML-6 (CRA-7.1.5).

Custody, segregation and wallets (CRA-8)

Client money and client crypto-assets must be segregated from the licensee's own funds in specially created segregated accounts, under CRA-2.6 and CRA-4.5. Chapter CRA-8 governs custody, covering general requirements, custodial arrangements, crypto wallets (CRA-8.3) and reconciliation, client reporting and record-keeping. Wallet storage and cryptographic key controls fall under CRA-5.4 (Technology Governance), a cyber-security insurance requirement was added in January 2020, and professional indemnity insurance is required, with a copy of the policy forming part of the application (CRA-4.8 and CRA-1.4(h)).

Governance, fit-and-proper and ongoing conditions (CRA-2)

Beyond capital and AML, a Bahrain licensee must satisfy the Chapter CRA-2 licensing conditions on grant and on an ongoing basis. These span the legal entity, the people running the firm, and the systems that keep it compliant. The CBB expects a CBB-licensed local legal entity, fit-and-proper controllers and approved persons, sound corporate governance, risk management, technology governance and conduct controls.

Local legal entity and approved persons

The applicant must be a CBB-licensed local legal entity, with fit-and-proper controllers and approved persons assessed under Module FM, and corporate governance under CRA-9 and Module HC. Risk management (CRA-6), technology governance and cyber security (CRA-5), conduct of business (CRA-12) and market-abuse prevention (CRA-13) round out the conditions. The specific company form (for example a joint stock company, WLL or branch) is not stated in the CRA chapters reviewed, so this guide does not assert a particular vehicle: confirm the correct entity type with the CBB and a Bahrain corporate-law adviser.

Tax note (verify before relying on it)

Tax is not addressed in Module CRA, so this guide does not assert a crypto-specific tax position for Bahrain. Older marketing material that claims "no corporate or capital-gains tax on crypto" should not be relied on without a tax-authority source. For context, Bahrain introduced a 15% Domestic Minimum Top-up Tax for large multinationals from 2025; its relevance to crypto SMEs is unverified. Confirm your position with a qualified Bahraini tax adviser before making decisions.

Bahrain vs other crypto licensing jurisdictions

Bahrain is one of several routes a crypto founder can take, and it reads very differently from its Gulf neighbour and from offshore and EU options. Its strength is a published, rule-numbered framework with a defined decision clock; its limit is that it is non-EU, so a Bahrain licence does not carry MiCA passporting rights across the European single market. Weigh it against peers using our pillar comparison.

Bahrain vs Dubai / UAE (GCC peers)

Both Bahrain and the UAE are Gulf hubs, but they are regulated differently: Bahrain by the CBB under Module CRA, and Dubai by VARA under its own regime. For founders evaluating the GCC, the choice often comes down to capital, activity scope and where their team and banking sit. See our guide to Dubai VARA crypto licensing to compare the two side by side.

Where Bahrain sits among global options

Beyond the Gulf, founders often compare Bahrain with offshore digital-asset regimes such as the Bermuda DABA digital-asset licence, and with EU CASP authorisation under MiCA. For the full matrix of capital, timelines and activity scope across jurisdictions, start with our best countries for a crypto license comparison guide.

Get expert help with your Bahrain crypto licence

Crypto Valley Partners AG, based at Aegeristrasse 5, 6300 Zug, Switzerland, advises founders, exchange operators and compliance officers on obtaining and maintaining crypto licences worldwide, including under the CBB Module CRA framework. From our practice, the work that decides a Bahrain application is rarely the form itself: it is choosing the right category, sizing the capital and any CBB uplift, and building an AML and custody framework that meets CRA-7 and CRA-8 before the file is filed.