Custodial wallet / SaaS in Mali

General Regulatory Stance:

The BCEAO issued a press release on May 19, 2021, warning the public about the risks associated with cryptocurrencies. It reiterated that cryptocurrencies are not recognized as legal tender in the UEMOA zone and are not subject to the supervision of the BCEAO or national financial authorities. The bank strongly discouraged financial institutions from engaging in activities related to cryptocurrencies.

This implies that any entity offering crypto custody services would be operating in an unregulated space, potentially contravening the spirit of the BCEAO's warnings.

Custodial License Requirements:

There are no specific custodial license requirements for digital asset service providers in Mali, as there is no established regulatory framework for cryptocurrencies. Given the BCEAO's warnings, attempting to operate such a licensed service would likely face significant challenges or be deemed unauthorized.

Segregation of Client Assets Rules:

No specific rules exist for the segregation of client assets for cryptocurrency custodians. This is due to the absence of a dedicated regulatory framework for crypto custody.

No specific insurance or bonding requirements are mandated for digital asset custodians.

Cold Storage Mandates:

No specific cold storage mandates or any other operational security requirements are legally defined for cryptocurrency custody in Mali.

Qualified Custodian Definitions:

No legal definition of a "qualified custodian" exists within the Malian or UEMOA financial regulatory framework concerning digital assets.

Pending Custody Legislation:

There is no publicly available information indicating any specific pending legislation in Mali or at the UEMOA regional level directly addressing digital asset custody. The focus remains largely on cautioning against and monitoring cryptocurrencies, rather than integrating them into a regulated financial system. Discussions within the UEMOA might involve the possibility of a Central Bank Digital Currency (eCFA), but this is distinct from regulating private cryptocurrency custody services.

December 2021: The BCEAO issued a directive (Circular N°0000000001/M/DG/2021) explicitly prohibiting financial institutions under its purview from engaging in any activities related to virtual assets.

None specifically for crypto. Since there is no dedicated crypto regulatory framework, there are no specific licenses for these activities.

Neither a registration nor a specific licensing regime currently exists for VASPs in Mali.

Entities operating in this space are doing so outside of a recognized regulatory framework. This is not a "light touch" approach; rather, it indicates a lack of formal permission or supervision, which can be interpreted as implicitly disallowed for formal financial sector participation.

They are not recognized as legal tender within the UEMOA zone.

They are not regulated or supervised by the BCEAO or any national financial authority in the region.

Financial institutions supervised by the BCEAO (banks, microfinance institutions) are generally prohibited or strongly discouraged from engaging in activities related to virtual assets due to the associated risks (money laundering, terrorist financing, consumer protection, financial stability).

Law N°2018-024 of August 21, 2018, amending Ordinance N°2015-032/P-RM of June 19, 2015, relating to the fight against money laundering and terrorist financing.

UEMOA Directive No. 02/2015/CM/UEMOA

Customer Identification and Verification:

Beneficial Ownership Identification: Identifying and verifying the natural persons who ultimately own or control the customer, or the natural person on whose behalf a transaction is being conducted.

Ongoing Monitoring: Conducting ongoing due diligence on the business relationship and scrutinizing transactions undertaken throughout the course of that relationship to ensure consistency with the institution’s knowledge of the customer, their business, and risk profile.

Risk-Based Approach: Applying enhanced due diligence (EDD) for higher-risk customers (e.g., politically exposed persons - PEPs, customers from high-risk jurisdictions, or those engaged in complex/unusual transactions) and simplified due diligence (SDD) for lower-risk scenarios.

Obligation: Any transaction (regardless of amount) that an institution knows, suspects, or has reasonable grounds to suspect is related to money laundering or terrorist financing must be reported.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or third parties that an STR has been filed or that a money laundering or terrorist financing investigation is being conducted.

Transaction Records: All transaction data, including the amount, currency, date, and details of the parties involved (originator and beneficiary), should be kept.

Customer Identification Records: Records obtained through CDD measures (copies of identification documents, account files, business correspondence) must be retained.

Retention Period: Generally, these records must be kept for at least five (5) years after the business relationship ends or after the date of an occasional transaction.

Cellule Nationale de Traitement des Informations Financières (CENTIF): Mali's FIU, responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs).

Entity Targeted: All regulated financial institutions (banks, microfinance institutions, payment service providers, etc.) within the UEMOA zone, including those operating in Mali. Also serves as a warning to the general public. Violation Type: Engaging in any activity related to cryptocurrencies (issuance, exchange, holding, investment, facilitation of transactions, etc.). The BCEAO considers these activities to be unauthorized and high-risk. Penalty Amount: Not a specific monetary penalty for a single action, but non-compliance by regulated entities could lead to severe administrative sanctions, including fines, withdrawal of operating licenses, and other regulatory penalties imposed by the BCEAO or national banking commissions. Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.

Outcome: A de facto ban on formal cryptocurrency operations within Mali's regulated financial sector. Financial institutions are prohibited from offering crypto services, and the public is warned about the risks and lack of regulatory protection.

Entity Targeted: Individuals or informal groups promoting and operating cryptocurrency-based investment scams or pyramid schemes. Violation Type: Fraud, swindling (escroquerie), illegal financial operations, often disguised as crypto investment opportunities. Penalty Amount: Varies depending on the scale of the fraud; can include prison sentences and financial reparations to victims. Specific public records of these amounts for crypto-specific cases in Mali are difficult to pinpoint from international sources. Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.

Outcome: Arrests, investigations, and potential prosecutions of individuals involved in scams. Public awareness campaigns to warn citizens against unregulated crypto investment opportunities.