Mali: technology regulation at a glance

Framework: BCEAO (Central Bank of West African States) / WAEMU regional instruments, principally the WAEMU Uniform AML/CFT Law (31 March 2023) introducing virtual-asset and VASP definitions; BCEAO C-CRYPTO committee tasked with a harmonised crypto-asset regulatory framework; BCEAO Instruction No. 001-01-2024 governing payment-service providers (in force 1 May 2025)

Mali has no standalone national crypto legislation; its regulatory environment is determined at the WAEMU regional level by the BCEAO. The WAEMU Council of Ministers adopted a uniform AML/CFT law on 31 March 2023 that introduced VASP definitions and a requirement for prior authorisation, but no operational VASP licensing regime is yet functioning in any WAEMU member state including Mali. The BCEAO's C-CRYPTO committee is actively developing a harmonised crypto-asset framework, leaving digital assets in a legal grey zone for now.

Framework: No dedicated AI law or regulation; relevant instruments are Loi n°2013-015 on personal data protection (APDP), Ordinance N°2023-022/PT-RM establishing CIAR-Mali (2023), and the National Cybersecurity Strategy 2026-2030

Mali has no AI-specific legislation, sectoral rules, or published national AI strategy as of May 2026. The country established a public AI and robotics research centre (CIAR-Mali) by presidential ordinance in August 2023, marking its first formal institutional step in the AI domain. Governance of AI-related risks is currently handled only indirectly through the general personal-data protection law of 2013 and a newly adopted cybersecurity strategy.

Framework: Law No. 2013-015 of 21 May 2013 on the Protection of Personal Data (as amended by Law No. 2017-070 of 18 December 2017), supervised by the Autorité de Protection des Données à caractère Personnel (APDP)

Mali enacted a comprehensive personal data protection law in 2013, establishing individual rights and controller obligations broadly analogous to pre-GDPR European frameworks. The independent supervisory authority APDP became operational in March 2016 and remains active as of 2026, having opened its first 2026 ordinary session in February with over 500 dossiers under review. A supplementary cybercrime law (Law No. 2019-056) adds further provisions relevant to digital data.

Framework: Regional WAEMU/UMOA framework administered by the BCEAO (Central Bank of West African States): Instruction n°008-05-2015 on electronic money issuers (EME) and Instruction n°001-01-2024 on payment services (payment institutions / EDP). Mali, as a UMOA member, applies these directly; licenses are granted per-country by the BCEAO.

Mali has a clear, in-force licensing regime for digital payments and fintech set at the regional level by the BCEAO, the central bank for the eight-member West African Monetary Union (UMOA/WAEMU) that issues the CFA franc. Electronic money issuers have been licensed under Instruction n°008-05-2015 (e.g. Orange Finances Mobiles Mali, EME.ML.008/2015), and a modernised payment-services regime (Instruction n°001-01-2024) now requires payment institutions and e-money firms to be licensed to operate; InTouch Mali obtained payment-institution (EDP) status in July 2025. The BCEAO also launched the regional interoperable instant-payment system PI-SPI in September 2025, while there is no dedicated open-banking or BNPL-specific legislation.

Framework: Loi No. 04-058/AN-RM du 25 novembre 2004 relative aux conditions d'entrée, de séjour et d'établissement des étrangers au Mali; Décret No. 05-322/P-RM du 19 juillet 2005 (implementing decree); administered by the Direction de la Police et des Frontières

Mali has no dedicated digital nomad or remote-work visa. The general immigration framework (Loi 04-058, 2004) permits foreigners to obtain a residence card (carte de séjour) by demonstrating sufficient means of subsistence without salaried employment, which is the only theoretical route for a self-employed remote worker. In practice this pathway is severely constrained: Mali carries a U.S. State Department Level 4 'Do Not Travel' advisory as of January 2026 due to terrorism, kidnapping and armed conflict, and as of 1 January 2026 Mali suspended visas to U.S. citizens entirely.

Framework: Law No. 2019-056 on the Suppression of Cybercrime (December 2019); Law No. 2013-015 on Personal Data Protection; Haute Autorité de la Communication (HAC) broadcast regulator; National Cybersecurity Strategy 2026-2030 (approved December 2025)

Mali's internet and online environment is governed by a 2019 cybercrime law that has been systematically used by the military junta to prosecute journalists, activists, and critics online. The junta has ordered internet shutdowns in conflict zones, restricted social media during protests, and banned numerous foreign media outlets, creating a climate of heavy state restriction rather than a rights-protective online safety framework. A newly adopted National Cybersecurity Strategy 2026-2030 focuses on infrastructure protection rather than platform accountability or user safety.

Framework: Law No. 2019-056 of 5 December 2019 on the Suppression of Cybercrime; Law No. 2013-015 of 21 May 2013 on the Protection of Personal Data; regulators: APDP (data protection), AMRTP (telecoms/ICT regulation), AGETIC (government ICT agency); National Cybersecurity Strategy 2026-2030 adopted December 2025

Mali's cybersecurity regime rests on two sectoral laws, a 2019 cybercrime suppression statute and a 2013 personal data protection law, without a unified cross-sector cybersecurity act comparable to NIS2. In December 2025 the Council of Ministers approved Mali's first National Cybersecurity Strategy and Action Plan 2026-2030, signalling intent to shift toward a coordinated framework. Mali ranks Tier 4 (basic) on the ITU Global Cybersecurity Index 2024, reflecting limited but existing legislative and institutional capabilities.

Framework: OHADA Uniform Act on Commercial Companies and Economic Interest Groups (2014 revision); Mali Investment Code, Law No. 2012-016 of 27 February 2012; API-Mali (Agence pour la Promotion des Investissements) one-stop shop (Guichet Unique)

Foreign investors may generally own 100% of a Malian company in most sectors, with registration formalised through the API-Mali Guichet Unique which targets a 72-hour processing time. The process is legally streamlined but practical completion routinely takes longer due to bureaucratic and governance challenges; sector-specific foreign-ownership caps apply in media and mining.