Bahrain CBB Training and Competency: 15 CPD Hours, the Annual Training Plan and Seven Records

Bahrain devotes an entire rulebook module to training and competency, which puts it ahead of most regulators covered in this library. It sets a numbered annual CPD requirement, mandates a documented annual training plan, lists seven categories of record a licensee must keep, and names the professional qualifications it expects for each senior role.

This guide works through the Central Bank of Bahrain Rulebook, Volume 6 (Capital Markets), Training and Competency (TC) Module, issued under Articles 38 and 65(b) of the CBB Law 2006. The version read is the 2021 edition. One honest caveat up front: TC-A.2.1 reads "This Module was first issued in XXXX 2021" — the day and month were never filled in — and TC-2.3.1 says the requirements are "effective from the date of issuance of this Module" without naming one. Check the current version on the CBB Rulebook before relying on it.

The ten controlled functions

TC-1.1.1 lists the functions the module governs: Board Member or Director; Chief Executive or General Manager and their deputies; CFO or Head of Finance; Chief Risk Officer or Head of Risk Management; Compliance Officer; CIO, CTO or Head of IT; Heads of Other Functions; MLRO; Registered Representative; and Chief Information Security Officer.

The Registered Representative is the customer-facing category — defined by responsibility for the "solicitation or handling of accounts or orders" for customers. Note what follows: the module contains no general training or competence rule for staff outside these ten functions. Where a position's status is unclear, TC-1.1.14 says licensees "should contact the CBB".

Fifteen hours of CPD a year

TC-1.2.1 is the headline: "All individuals holding controlled functions in a capital market licensee must undergo a minimum of 15 hours of CPD per annum."

Exemption is available but has to be asked for. Under TC-1.2.2 the licensee applies to the CBB with "the rationale", and the CBB may exempt the person altogether or "may recommend that the approved person undergoes the CPD programme at such other frequency (biennial, triennial etc.)". That is an unusually flexible remedy — a reduced frequency rather than a reduced number.

What counts is broad. TC-2.2.4 allows "courses, workshops, conferences and seminars at local or foreign training institutions", and TC-2.2.9 adds the CPD schemes of CBB-recognised professional bodies listed in Appendix TC-2, plus "In-house training, seminars, conferences, further qualifications, product presentations, computer-based training and one-to-one tuition". The module sets no hour-conversion rules, no topic minimums and no caps by activity type.

A transitional point worth knowing: TC-2.3.3 grandfathers approved persons already in post when the module was issued — except for the CPD requirement in TC-1.2.1. Existing staff inherited the 15 hours immediately.

The annual training plan is mandatory and documented

This is the obligation that falls on the firm rather than the individual, and it is more prescriptive than most equivalents.

TC-2.2.1: "A capital market licensee must annually determine the training needs of individuals undertaking controlled functions. It must develop a training plan to address these needs and ensure that training is planned, appropriately structured and evaluated." TC-2.2.3 requires the plan to "include a programme for continuous professional development training".

And one requirement no other regulator in this library imposes: TC-2.2.5 says annual training must include "the quarterly updates, if any, to the CBB Volume 6 (Capital Markets) Rulebook". The regulator's own rule changes are a mandatory training topic, every quarter they occur.

The plan must be documented, because TC-2.4.1(a) requires a record of "The annual training plan for each controlled function". The module does not say who approves the plan or who reviews it — there is no named owner, and no "training policy" requirement as distinct from the plan.

Nobody performs a controlled function until assessed

TC-B.1.7 requires licensees to ensure individuals in controlled functions hold suitable qualifications and experience, "remain competent for the work they do", and are "appropriately supervised".

TC-2.1.5 is the hard gate: a licensee "must not allow an individual to undertake or supervise a controlled function unless that individual has been assessed by the capital market licensee as competent". Competence under TC-2.1.7 means the individual "has demonstrated the ability to apply the knowledge and skills required".

Two refinements matter in practice. TC-2.1.9: competence in one function "does not necessarily mean" competence in another, so an internal move needs a fresh assessment. And TC-2.1.8 allows a prior assessment in a similar function to be taken into account, scaled to "the nature and the level of complexity" of the role.

Separately, TC-2.1.2 requires Form 3 to be filed and "the express written approval of the CBB" obtained before the person occupies the position. So there are two gates: the firm's own competence assessment, and the CBB's approval.

The qualifications the CBB names

TC-1.1.3 says competence "must be assessed on the basis of experience and relevant qualifications described in Appendix TC-1 as a minimum", and the CBB may require more. TC-1.1.4 allows an exemption where an individual's qualifications are "comparable".

Appendix TC-1 names qualifications by role, each introduced as examples rather than a closed list:

• CFO or Head of Finance — five years in a finance function plus a degree and professional qualification. Named: ACCA affiliate status, CPA, AAOIFI's Certified Islamic Professional Accountant (CIPA), ICAEW's ACA, and CFA
• Compliance Officer — two years' compliance experience plus a degree and an accounting or finance qualification. Named: the ICA International Diploma in Governance, Risk and Compliance and the ICA International Advanced Certificate in Compliance and Financial Crime. TC-1.1.11 also requires residency in Bahrain
• MLRO — two years in an AML role plus a degree and certification. Named: the ACAMS Certified Anti-Money Laundering Specialist examination and the ICA Diploma in Anti-Money Laundering
• Registered Representative — two years in financial markets plus a degree in accounting, finance, banking or management. Named: the BIBF General Securities Representatives Qualification (Series 7), Series 79, and CFA
• CRO or Head of Risk — five years in a financial institution, at least two in risk. Named: ARM, the IRM International Diploma, FRM and PRM
• Board members, CEO, Heads of Other Functions, CIO and CISO — experience thresholds plus a degree and "relevant" professional qualification or certification, without named examples in most cases

Note that the module stops short of making any named examination mandatory — every list is qualified by "may include but are not limited to" or "any other equivalent certification acceptable to the CBB". Appendix TC-2 lists recognised professional bodies, not qualifications, and the module does not say the CBB maintains a list of recognised qualifications.

Seven records, five years

TC-2.4.1 requires updated digital or manual records of:

1. the annual training plan for each controlled function
2. materials used for in-house courses
3. the list of participants
4. the results of course evaluations
5. the criteria applied in assessing competence
6. how and when the competence decision was arrived at
7. CPD hours undertaken by each approved person

Item six is the one firms rarely hold. Recording that someone was assessed as competent is common; recording the method and the date of that decision is not, and TC-2.4.1(f) requires it explicitly.

TC-2.4.2 requires these records for current and former employees "for a minimum period of five years" after termination. TC-2.4.3 adds recruitment and appointment records for approved persons, also for five years, and TC-2.4.4 says those "should include, but is not limited to" initial screening results, employment test results, interview results, background and reference checks, and professional qualification details.

TC-2.2.6 adds that licensees "should maintain appropriate training records for each individual" and note how the training "relates to and supports the individual's role" — and that these records "may be reviewed during supervisory visits". That is the practical test: the record has to connect the training to the job, not merely log attendance.

Supervision

TC-1.2.3 requires the licensee to ensure an approved person "is supervised and undergoes appropriate review and assessment of his/her performance". TC-1.2.4 says supervision "should be proportionate to the level of competence demonstrated" and includes "Reviewing and assessing work on a regular basis" and "Coaching and assessing performance". TC-1.2.5 adds that supervisors "should have technical knowledge and relevant skills, e.g. coaching and assessment skills".

The module sets no time limit on working under supervision before a competence assessment, and does not address acting or temporary appointments. TC-2.1.5 bars anyone from performing a controlled function before assessment, which leaves the interim position unaddressed.

What the module does not do

Three silences worth knowing.

No sanctions. The module contains no penalty or enforcement wording at all. It cites the CBB Law, but the consequence of a breach has to be found elsewhere in the Rulebook and the Law.

No annual return. There is no training or CPD submission to the CBB. The records are simply open to inspection at supervisory visits — which makes the records, rather than any filing, the whole of the compliance evidence.

No training-provider standards. TC-B.1.5 addresses outsourcing only by saying a licensee "should refer to the competency requirements, outlined in Appendix TC-1 for approved persons, for assessing the suitability of the outsourcing provider". There is no accreditation or approval requirement for training providers, and nothing obliging the licensee to retain responsibility for outsourced training.

One internal inconsistency to be aware of: TC-1.2.1 applies the 15 CPD hours to "All individuals holding controlled functions", while the record-keeping rule at TC-2.4.1(g) refers to "each approved person". The module does not reconcile the two populations.

Three things to check

First, whether your annual training plan exists as a document per controlled function, and whether it covers the quarterly Rulebook updates as TC-2.2.5 requires.

Second, whether you record how and when each competence decision was made, not just its outcome.

Third, whether anyone moved between controlled functions without a fresh assessment. TC-2.1.9 does not let competence travel with the person.

Bahrain sits between the Gulf's two other documented regimes — our guides to SAMA's senior appointment requirements and the UAE Central Bank's CPD and training plan rules set those out — and is the most explicit of the three on hours and records. Structured CPD programmes are one route to the 15 hours, provided the record connects the training to the role.

Sources and limits: written from the CBB Rulebook Volume 6 (Capital Markets) Training and Competency Module, 2021 edition, read in October 2026. The module shows no later version, but its only date is 2021 and it may have been superseded — confirm against the current CBB Rulebook. The Training and Competency modules for Volumes 1 to 5 (conventional banks, Islamic banks, insurance, investment business and specialised licensees) differ and are not covered here, nor are the MAE, CSD, MIR and CRA modules that set category-specific functions. Appendix TC-1 was read from a PDF extraction, so verify exact wording. General information about published rules, not legal or compliance advice.