Mali

Art. 9 lists the persons who must declare, Art. 10 requires a sworn declaration before taking office, filed with the President of the Supreme Court and updated by 31 December each year, and Art. 12 requires a final declaration within one month after leaving office. Art. 13 refers refusal or omission to the sanctions of Art. 35, which include loss of office and, for a false declaration, a fine equal to 12 months' salary.

Arts. 15-16 require controllers to tell people the purposes, recipients and retention period when collecting data, directly or not. Art. 12 gives a free right of access, Art. 13 a right to correction, completion or deletion with written confirmation within 30 days, and Art. 19 a right to object on legitimate grounds. Consent is defined in Art. 3(3); the law has no separate list of lawful bases.

Art. 23 requires client identity and risk-profile records to be kept for ten years after the account is closed or the relationship ends, and transaction records for ten years after the transaction.

Art. 12 requires reporting persons to adopt formal risk-management policies, procedures and controls approved by senior management, to designate one or more people to oversee them and, where appropriate, to set up a permanent and independent compliance function. Art. 13 adds duties for financial institutions: risk classification, client profiles, procedures and staff screening. Art. 15 requires a documented, up-to-date risk assessment.

Art. 16 requires identification of customers and beneficial owners and verification before a business relationship starts, Art. 17 lists the situations that trigger identification, Art. 18 requires verification before the relationship begins with limited exceptions, Art. 19 requires client information to be kept current, and Art. 20 requires constant vigilance over transactions and bans anonymous or fictitious-name accounts.

Art. 60 requires reporting persons to declare suspicious funds or transactions to the CENTIF immediately. Art. 61 requires them to refrain from the transaction until the report is made and to inform the CENTIF without delay if it was already executed. Art. 2 defines 'sans délai' as a maximum of 24 hours.

Arts. 7-8 require an internal AML/CFT unit attached to general management and one or more compliance officers; Art. 13 requires identity to be verified before a relationship starts and bans fictitious-name contracts; Art. 18 requires records to be kept for at least ten years; Art. 21 requires suspicion reports to the national FIU without significant delay, with no fixed number of days.

Art. 84 requires notification of any major operational incident to the BCEAO and the Commission Bancaire without delay, followed by a detailed report within 72 hours after the notification. Major incidents are defined in Art. 3(26).

Art. 28 requires notice to the BCEAO and the Commission Bancaire at least 30 days before outsourcing a critical operational function, and Art. 36 makes draft contracts for such outsourcing subject to prior information to the Central Bank under Art. 28. The text provides for notice, not approval.

Art. 9 bars providing the listed payment services without prior approval and listing as a payment institution. Art. 18 gives the BCEAO six months from a complete file, Art. 19 treats silence after six months as refusal (nine months where the home supervisor's non-objection is needed), and Art. 27 requires prior authorisation for listed changes such as mergers or major shareholding changes.

Art. 48 requires customer funds to be identifiable and kept apart from own funds, with funds not paid out or transferred by the end of the next working day after receipt placed in safeguarding accounts at a bank or microfinance institution and reconciled at the end of each working day.