• OM-5.3 OM-5.3 ATM Security Measures: Physical Security for Retail Banks

    • Record Keeping

      • OM-5.3.1

        Banks must record the details of the site risk assessments and retain such records for a period of five years from the date of the ATM installation, or whatever other period required by the Ministry of the Interior or the CBB from time to time, whichever is the longer.

        Added: January 2020

    • Installation of an Off-site ATM in Bahrain

      • OM-5.3.2

        Banks must notify the CBB in writing if they install a new off-site ATM or remove/terminate any of its off-site ATMs.

        Amended: January 2022
        Added: January 2020

      • OM-5.3.3

        [This Paragraph has been deleted in January 2022].

        Deleted: January 2022
        Added: January 2020

    • General Criteria

      • OM-5.3.4

        [This Paragraph has been deleted in January 2022].

        Deleted: January 2022
        Added: January 2020

      • OM-5.3.5

        [This Paragraph has been deleted in January 2022].

        Deleted: January 2022
        Added: January 2020

      • OM-5.3.6

        [This Paragraph has been deleted in January 2022].

        Deleted: January 2022
        Added: January 2020

      • OM-5.3.7

        [This Paragraph has been deleted in January 2022].

        Deleted: January 2022
        Added: January 2020

      • OM-5.3.8

        [This Paragraph has been deleted in January 2022].

        Deleted: January 2022
        Added: January 2020

      • OM-5.3.9

        [This Paragraph has been deleted in January 2022].

Deleted: January 2022
Added: January 2020

  • OM-5.3.10

    [This Paragraph has been deleted in January 2022].

    Deleted: January 2022
    Added: January 2020

  • OM-5.3.11

    [This Paragraph has been deleted in January 2022].

    Deleted: January 2022
    Added: January 2020

  • OM-5.3.12

    The CBB may, at its sole discretion, require an off-site ATM to be removed/terminated and decommissioned at any time.

    Added: January 2020

  • ATM Alarms

    • OM-5.3.13

      In addition to alarming the premises, banks must alarm the ATM itself, in a way which activates audibly when the ATM is under attack. The system must be monitored by remote signaling to an appropriate local police response designated by the Ministry of Interior. In doing so, banks must consider the following:

      (a) The design of the system must ensure that the ATM has a panic alarm installed;
      (b) The design of the system must give an immediate, system controlled warning of an attack on the ATM, and all ATMs must be fitted with fully operational fraud detection and inhibiting devices;
      (c) A maintenance record must be kept for the alarm detection system and routine maintenance must be conducted in accordance with at least the manufacturer's recommendations. The minimum must be two planned maintenance visits and tests every 6 months; and
      (d) The alarm system must be monitored from an Alarm Receiving Centre 24 hours daily. It must automatically generate an alarm signal if the telephone/internet line fails or is cut.
      Added: January 2020

  • Closed-circuit Television (CCTV)

    • OM-5.3.14

      Banks must ensure that ATMs are equipped with Closed-circuit television (CCTV). The location of camera installation must be carefully chosen to ensure that images of the ATM are recorded, however keypad entries must not be recorded. The camera must support the detection of the attachment of alien devices to the fascia (external body) and possess the ability to generate an alarm for remote monitoring if the camera is blocked or otherwise disabled. There must be sensors to detect and alert the bank if the camera has been blocked or tampered with.

      Added: January 2020

    • OM-5.3.15

      For the purposes of Paragraph OM-5.3.14, the location of camera installation in drive-thru ATMs must be carefully chosen to ensure that the images of the vehicle number plates are clearly captured during both daytime and nighttime.

      Added: January 2020

    • OM-5.3.16

      As a minimum, CCTV activity must be recorded (preferably in digital format) and, where risk dictates, remotely monitored by a third party Alarm Receiving Centre.

      Added: January 2020

    • OM-5.3.17

      When an ATM is located in an area where a public CCTV system operates, the deployer or agent must liaise with the agency responsible for the CCTV system to include the ATM site in any preset automatic camera settings or to request regular sweeps of the site. The CCTV system must not be able to view the ATM keypad thereby preventing observation of PIN entry.

      Added: January 2020

    • OM-5.3.18

      Banks must ensure that the specifications of CCTV cameras meet the following minimum requirements:

      (a) Analogue Cameras:
      Resolution — Minimum 700 TVL

      Lens — Vari-focal lenses from 2.8 to 12mm

      Sensitivity — Minimum 0.5 Luminance (Lux) without Infrared (IR), 0 Lux with IR

      IR — At least 10 to 20 meters (Camera that detects motion)
      (b) IP Cameras:
      Resolution — 2 MP — 1080 p

      Lens — Vari-focal lenses from 2.8 to 12mm

      Sensitivity — Minimum 0.5 Lux without IR, 0 Lux with IR

      IR — At least 10 to 20 meters
      Added: January 2020

    • OM-5.3.19

      Banks must ensure that the following network requirements are met for connecting the Banks CCTV system to MOI Control room:

      (a) The minimum speed of the upload should be 2 Mbps for each node (ATM's and branches);
      (b) Speed/storage limit threshold must not be applied in a manner which permits a network delay; and
      (c) Access must be restricted to authorised personnel.
      Added: January 2020

  • ATM Lighting

    • OM-5.3.20

      Banks must ensure that adequate and effective lighting is operational at all times within the ATM environment. The standard of the proposed lighting must be agreed with the Ministry of the Interior and other relevant authorities, and tested at least once every three months to ensure that the lighting is in good working order.

      Added: January 2020

    • OM-5.3.21

      Banks must ensure that adequate and effective lighting is operational within drive-thru ATMs to enable the CCTV cameras to capture the vehicle number plates during both daytime and nighttime.

      Added: January 2020

  • Fire Alarm

    • OM-5.3.22

      Banks must ensure that effective fire alarm and fire defense measures, such as a sprinkler, are installed and functioning for all ATMs. These alarms must be linked to the "General Directorate of Civil Defense" in Bahrain.

      Added: January 2020

  • Cash Replenishment

    • OM-5.3.23

      All cash movements between branches, to and from the CBB and to off-site ATMs must be performed by specialised service providers.

      Added: January 2020

  • ATM Service/Maintenance

    • OM-5.3.24

      Banks must maintain a list of all maintenance, replenishment and inspection visits by staff or other authorised parties.

      Added: January 2020

    • OM-5.3.25

      The CBB shall conduct inspections of ATM installations and any non-compliance with the physical security requirements stipulated in this Chapter may lead to suspension of the subject ATMs and trigger other enforcement measures set out in Module EN.

      Added: October 2022