Bahrain: technology regulation at a glance

Framework: Central Bank of Bahrain (CBB) Rulebook Volume 6 (Capital Markets) — Crypto-Asset (CRA) Module, Stablecoin Issuance and Offering (SIO) Module, together with the CBB and Financial Institutions Law No. 64 of 2006 and applicable AML/CFT decrees. NBR guidance sets VAT treatment.

Bahrain is one of the earliest and most comprehensive crypto-asset jurisdictions in the Gulf. The CBB operates a dedicated licensing regime for crypto-asset service providers (four categories from advisory to full exchange operator) under the CRA Module, and in July 2025 added a first-of-its-kind SIO Module regulating fiat-backed stablecoin issuers. Crypto is legal; conducting regulated crypto-asset services in or from Bahrain requires a CBB licence.

Framework: Draft Standalone AI Regulation Law (38 articles) pending in the Council of Representatives; interim guidance from the General Policy for the Use of AI (v1.0, 2025) and the Personal Data Protection Law (Law No. 30/2018) enforced by the Personal Data Protection Authority

Bahrain does not yet have a comprehensive AI law in force. A dedicated 38-article AI Regulation Bill was unanimously approved by the Shura Council in April 2024 and remains under review by the Council of Representatives' Legislative and Legal Affairs Committee, having faced government pushback that existing statutes suffice. In the meantime, AI use in the public sector is governed by the non-binding General Policy for the Use of Artificial Intelligence (issued 2025) and sector-neutral laws on data protection, cybercrime and electronic transactions, while a National AI Strategy is still in draft.

Framework: Personal Data Protection Law (PDPL) — Law No. 30 of 2018, in force since 1 August 2019; supervised by the Personal Data Protection Authority (PDPA), whose functions are entrusted to the Ministry of Justice, Islamic Affairs and Waqf under Royal Decree No. 78 of 2019.

Bahrain has a comprehensive, GDPR-inspired data-protection regime enacted as Law No. 30 of 2018 and effective from 1 August 2019 — making it the first GCC state with a standalone omnibus privacy statute. The Personal Data Protection Authority (PDPA), whose competencies are exercised by the Ministry of Justice, Islamic Affairs and Waqf, oversees enforcement, and a series of Ministerial Executive Orders (notably Order 42/2022 listing 83 'adequate' jurisdictions) implements the law. Obligations cover consent, sensitive-data controls, cross-border transfers, breach notification and (for some controllers) appointment of a Data Protection Guardian.

Framework: Central Bank of Bahrain (CBB) under the CBB and Financial Institutions Law 2006 (Decree No. 64 of 2006); payments/e-money and open banking are regulated primarily through CBB Rulebook Volume 5 (Ancillary Service Providers), including Module AU (Authorisation) and Module OB (Open Banking); crypto-asset services are regulated under Volume 6 Module CRA.

Bahrain operates a mature, dedicated licensing regime for digital payments and fintech administered by the Central Bank of Bahrain, with distinct authorisation categories for Payment Service Providers (PSPs), e-money issuers, Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs). It was the first MENA jurisdiction to mandate open banking (2018) and to launch a formal fintech regulatory sandbox (2017), and it operates a national instant-payment rail (Fawri+) via BENEFIT. Amendments in May 2026 tightened capital, governance and operational-resilience requirements for PSPs, while a BNPL-specific module remains in the consultation/finalisation phase following a 2025 consultation.

Framework: Nationality, Passports and Residence Affairs (NPRA) manages residence permits; the Golden Residency Visa (goldenresidency.gov.bh) offers long-term residence; the Labour Market Regulatory Authority (LMRA) governs work permits. No dedicated digital-nomad visa exists.

Bahrain does not offer a dedicated digital-nomad visa; the country's official NPRA e-visa portal lists only tourist, family, and business visit visas, plus employer-sponsored work permits. Remote workers and relocators typically rely on the tourist eVisa for short stays (up to 3 months), or pursue longer-term residence via the 10-year Golden Residency Visa (for property investors, high earners, retirees, or specialized talent), a self-sponsorship residence permit for property owners, or an Investor/Partner visa tied to a Commercial Registration. The former Flexi-Permit self-sponsorship scheme was abolished in October 2022 and replaced by a more restrictive Labour Registration Program.

Framework: Telecommunications Regulatory Authority (TRA) Resolution No. 12 of 2016 (Internet Safety Regulation) — a centralized state-managed blocking system — combined with Cybercrime Law 60/2014, the Penal Code, and the amended Press, Printing and Publishing Law (Law 41 of 2025) which brings electronic media under Ministry of Information licensing.

Bahrain operates a heavily restricted internet regime built around centralized state-run filtering. TRA Resolution 12/2016 requires every ISP to route traffic through a unified, TRA-controlled blocking system, and authorities routinely block political, human-rights, LGBT and religious content, while the Cybercrime Law and Penal Code are used to prosecute users for online expression. A 2025 amendment to the Press Law extended licensing and heavy fines to online outlets, and a Shura Council bill introduced in January 2026 proposes barring under-15s from social media with mandatory age-verification, though the government has objected on enforceability grounds.

Framework: National Cyber Security Center (NCSC) established under Royal Decree No. 65 of 2020 with responsibilities defined by Royal Order No. 17 of 2025; supported by Law No. 60 of 2014 on IT Crimes, CNI Cybersecurity Controls, CBB Rulebook cybersecurity requirements for financial firms, and PDPL (Law No. 30 of 2018) breach-notification duties

Bahrain does not have a single horizontal NIS2-style cybersecurity statute, but operates a layered regime built around the National Cyber Security Center (NCSC) — whose mandate was formally defined by Royal Order No. 17 of 2025 — plus sector-specific mandatory controls for Critical National Infrastructure (CNI) and the financial sector, and criminal offences under the 2014 IT Crimes Law. Mandatory cyber-incident reporting to the NCSC applies to CNI entities; broad private-sector incident reporting to the NCSC remains voluntary, while personal-data breach notification (72 hours) is mandatory under the PDPL and Order No. 43 of 2022.

Framework: Commercial Companies Law (Decree-Law No. 21 of 2001, as amended — most recently by Decree-Law No. 38 of 2025), administered by the Ministry of Industry and Commerce (MOIC) via the Sijilat one-stop online commercial-registration portal; the Bahrain Economic Development Board (EDB) supports investor onboarding.

Bahrain is one of the more liberal GCC jurisdictions for foreign entrepreneurs: MOIC permits 100% foreign ownership across the large majority of commercial activities (roughly 95–98% of the CR activity catalogue) with no local sponsor required, and a WLL (limited liability company) has no fixed minimum capital. Registration is done end-to-end online through Sijilat, and a straightforward WLL is typically incorporated within about 2–4 weeks once security clearance and sector approvals are in hand.