← Regulations / Mali / Operating Models / Crypto ATM

Crypto ATM / kiosk operator in Mali

Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.

Not permitted AI-Generated · Unreviewed

Crypto ATM is not permitted in Mali.

Verdict Details

Permitted
no
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • CDD/EDD obligations under Law N°2018-024 (implementing UEMOA Directive No. 02/2015/CM/UEMOA) — customer identification, verification, beneficial ownership identification, purpose-and-nature-of-business, ongoing monitoring, risk-based approach including EDD for PEPs/high-risk customers
  • STR obligation to CENTIF (Cellule Nationale de Traitement des Informations Financières) — any transaction, regardless of amount, that the operator knows/suspects/has reasonable grounds to suspect is related to ML/TF must be reported
  • No tipping-off prohibition — operator may not disclose to a customer that an STR has been filed or an investigation opened
  • Record-keeping: transaction records (amount, currency, date, parties) and customer identification records must be retained for at least 5 years after the business relationship ends or after an occasional transaction
  • No specific cash-transaction reporting threshold exists for crypto kiosks — general STR regime applies; however, the BCEAO's prohibition means lawful operation is effectively impossible for this model

Key Restrictions

  • De facto prohibition on any cryptocurrency-related activities by formal regulated entities under BCEAO Circular N°0000000001/M/DG/2021 (December 2021) and subsequent reiterations (April 2022, July 2023)
  • Financial institutions (banks, microfinance, payment service providers) are generally prohibited from engaging in virtual-asset activities — a crypto ATM/kiosk operator cannot integrate with the formal banking/payments system lawfully
  • No dedicated VASP licensing or registration regime exists — operating a crypto ATM/kiosk is outside any recognized regulatory framework
  • Crypto is not recognized as legal tender and is not regulated or supervised by the BCEAO or any national financial authority in Mali/UEMOA
  • Local entity required only insofar as any business operating in Mali must be registered — but no lawful pathway for a crypto-specific kiosk exists

Key Risks

  • High enforcement risk: BCEAO has repeatedly and publicly prohibited crypto activities for regulated entities; operators risk having bank accounts closed, being classified as operating illegally, and potential criminal prosecution
  • Criminal exposure: Malian Judicial Police and Public Prosecutor's Office have conducted arrests and investigations for crypto-related fraud (May 2023, Late 2022/Early 2023) — a kiosk operating outside the formal framework could be treated as a fraudulent scheme
  • No regulatory pathway means no tax or operational certainty; operator would be entirely outside the legal financial system
  • Reputational / PR risk: BCEAO public communiqués explicitly warn against crypto risks; operating in this environment carries significant regulatory hostility
  • Possible future regulatory change risk: As FATF VASP standards evolve, Mali/UEMOA may eventually adopt a licensing regime — but currently none exists

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 60% confidence

December 2021: The BCEAO issued a directive (Circular N°0000000001/M/DG/2021) explicitly prohibiting financial institutions under its purview from engaging in any activities related to virtual assets.

licensing 60% confidence

They are not recognized as legal tender within the UEMOA zone.

licensing 60% confidence

They are not regulated or supervised by the BCEAO or any national financial authority in the region.

licensing 60% confidence

Financial institutions supervised by the BCEAO (banks, microfinance institutions) are generally prohibited or strongly discouraged from engaging in activities related to virtual assets due to the associated risks (money laundering, terrorist financing, consumer protection, financial stability).

licensing 60% confidence

BCEAO Communiqué de Presse N° 006/CP/GOV/BCEAO/2018 du 21 mars 2018: This communiqué explicitly warns the public and financial institutions against the use of virtual currencies like Bitcoin, stating they are not legal tender and are unregulated, thus presenting significant risks.

licensing 60% confidence

None specifically for crypto. Since there is no dedicated crypto regulatory framework, there are no specific licenses for these activities.

licensing 60% confidence

Neither a registration nor a specific licensing regime currently exists for VASPs in Mali.

licensing 60% confidence

Entities operating in this space are doing so outside of a recognized regulatory framework. This is not a "light touch" approach; rather, it indicates a lack of formal permission or supervision, which can be interpreted as implicitly disallowed for formal financial sector participation.

aml 40% confidence

Law N°2018-024 of August 21, 2018, amending Ordinance N°2015-032/P-RM of June 19, 2015, relating to the fight against money laundering and terrorist financing.

aml 40% confidence

Customer Identification and Verification:

aml 40% confidence

Obligation: Any transaction (regardless of amount) that an institution knows, suspects, or has reasonable grounds to suspect is related to money laundering or terrorist financing must be reported.

aml 40% confidence

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or third parties that an STR has been filed or that a money laundering or terrorist financing investigation is being conducted.

aml 40% confidence

Transaction Records: All transaction data, including the amount, currency, date, and details of the parties involved (originator and beneficiary), should be kept.

aml 40% confidence

Customer Identification Records: Records obtained through CDD measures (copies of identification documents, account files, business correspondence) must be retained.

aml 40% confidence

Retention Period: Generally, these records must be kept for at least five (5) years after the business relationship ends or after the date of an occasional transaction.

aml 60% confidence

Cellule Nationale de Traitement des Informations Financières (CENTIF): Mali's FIU, responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs).

enforcement 60% confidence

Entity Targeted: All regulated financial institutions (banks, microfinance institutions, payment service providers, etc.) within the UEMOA zone, including those operating in Mali. Also serves as a warning to the general public. Violation Type: Engaging in any activity related to cryptocurrencies (issuance, exchange, holding, investment, facilitation of transactions, etc.). The BCEAO considers these activities to be unauthorized and high-risk. Penalty Amount: Not a specific monetary penalty for a single action, but non-compliance by regulated entities could lead to severe administrative sanctions, including fines, withdrawal of operating licenses, and other regulatory penalties imposed by the BCEAO or national banking commissions. Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.

enforcement 60% confidence

Entity Targeted: Individuals or informal groups promoting and operating cryptocurrency-based investment scams or pyramid schemes. Violation Type: Fraud, swindling (escroquerie), illegal financial operations, often disguised as crypto investment opportunities. Penalty Amount: Varies depending on the scale of the fraud; can include prison sentences and financial reparations to victims. Specific public records of these amounts for crypto-specific cases in Mali are difficult to pinpoint from international sources. Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.

enforcement 50% confidence

Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
high

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Not permitted — Crypto ATM/kiosk operation in Mali is effectively prohibited: the BCEAO has issued a de facto ban (Circular N°0000000001/M/DG/2021, reiterated in 2022 and 2023) barring all regulated financial institutions from engaging in virtual-asset activities, no VASP licensing or registration regime exists, and operators face criminal enforcement risk under Malian fraud/illegal-financial-operations statutes.

Questions this verdict aims to answer

  • What money-transmitter / kiosk-specific license is required?
  • What cash-transaction reporting thresholds apply?
  • What enhanced-KYC obligations attach to cash-in / cash-out?