← Regulations / Mali / Operating Models / DeFi frontend

DeFi protocol frontend in Mali

Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.

Conditional AI-Generated · Unreviewed

DeFi frontend is conditionally permitted in Mali without local incorporation, subject to AML obligations and none licensing burden.

Verdict Details

Permitted
conditional
Local entity required
No
Licensing burden
None
Last updated
2026-07-13

AML Obligations

  • No specific AML obligations apply to DeFi frontends as VASPs, because there is no VASP licensing regime in Mali/UEMOA — the activity is not legally recognized.
  • If the operator somehow falls under the broad definition of a 'financial institution' under Law N°2018-024 (which is unlikely for a pure DeFi frontend), general UEMOA AML/CFT obligations would apply: CDD, beneficial ownership identification, ongoing monitoring, and STR filing to CENTIF (Mali's FIU).
  • There is no established AML reporting threshold or registration pathway for crypto-related activities; the BCEAO has not designated a supervisor for crypto AML compliance.
  • Any transaction suspected of being linked to ML/TF must be reported to CENTIF (Cellule Nationale de Traitement des Informations Financières).
  • Record-keeping: 5-year retention period for transaction and customer identification records would apply if the operator is deemed a reporting entity.

Key Restrictions

  • De facto prohibition: BCEAO Circular N°0000000001/M/DG/2021 (Dec 2021) prohibits all regulated financial institutions from engaging in any crypto-related activity — a DeFi frontend accepting payments via the formal banking system would be cut off.
  • Cryptocurrencies are not recognized as legal tender in the UEMOA zone (BCEAO 2018 and 2021 communiqués).
  • No VASP licensing or registration regime exists — operating a DeFi frontend for Malian residents is structurally outside any legal framework.
  • Fee-taking (e.g., frontend swap fees) does not create a regulated classification; it simply increases risk exposure as an unlicensed financial activity.

Key Risks

  • Enforcement risk: Malian Judicial Police and Public Prosecutor's Office have conducted arrests and investigations for crypto-related schemes (May 2023), and any crypto-facing service could be prosecuted under fraud or illegal financial operations provisions.
  • Regulatory ambiguity: BCEAO statements warn that crypto assets are unregulated and unsupervised — this creates a 'grey zone' where even compliant frontends lack legal certainty and could face sudden enforcement.
  • No segregation of client assets, custody rules, or insurance requirements exist — operators cannot structure compliant custody even if they wanted to.
  • Banking access risk: The prohibition on financial institutions engaging with crypto means DeFi frontends will struggle to maintain fiat on/off ramps or bank accounts in Mali/UEMOA.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 80% confidence

No BCEAO instrument numbered 'Circular N°0000000001/M/DG/2021' exists, and the BCEAO has never issued any instrument prohibiting supervised institutions from virtual-asset activity. The BCEAO's own complete LBC/FT index and complete payment-systems index (2002-2024) contain no such text; BCEAO numbering is of the form nnn-mm-yyyy (e.g. 008-05-2015), never '/M/DG/'. As of August 2026 the BCEAO's only crypto-specific action is the C-CRYPTO drafting committee created in May 2026. The operative rule is instead La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

licensing 80% confidence

There is no BCEAO prohibition of cryptocurrencies for the Governor to have reiterated. BCEAO output on virtual assets consists of public risk warnings, not a prohibitory instrument; the BCEAO only began drafting a crypto framework with the C-CRYPTO committee in May 2026. La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

licensing 80% confidence

No July 2023 BCEAO communication on virtual assets could be located in any BCEAO index, and in any event the BCEAO maintains no prohibition to confirm. La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

licensing 80% confidence

Half right. It is true that no supervisory regime is operational and that no authority actually supervises virtual-asset activity. But it is wrong to say virtual assets are 'not regulated': La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee). This is the symmetric error - the correct position is a statutory prohibition on unlicensed PSAV activity coupled with an undesignated competent authority, so nothing is obtainable and nothing is supervised.

licensing 80% confidence

'Strongly discouraged' is defensible - the BCEAO has repeatedly warned publicly about virtual-asset risks. 'Prohibited' is not: no BCEAO instrument prohibits banks, EME or SFD from virtual-asset activity, and neither the complete LBC/FT index nor the complete payment-systems index contains any such text. The binding constraint is instead the art. 58 prior-agrement requirement on PSAV activity itself, with no competent authority designated.

licensing 80% confidence

The conclusion (no crypto-specific licence can be obtained in Mali) is right; the stated reason is wrong. It is not that 'there is no dedicated crypto regulatory framework' in the sense of no legal requirement - La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee). So the correct statement is: an agrement is legally required and simultaneously unobtainable.

licensing 80% confidence

True that no registration or licensing regime is operational and nothing can be applied for. False if read as meaning no legal authorisation requirement exists: La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

licensing 80% confidence

Right that this is not a deliberate light-touch approach and that operators sit outside any recognised framework. Wrong that the disallowance is merely 'implicit': under art. 58 of the UMOA uniform law the prohibition on unlicensed PSAV activity is express. La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

enforcement 80% confidence

There is no BCEAO instrument banning or prohibiting cryptocurrency activity in UEMOA; BCEAO's LBC/FT regulation index and its communiqués-de-presse index contain no such act, and the only crypto item BCEAO publishes is the 8 May 2026 Dakar conference. Nor does BCEAO sanction under the AML framework: under the uniform law as transposed by Ordonnance n°2024-011/PT-RM, administrative sanctions are imposed by the autorité de contrôle of the entity concerned (and, in Mali, targeted financial sanctions and asset freezes are ordered by arrêté of the Ministre de l'Économie et des Finances — e.g. Arrêté n°2026-0346/MEF-SG du 5 mars 2026), not by BCEAO and not by CENTIF. The real constraint on crypto activity in Mali is art. 58 of the Ordonnance plus the absence of a designated competent authority under art. 59.

enforcement 30% confidence

Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.

enforcement 60% confidence

Entity Targeted: Individuals or informal groups promoting and operating cryptocurrency-based investment scams or pyramid schemes. Violation Type: Fraud, swindling (escroquerie), illegal financial operations, often disguised as crypto investment opportunities. Penalty Amount: Varies depending on the scale of the fraud; can include prison sentences and financial reparations to victims. Specific public records of these amounts for crypto-specific cases in Mali are difficult to pinpoint from international sources. Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.

Evidence fact ml.custody.general-regulatory-stance not found (may have been renamed).

custody 80% confidence

No BCEAO press release of 19 May 2021 on cryptocurrencies can be located in BCEAO's own communiqués-de-presse index, and BCEAO's LBC/FT regulation index lists no virtual-asset instrument. The claim that crypto is outside the supervision of national financial authorities is also wrong as of 30 August 2024: Ordonnance n°2024-011/PT-RM makes prestataires de services d'actifs virtuels personnes assujetties (art. 3) and forbids unlicensed PSAV activity (art. 58). BCEAO has never issued an instrument discouraging or prohibiting financial institutions from crypto activity.

custody 80% confidence

Crypto custody is expressly inside Mali's AML/CFT framework. Art. 2(51) of Ordonnance n°2024-011/PT-RM defines a prestataire de services d'actifs virtuels to include 'la conservation et l'administration d'actifs virtuels', art. 3 makes PSAV assujettis, and art. 58 provides that 'Nul ne peut se livrer à l'activité professionnelle de prestataire de services d'actifs virtuels s'il n'a pas obtenu l'agrément ou l'autorisation préalable de l'autorité compétente.' A custodian is therefore not in an unregulated space — it is in a space where operating without an agrément is unlawful, and where art. 59 leaves the competent authority undesignated so no agrément can actually be obtained. It is also not a matter of contravening 'the spirit of BCEAO warnings'; no such BCEAO instrument exists.

aml 80% confidence

Obligation: Any transaction (regardless of amount) that an institution knows, suspects, or has reasonable grounds to suspect is related to money laundering or terrorist financing must be reported.

aml 80% confidence

The retention period in Mali is ten (10) years, not five. Art. 23 of Ordonnance n.2024-011/PT-RM du 30 aout 2024 requires the assujettis to keep client-identification and transaction records 'pendant une duree de dix ans'. This mirrors art. 23 of the UMOA loi uniforme du 31 mars 2023. The five-year figure is the FATF Recommendation 11 international minimum imported in place of reading the local text.

licensing 80% confidence

Ordinary criminal enforcement (fraud, scams) in Mali does lie with the police judiciaire and the parquet, but they are not financial regulators. In the UMOA AML/CFT architecture the FIU receiving suspicious-transaction reports is CENTIF-Mali (art. 60) and administrative sanctions are imposed by the 'autorite de controle', not by the FIU or the police (art. 182). For virtual-asset service providers specifically, La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).

licensing 60% confidence

May 2023: Local reports indicated arrests and investigations related to crypto investment scams promising high returns.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
high

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a DeFi frontend serving Malian residents would operate outside any recognized regulatory framework and face a de facto ban from the formal financial sector, with no VASP licensing path available and high enforcement risk due to BCEAO prohibitions on crypto activities.

Questions this verdict aims to answer

  • Is operating the frontend a regulated activity even if the protocol is decentralized?
  • What geofencing or KYC obligations apply?
  • Does fee-taking change classification?