Financial Services & Fintech in Bahrain: independent market-entry study

• Bahrain combines one financial regulator with a compact banking, insurance, investment and payments market. CBB records 368 licences at end-2024, but this is a whole-sector count and does not identify institutions willing to buy a particular fintech product.
• CBB reported 48 licensees conducting fintech activities at end-2024, 30 completed sandbox tests and eight companies that had progressed to a full operational licence. The figures describe different stages and denominators; they are not a conversion funnel or probability of approval.
• The financial sector contributed 17.3% of real GDP in 2024. This establishes national importance, not obtainable fintech revenue. Addressability begins with one regulated activity, one institution, one operating problem and one funded decision path.
• A Bahrain validation can support a wider GCC thesis, but every other market retains its own licensing, data, customer-protection, payments, tax and procurement perimeter. Bahrain approval is evidence of work completed, not a regional passport.

• Manama Diplomatic Area: location of the CBB and a concentration of regulated institutions and professional advisers. Proximity can support regulatory and buyer engagement but does not confer licence status or procurement access.
• Bahrain Bay and central Manama: concentration of banks, investment firms, fintech programmes and enterprise decision makers. Each prospect still requires its own budget owner, compliance sponsor, security route and production authority.
• Bahrain FinTech Bay and FinHub973: ecosystem and controlled-engagement routes for innovation and cross-institution dialogue. Participation, mentoring or a test introduction must not be recorded as CBB approval, customer commitment or a paid deployment.

• The 2024 CBB record of 48 fintech licensees establishes a regulated operating base. It does not reveal licence categories, revenue, procurement plans, technology gaps or accessible customers for a new entrant.
• The July 2025 licensing release records 16 newly licensed financial institutions and 52 applications under review from start-2024 to mid-2025. The perimeter is all financial institutions, not fintech alone, and pending is not approved.
• Open banking creates defined account-information and payment-initiation roles, customer-consent duties and bank-access rules. Commercial demand still requires a licensed role, usable customer journey, institution acceptance and viable liability allocation.
• The February 2026 payment-service module clarifies nine regulated activities and financial-resource requirements. This improves perimeter visibility; it does not reduce the need for activity-specific governance, controls, licensing evidence and production acceptance.

• Central Bank of Bahrain: regulator, sandbox authority and rulebook owner. It can admit, supervise or license the applicable activity but is not the commercial buyer for an institution’s technology deployment.
• Retail, wholesale and Islamic banks: potential account-holding, distribution, integration or procurement counterparties. Business ownership, compliance, cyber, architecture, operations, outsourcing and procurement must each accept their part of the production case.
• Payment, ancillary, insurance and investment licensees: distinct regulated buyers with different rulebook volumes, customer-money exposure and control obligations. One institution’s approval cannot be carried across another category without verification.
• Fintech programmes, accelerators and ecosystem operators: useful for discovery and introductions. Their support becomes pipeline only when a named regulated institution owns the need, evidence baseline, budget and next gate.

• Directly regulated model: map every function to the current CBB Rulebook volume and licence category before forming the operating case. For payment services, the February 2026 module identifies nine regulated activities, including account and instrument issuance, domestic and cross-border transfer, merchant acquisition, crypto-asset-based payments, e-money, money-changing, payment initiation and account information. Marketing the service in Bahrain can itself fall inside the perimeter.
• Sandbox model: submit the defined innovation, customer benefit, risk, AML/CFT, confidentiality, money-flow and test controls to the CBB FinTech Unit. Admission, a completed test and graduation are separate records. The production plan must identify whether the next gate is a CBB licence, delivery through an existing licensee or an ordinary technology-vendor contract.
• Licensed-institution vendor model: name the bank, insurer, investment firm or payment provider, the accountable business owner and the controlled process. Pass vendor due diligence, architecture, information-security, data, outsourcing, legal, procurement and production-acceptance gates; a supportive innovation team or successful proof of concept is not authority to deploy.
• Open-banking model: distinguish a licensed account-information or payment-initiation service from a software component supplied to a licensed participant. The access route is based on customer consent and the CBB framework; API connectivity, security testing and bank acceptance do not replace the applicable licence or customer-data duties.
• Payment-service application model: assemble the CBB prescribed application with controller, director and senior-management forms; legal status and constitutional documents; operating jurisdictions; programme of operations; products, pricing, channels and target customers; a forecast budget calculation for the first three financial years; minimum-capital evidence; safeguarding, governance, IT, cyber, fraud, continuity, information-security, AML/CFT and outsourcing controls; payment-scheme participation; auditor identity; and a proportionate wind-down plan. A company presentation or generic compliance pack is not a complete regulatory file.

• The CBB payment-service module states that no person may undertake, hold itself out as undertaking or market a regulated payment service in or from Bahrain without the applicable licence, exemption or express written permission. A foreign entity, local commercial registration or bank partnership therefore cannot be used as a general regulatory-passport claim.
• The February 2026 payment-service module lists BHD 30,000 minimum base capital for account-information activity and BHD 50,000 for issuance of payment accounts or instruments. It also requires net shareholders’ equity adequate to cover six months of operating expenses. These are regulatory floors for the stated scope, not total launch funding or proof that a licence will be granted.
• For open banking, CBB rules require conventional retail banks to provide licensed PISPs and AISPs objective, non-discriminatory account access based on customer consent, while preserving Bahrain Personal Data Protection Law obligations. Consent, access, purpose, retention, authentication, incident and revocation evidence must be designed into the service and contract.
• The CBB Volume 5 general requirements place cyber-risk governance on the licensed ancillary service provider, including board accountability and a framework aligned to NIST. A technology vendor must determine which controls apply directly, which are imposed through the regulated customer and which evidence the institution needs before production.
• For a complete payment-service application, CBB publishes a 60-calendar-day grant-or-refusal period and requires reasons for refusal. The clock follows receipt of the application and all required information; it is not a promise from first enquiry, entity formation or an incomplete submission.
• The February 2026 module sets a BHD 100 non-refundable PSP application fee, BHD 150 to add a previously unauthorised activity and an annual fee equal to 0.25% of qualifying operating expenses, with a BHD 2,000 floor and BHD 24,000 cap. These regulatory charges exclude company formation, assurance, safeguarding, technology, staffing, legal work and integration.
• A PSP receiving client money must place it in a segregated account by the next business day and use a retail-bank trust account, regulated-insurer cover or retail-bank guarantee. Cross-border client money must be placed with a bank rated AA- or above. The selected safeguarding route requires contracts, customer disclosure, annual counterparty assessment and at least five years of suitability records.
• Client-money operations require daily reconciliation to client ledgers, segregation of duties, a named senior-management owner and an independent client-money audit every six months. Holding the required capital does not satisfy these safeguarding and assurance controls.

• For payments, choose one of the nine regulated activity types, diagram the complete customer and money flow, identify who holds funds and accounts, and document safeguarding, reconciliation, settlement, chargeback, complaint, fraud, AML/CFT and incident ownership before seeking a licence or institutional sponsor.
• For open banking, select one customer journey and one licensed account-holding institution; prove lawful consent, API scope, strong authentication, data minimisation, revocation, service levels, error handling and the accountable PISP or AISP. Do not count API availability as a commercial contract.
• For RegTech, fraud, reconciliation or compliance infrastructure, measure one current operational baseline with a named regulated institution, obtain the control owner’s acceptance criteria and price the complete path from controlled test through security remediation, procurement and production support.
• For sandbox entry, write the post-test decision before applying: licence category and capital, licensed-partner contract or discontinuation. Set customer, transaction, loss, duration and stop limits and identify the CBB-licensed retail bank that controls any volunteer-customer money.
• For a PSP licence, create a traceable application evidence room indexed to each PS-1.1.7 requirement and maintain a completeness log. Model the three-year forecast, six-month operating-expense equity test, annual regulatory fee, safeguarding structure, external audit and wind-down funding together rather than budgeting only the application fee and base-capital floor.
• Where a product depends on agents or distributors, verify whether each agent is licensed for the same payment service, exempt for that service or covered by specific CBB approval. A commercial agency or referral agreement does not itself authorise delivery of a regulated payment service.

• Treating sandbox admission, completion or graduation as a CBB operating licence, an institutional procurement award or permission to scale beyond the approved test perimeter.
• Using the BHD 100 application fee and 15-day complete-application target as the total cost and time to establish, license, secure, integrate, test and operate the service.
• Converting 30 completed tests and eight later licences into a success rate when the official record does not disclose a comparable applicant cohort, denominator, decision period or category mix.
• Assuming the customer institution’s licence automatically covers a vendor that markets, contracts, initiates, informs, holds, moves or safeguards funds or customer data in its own role.
• Beginning production before outsourcing, cloud, cyber, privacy, resilience, audit, exit, complaint, reconciliation and incident responsibilities have an accepted owner and evidence set.
• Presenting the 60-day complete-file decision period as the elapsed time from first contact, or omitting information requests, corporate readiness, controller review, system build and institutional integration from the launch schedule.
• Treating a trust account, insurance policy or bank guarantee as a static procurement item without next-business-day segregation, daily reconciliation, customer disclosure, annual counterparty review, change notification and six-month independent audit controls.

• Which exact function is regulated, and is the company acting as licensee, sandbox participant, licensed institution, outsourced provider, software vendor or implementation partner for that function?
• What evidence proves the present gate: complete CBB application, sandbox admission, approved test, issued licence, bank vendor approval, signed contract, security acceptance, production release or paid use?
• Who contracts with the customer, obtains consent, holds or moves money, performs CDD, monitors fraud, reconciles, handles complaints, reports incidents and carries loss?
• Which capital, six-month operating-expense, governance, cyber, data, AML/CFT, consumer-protection, audit, resilience and local operating obligations apply to the selected licence and delivery model?
• Does the downside case remain funded through licensing delay, security remediation, partner integration, low adoption, fraud losses, chargebacks, support and an unsuccessful sandbox exit?
• Is every item in the CBB payment-service application register complete, current, owned and reconciled to the actual activity, controller, system, safeguarding and outsourcing design?
• Which safeguarding method is selected, which institution provides it, how does next-business-day segregation work, who performs daily reconciliation, and when is the six-month independent audit due?

• Bahrain uses Sijilat as the integrated commercial-registration and licensing gateway. A commercial registration without licence can establish the legal record, but the business may operate only after all activity licences and external approvals are in place. For Financial Services & Fintech, the route is not cleared until the competent authority confirms the central-bank, capital-markets, payments, insurance, AML, safeguarding and data perimeter of the proposed product.
• Financial Services & Fintech establishment route to test: Bahraini company registered and licensed through Sijilat. Record the exact activity that covers the proposed offer, the ownership conditions, issuing authority, output and evidence expiry date; a neighbouring activity code is not a substitute.
• Financial Services & Fintech operating sequence: Select the legal form, activity and ownership basis. Apply for the commercial registration through Sijilat. Treat the central-bank, capital-markets, payments, insurance, AML, safeguarding and data perimeter of the proposed product as a separate operating gate, together with any municipal, standards and buyer registration still required after commercial registration.

• Financial Services & Fintech tax perimeter: The standard VAT rate is 10%, with zero-rated and exempt categories defined by the VAT framework. Model registration, filing, invoicing, withholding and any customs or transaction treatment against the intended entity and revenue flow; recheck every free-zone or incentive assumption before relying on it.
• Financial Services & Fintech people and work authorisation: The entity must complete Labour Market Regulatory Authority and social-insurance requirements. Use the Labour Market Regulatory Authority for employer registration, work permits and the current foreign-worker process. Map immigration, labour, professional licensing and any controlled-site access to the actual roles the operating model requires.
• Financial Services & Fintech continuing compliance: A commercial registration without licence does not authorise the activity. Maintain the accounting, beneficial-ownership, renewal, payroll and sector evidence needed for the central-bank, capital-markets, payments, insurance, AML, safeguarding and data perimeter of the proposed product; verify the live authority service before filing, signing or paying.

• Establishment and market-entry controls: Select the activity and establish the commercial registration (Bahrain Ministry of Industry and Commerce); Activate the activity licence and premises approvals (MOIC, municipality and the competent sector regulator). Use the cited official routes below and retain the dated output; an authority listing is not evidence that Financial Services & Fintech permission has been granted.
• Operating and people controls: Determine VAT and multinational tax obligations (National Bureau for Revenue (NBR)); Register the employer and obtain work permits (Labour Market Regulatory Authority (LMRA) and connected authorities). Use the cited official routes below and retain the dated output; an authority listing is not evidence that Financial Services & Fintech permission has been granted.
• Verification control: before commitment, open the current Bahrain authority service, confirm that the named output still applies to the exact Financial Services & Fintech activity and record any sector approval, product registration or buyer qualification that remains unresolved.

• Fintech licensees: 48. Reference and status: End-2024 · CBB
• Completed sandbox tests: 30. Reference and status: End-2024 · CBB
• Sandbox graduates fully licensed: 8. Reference and status: End-2024 · CBB
• Sandbox application fee: BHD 100. Reference and status: Published CBB application charge · not total market-entry cost

• CBB Annual Report 2024 — 2024 report. Evidence role retained in this dossier: Primary licensing and sandbox evidence
• Bahrain EDB — 3 Sep 2026. Evidence role retained in this dossier: Investment and ecosystem route
• Information & eGovernment Authority — 3 Sep 2026. Evidence role retained in this dossier: Official economic and digital statistics
• Bahrain indicator source — 2026-10-14. Evidence role retained in this dossier: Current-account balance · 2026 projection · share of GDP · Pre-conflict baseline
• Bahrain Ministry of Industry and Commerce: Sijilat — 2026-10-28. Evidence role retained in this dossier: Select the activity and establish the commercial registration: official service and requirements route.

Market structure

• CBB is the decisive licensing and sandbox authority.
• Retail, wholesale and Islamic banks form the principal institutional buyer set.
• Fintech Bay, FinHub973 and technology providers support testing and partnership.
• Directly regulated operator, sandbox participant, bank technology vendor, outsourced service provider and implementation partner are different roles with different customer-money, data, liability, assurance and licensing consequences.
• Sijilat commercial registration, CBB permission, institutional vendor approval, production acceptance and regional-market permissions remain separate gates.
• The headline licensing pipeline covers multiple financial-institution categories. A fintech entrant still needs an activity-level mapping to the relevant CBB Rulebook volume, licence category, sandbox route or licensed-customer delivery model.

Opportunity lenses

• Open-banking, payment or compliance infrastructure only for a named licensed institution, mapped regulated function, permitted data and money flow, security and control baseline and production owner after testing.
• A supervised fintech test only where a named CBB-licensed institution owns the customers, data and control baseline, sandbox perimeter, loss and stop rules and documented path to production.
• Islamic-finance or cross-border propositions only after mapping the exact regulated activity, CBB route, Sharia governance where applicable, licensed institutional partner, customer-money flow and each target market’s separate approval.
• RegTech, fraud, reconciliation or infrastructure services where a named institution owns the problem, baseline, test data and production decision.

Risks and evidence gaps

• Sandbox admission is not a commercial licence.
• A compact domestic market may not support the full model alone.
• Cross-border scaling requires separate regulatory approval.
• Innovation-team sponsorship can fail to convert when compliance, security, architecture, procurement or the production business owner has not accepted the test.
• A low application fee can conceal a much larger cost of controlled testing, assurance, local support, licensing and unsuccessful exit.
• Using the 16 approvals or 52 pending applications as a fintech conversion rate would be invalid because the official release covers financial institutions generally and does not provide a comparable cohort, decision period or category split.
• The published 60-day decision period begins only with a complete application and cannot be converted into an end-to-end launch promise.
• Safeguarding is a continuing control system, not merely an account-opening task: failures in segregation, reconciliation, counterparty suitability, disclosure, audit or change notification can invalidate the operating case even where minimum capital is held.

Questions before commitment

• What exact regulated activity is performed?
• Which institution supplies customers or infrastructure?
• What evidence converts the Bahrain test into a scalable business?
• What customer, transaction, loss, data, complaint, reporting and stop limits define the supervised test?
• Which continuing CBB or institutional approvals are required before unrestricted production?
• Which CBB-licensed retail bank controls any volunteer-customer money during testing, and which agreement allocates safeguarding, reconciliation, complaints and loss responsibility?
• Which PS-1.1.7 application items are complete, which remain dependent on a named person or supplier, and what evidence starts the CBB 60-day complete-file decision period?
• Which safeguarding method and institution cover client money, and how are next-business-day segregation, daily reconciliation, six-month audit and five-year evidence retention operated?