Mali KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Mali.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Direct answer
What does the Mali compliance checklist cover?
The Mali checklist translates primary KYC, KYB and AML rules into 11 control areas and 35 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- FIU
- CENTIF Mali
- Primary AML rule
- Ordinance 2024-011, modified and ratified by Law 2024-022
- Suspicion reporting
- Immediately, including attempted transactions
- Cash transaction report
- XOF 15 million or more, including apparently linked operations
- Core AML retention
- 10 years under record-specific clocks
- FATF status
- Removed from increased monitoring in June 2025
Implementation detail
Mali compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingResolve the reporting entity, activity and supervisor before launch.3 items+
Determine whether each activity is in AML/CFT/CPF scope.
- Implementation action
- Map every entity, product, channel, branch, agent and profession to the financial-institution, DNFBP or other covered categories and identify CENTIF and the competent supervisor.
- Evidence to retain
- Applicability memo, product map, licences and accountable-owner register.
- Primary citation
- Ordinance 2024-011, Articles 2-4 and 107
Establish the current CENTIF reporting route.
- Implementation action
- Designate authorised reporters, obtain the current declaration form or electronic procedure, test secure delivery and preserve acknowledgements.
- Evidence to retain
- Appointment, user authority, channel test and receipt log.
- Primary citation
- Ordinance 2024-011, Articles 60, 64 and 95-103; CENTIF declaration page
Obtain authorisation before regulated activity.
- Implementation action
- Classify banking, payment, e-money, money-transfer, agent, foreign-exchange, insurance, securities, fintech and virtual-asset activities and obtain every required approval before launch.
- Evidence to retain
- Perimeter analysis, licences, conditions and renewal calendar.
- Primary citation
- Ordinance 2024-011, Articles 2-4 and 58-59; BCEAO Instruction 001-01-2024
02Governance and risk assessmentControls must be risk-based, documented, current and independently tested.3 items+
Maintain internal organisation and controls proportionate to risk.
- Implementation action
- Approve policies for CDD, beneficial ownership, PEPs, sanctions, monitoring, reporting, records, training and independent testing.
- Evidence to retain
- Policy suite, approvals, control library, training and audit reports.
- Primary citation
- Ordinance 2024-011, Articles 12-14; BCEAO Instruction 001-03-2025
Identify, assess and document ML, TF and PF risks.
- Implementation action
- Assess customers, geographies, products, transactions, channels, agents and new technologies before launch and on material change.
- Evidence to retain
- Risk assessment, methodology, source data, change log and approvals.
- Primary citation
- Ordinance 2024-011, Article 15
Apply proportionate group and outsourcing controls.
- Implementation action
- Map group standards, local-law conflicts, outsourced functions, data access and testing while retaining accountability.
- Evidence to retain
- Group policy, conflict register, vendor reviews and assurance results.
- Primary citation
- Ordinance 2024-011, Articles 12-14 and 35-38
03Natural-person identificationIdentify and verify customers, actors and beneficial owners at every statutory trigger.3 items+
Identify and verify the customer before a relationship or assisted transaction.
- Implementation action
- Capture identity attributes, verify reliable independent evidence, understand purpose and intended nature and establish expected activity.
- Evidence to retain
- CDD file, source provenance, verification, purpose and risk decision.
- Primary citation
- Ordinance 2024-011, Articles 16-17
Apply CDD to transfers, suspicion, identity doubt and applicable occasional or linked transactions.
- Implementation action
- Configure relationship, transfer, cash-aggregation, suspicion and identity-quality triggers; never treat a threshold as a safe harbour.
- Evidence to retain
- Trigger matrix, aggregation, alerts and CDD timestamps.
- Primary citation
- Ordinance 2024-011, Articles 17 and 49; UMOA Decision 021
Control delayed and remote verification.
- Implementation action
- Permit delay only under the statutory conditions, complete it as soon as possible and before the first transaction, and apply sufficient remote-onboarding safeguards.
- Evidence to retain
- Deferral rationale, restrictions, completion time, remote tests and exceptions.
- Primary citation
- Ordinance 2024-011, Articles 18 and 22
04KYB, registries, and beneficial ownershipVerify legal existence, authority, ownership and ultimate natural-person control.4 items+
Verify legal existence and every representative's authority.
- Implementation action
- Obtain current RCCM and constitutional evidence, addresses, directors, licences and mandates and reconcile discrepancies.
- Evidence to retain
- Registry extract, statutes, managers, licences, mandate and discrepancy log.
- Primary citation
- Ordinance 2024-011, Articles 17 and 26
Apply the beneficial-owner cascade.
- Implementation action
- For companies, identify natural persons holding directly or indirectly more than 25% of capital or voting rights, then test control by other means and only then the senior-managing-official fallback.
- Evidence to retain
- Ownership chart, control analysis, verified identities and fallback rationale.
- Primary citation
- Ordinance 2024-011, definitions and Article 26
Identify role holders in trusts and comparable arrangements.
- Implementation action
- Identify and verify settlor, trustee, protector, beneficiaries or class and every other natural person exercising ultimate control.
- Evidence to retain
- Instrument, role register, identity files and control analysis.
- Primary citation
- Ordinance 2024-011, definitions and Article 26
Keep shareholder and beneficial-owner information accurate and current.
- Implementation action
- Maintain event-driven updates, reconcile customer declarations with available RCCM and beneficial-owner information and complete filings under the live national procedure.
- Evidence to retain
- Registers, update log, filings, supporting documents and discrepancies.
- Primary citation
- Ordinance 2024-011, Articles 76-79 and 122
05PEPs, EDD, and remote onboardingHigher-risk relationships require enhanced, evidenced controls.3 items+
Detect PEP and connected-person exposure.
- Implementation action
- Screen customers and beneficial owners for foreign, domestic and international-organisation PEP status, family and close associates.
- Evidence to retain
- Screening, relationship map, match decision and refresh log.
- Primary citation
- Ordinance 2024-011, Article 29
Apply approval, source and monitoring controls.
- Implementation action
- Obtain senior-management approval, establish source of wealth and source of funds and apply enhanced ongoing monitoring where required.
- Evidence to retain
- Approval, provenance analysis and monitoring plan.
- Primary citation
- Ordinance 2024-011, Articles 29-30
Govern third-party reliance.
- Implementation action
- Assess eligibility, obtain required CDD information immediately, contract for document access and test retrieval; retain ultimate responsibility.
- Evidence to retain
- Due diligence, agreement, retrieval test and exceptions.
- Primary citation
- Ordinance 2024-011, Articles 35-38
06Monitoring and suspicious reportingCENTIF reporting must be immediate, complete and confidential.4 items+
Monitor and examine unusual activity.
- Implementation action
- Scrutinise transactions against the customer profile and document the background and purpose of complex, unusually large or apparently purposeless activity.
- Evidence to retain
- Alerts, investigation, written findings and disposition.
- Primary citation
- Ordinance 2024-011, Articles 19-21
Report suspicion and attempts immediately.
- Implementation action
- Timestamp when suspicion or reasonable grounds arose and report suspected sums, transactions and attempts to CENTIF using the current route; supplement without delay.
- Evidence to retain
- Decision chronology, report, supporting material, delivery and receipt.
- Primary citation
- Ordinance 2024-011, Article 60
Do not proceed where mandatory CDD fails.
- Implementation action
- Do not open or execute, or terminate an existing relationship, when required diligence cannot be completed and submit an STR.
- Evidence to retain
- Decline or exit decision, investigation and restricted reporting record.
- Primary citation
- Ordinance 2024-011, Article 25
Prevent tipping off and govern execution holds.
- Implementation action
- Restrict report access, withhold suspicious activity before reporting unless statutory post-execution conditions apply, and disclose nothing to the customer.
- Evidence to retain
- Hold decision, exception rationale, access logs and communications record.
- Primary citation
- Ordinance 2024-011, Articles 61 and 63
07Payments, wires, thresholds, and agentsKeep CDD triggers, special examination and automatic reports distinct.3 items+
Report cash transactions of XOF 15 million or more.
- Implementation action
- Aggregate apparently linked operations, configure the exact in-scope entity and transaction logic and obtain current CENTIF submission instructions.
- Evidence to retain
- Threshold configuration, tests, reports, receipts and exceptions.
- Primary citation
- Ordinance 2024-011, Article 72; UMOA Decision 021, Article 8
Apply identification and special-examination thresholds accurately.
- Implementation action
- For financial institutions, identify multiple daily or unusually frequent cash transactions above XOF 9 million; specially examine cash or bearer-title payments at XOF 50 million or more and unusual or unjustified operations at XOF 10 million or more.
- Evidence to retain
- Threshold register, aggregation tests, CDD and examination reports.
- Primary citation
- Ordinance 2024-011, Articles 17 and 21; UMOA Decision 021, Articles 3-4
Preserve required wire-transfer information.
- Implementation action
- Carry required originator and beneficiary information throughout the chain and define reject, suspend, execute, investigate and follow-up rules for deficient transfers.
- Evidence to retain
- Field matrix, validation, repair queue, samples and decisions.
- Primary citation
- Ordinance 2024-011, Articles 39-47
08Targeted financial sanctionsScreen, freeze, restrict and report without delay under current designation procedures.3 items+
Screen current authoritative designation lists.
- Implementation action
- Screen customers, beneficial owners, controllers, representatives and relevant transactions at onboarding, on list changes and before execution.
- Evidence to retain
- List inventory, update logs, screening configuration and dispositions.
- Primary citation
- Ordinance 2024-011, Articles 89 and 124
Freeze designated property without delay and prior notice.
- Implementation action
- Maintain a continuously available path to freeze direct, indirect, owned or controlled assets and prevent funds, services or resources being made available.
- Evidence to retain
- Freeze procedure, timestamps, asset record and transaction blocks.
- Primary citation
- Ordinance 2024-011, Article 89
Report funds, freezes, measures and attempts immediately.
- Implementation action
- Notify CENTIF and the competent authority through current national procedures and release nothing without lawful authority.
- Evidence to retain
- Notifications, receipts, directions and release decision.
- Primary citation
- Ordinance 2024-011, Articles 90-91
09Records and regulator accessRecords must reconstruct customers, ownership, transactions and decisions.3 items+
Retain customer records for 10 years after closure or relationship end.
- Implementation action
- Map identity, profile and analysis records to the relationship-based clock and apply legal holds.
- Evidence to retain
- Schedule, archive sample, deletion control and hold log.
- Primary citation
- Ordinance 2024-011, Article 23
Retain transaction and correspondence records for 10 years after execution.
- Implementation action
- Use transaction-based clocks and preserve enough information to reconstruct each operation.
- Evidence to retain
- Archive configuration, reconstruction test and retrieval log.
- Primary citation
- Ordinance 2024-011, Article 23
Make records available to competent authorities.
- Implementation action
- Authenticate requests, protect STR confidentiality, produce controlled records within the required time and log disclosure and receipt.
- Evidence to retain
- Request register, approval, production index and acknowledgement.
- Primary citation
- Ordinance 2024-011, Articles 24 and 103
10Privacy, biometrics, and transfersAML processing remains subject to Mali's personal-data framework.3 items+
Map lawful purpose, data, security and APDP formalities.
- Implementation action
- Inventory identity, ownership, screening, biometric, monitoring and reporting data; document purpose, basis, recipients, access, retention and the applicable declaration or authorisation route.
- Evidence to retain
- Processing register, basis assessment, notices, access matrix and APDP record.
- Primary citation
- Law 2013-015, Chapters III-V
Apply heightened controls to sensitive and biometric processing.
- Implementation action
- Confirm the exact APDP procedure before deploying facial, fingerprint, liveness-template, national-identifier or offence-data processing; minimise data and test security.
- Evidence to retain
- Legal assessment, impact review, APDP decision, access review and tests.
- Primary citation
- Law 2013-015; APDP authorised-processing register
Control cross-border personal-data transfers.
- Implementation action
- Map hosting, support and vendor destinations, assess safeguards and obtain any required APDP authorisation before transfer.
- Evidence to retain
- Transfer map, safeguards, contracts, APDP record and access logs.
- Primary citation
- Law 2013-015, cross-border transfer provisions
11Practical evidence packsMaintain concise packs that reproduce decisions and support supervision.3 items+
Maintain a reconstructable onboarding pack.
- Implementation action
- Bundle identity, KYB, beneficial ownership, screening, risk, approvals, data records and exceptions under stable identifiers.
- Evidence to retain
- Complete sampled onboarding pack.
- Primary citation
- Operational control supporting Ordinance 2024-011, Articles 12-26
Maintain a reconstructable monitoring and reporting pack.
- Implementation action
- Link transactions, alerts, analysis, approvals, CENTIF reports, delivery evidence and post-filing controls while protecting confidentiality.
- Evidence to retain
- Complete sampled case pack and access log.
- Primary citation
- Operational control supporting Ordinance 2024-011, Articles 19-25 and 60-64
Maintain a launch and change-control pack.
- Implementation action
- Record licensing, thresholds, sanctions lists, registry and privacy formalities, product risk, testing and authority confirmations before launch and material changes.
- Evidence to retain
- Signed launch pack, legal-source register and change approvals.
- Primary citation
- Official sources listed below
Primary-source register
13 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Official Gazette No. 29 containing Law No. 2024-022 and Ordinance No. 2024-011Mali General Secretariat of Government · Primary national legislation
- 2023 UMOA uniform AML/CFT/CPF lawBCEAO · Primary regional legal framework
- UMOA Decision No. 021 of 21 December 2023 setting implementation thresholdsBCEAO · Primary regional decision
- BCEAO Instruction No. 001-03-2025 on AML/CFT/CPF organisation and controlBCEAO · Primary regulator instruction
- BCEAO Instruction No. 003-03-2025 on customer identification and knowledgeBCEAO · Primary regulator instruction
- BCEAO Instruction No. 001-01-2024 on payment servicesBCEAO · Primary regulator instruction
- CENTIF Mali suspicious-transaction declaration pageCENTIF Mali · Official FIU reporting page
- Official Gazette containing Law No. 2013-015 on personal-data protectionMali General Secretariat of Government · Primary privacy legislation
- APDP processing declarations, authorisations and transfer formsMali Personal Data Protection Authority · Official privacy-authority procedure
- Mali sixth enhanced follow-up report (2026)GIABA · Authoritative regional assessment
- Mali removed from FATF increased monitoring - 13 June 2025FATF · Authoritative public statement
- FATF high-risk and monitored jurisdictions current at 19 June 2026FATF · Authoritative current status
- United Nations Security Council consolidated sanctions listUnited Nations · Authoritative sanctions list
Direct answers
Mali KYC, KYB and AML questions
Who receives suspicious transaction reports?+
CENTIF Mali, using its current prescribed declaration route.
When is suspicion reported?+
Immediately once suspicion or reasonable grounds arise, including attempted transactions; relevant supplements are sent without delay.
What cash transaction report threshold applies?+
Covered institutions and designated non-financial businesses report cash transactions of XOF 15 million or more, whether a single operation or apparently linked operations.
How is beneficial ownership determined?+
For companies, identify natural persons holding directly or indirectly more than 25% of capital or voting rights, then test control by other means, and only then use the senior-managing-official fallback. Legal arrangements use role-based tests.
How long are core AML records retained?+
Customer records are retained for 10 years after relationship cessation; transaction and correspondence records are retained for 10 years after execution.
What privacy rules apply?+
Law No. 2013-015 governs personal-data processing. Confirm the APDP route for the proposed processing, especially biometrics, sensitive data and foreign transfers.
Is Mali on a FATF public list?+
No. FATF removed Mali from increased monitoring on 13 June 2025, and Mali was not named in FATF's public lists dated 19 June 2026. It remains subject to GIABA follow-up.
Can payment, fintech or virtual-asset activity launch without approval?+
No. Classify the provider, product and agent model and obtain every applicable national or UMOA permission before launch.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 3 September 2026. Confirm current CENTIF filing and receipt mechanics, national threshold and sanctions measures, beneficial-owner registry procedures, APDP formalities and product-specific permissions with the competent authority and qualified Malian counsel before launch.