Fintech

KYB in Mali: Business Verification Requirements and Compliance Risks

A practical guide to verifying companies in Mali: data to collect, the beneficial-owner test, the public ownership register for extractive firms, and when a weak file becomes a CENTIF report.

Before a Malian company can open an account, get a payment facility, or join a mobile-money platform, the institution serving it has to answer one question: who actually owns and controls this business? Mali's 2024 AML ordinance makes that a legal duty, and a few Mali-specific details change how you answer it. VOVE ID builds business verification workflows for regulated teams, and the Malian rules show what a defensible ownership file has to contain.

This guide covers KYB requirements in Mali. For a full breakdown of the KYB framework, see our KYB Requirements Explained 2026.

Direct answer: Regulated firms in Mali must identify the company (legal name, legal form, registration and tax numbers, registered office), the people who run it, and every beneficial owner: anyone holding more than 25% of capital or voting rights, anyone controlling the company by other means, or, failing both, its senior manager. Files are kept for at least 10 years. If the beneficial owner cannot be identified, the firm should not open or keep the relationship and should report to CENTIF.

The legal basis for KYB in Mali

Four texts matter in practice:

Ordinance No. 2024-011/PT-RM of 30 August 2024 is Mali's current AML/CFT/CPF law. Its first article states that it transposes the WAEMU uniform law (Official Journal, special issue no. 17). That uniform law was adopted by the WAEMU Council of Ministers on 31 March 2023. The ordinance was later modified and ratified by Law No. 2024-022 (Official Gazette no. 29).
BCEAO Instruction No. 003-03-2025 of 18 March 2025 sets identification, verification, and KYC rules for credit institutions, financial holding companies, microfinance institutions, e-money institutions, and payment institutions (BCEAO).
CENTIF-Mali's 2022 guidelines are interpretive and not binding. They were written under the earlier 2016 law, but their identification annex is still the most concrete list of what a Malian file contains (CENTIF guidelines).
WAEMU Council of Ministers Decision No. 021 of 21 December 2023 sets the monetary thresholds used by the ordinance (BCEAO).

CENTIF-Mali is the financial intelligence unit that receives suspicious-transaction reports. Its own guidelines add that it also supervises certain reporting entities where no other authority has been designated. Banks and other financial institutions are supervised through the BCEAO framework.

Mali left the FATF list of jurisdictions under increased monitoring on 13 June 2025, after completing its action plan (FATF). The exit changes how Mali is rated, not what the ordinance requires from you.

What to collect on the company

Item	What to collect
Identity	Legal name, legal form, and constitutive documents (articles of association)
Registration	RCCM number (the commercial and personal property credit register), RCCM numbers of any branches, and the tax identification number
Address	Registered office, plus the principal place of business if different
Activity	What the company actually does, and the purpose and nature of the planned relationship
People	Partners or shareholders, directors, and the identity and powers of anyone who can operate the account
Control	A structure chart that runs down to natural persons

Sources: Article 26 of the ordinance and the CENTIF identification annex. When someone presents the file on the company's behalf, check that they are authorized to act (Article 17).

Who counts as a beneficial owner

The ordinance defines the beneficial owner of a company as a natural person who either holds, directly or indirectly, more than 25% of the capital or voting rights, or controls the management, administration, or direction bodies or the general meeting by any other means. Article 26 turns this into a cascade:

Identify who holds a controlling ownership interest.
If that is doubtful, or no one controls through ownership, identify who controls the company by other means.
If neither step names anyone, record the senior managing official.

Two practical points. "More than 25%" means a holder at exactly 25% does not trip the ownership test, so flag that case and test control as well. And do not stop at the first corporate layer: test ownership and control at every level until you reach a person. For trusts and similar arrangements, the settlor, trustees, protector, and beneficiaries are in scope.

Bearer shares and nominee arrangements are red flags in a KYB file. The ordinance requires companies issuing bearer shares, or using nominee shareholders and directors, to have mechanisms that prevent their misuse (Articles 80–81).

If the owner cannot be identified, the institution must not open the account, must refuse a one-off transaction, or must end an existing relationship, and it must file a suspicious-transaction report (Article 25). A separate duty covers any operation where the identity of the beneficial owner stays doubtful after due diligence (Article 60).

Mali's beneficial-ownership registers

Mali has a public beneficial-ownership register for extractive companies, created by Decree No. 2022-0107/PT-RM of 22 February 2022 and held at the registry offices that keep the RCCM. It receives declarations from companies and other entities in the extractive value chain (decree text). For a gold or mining customer, ask whether the declaration has been filed and compare it with what the customer tells you. Treat it as a cross-check, not as your only source.

The ordinance also requires every company to keep a shareholder register and its beneficial-owner information on Malian territory, to declare where it keeps them to the register referred to in Article 122, and to retain the information for at least 10 years after dissolution (Articles 76–79).

For the identity checks on each owner, see our KYC guide for Mali.

Gold, NGOs, and other higher-risk customers

Enhanced due diligence means more documents, a deeper ownership analysis, and senior-management approval where the ordinance requires it. In Mali the profiles that most often call for it are:

Gold and extractive companies, including artisanal operators. Dealers in precious metals and stones are designated non-financial businesses that must be authorized or registered before operating (Article 48)., so ask for the authorization or registration and keep a copy.
NGOs and other non-profits. The ordinance obliges them to register with the national authority, publish annual financial statements, deposit funds in accounts at licensed banks or microfinance institutions, and use regulated channels (Articles 56–57). Ask for each of these.
Cash-intensive businesses. Institutions must report cash transactions of FCFA 15 million or more, including apparently linked operations, to CENTIF (Article 72; Decision No. 021, Article 8), so large cash flows in a new customer's projected activity deserve a question at onboarding.
Politically exposed persons in ownership or control. Article 29 calls for a formal process to determine PEP status, senior-management approval, source-of-wealth and source-of-funds checks, enhanced monitoring, and a reassessment of the profile every three years.
Cross-border trade and complex structures, especially chains of entities with no visible commercial reason.

Keeping the file current

Update the file whenever you have reason to think it is no longer accurate (Article 16), and monitor the relationship against what you know about the business (Articles 19–20). CENTIF's guidelines suggest, as good practice rather than law, refreshing files every three years for low risk, two for medium, and one for high.

Treat these as trigger events: a change in shareholders or controlling persons, new directors or signatories, a new line of business (for example, a trading company starting to buy gold), new countries in its payment flows, and transactions that do not match the declared activity.

Keep KYB records for at least 10 years after the relationship ends. Records of individual transactions are kept for 10 years after execution (Article 23).

Reporting, and what a weak file costs you

File a suspicious-transaction report with CENTIF immediately when you suspect or have good reason to suspect funds linked to money laundering, terrorist financing, proliferation financing, or an underlying offense (Article 60). Do not carry out the transaction until you have filed, and never tell the customer. Reports made in good faith protect the institution and its staff from liability (Articles 67–68).

Weak KYB also shows up outside Mali. When a Malian bank serves foreign correspondents, it is assessed on its own controls, and correspondent banking with shell banks is prohibited (Articles 31–32). A thin ownership file on a corporate customer is exactly what a correspondent will ask about.

For reporting duties and program design, see our AML guide for Mali.

How VOVE ID fits

VOVE ID supports KYB cases in which the business submits its registration documents and profile details, adds its beneficial owners, and has each owner complete identity verification before the case goes to your team for review. Each step is logged, so the file can be shown to a supervisor or a correspondent bank. Configure the case to the Mali data points above, such as the RCCM number, the tax ID, and the identity of signatories. The decision to accept, escalate, or refuse stays with your compliance team.

Mali KYB checklist

Legal name, legal form, constitutive documents, RCCM number, tax ID
Registered office and principal place of business
Directors, shareholders, and authorized signatories, with proof of authority
Structure chart down to natural persons, with ownership and control tested at every layer
Beneficial owners identified and verified (more than 25%, control by other means, or senior manager)
Extractive customers: BO declaration checked against the public register
Gold dealers: authorization or registration confirmed
NGOs: registration, published financial statements, and bank account evidence
PEP check on owners and controllers, with senior-management sign-off where needed
Risk rating recorded, with a review date and a list of trigger events
STR decision documented if the owner cannot be identified
Records retained for at least 10 years

For the full source-linked version, with 11 control areas and 35 implementation checks, see VOVE ID's Mali KYC, KYB, and AML compliance checklist.

FAQ

What ownership threshold applies to beneficial owners in Mali?

More than 25% of capital or voting rights, held directly or indirectly. A person who controls the company by other means is also a beneficial owner, and the senior managing official is the fallback when neither test names anyone (Ordinance No. 2024-011/PT-RM, Articles 2 and 26).

Where can I check who owns a Malian gold or mining company?

Mali keeps a public beneficial-ownership register for extractive companies at the registry offices that hold the RCCM (Decree No. 2022-0107/PT-RM). Use it as a cross-check against what the customer declares, not as your only source.

What should an institution do if it cannot identify the beneficial owner?

It should not open the account, should refuse a one-off transaction, or should end the relationship, and it should file a suspicious-transaction report with CENTIF (Articles 25 and 60).

Sources

Conclusion

A KYB file in Mali is only as good as its answer to the ownership question. Collect the company data, trace ownership and control to natural persons, check the extractive-sector register where it applies, and keep the evidence for a decade. When the owner stays unknown, the ordinance already tells you what to do.

If your onboarding team is rebuilding its business verification flow for Mali, we can walk through how company and beneficial-owner checks fit your risk policy.

Show me how

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.