Bahrain's FATF mutual evaluation onsite visit is expected in November 2026, only weeks away. For financial crime teams, the question is no longer whether the framework exists on paper, but whether it can be shown to work.

Why it matters now

The joint FATF and MENAFATF assessment is Bahrain's first full evaluation since 2018. The FATF schedule lists a possible onsite period of November 2026 and a possible plenary discussion in June 2027, when the results would be adopted. As FATF notes, dates are subject to change.

During the onsite visit, assessors meet the authorities, including the Central Bank of Bahrain, the Ministry of Industry and Commerce and the Financial Intelligence National Centre (FINC). They also meet a sample of financial institutions and businesses. If your firm is asked to take part, assessors will want to hear how your controls work in practice, not how your policies read.

For the Kingdom's banks, fintechs, investment firms and listed companies, the months either side of the onsite visit are a period of heightened scrutiny. They are also an opportunity to get ahead of it.

Where Bahrain stands

In its 2018 mutual evaluation, Bahrain was rated "substantial" on three of eleven effectiveness outcomes and "moderate" on eight. Financial institutions were a relative strength; risk understanding and DNFBPs were weaker.

The 2022 follow-up upgraded several ratings, leaving Bahrain compliant or largely compliant on 39 of 40 Recommendations. Only DNFBP customer due diligence (R.22) remained partially compliant.

But those ratings were measured against older standards. FATF has since tightened its requirements on risk assessment and beneficial ownership, so technical compliance will be re-tested. This round will turn on whether the rules both meet today's standards and deliver results.

Where the pressure is likely to fall

The harder questions are likely to come where Bahrain's market has changed most since 2018.

Virtual assets. Bahrain has a growing community of CBB-licensed crypto-asset service providers. It introduced one of the region's first dedicated stablecoin regimes in July 2025 and licensed its first stablecoin issuer in June 2026. Recommendation 15 was upgraded to largely compliant in 2022, but the sector has grown considerably since. Expect attention on how crypto-asset transfers meet travel rule obligations, and on how banks manage their exposure to the crypto-asset firms they serve.

Reliance on national eKYC. The CBB has required licensees to move onto the national eKYC platform, which handled around 1.1 million verifications in 2025. It is a genuine strength, but shared infrastructure does not transfer responsibility. Firms should be able to explain where they rely on eKYC, where they go further, and how they treat higher-risk customers it cannot fully assess.

Sanctions and proliferation financing. Recommendations 6 and 7 were partially compliant in 2018 and have since been upgraded. The question now is whether firms screen and freeze without delay in practice. Assessors will also ask whether proliferation financing risk is genuinely reflected in risk assessments, rather than treated as a screening exercise alone.

Automated onboarding at speed. Bahrain's fintechs onboard customers in minutes using digital identity and open banking. Assessors are likely to ask how firms know automated decisions are right. Expect questions on who owns and approves the onboarding rules, how often they are tested against real outcomes, and what happens when the system refers a case. Oversight of third-party KYC and screening providers will come up too. A firm that can show a tested rule change, and a referral a human overturned, is in a far stronger position than one pointing to vendor documentation.

Board accountability. The CBB's Fit and Proper Requirements Module, introduced in March 2025, puts the onus on firms to evidence the suitability of their boards and senior management. Boards should expect to be asked how they oversee financial crime risk, not just whether they receive reports. That means how they set risk appetite, what their management information tells them, and when they last challenged a decision. The MLRO's access to the board, and the resources of the compliance function, are likely to come up as well.

Ownership and source of wealth. Beneficial ownership is a constant focus of evaluations, and FATF's standards here have been strengthened since Bahrain was last assessed. For investment firms raising capital from international investors, and for companies coming to list, the question is whether ultimate ownership and the origin of funds can be evidenced, not just recorded.

Trade finance and correspondent relationships. Trade-based money laundering is hard to detect because the red flags sit in documents rather than payments. Think over- and under-invoicing, multiple invoicing of the same shipment, goods that do not fit the customer's business, and dual-use items. The national Trade Finance Registry now being rolled out by BENEFIT, with NBB as its first participating bank, should help banks spot duplicate financing. Assessors will still want to see a risk-based approach, particularly as more trade moves to open account. On correspondent banking, expect scrutiny of respondent due diligence, nested relationships and payment transparency. FATF's revised Recommendation 16, due to take effect by the end of 2030, will raise the bar further, so it is worth preparing now. The outcome also shapes how international correspondents view Bahraini institutions, which makes this commercial as well as regulatory.

DNFBPs as customers. Customer due diligence among non-financial businesses remains Bahrain's only partially compliant rating, and the Ministry of Industry and Commerce's supervision of the sector will be closely examined. That matters to banks and fintechs too. Real estate agents, precious metals dealers and corporate service providers are often customers, and weaknesses in their controls can become yours.

Where to focus in the weeks before the onsite

With the visit weeks away, the priority is evidence, not new policy. An independent view can help: it is often easier to spot gaps from outside the business than from within it.

• Map and quantify your exposure. How many customers are crypto-asset firms or DNFBPs, what share of onboarding relies solely on eKYC, and which decisions are fully automated? Supervisors respond better to numbers than to narrative.

• Be ready to walk through real cases. Choose five or six higher-risk files, including at least one exit and one escalation. Make sure each decision can be explained end to end: what was known, what was done, and why. Gaps between policy and file are one of the most common findings in effectiveness reviews.

• Test sanctions in practice. Measure the time from a list update to live screening, and check how close matches and transliterated names are handled. Run a freeze scenario from alert to regulator notification. "Without delay" needs to be evidenced in hours, not assumed.

• Look at what your reporting says about you. Review the quality of internal escalations and suspicious transaction reports, not just the volumes. Defensive reporting with little analysis is a warning sign, as is a low number of reports from a high-risk business.

• Prepare your board and senior managers now. They should be able to explain your main financial crime risks, your risk appetite and a recent decision they challenged. A short briefing and a practice question session go a long way.

• Rehearse an assessor meeting. If your firm is invited to meet the assessors, decide who attends and run a mock session. Expect open questions on your risks, your controls and real examples, and answer with evidence rather than policy.

After the onsite visit

The onsite visit is the midpoint, not the end. Draft findings are discussed with the authorities, debated at plenary and published. The report then sets the agenda for Bahrain's follow-up process. Weaknesses identified at national level typically flow down to firms as supervisory priorities, thematic reviews and, in some cases, new rules.

Three things are worth doing once the report is published:

1. Read the immediate outcomes that apply to you, not just the headline ratings. The detailed findings on preventive measures and supervision show where supervisors will look next.

2. Map each relevant finding to your own controls and agree an action plan with your board, so you can show supervisors you acted before being asked.

3. Watch the follow-up cycle. Progress is reported back to MENAFATF over the following years, and supervisory attention tends to stay on the areas rated weakest.

Turning the evaluation into an advantage

Firms that treat the evaluation as an exercise to get through often find themselves revisiting the same issues later. Those that use it to build controls that work, can be evidenced and keep pace with the business turn compliance into a competitive advantage with regulators, banking partners and investors.

Finomni is a financial crime advisory firm based in Bahrain and the UK. We support firms with risk assessments, independent reviews and board training ahead of and after the evaluation.

Through November, FINOMNI is offering a free 30-minute pre-onsite readiness call, and practice sessions for boards and senior managers who may meet the assessors. To book, please contact us.