Crypto Regulation in Mauritius 2025 : A Practical Guide for VASPs

Mauritius has built a clear, FATF-aligned regime for virtual assets under the Virtual Asset and Initial Token Offering Services Act, 2021 (VAITOS), supervised by the Financial Services Commission (FSC). Five VASP licence classes cover brokerage, wallet, custody, advisory and marketplace/exchange services, with structured fit-and-proper, mind-and-management, AML/CFT and operational controls. This article distils what you need to know – who regulates, what is regulated, how marketing works, fee signals, mandatory requirements, application steps, and documents – so you can plan with confidence and speed. (Legal disclaimer at the end.)

1) Who regulates crypto in Mauritius?

Financial Services Commission (FSC). The FSC regulates and supervises VASPs and Issuers of Initial Token Offerings (IITOs) within the non-bank financial services sector. VAITOS expressly designates the FSC as both the prudential and AML/CFT supervisor for VASPs and IITOs (see VAITOS background in the FSC’s AML/CFT Guidance Notes, which cite section 5 VAITOS and set out the FSC’s supervisory mandate).

Banks and payment institutions. Banks or National Payment Systems Act (NPSA) licensees need Bank of Mauritius (BoM) written approval before even applying; moreover, Class M, O, S licences may only be issued to a subsidiary of the bank/NPS licensee (banks may directly apply for Class R or Class I with BoM approval).

2) What counts as a “virtual asset” and a “virtual asset exchange”?

FATF-consistent definitions are embedded across FSC Guidance and FAQs. In brief, a VA is a digital representation of value that can be traded/transferred and used for payment or investment; digital representations of fiat, securities or other financial assets are excluded.

A Virtual Asset Exchange must obtain a Class S (Virtual Asset Market Place) licence. The FSC FAQ explains the scope – centralised or decentralised platforms facilitating VA/fiat or VA/VA conversion for third parties, and notes inclusions/exclusions.

3) Marketing crypto services (including ITOs): what’s allowed?

1. ITO communications. Issuers must register and publish a White Paper (signed by all governing body members) with prescribed disclosures; ads must be clearly identifiable, consistent with the White Paper, and not misleading. Purchasers have rescission/withdrawal rights where there’s misrepresentation or within a short cooling-off window.
2. Change control & supplements. If information arises that may affect purchasers before the offer closes, a supplement must be filed with the FSC; changes to token classes need prior FSC approval.
3. VASPs’ ongoing conduct. The FSC highlights systems/controls to prevent market abuse, proper record-keeping (including originator/beneficiary information for VA transfers), segregation of client monies/assets, and maintenance of minimum stated unimpaired capital by licence class.

4) Regulated activities (licence classes) & what you can offer

Mauritius licenses five principal VASP classes. Below are the services you may market under each class (illustrative, based on the licence criteria and FSC FAQ).

• Class M: Virtual Asset Broker-Dealer (VA-1.1)

Activities typically include executing client orders, dealing as principal/agent, and facilitating OTC dealing; applications must address client onboarding, complaints handling, IT/cybersecurity, outsourcing, and liquidity-provider arrangements.

• Class O: Virtual Asset Wallet Services (VA-1.2)

Provision/operation of custodial and/or non-custodial wallets, safeguarding client keys and enabling VA transfers. The business plan must detail client asset arrangements, flows of fiat/VA, technology stack, and capital adequacy approach.

• Class R: Virtual Asset Custodian (VA-1.3)

Safekeeping and administration of client VAs and associated keys, with strict segregation, reconciliation, and solvency/liquidity safeguards; similar documentation as Class O but framed for full custody.

• Class I: Virtual Asset Advisory Services (VA-1.4)

Investment-style advice on VAs (non-discretionary/discretionary parameters as cleared with the FSC), including suitability, risk disclosures, and conflicts management.

• Class S: Virtual Asset Market Place (VA-1.5)

Exchange/marketplace operations – order matching, or purchasing as principal upon match; often includes listing, market integrity and surveillance obligations.

5) Paid-up capital & licensing fees (signals you can budget on)

1. Licence fees (processing & annual): The FSC’s class criteria include fee schedules. Illustrative entries include:

• Class M (Broker-Dealer): Processing USD 1,000 / MUR 45,000; Annual USD 2,000 / MUR 90,000.
• Class O (Wallet): Processing USD 1,000 / MUR 45,000; Annual USD 1,900 / MUR 85,000.
• Class R (Custodian): Processing USD 1,500 / MUR 70,000; Annual USD 2,500 / MUR 110,000.
• Class I (Advisory): Processing USD 3,000 / MUR 135,000; Annual USD 5,000 / MUR 220,000.
• Class S (Market Place): Processing USD 3,000 / MUR 135,000; Annual USD 5,000 / MUR 220,000.

2. Minimum stated unimpaired capital: The regime requires VASPs to maintain minimum capital by class; the FSC FAQ highlights this obligation but leaves the exact amount class-dependent and subject to FSC confirmation (expect FSC to tie thresholds to your business model, risk and forecast).

6) Mandatory licensing requirements (what you must put in place)

Corporate presence and mind & management. Applicants must be a Mauritian company, directed and managed from Mauritius, with a physical office; the FSC examines where strategy/executive decisions are made, board meeting location, and officers’ residency.

Fit & proper. Controllers, beneficial owners, associates and officers must satisfy FSC fit-and-proper criteria (integrity, competence, solvency).

AML/CFT framework.

• Adopt a risk-based approach, robust CDD/EDD, transaction monitoring, suspicious transaction reporting, and sanctions screening, in line with FIAMLA 2002/Regulations 2018 and FSC’s AML/CFT Handbook.
• Maintain escalation to an MLRO and internal reporting procedures; the Guidance Notes detail STR triggers and expectations for proactive monitoring.

Operational controls.

• Client asset protection and segregation; maintaining sufficient VAs to meet obligations where you hold custody.
• IT/Cybersecurity and BCP/DR documented in your IT manual and platform disclosures; independent testing/audits and third-party due diligence where applicable.
• Insurance & outsourcing: professional indemnity insurance (PII) quotes and detailed outsourcing controls are typically required.

7) Application procedure (how the FSC expects you to proceed)

Step 1 – Select class(es) and structure. Determine the correct Class M/O/R/I/S scope and confirm group structure (including BoM approval if you are a bank/NPSA licensee planning an M/O/S application via subsidiary).

Step 2 – File under VAITOS s.7. Submit a formal application under section 7 VAITOS, with the relevant FSC Application Form and cover letter.

Step 3 – Pay fees. Include processing fees and be ready for annual fees on approval (see fee signals above).

Step 4 – Evidence of mind & management and substance. The FSC will assess where decisions are made, who leads risk/ops, and your local staffing.

Step 5 – Provide full risk, AML/CFT and controls pack. AML manual (aligned with FIAMLA/FIAMLR), client onboarding/complaints, IT manual and platform architecture, BCP/DR, outsourcing frameworks, PII.

Step 6 – Business plan & financials. Three-year financial forecasts, capital plan (showing how you will meet minimum unimpaired capital), client asset arrangements, expected volumes, and liquidity approach.

Step 7 – Class-specific particulars.

• Class M: liquidity provider use, OTC framework, portfolio execution details.
• Class O/R: client asset safeguarding, key management, reconciliations.
• Class S: matching engine, order-handling, market integrity & surveillance (addressed in your IT manual and conduct controls).

Step 8 – Respond promptly to FSC queries. Incomplete applications may be returned; if you don’t respond within two months of the last query, the FSC may stop processing (you’d have to re-file).

8) Documents required (core set you should prepare)

Across licence classes, expect to provide the following at filing (illustrative; the FSC can ask for more):

• Corporate & ownership: incorporation filings; shareholder/beneficial ownership charts; “fit and proper” packs (PQ forms, IDs, proof of address; corporate good standing).
• Business plan: activities/services, client types (retail/sophisticated), geographic focus, marketing plan, end-to-end flowcharts of fiat and VA movements.
• Financials: three-year forecasts and capital plan showing compliance with minimum unimpaired capital (class-dependent).
• Policies & controls: AML/CFT Manual, Onboarding/Complaints, IT & Cybersecurity manual (security, backups, DR/BCP), outsourcing agreements, PII quote.
• Technology & platform (esp. Class M/S): platform architecture, independent testing/audit, access rights model, user rights protection, and key third-party contracts/due diligence if applicable.
• Premises & staffing: registered office lease, org chart, key personnel CVs, and Mauritius-based decision-makers.

For IITOs (if applicable): Registration at least 45 days before the start of the offer via a Mauritian virtual exchange (or equivalent), with processing typically within 30 days; maintain and publish a compliant White Paper throughout the offer period (≤ 6 months) and 15 days thereafter.

9) How Cryptoverse Legal helps you win authorisation – fast

1. Regulatory mapping & strategy. We benchmark your roadmap against Class M/O/R/I/S scope and confirm the most efficient licensing path, including BoM interface strategy for banks/NPSA licensees.
2. Application engineering. We draft the section 7 VAITOS application, assemble a business plan, AML/IT/BCP manuals tailored to your controls, and stress-test your governance against FSC expectations on mind-and-management, capital, and client-asset protection.
3. Tech & market integrity. For exchanges/brokers, we translate your matching engine, connectivity, surveillance and custody stack into FSC-ready artefacts and disclosures – covering testing, third-party risk and user-rights protection.
4. Marketing & ITO compliance. We harden your communications and ITO materials so they are accurate, non-misleading and consistent with the White Paper (and we build supplement/change-control playbooks).
5. Ongoing obligations. We set up your post-licensing compliance calendar: reporting, audits, change approvals (shares/controllers/officers/scope), market abuse prevention, record-keeping and segregation checks.

Final notes & practical tips

• Substance matters. The FSC’s “directed and managed from Mauritius” test is real – board cadence, local executives and risk/ops decision-making must be demonstrable.
• Iterate early on AML/IT manuals. The most common re-queries centre on transaction monitoring logic, sanctions controls, wallet/key management and BCP testing – build those deeply from day one.
• Budget for fees/capital. Plan for the processing/annual fees above and a class-appropriate unimpaired capital buffer (confirm current thresholds with the FSC during scoping).

Legal disclaimer

This article provides general information based on publicly available FSC guidance and licence criteria and does not constitute legal advice. Regulatory positions can change and class-specific capital or conditions may be updated by the FSC. Please obtain tailored advice for your facts and proposed business model.

FAQs: