Self-custodial wallet / non-custodial software in Mali
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is not permitted in Mali.
Verdict Details
- Permitted
- no
- Local entity required
- No
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- No specific AML obligations attach to self-custodial wallet software publishers because they do not fall within the definition of a financial institution or VASP under current Malian/UEMOA law.
- The existing AML framework (Law N°2018-024 and UEMOA Directive 02/2015/CM/UEMOA) targets traditional financial institutions and formal-sector entities; a non-custodial software publisher with no custody or control over funds does not trigger CDD, STR, or record-keeping obligations under the current text.
- If the publisher were somehow deemed a financial actor by CENTIF (Mali's FIU), general AML obligations would hypothetically apply — but no precedent or guidance extends the framework to self-custodial software.
- CENTIF (Cellule Nationale de Traitement des Informations Financières) is Mali's FIU, but no published guidance targets non-custodial wallet software.
Key Restrictions
- The BCEAO (Central Bank of West African States) has issued multiple prohibitions and warnings — December 2021 Circular, April 2022 reiteration, July 2023 confirmation — explicitly barring financial institutions from engaging in any cryptocurrency-related activities.
- Cryptocurrencies are not recognized as legal tender in the UEMOA zone and are not regulated or supervised by the BCEAO or any national financial authority in Mali.
- A self-custodial wallet publisher cannot legally partner with or use any BCEAO-supervised financial institution (e.g., banks, microfinance institutions, payment processors) for on-ramp/off-ramp services.
- No dedicated licensing or registration framework exists for VASPs in Mali — operating in this space is entirely outside any recognized regulatory framework and carries a de facto prohibition risk.
Key Risks
- The BCEAO prohibition applies to financial institutions, but the broader regulatory environment creates a chilling effect: even non-custodial software publishing could be targeted as facilitating unregulated crypto activity.
- Enforcement against crypto-related activity has occurred — arrests and investigations into crypto investment scams (May 2023, late 2022/early 2023) show that law enforcement (Malian Judicial Police, Public Prosecutor's Office) treats crypto-related operations as potentially fraudulent.
- No regulatory clarity exists for non-custodial software; a software publisher could face operational bans, website blocks, or criminal investigation simply for distributing wallet software to Malian residents.
- The UEMOA region is pursuing a coordinated anti-crypto stance — future regional legislation (e.g., a potential VASP framework under FATF pressure) could impose retroactive or unexpected obligations on software publishers.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
No BCEAO instrument numbered 'Circular N°0000000001/M/DG/2021' exists, and the BCEAO has never issued any instrument prohibiting supervised institutions from virtual-asset activity. The BCEAO's own complete LBC/FT index and complete payment-systems index (2002-2024) contain no such text; BCEAO numbering is of the form nnn-mm-yyyy (e.g. 008-05-2015), never '/M/DG/'. As of August 2026 the BCEAO's only crypto-specific action is the C-CRYPTO drafting committee created in May 2026. The operative rule is instead La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).
There is no BCEAO prohibition of cryptocurrencies for the Governor to have reiterated. BCEAO output on virtual assets consists of public risk warnings, not a prohibitory instrument; the BCEAO only began drafting a crypto framework with the C-CRYPTO committee in May 2026. La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).
No July 2023 BCEAO communication on virtual assets could be located in any BCEAO index, and in any event the BCEAO maintains no prohibition to confirm. La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).
They are not recognized as legal tender within the UEMOA zone.
Half right. It is true that no supervisory regime is operational and that no authority actually supervises virtual-asset activity. But it is wrong to say virtual assets are 'not regulated': La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee). This is the symmetric error - the correct position is a statutory prohibition on unlicensed PSAV activity coupled with an undesignated competent authority, so nothing is obtainable and nothing is supervised.
'Strongly discouraged' is defensible - the BCEAO has repeatedly warned publicly about virtual-asset risks. 'Prohibited' is not: no BCEAO instrument prohibits banks, EME or SFD from virtual-asset activity, and neither the complete LBC/FT index nor the complete payment-systems index contains any such text. The binding constraint is instead the art. 58 prior-agrement requirement on PSAV activity itself, with no competent authority designated.
True that no registration or licensing regime is operational and nothing can be applied for. False if read as meaning no legal authorisation requirement exists: La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).
Right that this is not a deliberate light-touch approach and that operators sit outside any recognised framework. Wrong that the disallowance is merely 'implicit': under art. 58 of the UMOA uniform law the prohibition on unlicensed PSAV activity is express. La loi uniforme UMOA du 31 mars 2023 (art. 58) interdit l'exercice professionnel de l'activite de prestataire de services d'actifs virtuels sans agrement ou autorisation prealable de l'autorite competente, et l'art. 59 renvoie tout le regime PSAV a cette autorite ; aucune autorite competente n'a ete designee, de sorte qu'aucun agrement PSAV n'est obtenable ni delivre. L'instrument malien de transposition n'a pas pu etre identifie (predecesseur presume : Loi n° 2016-008 du 17 mars 2016, non verifiee).
No such instrument sits in Mali's AML/CFT chain. Mali's predecessor uniform law is Loi n.2016-008 du 17 mars 2016 portant Loi uniforme relative a la lutte contre le blanchiment de capitaux et le financement du terrorisme - cited verbatim in the visas of Arrete n.2024-3011/MEF-SG du 26 aout 2024, i.e. still the operative AML basis days before the new ordinance. Mali's current AML statute is Ordonnance n.2024-011/PT-RM du 30 aout 2024 portant lutte contre le blanchiment de capitaux, le financement du terrorisme et de la proliferation des armes de destruction massive (JO n. special 17 du 2 septembre 2024). Independently, the cited number/date pairing is internally impossible: Malian laws are numbered sequentially by adoption date within the year, and Loi n.2018-043 was adopted on 27 juin 2018, so a 'Loi n.2018-024' cannot bear the date 21 aout 2018. Neither 'Loi n.2018-024' nor 'Ordonnance n.2015-032/P-RM du 19 juin 2015' appears in the visas of any Malian LBC/FT instrument located.
Directive n.02/2015/CM/UEMOA du 2 juillet 2015 is a real instrument but is no longer the operative AML/CFT framework. At the regional level it has been replaced by Directive n.01/2023/CM/UEMOA du 16 juin 2023 relative a la lutte contre le blanchiment de capitaux, le financement du terrorisme et de la proliferation des armes de destruction massive, and by the UMOA loi uniforme LBC/FT/FP du 31 mars 2023. For Mali specifically the operative instrument is Ordonnance n.2024-011/PT-RM du 30 aout 2024, which transposes the 2023 uniform law and is what Malian decrees have cited since.
Evidence fact ml.custody.general-regulatory-stance not found (may have been renamed).
No BCEAO press release of 19 May 2021 on cryptocurrencies can be located in BCEAO's own communiqués-de-presse index, and BCEAO's LBC/FT regulation index lists no virtual-asset instrument. The claim that crypto is outside the supervision of national financial authorities is also wrong as of 30 August 2024: Ordonnance n°2024-011/PT-RM makes prestataires de services d'actifs virtuels personnes assujetties (art. 3) and forbids unlicensed PSAV activity (art. 58). BCEAO has never issued an instrument discouraging or prohibiting financial institutions from crypto activity.
Crypto custody is expressly inside Mali's AML/CFT framework. Art. 2(51) of Ordonnance n°2024-011/PT-RM defines a prestataire de services d'actifs virtuels to include 'la conservation et l'administration d'actifs virtuels', art. 3 makes PSAV assujettis, and art. 58 provides that 'Nul ne peut se livrer à l'activité professionnelle de prestataire de services d'actifs virtuels s'il n'a pas obtenu l'agrément ou l'autorisation préalable de l'autorité compétente.' A custodian is therefore not in an unregulated space — it is in a space where operating without an agrément is unlawful, and where art. 59 leaves the competent authority undesignated so no agrément can actually be obtained. It is also not a matter of contravening 'the spirit of BCEAO warnings'; no such BCEAO instrument exists.
Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.
Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.
Entity Targeted: Individuals or informal groups promoting and operating cryptocurrency-based investment scams or pyramid schemes. Violation Type: Fraud, swindling (escroquerie), illegal financial operations, often disguised as crypto investment opportunities. Penalty Amount: Varies depending on the scale of the fraud; can include prison sentences and financial reparations to victims. Specific public records of these amounts for crypto-specific cases in Mali are difficult to pinpoint from international sources. Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.
May 2023: Local reports indicated arrests and investigations related to crypto investment scams promising high returns.
Late 2022 / Early 2023: Several warnings from public authorities and the BCEAO about the proliferation of fraudulent schemes, some leveraging cryptocurrencies.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
No — a self-custodial wallet software publisher cannot legally operate in Mali under current conditions; the BCEAO has imposed a de facto prohibition on crypto-related activity, no VASP licensing framework exists, and the publisher would be operating in a fully unregulated and implicitly banned space with enforcement risks including arrests for crypto-related operations.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?