Fintech in Bahrain: CBB licensing, the sandbox, crypto and stablecoins
A single regulator, a sandbox since 2017 and, since July 2025, a full licensing regime for stablecoin issuers. Here is which activity needs which licence and how to get there.
Why fintech firms look at Bahrain
Bahrain has a single integrated financial regulator: the Central Bank of Bahrain (CBB), which licenses and supervises banks, insurers, investment firms, payment and money services businesses, and crypto-asset service providers under the Central Bank of Bahrain and Financial Institutions Law of 2006 and its Rulebook. For a fintech start-up, that means one licensing counterpart, one set of rules and a regulator that has made innovation part of its mandate.
Bahrain was early in the region with a regulatory sandbox in 2017, an open banking framework, crypto-asset rules and, in July 2025, a dedicated framework for stablecoin issuers. Industry surveys in late 2026 note that, outside the UAE, Bahrain is the only GCC state licensing crypto service providers and stablecoin issuers. Combined with lower operating costs than Dubai and a land link to Saudi Arabia, that makes it a natural candidate for payments, regtech, wealth-tech and digital asset businesses targeting the Gulf.
Which activity needs which licence
| Activity | Regulatory position |
|---|---|
| Software, SaaS, IT services to financial institutions | No CBB licence; ordinary Commercial Registration |
| Payment services, e-wallets, payment initiation | CBB licence under the Rulebook's ancillary services and payment provisions |
| Money remittance and exchange | CBB money changer or remittance licence |
| Crypto-asset exchange, brokerage, custody, advice | CBB crypto-asset licence under Rulebook Volume 6 |
| Stablecoin issuance and offering | CBB licence under the Stablecoin Issuance and Offering (SIO) Module, from July 2025 |
| Lending, crowdfunding, investment platforms | CBB licence or approval for the relevant category |
| Testing a new model before licensing | CBB regulatory sandbox |
The first question is whether your product is a regulated activity at all. A software vendor to banks needs no licence; a platform that holds client money, executes payments or deals in crypto-assets does. Getting this wrong in either direction costs months.
Volume 6 of the Rulebook
Crypto-asset services, including exchange, brokerage, portfolio management, custody and advice, are licensed under the crypto-asset rules in Volume 6 of the CBB Rulebook, with categories that set capital and operational requirements according to the services offered. Licensees must disclose to clients, for each listed crypto-asset, its type, its function, whether it is backed by assets and its risks, including price volatility and cybersecurity vulnerabilities.
In July 2025 the CBB added the Stablecoin Issuance and Offering (SIO) Module, a consolidated framework for issuers of fiat-backed stablecoins in or from Bahrain. It is built on a full-reserve model, with rules on reserve composition and safeguarding, redemption, custody, disclosure, technology governance, reporting and anti-money laundering, and it applies alongside the Rulebook's AML, fit and proper and high-level controls modules. Applicants need a track record, typically three years as a stablecoin issuer, crypto-asset business or supervised financial institution, and a management team with relevant expertise; the CBB decides on a completed application within 60 calendar days.
Where clients are required to hold assets in self-custody, the CBB treats that as a material risk requiring clear upfront disclosure. Design client journeys with the disclosure rules in mind from the start.
Test first, license second
The CBB Regulatory Sandbox allows start-ups and established firms to test innovative financial products with real customers, under supervision and within agreed limits, before applying for a full licence. It suits businesses still proving product-market fit, integrating with bank partners or testing risk controls, and it produces the evidence a licence application needs: operating data, incident logs, complaint handling and control testing.
A typical path for a payments or digital asset business is: a Bahraini company with the right commercial activities, a sandbox application, a supervised pilot with limited customers and volumes, then a licence application drawing on the pilot's evidence. Bahrain FinTech Bay and the Economic Development Board support start-ups through the process, and Tamkeen can support hiring and training of Bahraini staff.
Obligations after the licence
Capital and safeguarding
Minimum capital by category, and segregation and safeguarding of client money and assets.
Fit and proper
Approval of controllers and key persons, with continuing obligations to notify changes.
AML and sanctions
A full AML programme under the AML law and the Rulebook, including crypto transfer and wire-transfer controls, transaction monitoring and suspicious transaction reporting.
Technology and outsourcing
Cybersecurity controls, business continuity, and CBB approval or notification for material outsourcing and cloud arrangements.
Conduct and complaints
Clear disclosures, fair treatment and a complaints process, with escalation routes for clients.
Reporting
Regular prudential and conduct reporting, audited accounts and annual compliance reviews.
The CBB supervises actively and can impose financial penalties, restrict activities or withdraw licences. Data protection obligations under Law No. 30 of 2018 apply alongside the Rulebook's own data and outsourcing rules.
A payments start-up's first year
A founder team plans a merchant payments and wallet product for small businesses in Bahrain and Saudi Arabia. In month one they form a Bahraini WLL with software and IT activities to build the product, which needs no CBB licence. In month two they apply to the sandbox with a defined pilot: two hundred merchants, capped transaction values, a partner bank holding client funds. During the six-month pilot they run the product, fix the reconciliation and complaints processes and document every control.
In month nine they apply for the CBB licence for payment services, with the pilot data, policies and audited controls in the application. Saudi Arabia, where they want to scale, has its own regulators and licensing; the Bahraini licence does not passport there, but the operating record and controls built in Bahrain make the Saudi application stronger. The cost of the sandbox route is time; the benefit is that the licence application is built on evidence rather than projections.
A natural niche for Bahrain
Bahrain has a long-standing position in Islamic finance: it hosts the Accounting and Auditing Organization for Islamic Financial Institutions (AAOIFI), whose standards are used across the industry, and the CBB has a mature framework for Islamic banks with Shariah governance requirements. That gives Islamic fintech, such as Shariah-compliant payments, savings, investment and digital asset products, a regulator and an ecosystem that understand both sides of the product.
For a fintech building Shariah-compliant products, the practical steps are the same as for any other licence, with two additions: a Shariah supervisory arrangement appropriate to the product and the licence category, and product documentation that shows how the structure complies. Building that in at the design stage avoids redesigning a product after the regulator or a partner bank asks.
Partner banks and accounts
Almost every fintech depends on a bank: for safeguarding client money, for settlement, for card schemes or simply for its own operating account. Bahraini banks apply the AML law and the CBB's rules rigorously, and they assess a fintech applicant on its licence status, ownership, controls and the risks of its customers and flows. Crypto-related businesses face the most questions, even when licensed, because banks also manage their correspondent relationships abroad.
Two things help. First, sequencing: approach banks with the regulatory route already clear, ideally with a sandbox approval or a licence application in progress, rather than before the business model is defined. Second, a clean file: beneficial owners matching the Sijilat records, a concrete description of flows and volumes, and documented AML controls. Bahrain's open banking framework also allows licensed providers to access bank data and initiate payments through standard interfaces, which some business models depend on.
People, permits and support
A licensed fintech needs people the CBB will approve in key roles: a chief executive, compliance officer, money laundering reporting officer and, depending on the category, risk and finance heads, all subject to fit and proper assessment. Many start-ups combine some roles at first, which the CBB may accept for smaller licences if competence and independence are shown. Foreign staff need LMRA work permits, and the company should plan Bahrainisation for its activity from the start.
Support is available. Tamkeen co-funds the hiring and training of Bahraini staff, the Economic Development Board helps foreign companies establish, and Bahrain FinTech Bay connects start-ups with banks and investors. Senior hires who want residence independent of the company can consider Golden Residency once they qualify. Budgeting the compliance team realistically is one of the most common gaps in fintech business plans submitted to regulators.
A one-line plan
Define the product, confirm the perimeter, form the company, decide sandbox or direct licence, build controls and team, approach banks, apply, launch within the licence, then plan Saudi or UAE expansion under their regulators.
Questions we get asked first
Who regulates fintech in Bahrain?
The Central Bank of Bahrain, an integrated regulator for banks, insurers, investment firms, payments and crypto-asset businesses, under the CBB and Financial Institutions Law of 2006 and the CBB Rulebook.
Does Bahrain license crypto businesses?
Yes. Crypto-asset services are licensed under Volume 6 of the CBB Rulebook, and since July 2025 stablecoin issuers are licensed under the Stablecoin Issuance and Offering Module.
What does the stablecoin module require?
A licence, a full-reserve model with safeguarded reserves and redemption rights, disclosure, technology governance, reporting and AML controls. The CBB decides on a completed application within 60 calendar days.
What is the CBB regulatory sandbox?
A supervised testing environment, open since 2017, allowing firms to test innovative financial products with real customers within agreed limits before applying for a full licence.
Does a software company serving banks need a CBB licence?
Generally not, if it provides only technology and does not hold client money, execute payments or deal in crypto-assets. An ordinary Commercial Registration is enough.
Does a Bahraini fintech licence work in Saudi Arabia?
No. It does not passport to Saudi Arabia, which has its own regulators, but a Bahraini operating record and controls can strengthen a Saudi application.
One regulator, a sandbox and a crypto regime that actually licenses
Bahrain offers fintech firms a single regulator, a working sandbox and licensing for crypto-assets and stablecoins that few Gulf states match. Decide first whether your product is regulated, use the sandbox to build evidence, and plan for the CBB's capital, AML, technology and reporting obligations from the start.
Building a fintech in Bahrain?
We set up the company, map your activity to the right CBB route and coordinate the sandbox and licence process.
Email us →Related reading
This article is general information, current as of 2026, and is not advice for any specific situation. Confirm current rules with the MOIC, the NBR or the relevant authority before acting.