CRA authorisation – Crypto-asset custody service License in Bahrain

A custody authorization allows a CASP to safekeep, control, and administer crypto-assets or the means of access to them (e.g., cryptographic keys) on behalf of clients

Custodians must hold clients’ crypto-assets in separate wallets from the company’s own assets. Client assets cannot be used for the firm's own account (e.g., staking, lending, or pre-funding transactions) unless prior, explicit, and signed consent is acquired

A mandatory, legally binding agreement must be signed with each client containing clear clauses on liability, security measures, and the applicable law

Custodians must implement a rigorous liability policy. They are held strictly liable for the loss of any crypto-assets or access keys resulting from cyberattacks, hacks, or internal operational failures

All members of the management body and shareholders holding qualifying stakes must satisfy rigorous "good repute" assessments. They must demonstrate a lack of criminal records (specifically regarding financial crimes, money laundering, or fraud) and possess adequate professional experience.

The top management must include at least one director who resides within the European Union to ensure local accountability.

The entity must appoint distinct personnel for key internal oversight functions:

• A designated Chief Compliance Officer (CCO)

• A Money Laundering Reporting Officer (MLRO)

• A dedicated Risk Management Officer

All members of the management body and shareholders holding qualifying stakes must satisfy rigorous "good repute" assessments. They must demonstrate a lack of criminal records (specifically regarding financial crimes, money laundering, or fraud) and possess adequate professional experience.

The top management must include at least one director who resides within the European Union to ensure local accountability.

The entity must appoint distinct personnel for key internal oversight functions:

• A designated Chief Compliance Officer (CCO)

• A Money Laundering Reporting Officer (MLRO)

• A dedicated Risk Management Officer

System infrastructure must completely align with the Digital Operational Resilience Act (DORA). This includes robust firewalls, continuous penetration testing, and advanced cryptographic key management systems (e.g., HSMs, MPC tech)

Extensive Know Your Customer (KYC), Anti-Money Laundering (AML), and Counter-Terrorist Financing (CTF) protocols must be integrated into the onboarding pipeline

Comprehensive disaster recovery protocols, secondary data centers, and clear wind-down plans are mandatory in the event of insolvency or system failure

The CASP must have its legal seat and its place of effective management within an EU Member State

Once authorization is granted by the home country's NCA, the custodian receives full passporting privileges. They can legally offer custody services across all 27 EU/EEA Member States without needing individual licenses in each country

Non-EU firms cannot target EU clients unless the client approaches the firm entirely at their own exclusive initiative; this exemption is strictly monitored

All authorized CASPs operating within the EU must fully comply with the OECD’s Crypto-Asset Reporting Framework (CARF)

Custodians are required to systematically track, log, and report user identity details, tax identification numbers (TIN), and complete transaction logs to tax authorities. This data is automatically exchanged between global and EU tax networks to ensure full tax compliance

For a custody service provider, the mandatory minimum initial regulatory capital is €150,000

The firm must continuously maintain capital reserves equal to the higher of the fixed €150,000 threshold or one-quarter of the preceding year's fixed overhead expenses

Custodians must maintain a comprehensive professional indemnity insurance policy or comparable commercial insurance guaranteeing coverage against the loss of client assets

Annual financial accounts must undergo independent auditing. Systems and internal security workflows typically require independent validation via SOC 2 Type II external audit reviews