Fintech

KYC in Mali: Regulatory Requirements, Risk Areas, and Compliance Considerations

What regulated firms in Mali must collect, verify, and keep: ID data, verification timing, remote-onboarding risk, PEPs, mobile-money agents, and the duty to report suspicion to CENTIF immediately.

Mali adopted a new AML ordinance in August 2024, and the BCEAO followed in March 2025 with an instruction written specifically for KYC. If your onboarding flow still reflects the older rules, it is worth a second look. VOVE ID builds digital onboarding flows for regulated teams, so this guide stays on what the Malian rules ask of the customer file.

This guide covers KYC requirements in Mali. For a full breakdown of the KYC framework, see our KYC Requirements Explained 2026.

Direct answer: Financial institutions in Mali must identify and verify every customer and beneficial owner before the relationship starts. In limited cases verification may finish after opening, but no later than the first transaction. They must apply due diligence in proportion to risk, treat remote onboarding as higher risk, and keep records for 10 years. The legal base is Ordinance No. 2024-011/PT-RM of 30 August 2024, supplemented by BCEAO Instruction No. 003-03-2025.

The legal stack for KYC in Mali

Ordinance No. 2024-011/PT-RM of 30 August 2024. Mali's AML/CFT/CPF law. Its first article states that it transposes the WAEMU uniform law adopted on 31 March 2023 (Official Journal, special issue no. 17). The ordinance was later modified and ratified by Law No. 2024-022 (Official Gazette no. 29).
BCEAO Instruction No. 003-03-2025 of 18 March 2025. Identification, identity verification, and customer knowledge for credit institutions, financial holding companies, microfinance institutions, e-money institutions, and payment institutions (BCEAO). A companion instruction, No. 001-03-2025, covers internal control and compliance.
CENTIF-Mali's 2022 guidelines. Interpretive, not binding, and written under the earlier 2016 law, but still the most practical list of what a Malian customer file holds (guidelines).

The ordinance's list of financial institutions is wide. It includes banks, payment institutions, e-money institutions, microfinance institutions, fintech companies, and the agents and intermediaries that act for them. Virtual asset service providers must be licensed before operating, and designated non-financial businesses such as real estate agents, dealers in precious metals and stones, casinos, lawyers, notaries, and accountants also have customer-identification duties.

What to collect from an individual

CENTIF's identification annex lists the data points below. Instruction No. 003-03-2025 now governs financial institutions' KYC detail, so read it alongside this list.

Customer	Core data
Malian national	Full name, parents' names (where applicable), date of birth, national ID card (CNI) number and expiry
Resident foreigner	Residence or registration card, with issue and expiry dates
Non-resident foreigner	Passport or equivalent, with issue and expiry dates and the issuing authority
All individuals	Exact address, profession, declaration of the source of funds, purpose and nature of the relationship
Traders	RCCM registration number and tax identification number
Sole proprietors under the self-entrepreneur regime	Registration number in the national self-entrepreneur register

For anyone acting for the customer, add their identity and the power of attorney or equivalent document.

For business customers and their beneficial owners, see our KYB guide for Mali.

When to verify, and what happens if you cannot

Verification applies when opening an account, taking custody of securities, starting any business relationship, handling an occasional transaction, sending a domestic or international transfer, or whenever there is suspicion of money laundering, terrorist financing, or proliferation financing. It also applies when someone claims to act for a customer, so you can check that they are authorized (Article 17). Anonymous accounts and accounts in fictitious names are prohibited (Article 20).

Verification should be done before the relationship starts. It may be completed afterward only if it happens as soon as possible and no later than the first transaction, if delaying is essential to normal business, and if the risk is effectively managed (Article 18).

If you cannot complete due diligence, do not open the account, refuse the one-off transaction, or end the existing relationship, and file a suspicious-transaction report about the customer (Article 25).

Remote onboarding

The ordinance requires "special and sufficient" measures for customers who are not physically present, and leaves the practical detail to the authorities (Article 22). CENTIF's guidelines treat non-face-to-face onboarding as a higher-risk situation that calls for enhanced due diligence. They suggest refusing remote onboarding where the customer seems to be avoiding contact to hide their identity, building up knowledge of the customer over time (for example through a later in-person meeting or extra documents), routing the first transaction through an account in the customer's name at a regulated institution in Mali or in a state with equivalent obligations, and requiring copies of valid official photo ID or using an electronic means of identification.

Because the BCEAO's March 2025 KYC instruction now sits above those guidelines for financial institutions, review its remote-identification conditions before you finalize a digital flow.

Biometrics and personal data

KYC in Mali also sits under the personal-data law. Law No. 2013-015 governs how identity, ownership, screening, and biometric data are processed, and Mali's data protection authority (APDP) runs the declaration and authorization procedures (Law 2013-015; APDP). Before you deploy facial recognition, liveness templates, fingerprints, or national-identifier processing, confirm the exact APDP procedure for that processing, keep only the data you need, and check whether sending data to a hosting or support location outside Mali needs APDP authorization. Treat this as a launch gate, next to licensing and the risk assessment.

Risk tiers and PEPs

Apply simplified, standard, or enhanced due diligence according to risk (Article 84), and record what you did and why. As good practice rather than law, CENTIF suggests refreshing customer files every three years for low risk, two for medium, and one for high.

Politically exposed persons are defined to include domestic, foreign, and international-organization PEPs, their family members, and their close associates. For each, Article 29 requires a formal process to establish PEP status, senior-management approval before the relationship starts, checks on the source of wealth and funds, enhanced ongoing monitoring, and a reassessment of the profile every three years. CENTIF's guidelines add that domestic and foreign PEPs should be treated the same.

In Mali, the factors that most often raise a customer's risk rating are cash-intensive activity, gold and other extractive trade, humanitarian or NGO-linked flows, cross-border trade, PEP links, and ties to jurisdictions the FATF calls on countries to treat with enhanced diligence (Article 30). Mali itself left the FATF grey list on 13 June 2025 (FATF), which does not change these duties.

Agents and mobile-money distribution

Much of Mali's retail finance runs through agents. The ordinance expects an institution to make sure its distributors, agents, branches, and subsidiaries apply the same obligations (Article 21). Money-transfer providers that use agents or sub-agents must build them into their AML program and monitor their compliance (Article 33). If your KYC happens in an agent's shop, the agent's process is your process: train them, sample their files, and keep the evidence.

Reporting and records

When a KYC file turns up something suspicious, the duty to report is immediate: file with CENTIF as soon as you suspect illicit funds, hold the transaction until you have, and never tell the customer (Articles 60, 61, and 63). The same duty applies when the identity of a customer or beneficial owner stays doubtful after due diligence. Two data rules sit directly on the KYC file. Wire transfers must carry the originator's name, account number, and address (or national ID number, or place and date of birth), plus the beneficiary's name and account, and the data goes to the beneficiary's institution within three working days of a request (Articles 39–40). Identity and customer-knowledge records are kept for 10 years after the account closes or the relationship ends, and transaction records for 10 years after execution (Article 23).

For the full reporting mechanics, see our AML guide for Mali.

Mali KYC checklist

Identity data captured per customer type (CNI, residence card, or passport), with expiry dates
Address, profession, source of funds, and purpose of the relationship recorded
Authority of any representative checked
Beneficial owner identified for every non-individual customer
Risk rating assigned and written into the file
PEP and sanctions screening done at onboarding and on a schedule afterward
Remote onboarding treated as higher risk, with the BCEAO instruction's conditions reviewed
APDP route confirmed before biometric or cross-border data processing
Agents trained, sampled, and covered by your AML program
STR decision path documented, including the hold-and-file rule
Records retained for at least 10 years

How VOVE ID fits

VOVE ID supports the KYC steps above with document capture and OCR, biometric liveness, face matching, and AML and sanctions screening, with each result logged so the file can stand up to an inspection. Before you rely on it for Mali, confirm with the VOVE ID team that the Malian documents you accept are covered in your configuration, confirm the APDP route for biometric processing, and set the rules for what an automated result can clear and what goes to manual review.

For the full source-linked version, with 11 control areas and 35 implementation checks, see VOVE ID's Mali KYC, KYB, and AML compliance checklist.

FAQ

Can a Malian institution onboard customers remotely?

The ordinance allows it with "special and sufficient" measures (Article 22), and CENTIF's guidelines treat it as higher risk that needs enhanced due diligence. For financial institutions, check the remote-identification conditions in BCEAO Instruction No. 003-03-2025 before you finalize the flow.

What identity document does a foreign resident need?

CENTIF's identification annex lists a residence or registration card, with issue and expiry dates, for resident foreigners, and a passport or equivalent for non-resident foreigners.

Do biometric checks need special handling in Mali?

Yes. Biometric and national-identifier processing falls under heightened controls in Law No. 2013-015, so confirm the exact APDP procedure before you deploy facial recognition or liveness checks, and check any transfer of the data outside Mali.

How long must KYC records be kept in Mali?

For 10 years after the account is closed or the relationship ends. Transaction records are kept for 10 years after execution (Article 23).

Sources

Conclusion

Mali's KYC rules reward firms that can show their work. A customer file that records who the person is, why you rated the risk the way you did, and what you did when something looked wrong will hold up with CENTIF, with the BCEAO, and with a correspondent bank. A file that only shows a scanned ID will not.

To see how document checks, liveness, and screening can be set up around your Mali onboarding policy, our team can walk you through it.

Talk to our team

This article is intended for general informational purposes only and does not constitute legal, financial, or regulatory advice. KYC/KYB/AML requirements may vary depending on jurisdiction, industry, and specific business circumstances. For up-to-date and binding compliance obligations, readers should refer to the relevant regulatory authorities or consult qualified professionals.