In short: On 14 July 2026 the Central Bank of Bahrain issued Circular OG/245/2026, amending Module FC (Volumes 1 to 5) and the AML Module. Licensees no longer need a customer’s employer address, may verify either the CPR or the passport number, and gain legal protection for good-faith suspicious transaction reports. It is effective from the circular date.
Key facts
| Authority | Central Bank of Bahrain (CBB) |
|---|---|
| Instrument | Circular OG/245/2026: Amendments to the Customer Due Diligence and Suspicious Transactions Reporting Requirements |
| Issue date | 14 July 2026 |
| Effective date | From the date of the circular, 14 July 2026; no transition period is stated |
| Applies to | All CBB licensees, through Module FC (Volumes 1 to 5) and the AML Module (Volume 6) |
| Status | In force |
| Official source | https://cbben.thomsonreuters.com/rulebook/amendments-customer-due-diligence-and-suspicious-transactions-reporting-requirements14 |
| Last verified | 13 October 2026, against the CBB Rulebook page, the signed circular and the July 2026 FC and AML modules (Volumes 1 to 6) |
What did the CBB change?
The CBB says it is streamlining requirements and reducing the compliance burden without weakening the Kingdom’s AML/CFT framework. The circular lists three amendments.
-
Employer address removed
Licensees no longer have to obtain the customer’s employer’s address as part of the identification information collected from natural persons at account opening or onboarding. In the July 2026 Volume 1 module, FC-1.2.1(i) now reads “Employer’s name (if self-employed, the nature of the self-employment)”. The name stays; the address goes.
-
CPR or passport number
Licensees may verify either the national ID (CPR) or the passport number. In Volume 1, FC-1.1.12H, 1.2.2A, 1.2.3, 1.4.14 and 1.4.16 now refer to items (a) to (d) and either (e) or (f) of FC-1.2.1. The change log also lists FC-1.2.2, a pointer to guidance notes, as a reference amendment.
-
Good-faith protection
A new paragraph says licensees, their directors, senior management and employees must not be held criminally, civilly, administratively or disciplinarily liable for reporting suspicions in good faith. It applies even where the reporter did not know the underlying crime, or no crime occurred. The CBB says this is in line with FATF standards.
What did not change. In Volume 1, the duty to report all suspicious or attempted transactions (FC-5.2.4), the tipping-off ban (FC-5.2.6) and five-year retention of STR details (FC-5.2.5) sit in the same section. The module change log lists only FC-5.2.7 for that chapter, so those paragraphs are not shown as amended.
What items (e) and (f) are. In Volume 1, FC-1.2.1(e) is the passport number, if the customer is a passport holder. Item (f) is the current CPR or Iqama number, for residents of Bahrain or GCC states, or government-issued national identification proof. The paragraphs named above now point to items (a) to (d) and either (e) or (f). Items (a) to (d) are the full legal name, the permanent residential address, the date of birth and the nationality.
The circular is signed by the Governor and directs any questions to the CBB’s Anti-Financial Crime Directorate. It says the amended Modules FC and AML will be available on the CBB Rulebook website.
Where do the new paragraphs sit?
The July 2026 modules carry the same protection under different numbers. It is FC-5.2.7 in Volumes 1, 2 and 5, FC-4.2.7 in Volumes 3 and 4, and AML-4.2.7 in Volume 6. The employer-address deletion appears in the natural-person list in each volume, where item (i) now asks only for the employer’s name.
Who is affected?
Every CBB licensee. The July 2026 modules cover conventional banks (Volume 1), Islamic banks (Volume 2), insurance (Volume 3), investment business (Volume 4), specialised licensees (Volume 5) and capital market licensees (Volume 6). The circular was addressed to the Chief Executive Officer of all licensees and copied to the Bahrain Association of Banks and to external audit firms. Onboarding teams, MLROs, compliance heads and the staff who file STRs are the functions most directly touched.
What should banks do next?
The circular says the amended modules are effective from 14 July 2026. The five moves below are practical advice, not requirements of the circular:
- Rewrite the CDD policy.Remove the employer-address requirement and record where your own risk assessment still wants it.
- Fix forms and systems.Check mandatory fields in onboarding forms, core banking and digital apps, so staff are not blocked by a field the rule no longer demands.
- Update the verification workflow.Confirm how staff verify the identification number, and keep verifying the other required items.
- Brief the STR team.Add the new protection to policies and training, with a reminder that reporting and tipping-off duties stand.
- Check every volume.Confirm each licence type you hold against the live Rulebook text.
Deadlines and penalties
The circular states no separate compliance date, no transition period and no penalty amount. The amended modules are effective from the date of the circular, 14 July 2026.
Frequently asked questions
Does Bahrain still require a customer’s employer address?
Not under the amended Rulebook. The circular removes the requirement to obtain it from natural persons at onboarding. The employer’s name stays in item FC-1.2.1(i).
Can a bank verify a customer using only a passport?
For the identification-number element, the circular allows licensees to verify either the national ID (CPR) or the passport number. Items (a) to (d) of FC-1.2.1 (name, address, date of birth, nationality) must still be verified, for example under FC-1.2.2A in Volume 1.
Who is protected when reporting suspicious transactions?
Licensees, their directors, senior management and employees cannot be held criminally, civilly, administratively or disciplinarily liable for reporting suspicions in good faith, even if they did not know the underlying crime or no crime occurred (FC-5.2.7 in Volume 1).
When do the changes take effect?
The circular says the amended modules are effective from the date of the circular, 14 July 2026. It states no transition period.
Sources (official, verified 13 October 2026)
- CBB Rulebook, Volume 1 Ad-hoc Communications: “Amendments to the Customer Due Diligence and Suspicious Transactions Reporting Requirements_14 July 2026” https://cbben.thomsonreuters.com/rulebook/amendments-customer-due-diligence-and-suspicious-transactions-reporting-requirements14
- Circular OG/245/2026, 14 July 2026, signed by the Governor (PDF) https://cbben.thomsonreuters.com/sites/default/files/net_file_store/OG-Amendments_to_the_Customer_Due_Diligence_and_Suspicious_Transactions_Reporting_Requirements_14_July_2026.pdf
- Module FC, Volume 1 Conventional Banks, July 2026 edition with change log (PDF) https://cbben.thomsonreuters.com/sites/default/files/net_file_store/Vol_1_FC_July_2026.pdf
- AML Module, Volume 6 Capital Markets, July 2026 edition (PDF) https://cbben.thomsonreuters.com/sites/default/files/net_file_store/Vol_6_AML_July_2026.pdf
- CBB Rulebook, Volume 1 Conventional Banks, contents https://cbben.thomsonreuters.com/rulebook/central-bank-bahrain-volume-1-conventional-banks-0
- Anti-money laundering
- Customer due diligence
- Suspicious transaction reporting
- CBB Rulebook
- Module FC
- FATF alignment
- Bahrain banking