Mali KYC, KYB & AML compliance checklist
Une checklist pratique et sourcée pour mettre en œuvre les exigences KYC, KYB et AML en Mali.
- Dernière revue
- Dernière revue:
- Version
- Version 1.0
Réponse directe
Que couvre la checklist de conformité pour Mali ?
La checklist pour Mali traduit les principales règles KYC, KYB et AML en 11 domaines de contrôle et 35 contrôles d’implémentation, avec les autorités, obligations de déclaration et preuves à conserver.
Faits réglementaires clés
- FIU
- CENTIF Mali
- Primary AML rule
- Ordinance 2024-011, modified and ratified by Law 2024-022
- Suspicion reporting
- Immediately, including attempted transactions
- Cash transaction report
- XOF 15 million or more, including apparently linked operations
- Core AML retention
- 10 years under record-specific clocks
- FATF status
- Removed from increased monitoring in June 2025
Détail d’implémentation
Exigences et actions de conformité pour Mali
Ouvrez chaque domaine pour consulter l’exigence, l’action recommandée, les preuves à conserver et la source primaire utilisée.
01Scope, authorities, and licensingResolve the reporting entity, activity and supervisor before launch.3 éléments+
Determine whether each activity is in AML/CFT/CPF scope.
- Action d’implémentation
- Map every entity, product, channel, branch, agent and profession to the financial-institution, DNFBP or other covered categories and identify CENTIF and the competent supervisor.
- Preuves à conserver
- Applicability memo, product map, licences and accountable-owner register.
- Source primaire
- Ordinance 2024-011, Articles 2-4 and 107
Establish the current CENTIF reporting route.
- Action d’implémentation
- Designate authorised reporters, obtain the current declaration form or electronic procedure, test secure delivery and preserve acknowledgements.
- Preuves à conserver
- Appointment, user authority, channel test and receipt log.
- Source primaire
- Ordinance 2024-011, Articles 60, 64 and 95-103; CENTIF declaration page
Obtain authorisation before regulated activity.
- Action d’implémentation
- Classify banking, payment, e-money, money-transfer, agent, foreign-exchange, insurance, securities, fintech and virtual-asset activities and obtain every required approval before launch.
- Preuves à conserver
- Perimeter analysis, licences, conditions and renewal calendar.
- Source primaire
- Ordinance 2024-011, Articles 2-4 and 58-59; BCEAO Instruction 001-01-2024
02Governance and risk assessmentControls must be risk-based, documented, current and independently tested.3 éléments+
Maintain internal organisation and controls proportionate to risk.
- Action d’implémentation
- Approve policies for CDD, beneficial ownership, PEPs, sanctions, monitoring, reporting, records, training and independent testing.
- Preuves à conserver
- Policy suite, approvals, control library, training and audit reports.
- Source primaire
- Ordinance 2024-011, Articles 12-14; BCEAO Instruction 001-03-2025
Identify, assess and document ML, TF and PF risks.
- Action d’implémentation
- Assess customers, geographies, products, transactions, channels, agents and new technologies before launch and on material change.
- Preuves à conserver
- Risk assessment, methodology, source data, change log and approvals.
- Source primaire
- Ordinance 2024-011, Article 15
Apply proportionate group and outsourcing controls.
- Action d’implémentation
- Map group standards, local-law conflicts, outsourced functions, data access and testing while retaining accountability.
- Preuves à conserver
- Group policy, conflict register, vendor reviews and assurance results.
- Source primaire
- Ordinance 2024-011, Articles 12-14 and 35-38
03Natural-person identificationIdentify and verify customers, actors and beneficial owners at every statutory trigger.3 éléments+
Identify and verify the customer before a relationship or assisted transaction.
- Action d’implémentation
- Capture identity attributes, verify reliable independent evidence, understand purpose and intended nature and establish expected activity.
- Preuves à conserver
- CDD file, source provenance, verification, purpose and risk decision.
- Source primaire
- Ordinance 2024-011, Articles 16-17
Apply CDD to transfers, suspicion, identity doubt and applicable occasional or linked transactions.
- Action d’implémentation
- Configure relationship, transfer, cash-aggregation, suspicion and identity-quality triggers; never treat a threshold as a safe harbour.
- Preuves à conserver
- Trigger matrix, aggregation, alerts and CDD timestamps.
- Source primaire
- Ordinance 2024-011, Articles 17 and 49; UMOA Decision 021
Control delayed and remote verification.
- Action d’implémentation
- Permit delay only under the statutory conditions, complete it as soon as possible and before the first transaction, and apply sufficient remote-onboarding safeguards.
- Preuves à conserver
- Deferral rationale, restrictions, completion time, remote tests and exceptions.
- Source primaire
- Ordinance 2024-011, Articles 18 and 22
04KYB, registries, and beneficial ownershipVerify legal existence, authority, ownership and ultimate natural-person control.4 éléments+
Verify legal existence and every representative's authority.
- Action d’implémentation
- Obtain current RCCM and constitutional evidence, addresses, directors, licences and mandates and reconcile discrepancies.
- Preuves à conserver
- Registry extract, statutes, managers, licences, mandate and discrepancy log.
- Source primaire
- Ordinance 2024-011, Articles 17 and 26
Apply the beneficial-owner cascade.
- Action d’implémentation
- For companies, identify natural persons holding directly or indirectly more than 25% of capital or voting rights, then test control by other means and only then the senior-managing-official fallback.
- Preuves à conserver
- Ownership chart, control analysis, verified identities and fallback rationale.
- Source primaire
- Ordinance 2024-011, definitions and Article 26
Identify role holders in trusts and comparable arrangements.
- Action d’implémentation
- Identify and verify settlor, trustee, protector, beneficiaries or class and every other natural person exercising ultimate control.
- Preuves à conserver
- Instrument, role register, identity files and control analysis.
- Source primaire
- Ordinance 2024-011, definitions and Article 26
Keep shareholder and beneficial-owner information accurate and current.
- Action d’implémentation
- Maintain event-driven updates, reconcile customer declarations with available RCCM and beneficial-owner information and complete filings under the live national procedure.
- Preuves à conserver
- Registers, update log, filings, supporting documents and discrepancies.
- Source primaire
- Ordinance 2024-011, Articles 76-79 and 122
05PEPs, EDD, and remote onboardingHigher-risk relationships require enhanced, evidenced controls.3 éléments+
Detect PEP and connected-person exposure.
- Action d’implémentation
- Screen customers and beneficial owners for foreign, domestic and international-organisation PEP status, family and close associates.
- Preuves à conserver
- Screening, relationship map, match decision and refresh log.
- Source primaire
- Ordinance 2024-011, Article 29
Apply approval, source and monitoring controls.
- Action d’implémentation
- Obtain senior-management approval, establish source of wealth and source of funds and apply enhanced ongoing monitoring where required.
- Preuves à conserver
- Approval, provenance analysis and monitoring plan.
- Source primaire
- Ordinance 2024-011, Articles 29-30
Govern third-party reliance.
- Action d’implémentation
- Assess eligibility, obtain required CDD information immediately, contract for document access and test retrieval; retain ultimate responsibility.
- Preuves à conserver
- Due diligence, agreement, retrieval test and exceptions.
- Source primaire
- Ordinance 2024-011, Articles 35-38
06Monitoring and suspicious reportingCENTIF reporting must be immediate, complete and confidential.4 éléments+
Monitor and examine unusual activity.
- Action d’implémentation
- Scrutinise transactions against the customer profile and document the background and purpose of complex, unusually large or apparently purposeless activity.
- Preuves à conserver
- Alerts, investigation, written findings and disposition.
- Source primaire
- Ordinance 2024-011, Articles 19-21
Report suspicion and attempts immediately.
- Action d’implémentation
- Timestamp when suspicion or reasonable grounds arose and report suspected sums, transactions and attempts to CENTIF using the current route; supplement without delay.
- Preuves à conserver
- Decision chronology, report, supporting material, delivery and receipt.
- Source primaire
- Ordinance 2024-011, Article 60
Do not proceed where mandatory CDD fails.
- Action d’implémentation
- Do not open or execute, or terminate an existing relationship, when required diligence cannot be completed and submit an STR.
- Preuves à conserver
- Decline or exit decision, investigation and restricted reporting record.
- Source primaire
- Ordinance 2024-011, Article 25
Prevent tipping off and govern execution holds.
- Action d’implémentation
- Restrict report access, withhold suspicious activity before reporting unless statutory post-execution conditions apply, and disclose nothing to the customer.
- Preuves à conserver
- Hold decision, exception rationale, access logs and communications record.
- Source primaire
- Ordinance 2024-011, Articles 61 and 63
07Payments, wires, thresholds, and agentsKeep CDD triggers, special examination and automatic reports distinct.3 éléments+
Report cash transactions of XOF 15 million or more.
- Action d’implémentation
- Aggregate apparently linked operations, configure the exact in-scope entity and transaction logic and obtain current CENTIF submission instructions.
- Preuves à conserver
- Threshold configuration, tests, reports, receipts and exceptions.
- Source primaire
- Ordinance 2024-011, Article 72; UMOA Decision 021, Article 8
Apply identification and special-examination thresholds accurately.
- Action d’implémentation
- For financial institutions, identify multiple daily or unusually frequent cash transactions above XOF 9 million; specially examine cash or bearer-title payments at XOF 50 million or more and unusual or unjustified operations at XOF 10 million or more.
- Preuves à conserver
- Threshold register, aggregation tests, CDD and examination reports.
- Source primaire
- Ordinance 2024-011, Articles 17 and 21; UMOA Decision 021, Articles 3-4
Preserve required wire-transfer information.
- Action d’implémentation
- Carry required originator and beneficiary information throughout the chain and define reject, suspend, execute, investigate and follow-up rules for deficient transfers.
- Preuves à conserver
- Field matrix, validation, repair queue, samples and decisions.
- Source primaire
- Ordinance 2024-011, Articles 39-47
08Targeted financial sanctionsScreen, freeze, restrict and report without delay under current designation procedures.3 éléments+
Screen current authoritative designation lists.
- Action d’implémentation
- Screen customers, beneficial owners, controllers, representatives and relevant transactions at onboarding, on list changes and before execution.
- Preuves à conserver
- List inventory, update logs, screening configuration and dispositions.
- Source primaire
- Ordinance 2024-011, Articles 89 and 124
Freeze designated property without delay and prior notice.
- Action d’implémentation
- Maintain a continuously available path to freeze direct, indirect, owned or controlled assets and prevent funds, services or resources being made available.
- Preuves à conserver
- Freeze procedure, timestamps, asset record and transaction blocks.
- Source primaire
- Ordinance 2024-011, Article 89
Report funds, freezes, measures and attempts immediately.
- Action d’implémentation
- Notify CENTIF and the competent authority through current national procedures and release nothing without lawful authority.
- Preuves à conserver
- Notifications, receipts, directions and release decision.
- Source primaire
- Ordinance 2024-011, Articles 90-91
09Records and regulator accessRecords must reconstruct customers, ownership, transactions and decisions.3 éléments+
Retain customer records for 10 years after closure or relationship end.
- Action d’implémentation
- Map identity, profile and analysis records to the relationship-based clock and apply legal holds.
- Preuves à conserver
- Schedule, archive sample, deletion control and hold log.
- Source primaire
- Ordinance 2024-011, Article 23
Retain transaction and correspondence records for 10 years after execution.
- Action d’implémentation
- Use transaction-based clocks and preserve enough information to reconstruct each operation.
- Preuves à conserver
- Archive configuration, reconstruction test and retrieval log.
- Source primaire
- Ordinance 2024-011, Article 23
Make records available to competent authorities.
- Action d’implémentation
- Authenticate requests, protect STR confidentiality, produce controlled records within the required time and log disclosure and receipt.
- Preuves à conserver
- Request register, approval, production index and acknowledgement.
- Source primaire
- Ordinance 2024-011, Articles 24 and 103
10Privacy, biometrics, and transfersAML processing remains subject to Mali's personal-data framework.3 éléments+
Map lawful purpose, data, security and APDP formalities.
- Action d’implémentation
- Inventory identity, ownership, screening, biometric, monitoring and reporting data; document purpose, basis, recipients, access, retention and the applicable declaration or authorisation route.
- Preuves à conserver
- Processing register, basis assessment, notices, access matrix and APDP record.
- Source primaire
- Law 2013-015, Chapters III-V
Apply heightened controls to sensitive and biometric processing.
- Action d’implémentation
- Confirm the exact APDP procedure before deploying facial, fingerprint, liveness-template, national-identifier or offence-data processing; minimise data and test security.
- Preuves à conserver
- Legal assessment, impact review, APDP decision, access review and tests.
- Source primaire
- Law 2013-015; APDP authorised-processing register
Control cross-border personal-data transfers.
- Action d’implémentation
- Map hosting, support and vendor destinations, assess safeguards and obtain any required APDP authorisation before transfer.
- Preuves à conserver
- Transfer map, safeguards, contracts, APDP record and access logs.
- Source primaire
- Law 2013-015, cross-border transfer provisions
11Practical evidence packsMaintain concise packs that reproduce decisions and support supervision.3 éléments+
Maintain a reconstructable onboarding pack.
- Action d’implémentation
- Bundle identity, KYB, beneficial ownership, screening, risk, approvals, data records and exceptions under stable identifiers.
- Preuves à conserver
- Complete sampled onboarding pack.
- Source primaire
- Operational control supporting Ordinance 2024-011, Articles 12-26
Maintain a reconstructable monitoring and reporting pack.
- Action d’implémentation
- Link transactions, alerts, analysis, approvals, CENTIF reports, delivery evidence and post-filing controls while protecting confidentiality.
- Preuves à conserver
- Complete sampled case pack and access log.
- Source primaire
- Operational control supporting Ordinance 2024-011, Articles 19-25 and 60-64
Maintain a launch and change-control pack.
- Action d’implémentation
- Record licensing, thresholds, sanctions lists, registry and privacy formalities, product risk, testing and authority confirmations before launch and material changes.
- Preuves à conserver
- Signed launch pack, legal-source register and change approvals.
- Source primaire
- Official sources listed below
Registre des sources primaires
13 sources utilisées pour cette checklist
Utilisez ces liens pour vérifier la législation, les lignes directrices, les procédures de déclaration et les statuts internationaux.
- Official Gazette No. 29 containing Law No. 2024-022 and Ordinance No. 2024-011Mali General Secretariat of Government · Primary national legislation
- 2023 UMOA uniform AML/CFT/CPF lawBCEAO · Primary regional legal framework
- UMOA Decision No. 021 of 21 December 2023 setting implementation thresholdsBCEAO · Primary regional decision
- BCEAO Instruction No. 001-03-2025 on AML/CFT/CPF organisation and controlBCEAO · Primary regulator instruction
- BCEAO Instruction No. 003-03-2025 on customer identification and knowledgeBCEAO · Primary regulator instruction
- BCEAO Instruction No. 001-01-2024 on payment servicesBCEAO · Primary regulator instruction
- CENTIF Mali suspicious-transaction declaration pageCENTIF Mali · Official FIU reporting page
- Official Gazette containing Law No. 2013-015 on personal-data protectionMali General Secretariat of Government · Primary privacy legislation
- APDP processing declarations, authorisations and transfer formsMali Personal Data Protection Authority · Official privacy-authority procedure
- Mali sixth enhanced follow-up report (2026)GIABA · Authoritative regional assessment
- Mali removed from FATF increased monitoring - 13 June 2025FATF · Authoritative public statement
- FATF high-risk and monitored jurisdictions current at 19 June 2026FATF · Authoritative current status
- United Nations Security Council consolidated sanctions listUnited Nations · Authoritative sanctions list
Réponses directes
Questions KYC, KYB et AML pour Mali
Who receives suspicious transaction reports?+
CENTIF Mali, using its current prescribed declaration route.
When is suspicion reported?+
Immediately once suspicion or reasonable grounds arise, including attempted transactions; relevant supplements are sent without delay.
What cash transaction report threshold applies?+
Covered institutions and designated non-financial businesses report cash transactions of XOF 15 million or more, whether a single operation or apparently linked operations.
How is beneficial ownership determined?+
For companies, identify natural persons holding directly or indirectly more than 25% of capital or voting rights, then test control by other means, and only then use the senior-managing-official fallback. Legal arrangements use role-based tests.
How long are core AML records retained?+
Customer records are retained for 10 years after relationship cessation; transaction and correspondence records are retained for 10 years after execution.
What privacy rules apply?+
Law No. 2013-015 governs personal-data processing. Confirm the APDP route for the proposed processing, especially biometrics, sensitive data and foreign transfers.
Is Mali on a FATF public list?+
No. FATF removed Mali from increased monitoring on 13 June 2025, and Mali was not named in FATF's public lists dated 19 June 2026. It remains subject to GIABA follow-up.
Can payment, fintech or virtual-asset activity launch without approval?+
No. Classify the provider, product and agent model and obtain every applicable national or UMOA permission before launch.
Méthode de recherche et de revue
VOVE ID Compliance Research cartographie le périmètre réglementaire, traduit les obligations en contrôles opérationnels, relie les affirmations importantes aux sources et date chaque revue.
General regulatory information, not legal advice or a licence determination. Reviewed as applicable on 3 September 2026. Confirm current CENTIF filing and receipt mechanics, national threshold and sanctions measures, beneficial-owner registry procedures, APDP formalities and product-specific permissions with the competent authority and qualified Malian counsel before launch.