Custodial wallet / SaaS in Mali

Evidence fact ml.custody.general-regulatory-stance not found (may have been renamed).

No BCEAO press release of 19 May 2021 on cryptocurrencies can be located in BCEAO's own communiqués-de-presse index, and BCEAO's LBC/FT regulation index lists no virtual-asset instrument. The claim that crypto is outside the supervision of national financial authorities is also wrong as of 30 August 2024: Ordonnance n°2024-011/PT-RM makes prestataires de services d'actifs virtuels personnes assujetties (art. 3) and forbids unlicensed PSAV activity (art. 58). BCEAO has never issued an instrument discouraging or prohibiting financial institutions from crypto activity.

Crypto custody is expressly inside Mali's AML/CFT framework. Art. 2(51) of Ordonnance n°2024-011/PT-RM defines a prestataire de services d'actifs virtuels to include 'la conservation et l'administration d'actifs virtuels', art. 3 makes PSAV assujettis, and art. 58 provides that 'Nul ne peut se livrer à l'activité professionnelle de prestataire de services d'actifs virtuels s'il n'a pas obtenu l'agrément ou l'autorisation préalable de l'autorité compétente.' A custodian is therefore not in an unregulated space — it is in a space where operating without an agrément is unlawful, and where art. 59 leaves the competent authority undesignated so no agrément can actually be obtained. It is also not a matter of contravening 'the spirit of BCEAO warnings'; no such BCEAO instrument exists.

Evidence fact ml.custody.custodial-license-requirements not found (may have been renamed).

There is no obtainable custody licence in Mali, but not because there is no framework. Art. 58 of Ordonnance n°2024-011/PT-RM du 30 août 2024 prohibits carrying on PSAV activity — which art. 2(51) defines to include the custody and administration of virtual assets — without the prior agrément or authorisation of the competent authority; art. 59 then defers all PSAV-specific requirements to a competent authority that Mali has not designated. So a custody service would indeed be unauthorised, but by force of statute, not by force of BCEAO warnings, and no licence exists to apply for.

Segregation of Client Assets Rules:

No specific rules exist for the segregation of client assets for cryptocurrency custodians. This is due to the absence of a dedicated regulatory framework for crypto custody.

No specific insurance or bonding requirements are mandated for digital asset custodians.

Evidence fact ml.custody.cold-storage-mandates not found (may have been renamed).

No specific cold storage mandates or any other operational security requirements are legally defined for cryptocurrency custody in Mali.

Evidence fact ml.custody.qualified-custodian-definitions not found (may have been renamed).

No legal definition of a "qualified custodian" exists within the Malian or UEMOA financial regulatory framework concerning digital assets.

Evidence fact ml.custody.pending-custody-legislation not found (may have been renamed).

Legislation directly addressing virtual-asset custody is not pending — it is enacted. At regional level the UMOA loi uniforme LBC/FT/FP of 31 March 2023 (with Directive n°01/2023/CM/UEMOA and Décision n°04/31/03/2023/CM/UMOA of the same date) already defines PSAV to include the custody and administration of virtual assets. Mali transposed it by Ordonnance n° 2024-011/PT-RM du 30 août 2024, in force on publication in JO n°2024-17 spécial of 2 September 2024. Separately, BCEAO set up the C-CRYPTO drafting committee in May 2026 and held its Dakar crypto-assets conference on 8 May 2026, so regional work is ongoing rather than absent.

No BCEAO instrument numbered 'Circular N°0000000001/M/DG/2021' exists, and the BCEAO has never issued any instrument prohibiting supervised institutions from virtual-asset activity. The BCEAO's own complete LBC/FT index and complete payment-systems index (2002-2024) contain no such text; BCEAO numbering is of the form nnn-mm-yyyy (e.g. 008-05-2015), never '/M/DG/'. As of August 2026 the BCEAO's only crypto-specific action is the C-CRYPTO drafting committee created in May 2026. The operative rule is instead La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

The conclusion (no crypto-specific licence can be obtained in Mali) is right; the stated reason is wrong. It is not that 'there is no dedicated crypto regulatory framework' in the sense of no legal requirement - La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee). So the correct statement is: an agrement is legally required and simultaneously unobtainable.

True that no registration or licensing regime is operational and nothing can be applied for. False if read as meaning no legal authorisation requirement exists: La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

Right that this is not a deliberate light-touch approach and that operators sit outside any recognised framework. Wrong that the disallowance is merely 'implicit': under art. 58 of the UMOA uniform law the prohibition on unlicensed PSAV activity is express. La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

They are not recognized as legal tender within the UEMOA zone.

Half right. It is true that no supervisory regime is operational and that no authority actually supervises virtual-asset activity. But it is wrong to say virtual assets are 'not regulated': La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee). This is the symmetric error - the correct position is a statutory prohibition on unlicensed PSAV activity coupled with an undesignated competent authority, so nothing is obtainable and nothing is supervised.

'Strongly discouraged' is defensible - the BCEAO has repeatedly warned publicly about virtual-asset risks. 'Prohibited' is not: no BCEAO instrument prohibits banks, EME or SFD from virtual-asset activity, and neither the complete LBC/FT index nor the complete payment-systems index contains any such text. The binding constraint is instead the art. 58 prior-agrement requirement on PSAV activity itself, with no competent authority designated.

No such instrument sits in Mali's AML/CFT chain. Mali's predecessor uniform law is Loi n.2016-008 du 17 mars 2016 portant Loi uniforme relative a la lutte contre le blanchiment de capitaux et le financement du terrorisme - cited verbatim in the visas of Arrete n.2024-3011/MEF-SG du 26 aout 2024, i.e. still the operative AML basis days before the new ordinance. Mali's current AML statute is Ordonnance n.2024-011/PT-RM du 30 aout 2024 portant lutte contre le blanchiment de capitaux, le financement du terrorisme et de la proliferation des armes de destruction massive (JO n. special 17 du 2 septembre 2024). Independently, the cited number/date pairing is internally impossible: Malian laws are numbered sequentially by adoption date within the year, and Loi n.2018-043 was adopted on 27 juin 2018, so a 'Loi n.2018-024' cannot bear the date 21 aout 2018. Neither 'Loi n.2018-024' nor 'Ordonnance n.2015-032/P-RM du 19 juin 2015' appears in the visas of any Malian LBC/FT instrument located.

Directive n.02/2015/CM/UEMOA du 2 juillet 2015 is a real instrument but is no longer the operative AML/CFT framework. At the regional level it has been replaced by Directive n.01/2023/CM/UEMOA du 16 juin 2023 relative a la lutte contre le blanchiment de capitaux, le financement du terrorisme et de la proliferation des armes de destruction massive, and by the UMOA loi uniforme LBC/FT/FP du 31 mars 2023. For Mali specifically the operative instrument is Ordonnance n.2024-011/PT-RM du 30 aout 2024, which transposes the 2023 uniform law and is what Malian decrees have cited since.

Evidence fact ml.aml.customer-identification-and-verification not found (may have been renamed).

Beneficial Ownership Identification: Identifying and verifying the natural persons who ultimately own or control the customer, or the natural person on whose behalf a transaction is being conducted.

Ongoing Monitoring: Conducting ongoing due diligence on the business relationship and scrutinizing transactions undertaken throughout the course of that relationship to ensure consistency with the institution’s knowledge of the customer, their business, and risk profile.

Risk-Based Approach: Applying enhanced due diligence (EDD) for higher-risk customers (e.g., politically exposed persons - PEPs, customers from high-risk jurisdictions, or those engaged in complex/unusual transactions) and simplified due diligence (SDD) for lower-risk scenarios.

Obligation: Any transaction (regardless of amount) that an institution knows, suspects, or has reasonable grounds to suspect is related to money laundering or terrorist financing must be reported.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or third parties that an STR has been filed or that a money laundering or terrorist financing investigation is being conducted.

Transaction Records: All transaction data, including the amount, currency, date, and details of the parties involved (originator and beneficiary), should be kept.

Customer Identification Records: Records obtained through CDD measures (copies of identification documents, account files, business correspondence) must be retained.

The retention period in Mali is ten (10) years, not five. Art. 23 of Ordonnance n.2024-011/PT-RM du 30 aout 2024 requires the assujettis to keep client-identification and transaction records 'pendant une duree de dix ans'. This mirrors art. 23 of the UMOA loi uniforme du 31 mars 2023. The five-year figure is the FATF Recommendation 11 international minimum imported in place of reading the local text.

Cellule Nationale de Traitement des Informations Financières (CENTIF): Mali's FIU, responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs).

There is no BCEAO instrument banning or prohibiting cryptocurrency activity in UEMOA; BCEAO's LBC/FT regulation index and its communiqués-de-presse index contain no such act, and the only crypto item BCEAO publishes is the 8 May 2026 Dakar conference. Nor does BCEAO sanction under the AML framework: under the uniform law as transposed by Ordonnance n°2024-011/PT-RM, administrative sanctions are imposed by the autorité de contrôle of the entity concerned (and, in Mali, targeted financial sanctions and asset freezes are ordered by arrêté of the Ministre de l'Économie et des Finances — e.g. Arrêté n°2026-0346/MEF-SG du 5 mars 2026), not by BCEAO and not by CENTIF. The real constraint on crypto activity in Mali is art. 58 of the Ordonnance plus the absence of a designated competent authority under art. 59.

Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.

Entity Targeted: Individuals or informal groups promoting and operating cryptocurrency-based investment scams or pyramid schemes. Violation Type: Fraud, swindling (escroquerie), illegal financial operations, often disguised as crypto investment opportunities. Penalty Amount: Varies depending on the scale of the fraud; can include prison sentences and financial reparations to victims. Specific public records of these amounts for crypto-specific cases in Mali are difficult to pinpoint from international sources. Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.

Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.