diff --git a/tools/offline.ml b/tools/offline.ml
index 589685f0..2b6c2aa2 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -136,6 +136,22 @@ let enable_auditor_cmd =
   enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
     ~validity_start
 
+let disable_auditor_cmd =
+  let doc = "Disable auditor." in
+  let auditor_pub =
+    Arg.(required & opt (some eddsa_pub) None & info [ "auditor_pub" ])
+  in
+  let validity_end =
+    Arg.(required & opt (some timestamp) None & info [ "validity_end" ])
+  in
+  Cmd.make (Cmd.info "disable-auditor" ~doc)
+  @@
+  let+ output = output
+  and+ master_key = master_key
+  and+ auditor_pub = auditor_pub
+  and+ validity_end = validity_end in
+  disable_auditor ~output ~master_key ~auditor_pub ~validity_end
+
 let global_fees_cmd =
   let doc = "Provides global fee configuration." in
   let start_date =
@@ -193,6 +209,7 @@ let cli =
       revoke_denom_cmd;
       revoke_signkey_cmd;
       enable_auditor_cmd;
+      disable_auditor_cmd;
       global_fees_cmd;
     ]
 
@@ -200,8 +217,6 @@ let main () = Cmd.eval_result cli
 let () = if !Sys.interactive then () else exit (main ())
 
 (* TODO all management operations:
-     /management/auditors
-     /management/auditors/$AUDITOR_PUB/disable
      /management/wire-fee
      /management/wire
      /management/wire/disable
diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml
index 4dcde9c9..5915cd5d 100644
--- a/tools/offline_impl.ml
+++ b/tools/offline_impl.ml
@@ -155,3 +155,15 @@ let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub
   let* s = Api.encode Api.AuditorSetupMessage.jsont v in
   let* () = write_file output s in
   Ok ()
+
+let disable_auditor ~output ~master_key ~auditor_pub ~validity_end =
+  let open Crypto in
+  let* key = read_master_key_file master_key in
+  let master_sig =
+    let open Bin_sig.MasterDelAuditor in
+    sign_f ~f:(EddsaSignature.sign ~key) { end_date= validity_end; auditor_pub }
+  in
+  let v = Api.AuditorTeardownMessage.{ master_sig; validity_end } in
+  let* s = Api.encode Api.AuditorTeardownMessage.jsont v in
+  let* () = write_file output s in
+  Ok ()