Executive Summary

Legal Basis

Evolution of Module

GR-B.1.1

Unless otherwise indicated, the requirements in this Module apply to all ancillary service provider licensees, thereafter referred to in this Module as licensees.

GR-C.1.1

Ancillary service provider licensees must ensure that all regulated financial services are provided without any discrimination based on gender, nationality, origin, language, faith, religion, physical ability or social standing.

GR-1.1.1

Licensees must ensure that any information in their control or custody is not used or disclosed unless:

GR-1.1.2

Ancillary service providers must take appropriate steps to ensure the security of any information handled for its customers or held on behalf of other CBB licensees.

GR-2.1.1

In accordance with Article 59 of the CBB Law, all licensees must maintain books and records (whether in electronic or hard copy form) sufficient to produce financial statements and show a complete record of the business undertaken by a licensee. These records must be retained for at least ten years according to Article 60 of the CBB Law.

GR-2.1.2

Paragraph GR-2.1.1 includes accounts, books, files and other records related to client information (e.g. trial balance, general ledger, reconciliations, list of counterparties, etc.). It also includes records that substantiate the value of the assets and liabilities.

GR-2.1.3

Separately, Bahrain Law currently requires other transaction records to be retained for at least five years (see Ministerial Order No. 23 of 2002, Article 5(2), made pursuant to the Amiri Decree Law No. 4 of 2001).

GR-2.1.4

Unless otherwise agreed to by the CBB in writing, records must be kept in either English or Arabic. Any records kept in languages other than English or Arabic must be accompanied by a certified English or Arabic translation. Records must be kept current. The records must be sufficient to allow an audit of the licensee's business or an on-site examination of the licensee by the CBB.

GR-2.1.5

Translations produced in compliance with Rule GR-2.1.4 may be undertaken in-house, by an employee or contractor of the licensee, provided they are certified by an appropriate officer of the licensee.

GR-2.1.6

Records must be accessible at any time from within the Kingdom of Bahrain, or as otherwise agreed with the CBB in writing.

GR-2.1.7

Where older records have been archived, the CBB may accept that records be accessible within a reasonably short time frame (e.g. within 5 business days), instead of immediately. The CBB may also agree similar arrangements where elements of record retention and management have been centralised in another group company, whether inside or outside of Bahrain.

GR-2.1.8

Paragraphs GR-2.1.1 to GR-2.1.7 apply to licensees, with respect to all business activities.

GR-2.2.1

Licensees must keep completed transaction records for as long as they are relevant for the purposes for which they were made (with a minimum period in all cases of five years from the date when the transaction was terminated). Records of terminated transactions must be kept whether in hard copy or electronic format as per the Legislative Decree No. (54) of 2018 with respect to Electronic Transactions “The Electronic Communications and Transactions Law” and its amendments.

GR-2.2.2

[This Paragraph has been deleted in July 2017].

GR-2.2.3

Rule GR-2.2.1 applies only to transactions relating to business booked in Bahrain by the licensee.

Corporate Records

Customer Records

GR-3.1.1

Any written communication, including stationery, business cards or other business documentation published by the licensee, or used by its employees must include a statement that the licensee is regulated by the Central Bank of Bahrain, the type of license and the legal status.

GR-4.1.1

A TPA's compensation may be determined:

GR-4.2.1

TPAs are allowed to enter into agreement with more than one:

GR-4.2.2

TPAs must not charge any kind of fees to the claimants/policyholders.

GR-4.2.3

TPAs must not market or sell insurance nor own any part of a healthcare facility or company.

GR-4.2.4

Where a TPA owns any part of a healthcare facility or company at the time this Module is issued, it will be permitted to retain its ownership in the company.

GR-4.2.5

TPAs must act in the insurance firm's and/or self-funded scheme's (limited to outside Bahrain) best interests at all times and must fulfill their needs to the best of their ability.

GR-4.2.6

TPAs must improve the skills of their employees and increase their knowledge through continuing education and training.

GR-4.2.7

TPAs must disclose to the existing and prospective insurance firm and/or self-funded scheme (limited to outside Bahrain) any and all information that may affect the TPA's ability to provide services and/or advice to the clients.

GR-4.2.8

TPAs must ensure that all client funds collected and/or held by the TPA are used for the express purpose for which the funds are collected and/or held as understood by the insurance firm and/or self-funded scheme (limited to outside Bahrain).

GR-4.2.9

TPAs must fully disclose to each insurance firm and/or self-funded scheme (limited to outside Bahrain) the terms of engagement and the services to be rendered to that client.

GR-4.3.1

All funds remitted to a TPA by an insurance firm and/or self-funded scheme (limited to outside Bahrain) must be held by the TPA in a separate account maintained in the name of the insurance firm and/or self-funded scheme (limited to outside Bahrain) or in a separate account maintained jointly in the names of the insurance firm and/or self-funded scheme (limited to outside Bahrain) and the TPA.

GR-4.3.2

When funds are collected by a TPA from a healthcare provider on behalf of an insurance firm and/or self-funded scheme (limited to outside Bahrain), such funds must be promptly deposited in a separate account maintained in the name of the insurance firm and/or self-funded scheme (limited to outside Bahrain) or an account maintained jointly in the names of the insurance firm and/or self-funded scheme (limited to outside Bahrain) and the TPA, or remitted to the insurance firm and/or self-funded scheme (limited to outside Bahrain), as provided for in the agreement.

GR-4.3.3

When an account is held jointly in the names of the insurance firm and/or self-funded scheme (limited to outside Bahrain) and the TPA, the TPA must provide the insurance firm and/or self-funded scheme (limited to outside Bahrain) on a monthly basis a record of all transactions in the joint account.

GR-4.3.4

Funds must not be commingled with any other funds of the TPA nor other insurance firm and/or self-funded scheme (limited to outside Bahrain) of the TPA. Records of a TPA must clearly show funds received and paid out allocated per insurance firm and/or self-funded scheme (limited to outside Bahrain) and must be made available to the insurance firm and/or self-funded scheme (limited to outside Bahrain) upon request.

GR-4.3.5

An insurance firm and/or self-funded scheme (limited to outside Bahrain) shall have the responsibility to make available to the TPA funds necessary to enable the TPA to pay claims in a timely manner, as provided in the agreement.

GR-4.3.6

TPAs must process and settle claims of the policyholder/claimant within 15 calendar days from the receipt of all necessary documents.

GR-4.3.7

TPAs must process and settle claims from healthcare service providers within 30 calendar days from the receipt of all necessary documents from the healthcare service providers.

GR-4.3.8

TPAs must comply with Paragraphs GR-4.3.6 and GR-4.3.7 by 30^th September 2016 at the latest.

GR-4.4.1

A TPA must not conduct any business with an insurance firm and/or self-funded scheme (limited to outside Bahrain) in the absence of a written agreement between the TPA and the insurance firm and/or self-funded scheme (limited to outside Bahrain). The agreement must be retained as part of the official records of the TPA for the duration of the agreement.

GR-4.4.2

The agreement referred to in Paragraph GR-4.4.1 must include at a minimum:

GR-4.5.1

TPAs are prohibited from collecting premiums/contributions from policyholders. Premiums/contributions must be paid directly by the policyholders to insurance firms.

GR-5.1.1

Credit reference bureaus must comply with the Code of Practice (Appendix CM-3 under Volumes 1 and 2 of the CBB Rulebook).

GR-5A.1.1

[This Paragraph was deleted in April 2022].

GR-5A.1.2

[This Paragraph was deleted in April 2022].

GR-5A.1.3

[This Paragraph was deleted in April 2022].

GR-5A.1.4

[This Paragraph was deleted in April 2022].

GR-5A.1.5

[This Paragraph was deleted in April 2022].

GR-5A.1.6

[This Paragraph was deleted in April 2022].

GR-5A.1.7

[This Paragraph was deleted in April 2022].

GR-5A.1.8

[This Paragraph was deleted in April 2022].

GR-5A.1.9

[This Paragraph was deleted in April 2022].

GR-5A.1.10

[This Paragraph was deleted in April 2022].

GR-5A.1.11

[This Paragraph was deleted in April 2022].

GR-5A.1.11A

[This Paragraph was deleted in April 2022].

GR-5A.1.12

[This Paragraph was deleted in April 2022].

GR-5A.1.13

[This Paragraph was deleted in April 2022].

GR-5A.1.14

[This Paragraph was deleted in April 2022].

GR-5A.1.15

[This Paragraph was deleted in April 2022].

GR-5A.1.16

[This Paragraph was deleted in April 2022].

GR-5A.1.17

[This Paragraph was deleted in April 2022].

GR-5A.1.18

[This Paragraph was deleted in April 2022].

GR-5A.1.19

[This Paragraph was deleted in April 2022].

GR-5A.1.20

[This Paragraph was deleted in April 2022].

GR-5A.1.21

[This Paragraph was deleted in April 2022].

GR-5A.1.22

[This Paragraph was deleted in April 2022].

GR-5A.1.23

[This Paragraph was deleted in April 2022].

GR-5A.1.24

[This Paragraph was deleted in April 2022].

GR-5A.1.25

[This Paragraph was deleted in April 2022].

GR-5A.1.26

[This Paragraph was deleted in April 2022].

GR-5A.1.27

[This Paragraph was deleted in April 2022].

GR-5A.1.28

[This Paragraph was deleted in April 2022].

GR-5A.1.29

[This Paragraph was deleted in April 2022].

GR-5A.2.1

[This Paragraph was deleted in April 2022].

GR-5A.2.2

[This Paragraph was deleted in April 2022].

GR-5A.2.3

[This Paragraph was deleted in April 2022].

GR-5A.2.4

[This Paragraph was deleted in April 2022].

GR-5A.2.5

[This Paragraph was deleted in April 2022].

GR-5A.2.6

[This Paragraph was deleted in April 2022].

GR-5A.2.7

[This Paragraph was deleted in April 2022].

General Requirement

Record Keeping

CDM/ Kiosk Alarms

Closed-circuit Television (CCTV)

CCTV Network Systems

CDMs/Kiosks Lighting

Fire Alarm

Cash Replenishment

CDMs/Kiosks Service and Maintenance

Europay, MasterCard and Visa (EMV) Compliance

GR-5B.2.1

Entry to sensitive areas by the PSP staff or other authorized parties into the CDM/Kiosk environment/surroundings must be controlled, monitored and recorded. The names of the persons accessing the area; the date; and the time of access to and exit from the area must be recorded. CCTV cameras must be installed, and used to record all activities within the CDM/Kiosk environment.

GR-5B.2.2

The applicable standards relating to Payment Card Industry (PCI), PIN Transaction Security (PTS), and Point of Interaction (POI) requirements must, in all instances, be fully complied with.

GR-5B-2.3

PSPs must ensure that the integration of Secure Card Readers, (SCRs) and, if applicable, any mechanism protecting the SCRs are properly implemented and fully comply with the guidelines provided by the device vendor. SCRs must be approved by and fully comply with all Payment Card Industry standards at all times.

GR-5B-2.4

PSPs must ensure that all CDMs/Kiosks are equipped with mechanisms which prevent skimming attacks. There must be no known or demonstrable way to disable or defeat the above-mentioned mechanisms, or to install an external or internal skimming device.

GR-6.1.1

Licensees must obtain a letter of no-objection from the CBB to any dividend proposed, before announcing the proposed dividend by way of press announcement or any other means of communication and prior to submitting a proposal for a distribution of profits to a shareholder vote.

GR-6.1.2

The CBB will grant a no-objection letter where it is satisfied that the level of dividend proposed is unlikely to leave the licensee vulnerable — for the foreseeable future — to breaching the CBB's capital requirements, taking into account (as appropriate) the licensee's liquidity.

GR-6.1.3

To facilitate the prior approval required under Paragraph GR-6.1.1, licensees must provide the CBB with:

GR-7.1.1

Licensees must obtain prior written approval from the CBB for any changes to their controllers (as defined in Section GR-7.2):

GR-7.1.2

Condition 3 of the CBB's licensing conditions specifies, among other things, that licensees must satisfy the CBB that their controllers are suitable and pose no undue risks to the licensee (See Paragraph AU-2.3.1). There are also certain procedures which are set out in Articles 52 to 56 of the CBB Law on controllers.

GR-7.1.3

Applicants for a license must provide details of their controllers, by submitting a duly completed Form 2 (Application for Authorisation of Controller). (See sub-Paragraph AU-4.1.4(a)).

GR-7.1.4

Where a controller is a legal person, the controller must notify the CBB of any change in its shareholding at the earlier of:

GR-7.1.5

For approval under Paragraph GR-7.1.1 to be granted, the CBB must be satisfied that the proposed controller or increase in control poses no undue risks to the licensee or the financial system. The CBB may impose any restrictions that it considers necessary to be observed where approval is given for a new or a change in controller. A duly completed Form 2 (Controllers) must be submitted as part of the request for a change in controllers. An approval of controller will specify the applicable period for effecting the proposed acquisition of shares.

GR-7.1.6

If, as a result of circumstances outside the licensee's knowledge and/or control, a change in controller is triggered prior to CBB approval being sought or obtained, the licensee must notify the CBB no later than 15 calendar days on which those changes have occurred.

GR-7.1.7

The approval provisions outlined above do not apply to existing holdings or existing voting control by controllers already approved by the CBB. The approval provisions apply to new/prospective controllers or to increases in existing holdings/voting control.

GR-7.1.8

Licensees are required to notify the CBB as soon as they become aware of events that are likely to lead to changes in their controllers.

GR-7.1.9

The criteria by which the CBB assesses the suitability of controllers are set out in Section GR-7.3. The CBB aims to respond to requests for approval within 30 calendar days and is obliged to reply within 3 months to a request for approval. The CBB may contact references and supervisory bodies in connection with any information provided to support an application for controller. The CBB may also ask for further information, in addition to that provided in Form 2, if required to satisfy itself as to the suitability of the applicant.

GR-7.1.10

Licensees must submit, within 3 months of their financial year-end, a report on their controllers (See Subparagraph BR-1.1.3(d)). This report must identify all controllers of the licensee, as defined in Section GR-7.2, the extent of their shareholding interests and any change in their legal status or any adverse information on the controllers.

GR-7.1.1A

Licensees must not incur or otherwise have an exposure (either directly or indirectly) to their controllers, including subsidiaries and associated companies of such controllers.

GR-7.1.1B

For the purpose of Paragraph GR-7.1.1A, licensees that already have an exposure to controllers must have an action plan agreed with the CBB's supervisory point of contact to address such exposures within a timeline agreed with the CBB.

GR-7.2.1

A controller of a licensee is a natural or legal person who either alone, or with his associates:

GR-7.2.2

For the purposes of Paragraph GR-7.2.1, "associate" includes:

GR-7.2.3

Associate also includes any other person or undertaking with which the controller has entered into an agreement or arrangement as to the acquisition, holding or disposal of shares or other interests in the licensee, or under which they undertake to act together in exercising their voting power in relation to the licensee.

GR-7.3.1

All new controllers or prospective controllers (as defined in Section GR-7.2) of a licensee must obtain the prior written approval of the CBB. Any increases to existing controllers' holdings or voting control must also have prior written approval from the CBB and are subject to the conditions outlined in this Section. Such changes in existing controllers (as defined in the Section GR-7.2) or new/prospective controllers of a licensee must satisfy the CBB of their suitability and appropriateness. The CBB will issue an approval notice or notice of refusal of a controller according to the approval process outlined in Section GR-7.4.

GR-7.3.2

All controllers or prospective controllers (whether natural or legal persons) of all licensees are subject to the approval of the CBB. Persons who intend to take ownership stakes of 10% or above of the voting capital of a licensee are subject to enhanced scrutiny, given the CBB's position as home supervisor of such licensees. The level of scrutiny and the criteria for approval become more onerous as the level of proposed ownership increases.

GR-7.3.3

In assessing the suitability and the appropriateness of new/prospective controllers (and existing controllers proposing to increase their shareholdings) who are natural persons, the CBB has regard to their professional and personal conduct, including, but not limited to, the following:

GR-7.3.4

In assessing the suitability and appropriateness of legal persons as controllers (wishing to increase their shareholding) or new/potential controllers, the CBB has regard to their financial standing, judicial and regulatory record, and standards of business practice and reputation, including, but not limited to, the following:

GR-7.4.1

Within 3 months of receipt of an approval request under Paragraph GR-7.1.1, the CBB will issue an approval notice (with or without restrictions) or a written notice of refusal if it is not satisfied that the person concerned is suitable to increase his shareholding in, or become a controller of the licensee. The notice of refusal or notice of approval with conditions will specify the reasons for the objection or restriction and specify the applicant's right of appeal in either case. Where an approval notice is given, it will specify the period for which it is valid and any conditions that attach. These conditions will include the maximum permitted limit of holding or voting control exercisable by the controller.

GR-7.4.2

Notices of refusal have to be approved by an Executive Director of the CBB. The applicant has 30 calendar days from the date of the notice in which to make written representation as to why his application should not be refused. The CBB then has 30 calendar days from the date of receipt of those representations to reconsider the evidence submitted and make a final determination, pursuant to Article 53 of the Central Bank of Bahrain and Financial Institutions Law (Decree No. 64 of 2006) ("CBB Law") and Module EN (Enforcement).

GR-7.4.3

Pursuant to Article 56 of the CBB Law, where a person has become a controller by virtue of his shareholding in contravention of Paragraph GR-7.1.1, or a notice of refusal has been served to him under Paragraph GR-7.4.1 and the period of appeal has expired, the CBB may, by notice in writing served on the person concerned, direct that his shareholding shall be transferred or until further notice, no voting right shall be exercisable in respect of those shares.

GR-7.4.4

Article 56 of the CBB Law empowers the CBB to take appropriate precautionary measures, or sell such shares mentioned in Paragraph GR-7.4.3, if the licensee fails to carry out the order referred to in the preceding Paragraph.

GR-8.1.1

Condition 3 of the CBB's licensing conditions specifies, amongst other things, that licensees must satisfy the CBB that their close links do not prevent the effective supervision of the licensee and otherwise pose no undue risks to the licensee. (See Paragraph AU-2.3.1).

GR-8.1.2

Applicants for a license must provide details of their close links, as provided for under Form 1 (Application for a License). (See Paragraph AU-4.1.1).

GR-8.1.3

Licensees must submit to the CBB, within 3 months of their financial year-end, a report on their close links (See Subparagraph BR-1.1.3(b)). The report must identify all undertakings closely linked to the licensee, as defined in Section GR-8.2.

GR-8.1.4

Licensees may satisfy the requirement in Paragraph GR-8.1.3 by submitting a corporate structure chart, identifying all undertakings closely linked to the licensee.

GR-8.1.5

Licensees must provide information on undertakings with which they are closely linked, as requested by the CBB.

GR-8.2.1

A licensee ('L') has close links with another undertaking ('U'), if:

GR-8.3.1

In assessing whether a licensee's close links may prevent the effective supervision of the licensee, or otherwise poses no undue risks to the licensee, the CBB takes into account the following:

GR-9.1.1

As specified in Article 50 of the CBB Law, a licensee wishing to cease to provide or suspend any or all of the licensed regulated services of its operations and/or liquidate its business must obtain the CBB's prior approval.

GR-9.1.2

Licensees must notify the CBB in writing at least six months in advance of their intended suspension of any or all the licensed regulated services or cessation of business, setting out how they propose to do so and, in particular, how they will treat any of their liabilities.

GR-9.1.3

If the licensee wishes to liquidate its business, the CBB will revise its license to restrict the firm from entering into new business. The licensee must continue to comply with all applicable CBB requirements until such time as it is formally notified by the CBB that its obligations have been discharged and that it may surrender its license.

GR-9.1.4

A licensee in liquidation must continue to meet its contractual and regulatory obligations to its clients and creditors.

GR-9.1.5

Once the licensee believes that it has discharged all its remaining contractual obligations to clients and creditors, it must publish a notice in two national newspapers in Bahrain approved by the CBB (one being in English and one in Arabic), stating that it has settled all its dues and wishes to leave the market. According to Article 50 of the CBB Law, such notice shall be given after receiving the approval of the CBB, not less than 30 days before the actual cessation is to take effect.

GR-9.1.6

The notice referred to in Paragraph GR-9.1.5 must include a statement that written representations concerning the liquidation may be sent to the CBB before a specified day, which shall not be later than thirty days after the day of the first publication of the notice. The CBB will not decide on the application until after considering any representations made to the CBB before the specified day.

GR-9.1.7

If no objections to the liquidation are upheld by the CBB, then the CBB may issue a written notice of approval for the surrender of the license.

GR-9.1.8

Upon satisfactorily meeting the requirements set out in GR-9.1, the licensees must surrender the original license certificate issued by the Licensing Directorate at the time of establishment, and submit confirmation of the cancellation of its commercial registration from the Ministry of Industry, Commerce and Tourism.

GR-10.1.1

All licensees must have appropriate customer complaints handling procedures and systems for effective handling of complaints, whether received directly by the licensee or through other parties connected to the licensee.

GR-10.1.2

Customer complaints procedures must be documented appropriately and their customers must be informed of their availability.

GR-10.1.3

All licensees must appoint a customer complaints officer and publicise his/ her contact details at all departments and branches and on the licensee's website. The customer complaints officer must be of a senior level at the licensee and must be independent of the parties to the complaint to minimise any potential conflict of interest.

GR-10.1.4

The position of customer complaints officer may be combined with that of compliance officer.

GR-10.2.1

In order to make customer complaints handling procedures as transparent and accessible as possible, all licensees must document their customer complaints handling procedures. These include setting out in writing:

GR-10.2.2

Licensees must provide a copy of the procedures to all relevant staff, so that they may be able to inform customers. A simple and easy-to-use guide to the procedures must also be made available to all customers, on request, and when they want to make a complaint.

GR-10.2.3

Licensees are required to ensure that all financial services related documentation provided to the customer includes a statement informing the customer of the availability of a simple and easy-to-use guide on customer complaints procedures in the event the customer is not satisfied with the services provided.

GR-10.3.1

Adherence to the following principles is required for effective handling of complaints:

Visibility

Accessibility

Responsiveness

Objectivity and Efficiency

GR-10.4.1

A licensee's internal complaint handling procedures must provide for:

GR-10.4.2

A licensee's internal complaint handling procedures must be designed to ensure that:

GR-10.5.1

A licensee must acknowledge in writing customer written complaints within 5 working days of receipt.

GR-10.5.2

A licensee must respond in writing to a customer complaint within 4 weeks of receiving the complaint, explaining their position and how they propose to deal with the complaint.

Redress

GR-10.6.1

A licensee must maintain a record of all customers' complaints. The record of each complaint must include:

GR-10.7.1

A licensee must submit to the CBB's Consumer Protection Unit, 20 days after the end of the quarter, a quarterly report summarising the following:

GR-10.7.2

The report referred to in Paragraph GR-10.7.1 must be sent electronically to complaint@cbb.gov.bh.

GR-10.7.3

Where no complaints have been received by the licensee within the quarter, a 'nil' report should be submitted to the CBB's Consumer Protection Unit.

GR-10.8.1

Compliance with these requirements is subject to the ongoing supervision of the CBB as well as being part of any CBB inspection of a licensee. Failure to comply with these requirements is subject to enforcement measures as outlined in Module EN (Enforcement).

GR-11.1.1

This Chapter sets out the CBB’s approach to outsourcing by licensees. It also sets out various requirements that licensees must address when considering outsourcing an activity or function.

GR-11.1.2

In the context of this Chapter, ‘outsourcing’ means an arrangement whereby a third party performs on behalf of a licensee an activity which commonly would have been performed internally by the licensee. Examples of services that are typically outsourced include data processing, cloud services, customer call centres and back-office related activities.

GR-11.1.3

In the case of branches of foreign entities, the CBB may consider a third-party outsourcing arrangement entered into by the licensee’s head office/regional office or other offices of the foreign entity as an intragroup outsourcing, provided that the head office/regional office submits to the CBB a letter of comfort which includes, but is not limited to, the following conditions:

GR-11.1.4

The licensee must not outsource the following functions:

GR-11.1.5

For the purposes of Paragraph GR-11.1.4, certain support activities, processes and systems under these functions may be outsourced (e.g. call centres, data processing, credit recoveries, cyber security, e-KYC solutions) subject to compliance with Paragraph GR-11.1.7. However, strategic decision-making and managing and bearing the principal risks related to these functions must remain with the licensee.

GR-11.1.6

Branches of foreign entities may be allowed to outsource to their head office, the risk management function stipulated in Subparagraph GR-11.1.4 (iv), subject to CBB’s prior approval.

GR-11.1.7

Licensees must comply with the following requirements:

GR-11.1.8

For the purpose of Subparagraph GR-11.1.7 (iv), licensees as part of their assessments may use the following:

When conducting on-site examinations, licensees should ensure that the data of the outsourcing service provider’s other clients is not negatively impacted, including impact on service levels, availability of data and confidentiality.

GR-11.1.9

For the purpose of Subparagraph GR-11.1.7 (i), the CBB will provide a definitive response to any prior approval request for outsourcing within 10 working days of receiving the request complete with all the required information and documents.

GR-12.1.1

PSPs must implement enhanced fraud monitoring of movements in customers’ accounts to guard against electronic frauds using various tools and measures, such as limits in value, volume and velocity.

GR-12.1.2

PSPs must have in place customer awareness communications, pre and post onboarding process, using video calls, short videos or pop-up messages, to alert and warn natural persons using online channels or applications about the risk of electronic frauds, and emphasise the need to secure their personal credentials and not share them with anyone, online or offline.

Secure Authentication

GR-12.2.1

This Section applies to ancillary service provider licensees that provide services through digital channels.

GR-12.2.2

All licensees must have in place vulnerability and patch management processes, including remediation processes to ensure that the vulnerabilities identified are addressed. Security patches must be applied where relevant within a timeframe that is commensurate with the risks posed by each vulnerability.

GR-12.2.3

PSPs, AISPs, and PISPs must perform penetration testing of their systems, applications, and network devices to verify the robustness of the security controls in place at least twice a year and all other licensees offering services through digital means must perform such tests at least once a year. The tests must be conducted simulating real world cyber-attacks on the technology environment and must:

GR-12.2.4

The tests referred to in Paragraph GR-12.2.3 must be conducted each year in June and December by licensees required to perform the tests twice a year and in June for licensees required to perform the tests at least once a year. Reports on penetration testing must be submitted to CBB before 30^th September for the tests as at 30^th June and 31^st March for the tests as at 31^st December. The penetration testing reports must include the vulnerabilities identified and a full list of ‘passed’ tests and ‘failed’ tests together with the steps taken to mitigate the risks identified.

Role of the Board and Senior Management

Cyber Security Strategy

Cyber Security Policy

Approach, Tools and Methodology

Prevention Controls

Cyber Risk Identification and Assessments

Cyber Incident Detection and Management

Recovery

Cyber Security Insurance

Training and Awareness

Incident Reporting to CBB

GR-13.1.1

PSPs must exempt the Zakat and Charity Fund (“the Fund”) of the Ministry of Justice, Islamic Affairs and Awqaf from merchant fees for payments made to the Fund.

GR-14.1.1

Pursuant to Article 3(b) of Resolution No. (16) of 2012 relating to marketing financial services in the Kingdom of Bahrain, and in relation to regulated services provided by PSPs:

GR-15.1.1

This Chapter applies to all PSPs that are allowed to hold client money.

GR-15.1.2

Licensees must receive client money into a client money account with a retail bank in Bahrain and make clear in the title of the bank account that the funds in the account belong to one or more customers of the licensee and not to the licensee.

GR-15.1.3

Licensees must ensure that it has established and implemented adequate policies, procedures and systems, including those related to fraud risk and that the client money is:

GR-15.1.4

Licensees must perform reconciliations of client money accounts with related client customer accounts in their accounting records. These reconciliations must be carried out on a monthly basis as at the last business day of each calendar month. The licensee must ensure that the reconciliations are completed within 10 business days of the month end so that any unresolved differences, shortfalls and excess balances can be investigated, and corrective action initiated.

GR-15.1.5

Licensees holding client money in the course of carrying out payment services must appoint independent auditors to perform an audit of client money every 6 months and submit the report to the CBB as required in Paragraph BR-1.1.6.