The sources reviewed do not make it possible to provide a complete crypto licensing procedure applicable to every service. Instead, this guide offers a qualification framework covering flows, responsibilities, documents and questions to submit to the relevant authorities. It is neither authorization to launch nor individual legal advice.
In brief
- A project must explain who receives, holds, converts and returns funds or assets.
- The payments framework and innovation programs do not automatically approve a crypto activity.
- Prepare compliance, continuity and wind-down procedures before accepting client funds.
Mauritania’s crypto regulation: map the actual flows
Accurate mapping starts with the customer’s actions. Our guide to crypto platforms and their legal status distinguishes functions rather than assigning an overall label. The company must explain the orders it receives, the accounts used, the assets delivered and who controls the keys. Calling a service “support” or “community” does not necessarily change the responsibilities it performs.
Take a hypothetical project that receives MRU, buys a token from a partner and holds a balance for the customer. The collection of funds, execution and custody must be identified separately. If the partner handles part of the process, its role should appear in the contracts and procedures. Customers should not discover this division only when a transaction fails.
Add the relevant jurisdictions. The company’s headquarters, customers’ places of residence, the location of accounts and technical providers may all be in different countries. Authorization obtained in one jurisdiction does not automatically resolve every question surrounding marketing and service provision in another. The file must allow these relationships to be assessed, without inferring a general exemption from geographical distance.
Finally, describe the revenue model. A conversion fee, software billing and a product that pays returns on entrusted funds do not create the same business model. Each revenue stream should correspond to an explained operation. A presentation promising both no fees and high returns must show how the activity is financed, without using new inflows to conceal losses.
The diagram should remain understandable without blockchain jargon. A lawyer or banking partner should be able to follow a unit of value from the customer’s payment through to its return. When that reading fails, the problem first concerns how the project is described. Extensive technical documentation cannot compensate for a contradiction over ownership or the availability of funds.
Read the available texts and identify open questions
The legal framework presented by the BCM notably lists Law No. 2021-014 on electronic payment services and means, along with sector-specific instructions. This directory is a starting point, not a complete answer covering every virtual asset. The existence of digital-asset-related texts does not allow a project to be assigned a category or authorization without review.
The project owner should clarify which functions fall under payments, transfers, custody or another financial service. A partner company that is already known does not necessarily cover a new feature added to the process. Request a classification based on the actual operations, including their conditions and limits. A commercial partnership formula is no substitute for this verification.
The BCM’s innovation programs provide another piece of information: a controlled environment may make it possible to assess a project according to agreed parameters. Do not present it as an unlimited exemption. If admission is granted, it should be read together with the test’s scope, participants and the conditions applicable to the relevant experiment.
The Fintech Program FAQ published in August 2026 notably describes support and the preparation of experiments. It does not demonstrate the automatic admission of a crypto project. A company should therefore not present participation in a program as a license covering all of its products. The language used in communications must match the documents obtained.
No specific crypto regulatory capital threshold, licensing timeline or fee has been confirmed for this guide. Do not invent one in a financial forecast presented as compliant. Set aside a line for requirements still to be confirmed and request appropriate official responses. An accurate budget must distinguish internal assumptions from verified obligations, even when that delays a commercial announcement.
Prepare identity checks, monitoring and data protection
The file must identify the entity, its managers, its owners and the people who make sensitive decisions. An organization chart is useful only if it reflects actual access rights and authority. If a single employee can change a beneficiary and authorize a transfer, explain the control that limits error or abuse instead of presenting a fictional separation of duties.
Our guide to KYC, data and recourse helps organize supporting documents without improvised collection. The BCM directory also mentions a law on personal data. The project should have its purposes, access rights, retention periods and relevant providers reviewed. Collecting more documents does not automatically amount to better compliance.
Avoid keeping customer documents in sales staff’s private messaging accounts. Define an appropriate channel, audit trail and access rights. Teams must know which information to request and which information to refuse. A recovery phrase or bank verification code must never become part of a customer file under the pretext of identity verification.
Monitoring must reflect the service’s actual risks. How does the company handle an identity discrepancy, a third-party payment or an unusual request? Who decides to suspend an account, and how does the customer receive understandable information? These questions are part of operational preparation; the precise obligations and any required filings must be confirmed with the relevant authorities.
Also plan for collection errors and security incidents. A document sent to the wrong recipient can create a lasting risk. The procedure should specify who intervenes, how exposure is limited and which steps must be checked. An external provider does not remove the responsibility to organize these situations in the contracts and in the service’s actual operations.
Check the economics and continuity before launch
A business model must withstand activity below forecast. Hypothetical example: 800 monthly transactions generating 75 MRU each would produce 60,000 MRU in gross revenue. With 40,000 MRU in fixed costs and 12,000 MRU in variable costs, 8,000 MRU would remain in this simplified model, before other unrepresented items.
If volume falls to 400 transactions and the variable cost remains 15 MRU per transaction, revenue reaches 30,000 MRU against modeled costs of 46,000 MRU. The deficit amounts to 16,000 MRU. These figures describe neither a legal threshold nor a real company. They show why the service’s operating cash must be separated from assets entrusted by customers.
Our guide to crypto fees and the total purchase price can help compare the advertised price with the costs incurred. An attractive fee must not require withdrawal delays to keep the business running. If a promotion conceals a structural loss, the company must know who is financing it and for how long, without turning a marketing promise into an invisible risk for users.
Technical continuity calls for the same scenario planning. An outage affecting the banking provider, identity provider or a network must not lead to uncontrolled manual approvals. Define a suspended state, customer communications and restart conditions. Permanent availability requires resources, not merely a support button in an application.
For custody, our guide to crypto wallets and backups provides the basics. A company must document signing powers, backups and employee departures in greater detail. If one person can leave the project with indispensable access, continuity has not been addressed adequately, regardless of the quality of the public website.
Set rules for changes, complaints and wind-down
Prepare a list of changes that require a new review: another asset, another country, a new remuneration method or a new partner. A qualification obtained for a limited service must not automatically be reused for a different product. Sales and technical teams should know when to pause a new feature and assess its consequences.
Payments require clear documentation. Our guide to buying crypto with mobile payments separates monetary processing from asset delivery. Customers must understand which party is responsible for each step. Partner contracts should reflect this allocation and avoid a situation in which every support channel shifts responsibility for the same incident to someone else.
A useful complaint record preserves the order, payment, execution and response. Define a contact person, procedure and announced deadlines that are compatible with actual operations. Do not require customers to disclose secrets during an investigation. Histories and references should make it possible to establish the facts without creating new exposure of access credentials or personal data.
Finally, plan for cessation: stop new transactions, provide information, handle outstanding commitments and return assets according to the applicable terms. A company should not discover these questions when cash is already running short. The exact obligations must be verified legally, but operational preparation can begin before the first customer. Wind-down is part of a service’s life cycle, not a secondary detail.
Good preparation therefore produces a coherent file covering functions, flows, responsible parties, resources and limits. No diagram replaces a review of the applicable rules, but it helps frame the right questions. Until every essential function has a clear qualification or operational answer, accepting public funds would transfer the project’s uncertainty to its customers.
