Bahrain Crypto License: CBB Categories, Capital & Sandbox

A Bahrain crypto license is a Central Bank of Bahrain authorisation to provide regulated crypto-asset services in or from the Kingdom of Bahrain. It is granted under Module CRA in CBB Rulebook Volume 6, which sets four licence categories, minimum paid-up capital of BD 25,000 to BD 300,000, and a 60-calendar-day CBB decision.

Bahrain was one of the earliest movers in the Gulf to write a dedicated rulebook for crypto-asset firms. For founders, exchange operators and compliance officers weighing where to license, that maturity matters: the rules are specific, the capital ladder is published, and the decision clock is defined. This guide sets out the CBB framework precisely, with the rule numbers that make it citable, and explains how the separate CBB Regulatory Sandbox differs from a full licence. For the wider picture, see our best countries for a crypto license comparison and how Bahrain fits within the global VASP licensing explained framework.

Bahrain crypto licensing at a glance

Crypto is regulated in Bahrain by the Central Bank of Bahrain (CBB) under Module CRA (Crypto-asset) in CBB Rulebook Volume 6, Capital Markets. A licence is mandatory for anyone providing regulated crypto-asset services in or from Bahrain. Firms choose one of four categories, with minimum capital from BD 25,000 to BD 300,000, and the CBB decides within 60 calendar days of a complete file.

Who regulates crypto in Bahrain (the CBB)

The Central Bank of Bahrain administers crypto licensing through Module CRA, housed in Volume 6 (Capital Markets) of its rulebook. The CRA module was first issued in February 2019, making Bahrain an early mover among Gulf and global jurisdictions. It was overhauled in April 2023, when a chapter on digital token offerings was added, and last amended in May 2026; stablecoin issuance is governed by a separate Stablecoin Issuance and Offering (SIO) module issued in July 2025. The CBB also runs a separate FinTech and Innovation unit that operates the Regulatory Sandbox, described later in this guide.

What this guide covers

This guide walks through the full decision funnel a licence applicant faces: what counts as a regulated crypto-asset service, the four CBB categories and their constraints, the minimum-capital ladder, the application and annual fees, the process and 60-day decision, and the AML and custody obligations. It also draws a clear line between the direct CRA licence and the CBB Regulatory Sandbox, which are two distinct tracks that should not be confused.

What counts as a regulated crypto-asset service in Bahrain

A CBB licence is mandatory for any person undertaking regulated crypto-asset services in or from the Kingdom of Bahrain under CRA-1.1.1. The threshold question is whether your activity falls inside the regulated list in CRA-1.1.6 or sits within the exclusions in CRA-1.1.7. A licensee may only list crypto-assets that pass its own CBB-notified listing policy and risk assessment (CRA-4.3).

Regulated services (CRA-1.1.6)

Under CRA-1.1.6, a regulated crypto-asset service includes any of the following:

• Reception and transmission of orders.
• Trading in crypto-assets as agent.
• Trading in crypto-assets as principal.
• Portfolio management.
• Crypto-asset custodian (safeguarding, storing and holding crypto-assets).
• Investment advice.
• Operating a crypto-asset exchange.
• Acting as a digital token advisor.

If your business model touches any of these, you are inside the licensing perimeter and must pick a category.

What is excluded (CRA-1.1.7)

The CBB carves out several activities that are not regulated crypto-asset services under CRA-1.1.7: creating a crypto-asset; developing or using software to create or mine a crypto-asset; loyalty programmes; and anything the CBB deems not to constitute the service. These exclusions matter because they keep token issuers, miners and reward-scheme operators from over-applying the licence requirement to activities the CBB does not regulate as crypto-asset services.

Listing crypto-assets (CRA-4.3)

Under CRA-4.3, a licensee must adopt a board-approved crypto-asset listing policy and give the CBB a copy before it starts operating; unless the CBB raises concerns, the licensee may then self-certify crypto-assets for listing (CRA-4.3.6 and 4.3.7). Before each listing it notifies the CBB, with its risk assessment and the board resolution approving the asset (CRA-4.3.8). The assessment covers the issuer's track record, the availability of a reliable multi-signature hardware wallet solution, the protocol and consensus design, anonymisation features, cyber-security and traceability (CRA-4.3.14). Assets that facilitate concealment of a client's identity may not be listed (CRA-4.3.12), and the CBB can instruct a licensee to delist an asset (CRA-4.3.18). Licensees may undertake spot trading, and may list derivatives only where the CBB allows it (CRA-4.3.2A and 4.3.2B).

The four CBB crypto licence categories

A person picks one of four licence categories by activity under CRA-1.1.8. The permitted services in CRA-1.1.9 to CRA-1.1.17 climb from advice only at Category 1 to operating a full exchange at Category 4, and the minimum-capital ladder rises in step. The categories below replace the vague labels that older guides used with the actual CBB structure.

Category 1: advice and order transmission

A Category 1 firm may carry out reception and transmission of orders and provide investment advice. It must not hold client assets or money, and it may not operate an exchange (CRA-1.1.10). This is the lightest category, suited to advisers and introducers that never take custody.

Category 2: agency, custody and portfolio management

A Category 2 firm may trade as agent, provide portfolio management, act as a crypto-asset custodian and give investment advice. It may hold and control client assets and money, but it must not deal as principal or operate an exchange, per CRA-1.1.9 to CRA-1.1.17. This category fits brokers and custodians acting purely on behalf of clients.

Category 3: adds principal dealing

A Category 3 firm covers everything Category 2 does, and adds trading as principal. It may trade as agent and as principal, provide portfolio management, hold custody, give advice and act as a digital token advisor, and it may hold client assets and money. It still must not operate an exchange under CRA-1.1.9 to CRA-1.1.17.

Category 4: operating a crypto-asset exchange

Only a Category 4 firm may operate a licensed crypto-asset exchange, and the category also covers custody and acting as a digital token advisor. The exchange must not trade against its own proprietary capital or carry out matched principal trading (CRA-1.1.16). Category 4 is the route for venue operators, and it connects directly to the rules on operating a licensed crypto exchange.

Combining and constraining activities

Licensees may undertake one or more of the services permitted in their category, under CRA-1.1.9 to CRA-1.1.15. Category 1, 2 and 3 firms must not structure themselves so as to look like an exchange: no public order book and no price discovery, per CRA-1.1.26 and CRA-1.1.27. That boundary keeps the exchange privilege exclusive to Category 4.

Minimum capital and fees for a Bahrain crypto licence

Minimum paid-up capital ranges from BD 25,000 for a Category 1 licence to BD 300,000 for a Category 4 licence, set by CRA-3.1.2. On top of capital, applicants pay a non-refundable BD 100 application fee at submission and an annual licence fee of 0.25% of relevant operating expenses, bounded by category floors and caps. Capital must be paid-up, unimpaired by losses, and deposited into a Bahrain-licensed retail bank.

Minimum paid-up capital by category (CRA-3.1.2)

The paid-up capital ladder, from CRA-3.1.2, is as follows. Capital must be unimpaired by losses and paid into a retail bank licensed in Bahrain (CRA-3.1.1).

The rulebook states every figure in Bahraini dinars (BD); the CBB pegs the dinar at BD 0.376 to the US dollar, about USD 2.66 per dinar. To put these against other jurisdictions, compare crypto license costs across countries.

Application and annual fees (CRA-1.5, CRA-1.6)

The application fee is a non-refundable BD 100, payable at submission under CRA-1.5.1. The annual licence fee is 0.25% of relevant operating expenses, subject to category floors and caps set in CRA-1.6.3, and the first annual fee equals the floor, payable when the licence is issued (CRA-1.6.10).

When the CBB can require additional capital

The minimums are floors, not ceilings. The CBB may require additional capital above the category minimum at its discretion under CRA-3.1.3 and CRA-3.1.4, based on factors such as asset composition, liquidity profile, transaction volume and the range of product types offered. Applicants planning higher-risk or higher-volume models should budget for the possibility of a capital uplift on top of the published minimum.

How to apply for a CBB crypto licence (process and timeline)

Applying for a CBB crypto licence means submitting a written application in the prescribed form, paying the BD 100 fee, and waiting for a formal CBB decision within 60 calendar days of a complete file under CRA-1.2.11. The outcome can be a grant, a grant with conditions, or a refusal, and the applicant must meet the CRA-2 minimum criteria by the grant date and on an ongoing basis.

Step-by-step CBB application

1. Apply in writing to the CBB on Form 1 with a covering letter. Under CRA-1.2.1 and CRA-1.2.4, the file includes Form 2 for each shareholder, Form 3 for each proposed director and senior manager, a business plan (CRA-1.2.6), the commercial registration certificate, a board resolution and audited financial statements.
2. Pay the BD 100 application fee on submission (CRA-1.5.1).
3. CBB review. The CBB assesses the file against the licensing criteria.
4. Formal decision within 60 calendar days of a complete file (CRA-1.2.11). A licence may be granted subject to conditions (CRA-1.2.19); before refusing, the CBB gives written notice and at least 30 calendar days to appeal (CRA-1.2.21).
5. Meet the CRA-2 criteria by the date of grant and on an ongoing basis (CRA-1.1.22), with minimum capital deposited in a Bahrain retail bank (CRA-3.1.1).

How long CBB approval takes (the 60-day clock)

The CBB issues a formal decision within 60 calendar days of receiving a complete application in acceptable form, per CRA-1.2.11. That clock starts only once the file is complete. The real-world total elapsed time, including drafting the business plan, gathering documents and responding to CBB queries, is longer and is not defined by the CBB.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, with no commitment. Book a Call

The CBB Regulatory Sandbox (a separate route)

The CBB Regulatory Sandbox is a separate framework from Module CRA, run by the CBB FinTech and Innovation unit, that lets fintech and crypto firms test innovative solutions in a controlled space before meeting full regulatory and capital requirements. Per the current CBB sandbox page, the testing window is up to 12 months, the application fee is BD 100, and the CBB decides within 15 calendar days. It is a distinct track, not a stage of the licence flow.

What the sandbox is and who qualifies

The sandbox is a controlled testing environment for genuinely innovative fintech and crypto solutions. To qualify under the CBB sandbox criteria, an applicant must show innovation that addresses a market gap or is sufficiently different, identifiable customer benefit supported by evidence, identification and mitigation of risks including business continuity, compliance with customer due diligence and AML/CFT obligations, and protection of customer-information confidentiality. It suits firms with an unproven model that want to validate it before committing full capital.

Sandbox timeline and fee

Applicants apply through an online platform and pay a non-refundable BD 100 fee. The CBB issues a formal decision within 15 calendar days under the sandbox framework, and the testing period runs up to 12 months from authorisation, with an extension available on request with 30 days advance notice, decided case by case.

Does the sandbox guarantee a full licence?

No. The sandbox is a test phase, and a full CRA licence is a separate authorisation. The current CBB sandbox page does not set out a guaranteed graduation pathway from sandbox to licence. Plan the sandbox as "test, then apply," not "test, then automatically receive." A firm that completes a sandbox test still has to file a full CRA application and meet every CRA-2 criterion to be licensed.

Direct licence or sandbox first: how to choose

Choosing between the direct CRA licence and the sandbox comes down to how proven your model is and how ready you are to commit capital and build full compliance. The two routes share the BD 100 fee but differ sharply in commitment: a direct licence asks for the full category capital and a complete compliance build up front, while the sandbox lets you test first within a controlled window.

When the direct CRA licence fits

The direct route suits firms with an established or well-understood business model, the category capital already in hand, and a clear view of which of the four categories applies. If you know you will operate an exchange (Category 4) or deal as principal (Category 3) at scale, there is little to gain from a test phase, and a direct application puts you on the 60-day decision clock once your file is complete.

When the sandbox fits

The sandbox fits novel or unproven models where you want to validate product-market fit, technology and compliance design before locking up the full category capital. It lowers the initial commitment, gives you up to 12 months of controlled live testing, and lets you build evidence of customer benefit and risk control that strengthens a later full CRA application. Just remember it does not guarantee that licence.

AML, KYC and client-asset protection

Bahrain applies its capital-markets anti-money-laundering rules in full to crypto firms: a licensee's financial-crime systems and controls must meet Module AML of CBB Rulebook Volume 6 (CRA-2.6.3), and client assets must be segregated and safeguarded under CRA-4.5 and CRA-8. Module AML adds crypto-specific duties: customer due diligence on every crypto-asset transfer regardless of amount, controls on suspicious wallet addresses, and records that tie each transaction to a natural person. These obligations sit at the heart of the AML and KYC compliance requirements a Bahrain licensee must build.

AML and CDD obligations (Module AML)

Under Module AML, which applies to crypto-asset licensees (AML-B.1), a Bahrain crypto licensee must:

• Apply customer due diligence when carrying out any crypto-asset transfer or wire transfer, irrespective of value (AML-1.1.2(i)).
• Set policies to identify wallet addresses suspected of money laundering or terrorist financing, refuse to deal with them, and immediately file a suspicious transaction report and notify the CBB when one is found (AML-1.1.14 to AML-1.1.16).
• Run risk-based transaction monitoring with limits that cover crypto-asset transactions (AML-2.2.1).
• Keep transaction records that allow each transaction to be reconstructed and linked to a natural person; public blockchain data alone is not sufficient (AML-6.1.1A and AML-6.1.1C).

Custody, segregation and wallets (CRA-8)

Client money and client crypto-assets must be segregated from the licensee's own funds in specially created segregated accounts, under CRA-2.6 and CRA-4.5. Chapter CRA-8 governs custody, covering general requirements, custodial arrangements, crypto wallets (CRA-8.3) and reconciliation, client reporting and record-keeping. Wallet storage and cryptographic key controls fall under CRA-5.4. Since January 2020 a licensee must evaluate cyber risk insurance every year and document that evaluation (CRA-5.8.28), and a licensee handling client assets or client money must hold professional indemnity cover of at least BD 100,000 (CRA-4.8.1 and CRA-4.8.2), with a copy of the policy given to the CBB before operations start (CRA-1.2.26(h)).

Governance, fit-and-proper and ongoing conditions (CRA-2)

Beyond capital and AML, a Bahrain licensee must satisfy the Chapter CRA-2 licensing conditions on grant and on an ongoing basis. These span the legal entity, the people running the firm, and the systems that keep it compliant. The CBB expects a CBB-licensed local legal entity, fit-and-proper controllers and approved persons, sound corporate governance, risk management, technology governance and conduct controls.

Local legal entity and approved persons

The applicant must be a Bahraini company: a company with limited liability (W.L.L.) or a joint stock company (B.S.C.) for Categories 1 to 3, and a B.S.C. for a Category 4 exchange, under CRA-2.1.1. Controllers and approved persons must meet the CBB's Fit and Proper Requirements, and corporate governance must meet Module HC (CRA-2.6.1). Risk management (CRA-6), technology governance and cyber security (CRA-5), conduct of business (CRA-12) and market-abuse prevention (CRA-13) round out the conditions.

Tax note

Tax is not addressed in Module CRA, so this guide does not assert a crypto-specific tax position for Bahrain. Under Decree-Law No. (11) of 2024, Bahrain applies a 15% Domestic Minimum Top-up Tax to the Bahrain entities of multinational groups with annual global revenue of at least EUR 750 million in at least two of the four preceding financial years, for financial years starting on or after 1 January 2025, so groups below that threshold are outside it. Confirm your position with a qualified Bahraini tax adviser before making decisions.

Bahrain vs other crypto licensing jurisdictions

Bahrain is one of several routes a crypto founder can take, and it reads very differently from its Gulf neighbour and from offshore and EU options. Its strength is a published, rule-numbered framework with a defined decision clock; its limit is that it is non-EU, so a Bahrain licence does not carry MiCA passporting rights across the European single market. Weigh it against peers using our pillar comparison.

Bahrain vs Dubai / UAE (GCC peers)

Both Bahrain and the UAE are Gulf hubs, but they are regulated differently: Bahrain by the CBB under Module CRA, and Dubai by VARA under its own regime. For founders evaluating the GCC, the choice often comes down to capital, activity scope and where their team and banking sit. See our guide to Dubai VARA crypto licensing to compare the two side by side.

Where Bahrain sits among global options

Beyond the Gulf, founders often compare Bahrain with offshore digital-asset regimes such as the Bermuda DABA digital-asset licence, and with EU CASP authorisation under MiCA. For the full matrix of capital, timelines and activity scope across jurisdictions, start with our best countries for a crypto license comparison guide.

Get expert help with your Bahrain crypto licence

Crypto Valley Partners AG, based at Aegeristrasse 5, 6300 Zug, Switzerland, advises founders, exchange operators and compliance officers on obtaining and maintaining crypto licences worldwide, including under the CBB Module CRA framework. From our practice, the work that decides a Bahrain application is rarely the form itself: it is choosing the right category, sizing the capital and any CBB uplift, and building an AML and custody framework that meets Module AML and CRA-8 before the file is filed.

Limitations and scope

This page covers the CBB's Module CRA licence categories, capital and fee ladder, and the separate CBB Regulatory Sandbox. It does not cover tax treatment, which Module CRA itself does not address; see our Dubai VARA crypto licensing and Bermuda DABA digital-asset licence pages for comparable regimes.

• Capital and fee figures are the published CRA-3.1.2, CRA-1.5 and CRA-1.6 minimums; the CBB may require additional capital case by case.
• The CBB sets no total timeline beyond the 60-calendar-day decision clock.
• Sandbox entry does not guarantee a full CRA licence, since the CBB does not state a graduation pathway.