Crypto ATM / kiosk operator in Mali
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is not permitted in Mali.
Verdict Details
- Permitted
- no
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CDD/EDD obligations under Law N°2018-024 (implementing UEMOA Directive No. 02/2015/CM/UEMOA) — customer identification, verification, beneficial ownership identification, purpose-and-nature-of-business, ongoing monitoring, risk-based approach including EDD for PEPs/high-risk customers
- STR obligation to CENTIF (Cellule Nationale de Traitement des Informations Financières) — any transaction, regardless of amount, that the operator knows/suspects/has reasonable grounds to suspect is related to ML/TF must be reported
- No tipping-off prohibition — operator may not disclose to a customer that an STR has been filed or an investigation opened
- Record-keeping: transaction records (amount, currency, date, parties) and customer identification records must be retained for at least 5 years after the business relationship ends or after an occasional transaction
- No specific cash-transaction reporting threshold exists for crypto kiosks — general STR regime applies; however, the BCEAO's prohibition means lawful operation is effectively impossible for this model
Key Restrictions
- De facto prohibition on any cryptocurrency-related activities by formal regulated entities under BCEAO Circular N°0000000001/M/DG/2021 (December 2021) and subsequent reiterations (April 2022, July 2023)
- Financial institutions (banks, microfinance, payment service providers) are generally prohibited from engaging in virtual-asset activities — a crypto ATM/kiosk operator cannot integrate with the formal banking/payments system lawfully
- No dedicated VASP licensing or registration regime exists — operating a crypto ATM/kiosk is outside any recognized regulatory framework
- Crypto is not recognized as legal tender and is not regulated or supervised by the BCEAO or any national financial authority in Mali/UEMOA
- Local entity required only insofar as any business operating in Mali must be registered — but no lawful pathway for a crypto-specific kiosk exists
Key Risks
- High enforcement risk: BCEAO has repeatedly and publicly prohibited crypto activities for regulated entities; operators risk having bank accounts closed, being classified as operating illegally, and potential criminal prosecution
- Criminal exposure: Malian Judicial Police and Public Prosecutor's Office have conducted arrests and investigations for crypto-related fraud (May 2023, Late 2022/Early 2023) — a kiosk operating outside the formal framework could be treated as a fraudulent scheme
- No regulatory pathway means no tax or operational certainty; operator would be entirely outside the legal financial system
- Reputational / PR risk: BCEAO public communiqués explicitly warn against crypto risks; operating in this environment carries significant regulatory hostility
- Possible future regulatory change risk: As FATF VASP standards evolve, Mali/UEMOA may eventually adopt a licensing regime — but currently none exists
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
December 2021: The BCEAO issued a directive (Circular N°0000000001/M/DG/2021) explicitly prohibiting financial institutions under its purview from engaging in any activities related to virtual assets.
April 2022: The BCEAO Governor, Tiémoko Meyliet Koné, reiterated this prohibition, warning against the risks associated with cryptocurrencies.
July 2023: Another communication from the BCEAO confirmed its continued vigilance and prohibition.
They are not recognized as legal tender within the UEMOA zone.
They are not regulated or supervised by the BCEAO or any national financial authority in the region.
Financial institutions supervised by the BCEAO (banks, microfinance institutions) are generally prohibited or strongly discouraged from engaging in activities related to virtual assets due to the associated risks (money laundering, terrorist financing, consumer protection, financial stability).
BCEAO Communiqué de Presse N° 006/CP/GOV/BCEAO/2018 du 21 mars 2018: This communiqué explicitly warns the public and financial institutions against the use of virtual currencies like Bitcoin, stating they are not legal tender and are unregulated, thus presenting significant risks.
None specifically for crypto. Since there is no dedicated crypto regulatory framework, there are no specific licenses for these activities.
Neither a registration nor a specific licensing regime currently exists for VASPs in Mali.
Entities operating in this space are doing so outside of a recognized regulatory framework. This is not a "light touch" approach; rather, it indicates a lack of formal permission or supervision, which can be interpreted as implicitly disallowed for formal financial sector participation.
Law N°2018-024 of August 21, 2018, amending Ordinance N°2015-032/P-RM of June 19, 2015, relating to the fight against money laundering and terrorist financing.
Obligation: Any transaction (regardless of amount) that an institution knows, suspects, or has reasonable grounds to suspect is related to money laundering or terrorist financing must be reported.
No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or third parties that an STR has been filed or that a money laundering or terrorist financing investigation is being conducted.
Transaction Records: All transaction data, including the amount, currency, date, and details of the parties involved (originator and beneficiary), should be kept.
Customer Identification Records: Records obtained through CDD measures (copies of identification documents, account files, business correspondence) must be retained.
Retention Period: Generally, these records must be kept for at least five (5) years after the business relationship ends or after the date of an occasional transaction.
Cellule Nationale de Traitement des Informations Financières (CENTIF): Mali's FIU, responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs).
Entity Targeted: All regulated financial institutions (banks, microfinance institutions, payment service providers, etc.) within the UEMOA zone, including those operating in Mali. Also serves as a warning to the general public. Violation Type: Engaging in any activity related to cryptocurrencies (issuance, exchange, holding, investment, facilitation of transactions, etc.). The BCEAO considers these activities to be unauthorized and high-risk. Penalty Amount: Not a specific monetary penalty for a single action, but non-compliance by regulated entities could lead to severe administrative sanctions, including fines, withdrawal of operating licenses, and other regulatory penalties imposed by the BCEAO or national banking commissions. Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.
Entity Targeted: Individuals or informal groups promoting and operating cryptocurrency-based investment scams or pyramid schemes. Violation Type: Fraud, swindling (escroquerie), illegal financial operations, often disguised as crypto investment opportunities. Penalty Amount: Varies depending on the scale of the fraud; can include prison sentences and financial reparations to victims. Specific public records of these amounts for crypto-specific cases in Mali are difficult to pinpoint from international sources. Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.
Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.
Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.
May 2023: Local reports indicated arrests and investigations related to crypto investment scams promising high returns.
Late 2022 / Early 2023: Several warnings from public authorities and the BCEAO about the proliferation of fraudulent schemes, some leveraging cryptocurrencies.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Not permitted — Crypto ATM/kiosk operation in Mali is effectively prohibited: the BCEAO has issued a de facto ban (Circular N°0000000001/M/DG/2021, reiterated in 2022 and 2023) barring all regulated financial institutions from engaging in virtual-asset activities, no VASP licensing or registration regime exists, and operators face criminal enforcement risk under Malian fraud/illegal-financial-operations statutes.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?