Metadata (for Ghost — not part of the article body)

• Slug (published, do not change): aml-in-mali-regulatory-framework-key-risks-and-compliance-expectations
• Meta description: Mali AML/CFT in 2026: the 2024 ordinance, immediate CENTIF reporting, sanctions freezing, program duties, and life after the FATF grey list.
• Excerpt: How an AML program in Mali runs: who is covered, compliance-function duties, CENTIF reporting and what follows, wire-transfer and cash rules, and the Mali-specific risks to rate.
• LinkedIn summary: 🇲🇱 In Mali, a suspicious-transaction report has to be filed immediately, the transaction is held until it is filed, and the customer must not be told. Under Ordinance No. 2024-011/PT-RM, CENTIF can also block the transaction for up to four days once it has the report. Behind that moment sits the rest of the program: a documented risk assessment that covers new products before launch, a designated compliance officer, trained staff, monitoring for unusual activity, targeted financial sanctions screening, and 10-year records. Mali left the FATF grey list in June 2025, but examiners and correspondent banks will still ask whether the controls work. Our guide maps the framework, the reporting mechanics, and the Mali-specific risks, from gold and cash to NGO flows and cross-border cash movement.Read the full guide → https://blog.voveid.com/aml-in-mali-regulatory-framework-key-risks-and-compliance-expectations/#VOVEID #AML #Mali #WAEMU #CENTIF #FATF #Fintech #Compliance #WestAfrica
• Primary tag: AML
• Additional tags: Mali, Fintech

AML in Mali: Regulatory Framework, Key Risks, and Compliance Expectations

A suspicious-transaction report in Mali is not something you file when convenient. The 2024 ordinance says to file immediately, to hold the transaction until you do, and to say nothing to the customer. Most of a Malian AML program exists to make that moment work. VOVE ID supplies the screening and monitoring layer of such a program, and the sections below set out what the Malian rules wrap around it.

This guide covers AML/CFT requirements in Mali. For a full breakdown of the AML framework, see our AML Requirements Explained 2026.

Direct answer: Mali's AML/CFT/CPF regime rests on Ordinance No. 2024-011/PT-RM of 30 August 2024, which transposes the 2023 WAEMU uniform law, plus BCEAO instructions and CENTIF guidance. Obliged entities must assess risk, run documented internal controls with a designated compliance officer, apply customer due diligence, monitor transactions, report suspicion to CENTIF immediately, apply targeted financial sanctions without delay, and keep records for 10 years.

Who is covered

The ordinance applies to financial institutions, designated non-financial businesses and professions (DNFBPs), and virtual asset service providers (VASPs) (Official Journal, special issue no. 17). The ordinance was later modified and ratified by Law No. 2024-022 (Official Gazette no. 29).

• Financial institutions include credit institutions, payment institutions, e-money institutions, microfinance institutions, insurers, regional-market intermediaries, manual money changers, fintech companies, and the agents who act for them.
• DNFBPs include casinos and gaming operators, real estate professionals, dealers in precious metals and stones, lawyers, notaries, accountants, company-service providers, vehicle dealers, travel agencies, hotels, professional sports clubs and agents, cultural-event promoters, cash-in-transit firms, and security companies.
• VASPs need prior authorization from the competent authority.
• Non-profits have their own provisions: registration, annual published financial statements, banking of all funds, and prompt reporting of terrorism-financing concerns to CENTIF.

Coverage also decides licensing. Classify each product and agent model, and obtain the national or WAEMU authorization before launching regulated activity (Articles 2–4 and 58–59; for payment services, BCEAO Instruction No. 001-01-2024).

Who does what

• CENTIF-Mali is the financial intelligence unit. It receives and analyzes reports, acknowledges them, can request more information, and passes cases to the public prosecutor. CENTIF's own 2022 guidelines add that it also supervises certain reporting entities where no other supervisor has been designated (CENTIF guidelines).
• The BCEAO issues the instructions that apply to financial institutions. In March 2025 it issued Instruction No. 001-03-2025 on internal control and compliance, No. 003-03-2025 on KYC, and No. 002-03-2025 on the declaration threshold for physical transport of cash within the union (overview).
• The Minister of Finance sets the suspicious-transaction report template and, under a 2021 decree, is the competent authority for administrative asset freezes (per CENTIF's guidelines).
• Customs handle declarations of cash and bearer instruments crossing the border.

What a compliant program contains

The ordinance expects each obliged entity to have:

• Written policies and controls covering customer and beneficial-owner identification, risk management, due diligence, transaction monitoring, record-keeping, internal control, data protection, and staff recruitment and training, all approved by senior management (Article 12).
• A designated person responsible for implementing them, and, where size and activity justify it, a permanent and independent compliance function.
• A documented risk assessment that covers customers, geographies, products, and delivery channels, and is kept up to date (Article 15). It must also assess new products, practices, and technologies before they launch. Fintech teams should treat this as a release gate.
• Group-wide programs where the entity belongs to a group, including information sharing for AML purposes (Article 14).

CENTIF's guidelines add practical expectations: tell CENTIF who the AML officer is, give that officer real-time access to customer data and a direct line to management, and send an annual activity report to management, the supervisor, and CENTIF. Keep training materials and attendance records, and run an internal alert channel for staff.

An examiner will typically ask to see:

• the written enterprise-wide risk assessment, with its method;
• customer files with a risk rating and the due diligence evidence behind it;
• the procedures manual and the internal control reports;
• training records;
• the STR log and the reasoning behind decisions not to file.

For a source-linked implementation checklist covering these controls, see VOVE ID's Mali KYC, KYB, and AML compliance checklist.

Monitoring for unusual activity

Institutions must monitor all operations against what they know of the customer's business, risk profile, and source of funds (Article 20). Three categories need special scrutiny and a written, confidential report that is kept for 10 years (Article 21):

• cash or bearer-instrument payments above a regulatory threshold;
• unusually complex transactions, or transactions above a set amount with no apparent economic or lawful purpose;
• operations that are unusually large for the customer's profile.

WAEMU Decision No. 021 sets the amounts. Financial institutions should identify multiple daily or unusually frequent cash transactions above FCFA 9 million, and specially examine cash or bearer-title payments of FCFA 50 million or more and unusual or unjustified operations of FCFA 10 million or more (Articles 17 and 21; Decision No. 021, Articles 3–4).

CENTIF's guidelines describe an atypical transaction as one that is complex, involving several legal entities or trusts across countries; abnormally large for the customer; made in an unusual pattern; or without a visible economic purpose. They also note that some reporting entities should use a monitoring system that generates alerts.

Reporting to CENTIF

1. File immediately on suspicion of money laundering, terrorist financing, proliferation financing, or an underlying offense, including attempted transactions (Article 60). Use the route on CENTIF's declaration page and keep the acknowledgment of receipt. Suspected tax fraud is reportable when at least one regulatory criterion is present.
2. Hold the transaction until the report is filed (Article 61). If it was impossible to wait, or the need to report emerged later, tell CENTIF without delay. The ordinance defines "without delay" as a maximum of 24 hours.
3. Expect a possible block. CENTIF can oppose execution of a reported transaction, in writing, for up to four days (Article 65). It acknowledges receipts and refers cases to the prosecutor (Articles 64 and 66).
4. Keep it confidential. Do not tell the customer or any third party about the report (Article 63). Good-faith reports protect the institution and its staff from liability (Articles 67–68).
5. Update the file. Any information that confirms, changes, or weakens the report goes to CENTIF without delay (Article 60).
6. Report cash. Cash transactions of FCFA 15 million or more, single or linked, are reported to CENTIF (Article 72; WAEMU Decision No. 021, Article 8) (BCEAO).

Wire transfers, cash, and sanctions

Wire transfers. The ordering institution must obtain and verify the originator's name, account number, and address (or national ID number, or place and date of birth), and obtain the beneficiary's name and account (Article 39). It must make the data available within three working days of the beneficiary institution's request (Article 40) and must not execute a transfer when it lacks the data (Article 42). An intermediary that cannot get missing originator data within three days must not execute the transfer and must inform CENTIF (Article 45).

Cash controls. Debts above a set threshold cannot be paid in cash, and real estate prices above a set threshold must be paid by transfer or check (Articles 73–74). Travelers entering or leaving Mali must declare cash and bearer instruments above the threshold, and customs can hold suspected funds for up to 72 hours (Articles 70–71).

Targeted financial sanctions. The ordinance defines "without delay" as a maximum of 24 hours and applies freezing measures to wire transfers (Article 41). Freezing happens without prior notice to the designated person (Article 89), and funds, freezes, and attempted dealings are reported to CENTIF and the competent authority immediately (Articles 90–91). CENTIF's guidelines identify the UN sanctions regimes and WAEMU measures as the sources, and the Minister of Finance as the administrative freezing authority. Screen at onboarding, on every list update, and on every transfer.

Mali-specific risks to rate

• Gold and extractives, including artisanal mining and informal trade. Dealers in precious metals and stones are DNFBPs and need authorization or registration. Mali also keeps a public beneficial-ownership register for extractive companies.
• Cash-intensive activity, which limits traceability and drives the 15 million FCFA reporting duty.
• Humanitarian and NGO flows, where the funds-handling rules for non-profits are your benchmark.
• Cross-border trade and cash movement, within the WAEMU and beyond.
• PEPs and public-sector links.
• New products and channels, including digital and agent-based services, which must be assessed before launch.

For how to verify extractive-sector companies and their owners, see our KYB guide for Mali.

For the PEP process and customer identification data, see our KYC guide for Mali.

After the FATF grey list

On 13 June 2025 the FATF removed Mali, Croatia, and Tanzania from its list of jurisdictions under increased monitoring after they completed their action plans, and said they would keep working with their regional bodies to sustain improvements (FATF). Mali was not named in the FATF's public lists of 19 June 2026, and it remains under GIABA follow-up (GIABA). The practical lesson is that the list was a snapshot. Your supervisor and your correspondent banks will keep asking whether controls work, and the evidence they can inspect is the one described above.

How VOVE ID fits

VOVE ID supports the operational side of this program with AML and sanctions screening, transaction monitoring, and audit-ready logging, so alerts, decisions, and the reasons behind them stay in one record. Set the rules, thresholds, and escalation paths to your own risk assessment, and keep the filing decision with your compliance officer.

FAQ

How fast must a suspicious transaction be reported in Mali?

Immediately, and the transaction is held until the report is filed (Articles 60 and 61). If it has already been carried out, CENTIF must be told without delay, which the ordinance defines as a maximum of 24 hours.

Can CENTIF stop a transaction?

Yes. Once it holds a report, CENTIF can oppose execution of the transaction, in writing, for up to four days (Article 65).

Is Mali still on the FATF grey list?

No. The FATF removed Mali from its list of jurisdictions under increased monitoring on 13 June 2025 after it completed its action plan. The obligations in the ordinance apply regardless.

Sources

• Ordinance No. 2024-011/PT-RM of 30 August 2024, Journal Officiel du Mali, special issue no. 17
• Official Gazette no. 29, containing Law No. 2024-022 and the modified Ordinance No. 2024-011
• CENTIF-Mali, Lignes directrices en matière de LBC/FT/FP (2022)
• BCEAO Instruction No. 001-03-2025 of 18 March 2025
• CENTIF-Mali, suspicious-transaction declaration page
• BCEAO Instructions of March 2025, overview (Droit Médias Finance)
• WAEMU Decision No. 021 of 21 December 2023, implementation thresholds (BCEAO)
• FATF, Outcomes of the Joint FATF-MONEYVAL Plenary, 12–13 June 2025

Conclusion

Mali's AML rules are specific about timing: report immediately, hold the transaction, keep quiet, and freeze without delay. Teams that practice those steps before an alert arrives, and keep the documents that prove them, are the ones that come through an inspection or a correspondent-bank review without surprises.

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.