Mali Cryptocurrency Regulation: The Approval Rule an Exchange App Cannot Answer
Explore Mali’s Article 58 approval requirement, its national AML ordinance and why a country assessment cannot prove an exchange is licensed.
On this page
Mali’s national AML ordinance expressly requires prior approval for professional virtual-asset services. The ability to download a trading app does not establish that approval.
For customers and operators, the useful starting point is the document naming the company and the activity it may perform.
Our African cryptocurrency regulation directory compares the rules and the evidence needed to use them.
Where is the approval requirement written?
The official gazette of 2 September 2024 publishes Ordinance No. 2024-011/PT-RM of 30 August 2024.
Article 58 prohibits professional virtual-asset service activity without prior approval or authorisation from the competent authority. Article 59 requires providers operating in Mali to comply with the ordinance’s relevant provisions, including preventive measures.
The same article leaves VASP-specific requirements and sanctions to the competent authorities. Those implementing details matter when assessing a real business.
Article 3(c) also expressly includes VASPs among the persons subject to the ordinance. Their inclusion should not be omitted from an AML review or left to an assumption about the definition of a financial institution.
What is still needed for an application?
This review did not independently verify a complete current public VASP application pack, a named approved exchange or a universal VASP minimum capital amount.
That limitation does not remove Article 58. It also does not establish that no authority can act.
An applicant should request the current designation and implementing texts. Confirm the application recipient, required documents, service categories and conditions for receiving a decision.
Keep those answers with the business plan. Avoid presenting a general enquiry or acknowledgement as an approval.
What can GIABA’s newer report tell readers?
GIABA’s 2026 sixth enhanced follow-up report page identifies the Recommendations being reassessed. Its listed re-rating scope does not include Recommendation 15, the FATF standard addressing new technologies and VASPs.
The report therefore should not be advertised as a fresh crypto licensing decision. Nor does a national technical-compliance assessment approve an individual company.
A country report can help identify legislative progress and remaining weaknesses. A provider still needs evidence covering its own activities.
When did Mali leave FATF increased monitoring?
FATF removed Mali from increased monitoring on 13 June 2025, following progress on its AML/CFT action plan. It called for continued work with GIABA to sustain improvements.
That decision concerns the country’s AML/CFT framework. It does not authorise a crypto exchange or establish that a complete VASP application process is open.
How should a cross-border service map its permissions?
Consider a customer paying local currency for crypto held offshore. The payment collector, seller and custodian may be different entities.
Write down the responsibility of each one. Explain which company returns the money if the transaction fails.
| Transaction stage | Document to examine |
|---|---|
| Fiat collection | Payment provider’s permission and agreement |
| Crypto exchange | Seller identity and relevant authorisation |
| Custody | Customer-asset terms and control of keys |
| Withdrawal | Responsible company, fees and settlement terms |
| Complaint | Available process and contact entity |
These questions help organise a review. They do not confirm that a particular arrangement is permitted.
What belongs in the compliance plan?
Article 59 makes the preventive obligations relevant to the analysis. Review their detailed application to the proposed services.
A useful plan identifies customer checks, beneficial ownership, monitoring, suspicious-activity escalation and record handling. It also names the staff or functions accountable for those controls.
If another company performs checks, describe the relationship and the information available to the serving entity. Outsourcing should not obscure who must comply.
Which claims deserve extra scrutiny?
Ask for the underlying instrument when someone quotes a capital amount or a guaranteed approval deadline. Check that the figure relates to virtual-asset services rather than another financial licence.
Customers should retain the terms accepted at opening. Check withdrawals and complaints before depositing significant funds.
For comparison, read Senegal’s cryptocurrency authorisation analysis, Guinea’s BCRG approval rule and Ghana’s crypto regulatory framework.
Research scope and limits
Research reviewed 6 November 2026. Sources include the official national ordinance, GIABA’s 2026 follow-up scope and FATF’s June 2025 monitoring decision. The prior-approval requirement and express reporting-entity coverage were verified. A complete current public VASP application pack, definitive VASP authority-designation instrument, named provider approval and universal VASP capital amount were not independently established. These evidence gaps do not prove that the instruments or providers do not exist. Obtain current authority confirmation for a proposed business model.
