The ordinance of 30 August 2024 and its ratification in December provide a documented framework for virtual asset service providers. This guide sets out a preparation and control method. It does not provide individual legal advice or suggest that a commercial file can replace an administrative authorization.
In brief
- Under Article 58, carrying out a VASP activity professionally requires prior authorization or approval.
- The process must separately identify the seller, payment service provider, custodian and recipient of the funds.
- Customer checks, data management and incident handling must follow documented procedures suited to the applicable obligations.
Start with the text, then classify the activities actually performed
A Malian project should distinguish its national framework from regional mechanisms. The overview of UEMOA and BCEAO crypto rules provides that broader perspective. It does not remove the need to verify the exact status of the proposed service in Mali and the decisions of the competent authorities.
Ordinance No. 2024-011/PT-RM, published in the Official Gazette on 2 September 2024, includes a chapter dedicated to VASPs. Article 58 requires prior approval or authorization to operate professionally. Article 59 brings these actors within the relevant provisions on anti-money laundering, counter-terrorist financing and counter-proliferation.
Law No. 2024-022 of 11 December 2024 amends and ratifies that ordinance. Its intervention regarding Article 205 notably concerns the necessary implementing texts and guidelines, as well as the continued application of certain earlier measures that are not incompatible, until they are repealed. The title of the law alone is therefore not enough to build an operational file.
Begin by describing each service in plain language. Which company receives the CFA francs? Then identify the token provider and the person able to move the funds after they are received. Also specify who holds a key or validates a withdrawal. A single interface may bring together several companies, but users must be able to understand which entity they are contracting with and for which function.
Our research is not an exhaustive inventory of current approval decisions and implementing texts. No particular provider is certified here. Before any commercial launch, the project should be confirmed by the competent authorities and by professionals familiar with national and regional rules, as well as any international flows involved.
Map the flows before drafting customer terms
Consider a fictional service that accepts a mobile payment in XOF and then delivers a stablecoin. The arrangement includes at least the customer, seller, payment operator and network used for the transfer. A custody platform or liquidity provider may add further intermediaries. Responsibilities do not disappear because a partner performs part of the work.
The BCEAO list of electronic money institutions can help verify certain identities and partnerships in Mali. It notably mentions Orange Finances Mobiles Mali, SAMA Money and the BDM partnership with SOTELMA-MALITEL for Moov Money. These listings do not amount to crypto authorization for every merchant that accepts their payments.
A partnership agreement must therefore specify permitted uses, required checks and how suspensions are handled. Do not assume that technically possible transfers demonstrate the provider’s approval of the business model. A restriction discovered after collecting customer funds can block the entire chain and trigger simultaneous complaints.
Refund paths should also be documented. If the customer pays but the selected network cannot deliver the asset, who decides to return the money, and in what form? A business should be able to answer that question before the first order. The answer must remain compatible with applicable rules and technical capabilities, rather than promising the automatic cancellation of every transaction.
The full cost of a crypto purchase provides a second mapping tool. Conversion margin, payment fees, network fees and exit fees should appear in the right place. This breakdown supports both commercial transparency and accounting reconciliation; it does not allow a commission to be hidden in a lower token amount.
Design consistent controls without collecting data blindly
Effective customer screening does not mean requesting the maximum number of documents from everyone. The business must determine what information is necessary, which circumstances trigger additional review and who is authorized to decide. Specific requirements depend on the rules, the service and the risks identified; this guide does not create a single legal threshold.
The process should in particular identify an unexplained mismatch between the account holder and the payer. A company that automatically accepts third-party payments without justification weakens its understanding of the flows. Conversely, a documented review should prevent improvised accusations: a different name calls for verification, not a criminal conclusion drawn by a support agent.
Our guide to crypto KYC and data protection highlights the importance of the collection channel. An employee’s personal messaging account should not become a parallel archive of identity cards. The project must define access rights, transfers to partners, security measures and the retention rules that actually apply.
Anti-money laundering prevention also includes confidentiality requirements. A business should not promise customers that it will disclose every report or confidential exchange with the authorities. Commercial explanations for a suspension, the individual’s rights and information whose disclosure may be legally restricted must be kept distinct.
Provide a correction procedure for cases in which a document is illegible or submitted information contains an error. A series of contradictory requests can trap a good-faith customer in an endless block. The quality of a control is also measured by its consistency, the traceability of decisions and the ability to escalate a case without bypassing obligations.
Cover custody, cybersecurity and accounting to avoid blind spots
The project must clearly state whether customers hold their own keys or whether an operator controls the assets on their behalf. The second arrangement creates dependence on the custodian’s processes. The first transfers certain technical responsibilities to the user. The guide to how crypto wallets work helps explain this distinction without resorting to misleading slogans.
Any security promise should correspond to demonstrable practices: restricted access rights, approval of sensitive operations, backups and procedures for employee departures. The business must also plan for a lost device or an unavailable manager. No serious procedure should depend solely on a personal phone and one person’s memory.
Separate operating flows from customer-related flows, in line with the applicable obligations and organizational arrangements. A single total balance in an application is not enough to show who owns what. Reconciliation should connect the order, payment, delivery and any refund, with explicit handling of discrepancies and pending transactions.
For an asset available on several blockchains, identify the network and the contract where applicable. The same commercial symbol may refer to different assets or fraudulent copies. Support staff must be able to distinguish a deposit on an unsupported network from a missing payment, without guaranteeing recovery that the technical team cannot carry out.
Dependence on an external provider also calls for a continuity scenario. If its withdrawals stop, can the business immediately suspend new orders affected by the issue? Who informs customers? Continuing to accept funds to protect revenue could potentially worsen the situation. The plan should prioritize control over commitments rather than growth that can no longer be served.
Prepare for incidents and review the service regularly
An actionable complaint starts with a verifiable timeline: quote time, validity period, payment, order reference and delivery status. Teams should use a common format. Isolated screenshots do not necessarily show whether payment preceded the quote’s expiry or whether the customer selected another network after approval.
The framework should distinguish a technical incident, a commercial dispute and a suspicion requiring a specific procedure. Mixing these situations produces opaque responses and decisions that are difficult to review. Users should receive the information about their case that can be disclosed, without the service revealing other customers’ data or legally confidential material.
When selecting a provider, the method for comparing platforms and their statuses remains useful: identity, business scope, custody, withdrawals and remedies. A globally recognized partner does not replace an analysis of the contract actually offered to a Malian company. The version of the terms used to make the decision should be retained.
Finally, schedule a review whenever the bank, mobile operator, custody provider or network changes. A seemingly technical modification can alter the data collected, the country of execution or the refund path. The responsible person should assess the impact before enabling the option for all customers, not after the first dispute.
Crypto regulation in Mali is therefore not limited to a terms-and-conditions page or an identity check displayed in an application. The documented starting point is the prior authorization required for professional VASP activity. The operational work then consists of connecting that requirement to actual flows, partners and evidence, with project-specific legal confirmation before the service goes live.
