diff --git a/modules/ibc/ibc_test.go b/modules/ibc/ibc_test.go
index 76133d5a3..336e1aa2b 100644
--- a/modules/ibc/ibc_test.go
+++ b/modules/ibc/ibc_test.go
@@ -1,12 +1,19 @@
 package ibc
 
 import (
+	"encoding/json"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/tendermint/light-client/certifiers"
+	"github.com/tendermint/tmlibs/log"
+
+	"github.com/tendermint/basecoin"
+	"github.com/tendermint/basecoin/errors"
 	"github.com/tendermint/basecoin/stack"
 	"github.com/tendermint/basecoin/state"
-	"github.com/tendermint/light-client/certifiers"
 )
 
 type checkErr func(error) bool
@@ -23,6 +30,7 @@ func genEmptySeed(keys certifiers.ValKeys, chain string, h int,
 	return certifiers.Seed{cp, vals}
 }
 
+// this tests registration without registrar permissions
 func TestIBCRegister(t *testing.T) {
 	assert := assert.New(t)
 
@@ -60,7 +68,6 @@ func TestIBCRegister(t *testing.T) {
 
 	ctx := stack.MockContext("hub", 50)
 	store := state.NewMemKVStore()
-	// no registrar here
 	app := stack.New().Dispatch(stack.WrapHandler(NewHandler()))
 
 	for i, tc := range cases {
@@ -70,6 +77,84 @@ func TestIBCRegister(t *testing.T) {
 	}
 }
 
+// this tests registration without registrar permissions
+func TestIBCRegisterPermissions(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+
+	// the validators we use to make seeds
+	keys := certifiers.GenValKeys(4)
+	appHash := []byte{0x17, 0x21, 0x5, 0x1e}
+
+	foobar := basecoin.Actor{App: "foo", Address: []byte("bar")}
+	baz := basecoin.Actor{App: "baz", Address: []byte("bar")}
+	foobaz := basecoin.Actor{App: "foo", Address: []byte("baz")}
+
+	cases := []struct {
+		seed      certifiers.Seed
+		registrar basecoin.Actor
+		signer    basecoin.Actor
+		checker   checkErr
+	}{
+		// no sig, no registrar
+		{
+			seed:    genEmptySeed(keys, "chain-1", 100, appHash, len(keys)),
+			checker: noErr,
+		},
+		// sig, no registrar
+		{
+			seed:    genEmptySeed(keys, "chain-2", 100, appHash, len(keys)),
+			signer:  foobaz,
+			checker: noErr,
+		},
+		// registrar, no sig
+		{
+			seed:      genEmptySeed(keys, "chain-3", 100, appHash, len(keys)),
+			registrar: foobar,
+			checker:   errors.IsUnauthorizedErr,
+		},
+		// registrar, wrong sig
+		{
+			seed:      genEmptySeed(keys, "chain-4", 100, appHash, len(keys)),
+			signer:    foobaz,
+			registrar: foobar,
+			checker:   errors.IsUnauthorizedErr,
+		},
+		// registrar, wrong sig
+		{
+			seed:      genEmptySeed(keys, "chain-5", 100, appHash, len(keys)),
+			signer:    baz,
+			registrar: foobar,
+			checker:   errors.IsUnauthorizedErr,
+		},
+		// registrar, proper sig
+		{
+			seed:      genEmptySeed(keys, "chain-6", 100, appHash, len(keys)),
+			signer:    foobar,
+			registrar: foobar,
+			checker:   noErr,
+		},
+	}
+
+	store := state.NewMemKVStore()
+	app := stack.New().Dispatch(stack.WrapHandler(NewHandler()))
+
+	for i, tc := range cases {
+		// set option specifies the registrar
+		msg, err := json.Marshal(tc.registrar)
+		require.Nil(err, "%+v", err)
+		_, err = app.SetOption(log.NewNopLogger(), store,
+			NameIBC, OptionRegistrar, string(msg))
+		require.Nil(err, "%+v", err)
+
+		// add permissions to the context
+		ctx := stack.MockContext("hub", 50).WithPermissions(tc.signer)
+		tx := RegisterChainTx{tc.seed}.Wrap()
+		_, err = app.DeliverTx(ctx, store, tx)
+		assert.True(tc.checker(err), "%d: %+v", i, err)
+	}
+}
+
 func TestIBCUpdate(t *testing.T) {
 
 }