Executive Summary

Legal Basis

Evolution of Module

Superseded Requirements

License Categories

Bahraini and Branches of Foreign Islamic Bank Licensees

GR-2.1.1

Licensees must obtain CBB’s prior written approval for any change in their legal name. Licensees must notify the CBB of any change in their corporate name at least one week prior to effecting the proposed change.

GR-2.1.2

GR-2.1.1 applies to branches of foreign bank licensees only with respect to their Bahrain branch.

GR-2.1.3

Rules GR-2.1.1 and GR-2.1.2 refers to the requirements contained in Article 41 of the CBB Law.

GR-2.1.4

In approving a corporate or trade name, the CBB seeks to ensure that it is sufficiently distinct as to reduce possible confusion with other unconnected businesses, particularly those operating in the financial services sector. The CBB also seeks to ensure that names used by unregulated subsidiaries do not suggest those subsidiaries are in fact regulated.

GR-3.1.1

Bahraini Islamic bank licensees must obtain CBB’s prior approval for any proposed cash or stock dividend before any public announcements or the Annual General Meeting.

GR-3.1.2

[This Paragraph was deleted in July 2023].

GR-3.1.3

For the purpose of Paragraph GR-3.1.1, Islamic bank licensees must:

GR-3.2.1

Retail branches of foreign banks must comply with the following when repatriating profits to Head Office:

GR-4.1.1 [deleted]

GR-4.1.2 [deleted]

GR-4.1.3 [deleted]

GR-4.1.4 [deleted]

GR-4.1.5 [deleted]

GR-4.1.6 [deleted]

GR-4.1.1

In accordance with the CBB Governor s Resolution No.(33) for the year 2012 issued pursuant to Article 66 of the CBB Law, an Islamic bank licensee (transferor) must seek prior written approval from the CBB before transferring any regulated banking service to a person (transferee), except in the following circumstances:

GR-4.1.2

For purposes of Paragraph GR-4.1.1 (a), a business transfer refers to a transfer of the rights and obligations of one Islamic bank licensee to a third party, so that the customers continue to be subject to the same terms and conditions as those originally agreed.

GR-4.1.3

In instances where Subparagraph GR-4.1.1(b) applies, Islamic bank licensees must notify the CBB before transferring any regulated banking service to a transferee one month prior to the transfer taking place.

GR-4.1.4

Rule GR-4.1.1 is intended to apply to circumstances where a bank wishes to transfer all or part of its business (examples: credit card business, asset management business) to a third party, or is undertaking winding up proceedings.

GR-4.1.5

In the case of a Bahraini Islamic bank licensee, Chapter GR-4 applies to its assets and liabilities booked in Bahrain. In the case of branches of foreign bank licensee, Chapter GR-4 applies only to assets and liabilities booked in the bank's Bahrain branch.

GR-4.2.1

Islamic bank licensees wishing to transfer banking business in the Kingdom must apply to the Executive Director of Banking Supervision by submitting an application form along with the supporting documents as specified by the CBB (see Part B, Supplementary Information, Appendix GR-1). Unless otherwise directed by the CBB, the application must provide:

GR-4.2.2

Banks intending to apply to transfer a regulated service are advised to contact the CBB at the earliest possible opportunity, in order that the CBB may determine the nature and level of any documentation and/or the need for an auditor or other expert opinion to be provided. The CBB will grant its permission where the transfer will have no negative impact on the financial soundness of the bank, and does not otherwise compromise the interests of the bank's depositors and creditors. In all cases, the CBB will only grant its permission where the institution acquiring the regulated service holds the appropriate regulatory approvals and is in good regulatory standing.

Preliminary Assessment

Publication of the Transfer of Business Application

GR-4.3.1

The CBB will consider an application under Paragraph GR-4.2.1 if it is satisfied that:

GR-4.3.2

The CBB will not approve the transfer, under the terms of Paragraph GR-4.2.1, unless it is satisfied that:

GR-4.3.3

In assessing the criteria outlined in Paragraph GR-4.3.2, the CBB will, amongst other factors, take into account the financial strength of the transferee; its capacity to manage the business being transferred; its track record in complying with applicable regulatory requirements; and (where applicable) its track record in treating customers fairly. The CBB will also take into account the impact of the transfer on the transferor, and any consequences this may have for the transferor's remaining customers.

GR-4.3.4

The CBB will review the application and any other documents or information requested by the CBB taking into consideration any objections received and conditions stated in Article 66 (d) of the CBB law.

GR-4.3.5

The CBB reserves the right to impose additional requirements if, in the opinion of the CBB, additional requirements are necessary to protect customer interests. In all cases where additional requirements are imposed, the CBB shall state the reasons for doing so.

GR-4.3.6

The CBB will communicate its final decision to the transferor within 5 working days of the expiry of the period for submitting objections to the CBB (see Paragraph GR-4.2.4).

GR-4.4.1

In accordance with Article 67 (d) of the CBB Law and Article 8 of the Regulation issued pursuant to Resolution No.(33) of 2012, the CBB's decision regarding the application for transfer made under Section GR-4.2, will be published as a notice in the Official Gazette and in two local newspapers (one in Arabic and one in English) and will come into effect from this date.

GR-4.4.2

If the liabilities are located in a jurisdiction outside Bahrain, the CBB may also publish such notice in the jurisdiction in which the risk is situated.

GR-4.4.3

The costs of publication of the notices referred to in Paragraphs GR-4.4.1 and GR-4.4.2 must be met by the transferor.

GR-4.4.4

Article 67(e) of the CBB Law notes that where the application for business transfer has been turned down by the CBB or includes restrictions, the applicant may appeal to a competent court within 30 calendar days from the date of publication referred to in Paragraph GR-4.4.1.

GR-6.1.1

The CBB has recognised the need to revise its rules in keeping with the following changes at a systemic level, both globally and regionally:

This section sets forth the rules applicable to Islamic retail bank licensees with regards to the new category of ancillary service providers described below.

GR-6.1.2

The CBB has established a Directive contained in "Module OB: Open Banking" in Volume 5 of the CBB Rulebook that deals with a new sub category of ancillary service providers who, under the terms of the CBB license, may provide "payment initiation services" and/or "account information services". Such licensees are termed "payment initiation service providers" or PISPs and "account information service providers" or AISPs. Banks and other licensees which maintain a customer account is referred to in the CBB Rulebook Volume 5 as "licensees maintaining customer accounts".

GR-6.1.3

Islamic retail bank licensees must:

GR-6.1.4

Access to customer accounts granted pursuant to Paragraph GR-6.1.3 must be sufficiently extensive to allow the AISP and PISP access in an unhindered and efficient manner.

GR-6.1.5

Access to customer accounts granted pursuant to Paragraph GR-6.1.3 shall mean that at customer’s direction, the licensees are obliged to share, without charging a fee, all information that has been provided to them by the customer and that which can be accessed by the customer in a digital form. The obligation should only apply where the licensee keeps that information in a digital form. Furthermore, the obligation should not apply to information supporting identity verification assessment; which the licensees should only be obliged to share with the customer directly, not a data recipient. The information accessed and shared shall include transaction data, relevant Merchant Category Code information and product and services data that banks are required to publicly disclose, such as price, fees, and other charges should be made publicly available under open banking. Fees may be charged by banks to AISPs for sharing ‘Value Added Data’ and ‘Aggregated Data’ are not required to be shared. Value added data or derived data results from material enhancement by the application of insights, analysis, or transformation on customer data by the licensee. Aggregated data refers to data which is aggregated across the licensee’s customer segments for the purpose of analysis.

GR-6.1.6

If an Islamic retail bank licensee refuses a request for access to such services or withdraws access to such services, it must seek approval of the CBB in a formal communication which must contain the reasons for the refusal or the withdrawal of access and contain such information as the CBB may direct. The CBB shall approve the request if it is satisfied that the impact of not giving access is minimal. If the request is rejected, the Islamic retail bank licensee must adhere to the direction provided by the CBB.

GR-6.1.7

Islamic retail bank licensees must comply with each of the following requirements:

GR-6.1.8

For the purposes of this Chapter, Islamic retail bank licensees must provide access to and share information and data pertaining to customer account activity, including the Merchant Category Code information relevant to the payments from the customer account, and balances covering a period of 12 full months or 365 days at the time of access to the AISPs in respect of the following services/products offered by the licensee:

GR-6.2.1

Islamic retail bank licensees that offer a customer account that is accessible online must have in place at least one interface which meets each of the following requirements:

GR-6.2.2

Islamic retail bank licensees must establish the interface(s) referred to in Paragraph GR-6.2.1 by means of a dedicated interface.

GR-6.2.3

For the purposes of authentication of the customer, the interfaces referred to in paragraph GR-6.2.1 must allow AISPs and PISPs to rely on the authentication procedures provided by the Islamic retail bank licensee to the customer. In particular, the interface must meet all of the following requirements:

GR-6.2.4

Islamic retail bank licensees must ensure that their interface(s) follows standards of communication which are agreed by the CBB and that the protocols are technology neutral. They must ensure that the technical specifications of the interface are documented and are made available to AISPs and PISPs when requested.

GR-6.2.5

Islamic retail bank licensees must establish and make available a testing facility, in accordance with the operational guidelines included in the Bahrain Open Banking Framework (see Section 4.1), to authorised AISPs and PISPs, companies operating in the CBB’s Regulatory Sandbox as open banking service providers and AISPs/PISPs granted in-principle confirmation to proceed with the CBB’s licensing process. No sensitive information must be shared through the testing facility. Licensees must display a link to the testing facility on their website.

GR-6.2.6

Islamic retail bank licensees must ensure that the dedicated interface established for the AISPs and PISPs offers the same level of availability and performance, including support, as well as the same level of contingency measures, as the interface made available to the customer for directly accessing its payment account online.

GR-6.2.7

For the purposes of GR-6.2.6, the following requirements apply:

GR-6.2.8

Islamic retail bank licensees must include in the design of dedicated interface, a strategy and plans for contingency measures in the event of an unplanned unavailability of the interface and systems breakdown. The strategy must include communication plan to inform the relevant AISP/PISP making use of the dedicated interface in the case of breakdown, measures to bring the system back to 'business as usual' and a description of alternative options AISPs and PISPs may make use of during the unplanned downtime.

GR-6.3.1

Islamic retail bank licensees must ensure that communication sessions with PISPs and AISPs including merchants, relies on each of the following:

GR-6.3.2

Islamic retail bank licensees must ensure secured identification when communicating with AISPs and PISPs.

GR-6.3.3

Islamic retail bank licensees must ensure that, when exchanging data via the internet, with PISPs and AISPs, secure encryption is applied between the communicating parties throughout the respective communication session in order to safeguard the confidentiality and the integrity of the data, using strong and widely recognised encryption techniques.

GR-6.3.4

PISPs and AISPs must keep the access sessions offered by Islamic retail bank licensees as short as possible and they must actively terminate the session as soon as the requested action has been completed.

GR-6.3.5

When maintaining parallel network sessions with the PISPs and AISPs, Islamic retail bank licensees must ensure that those sessions are securely linked to relevant sessions established in order to prevent the possibility that any message or information communicated between them could be misrouted.

GR-6.3.6

Islamic retail bank licensees' sessions with PISPs and AISPs must contain unambiguous reference to each of the following items:

GR-6.3.7

Islamic retail bank licensees must ensure that where they communicate personalised security credentials and authentication codes, these are not readable by any staff at any time.

GR-6.3.8

[This Paragraph was moved to GR-6.1.7].

GR-6.3.9

In case of an unexpected event or error occurring during the process of identification, authentication, or the exchange of the data elements, the Islamic retail bank licensees must send a notification message to the relevant PISP or AISP which explains the reason for the unexpected event or error.

GR-6.3.10

Where the Islamic retail bank licensee offers a dedicated interface, it must ensure that the interface provides for notification messages concerning unexpected events or errors to be communicated by any PISP or AISP that detects the event or error to the other licensees participating in the communication session.

GR-6.3.11

Islamic retail bank licensees must provide access to information from customer accounts to AISPs whenever the customer requests such information.

Secure authentication

Independence of elements of strong authentication

GR-6.4.1

Islamic retail bank licensees must adhere to the Operational Guidelines, Security Standards and Guidelines, Open Banking Application Program Interface (API) Specifications and Customer Journey Guidelines included in Bahrain Open Banking Framework (see CBB website).

GR-6.4.2

Islamic retail bank licensees must ensure that compliance with standards and guidelines specified in Paragraph GR-6.4.1 is subject to independent review and tests, including testing in a test environment., by an independent consultant upon implementation.

GR-6.4.3

To remain technologically neutral the technical standards adopted by Islamic retail bank licensees must not require a specific technology. Authentication codes must be based on solutions such as generating and validating one-time passwords, digital signatures or other cryptographically underpinned validity assertions using keys and/or cryptographic material stored in the authentication elements, as long as the security requirements are fulfilled.

GR-6.5.1

[This Paragraph was deleted in July 2021].

GR-7.1.1

As specified in Article 50 of CBB Law, an Islamic bank licensee wishing to cease to provide or suspend any or all of the licensed regulated services, completely or at any of its branches must obtain prior written approval from the CBB, setting out how it proposes to do so and, in particular, how it will treat any Shari'a money placements/deposits, and investment accounts, that it holds.

GR-7.1.2

[This Paragraph was deleted in October 2011].

GR-7.1.3

If the Islamic bank licensee wishes to liquidate its business, the CBB will revise its license to restrict the firm from entering into new business. The licensee must continue to comply with all applicable CBB requirements until such time as it is formally notified by the CBB that its obligations have been discharged and that it may surrender its license.

GR-7.1.4

In the case of a Bahraini Islamic bank licensee, Chapter GR-7 applies both to its business booked in Bahrain and the licensee's overseas branches. In the case of branches of foreign bank licensees, Chapter GR-7 applies only to business booked in the licensee's Bahrain branch.

GR-7.1.5

Licensees seeking to obtain the CBB's permission to cease business must apply to the CBB in writing, in the form of a formal request together with supporting documents. Unless otherwise directed by the CBB, the following information/documentation must be provided in support of the request:

GR-7.1.6

Islamic bank licensees intending to apply to cease business are advised to contact the CBB at the earliest opportunity, prior to submitting a formal application, in order that the CBB may determine the nature and level of documentation to be provided and the need for an auditor or other expert opinion to be provided to support the application. The information/documentation specified in Paragraph GR-7.1.5 may be varied by the CBB, depending on the nature of the proposed cessation, such as the materiality of the business concerned and its impact on customers.

GR-7.1.7

Approval to cease business will generally be given where adequate arrangements have been made to offer alternative arrangements to any affected customers. The CBB's approval may be given subject to any conditions deemed appropriate by the CBB. In all cases where additional requirements are imposed, the CBB shall state the reasons for doing so.

GR-7.1.8

An Islamic bank licensee in liquidation must continue to meet its contractual and regulatory obligations to depositors, other clients and creditors.

GR-7.1.9

[This Paragraph was deleted in October 2011].

GR-7.1.10

[This Paragraph was deleted in October 2011].

GR-7.1.11

[This Paragraph was deleted in October 2011].

GR-7.1.12

Upon satisfactorily meeting the requirements set out in GR-7.1.4, the Islamic bank licensee must surrender the original license certificate issued by the Licensing Directorate at the time of establishment, and submit confirmation of the cancellation of its commercial registration from the Ministry of Industry, Commerce and Tourism.

GR-9.1.1

Islamic retail bank licensees must place any prepaid card which is inactive for a period of six months on the “dormant” list.