Guidance Notes on Security Token Offerings and Security Token Trading Systems

Financial Services Commission Page 1 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org Fintech Series Guidance Notes Security Token Offerings and Security Token Trading Systems (Updated 23 August 2022)

1. Background 1.1 The Financial Services Commission, Mauritius (“FSC”), the integrated regulator for the non-banking financial services and global business sectors, remains highly supportive of Fintech-related initiatives in Mauritius.

Financial Services Commission Page 2 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 1.2 These Guidance Notes were issued by the FSC pursuant to its powers under section 7(1) (a) of the Financial Services Act (the “FSA”) on 15 June 2020 and updated on 23 August 2022. 1.3 The objective of these Guidance Notes is to provide for the implementation of a common set of standards for Security Token Offerings (“STO”) and the licensing of Security Token Trading Systems in Mauritius. 1.4 Following the enactment of the Virtual Asset and Initial Token Offerings Services Act 2021 (“VAITOS Act”), the FSC deemed it necessary to update the contents of the Guidance Notes to, inter-alia, avoid any inconsistencies with the provisions of the VAITOS Act and the new definitions (such as ‘Virtual Asset’ or ‘Virtual Token’) provided therein. 1.5 The Guidance Notes neither derogate nor restrict the powers vested upon the FSC by statute, and should be read together with the relevant Acts as well as guidelines and Circulars issued by the FSC.

Financial Services Commission Page 3 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 1.6 The Guidance Notes form part of ‘guidelines’ issued by the FSC pursuant to its powers under section 7(1) (a) of the FSA. Breaches of the Guidance Notes may entail regulatory sanctions. In addition, the FSC may direct any licensee to comply with the Guidance Notes or any part thereof and failure to do so, shall constitute a contravention of the law and may lead to prosecution. PART I – SECURITY TOKEN OFFERINGS 2. Definition of Security Token 2.1 “Security Tokens” are “securities”, as defined under the Securities Act (the “SA”), represented in digital format. For the avoidance of doubt, the VAITOS Act does not apply to digital representations of securities which fall under the purview of the SA. 2.2 By way of illustration, a Security Token may constitute: 2.2.1 a share, where it confers or represents ownership or economic rights of the holder of the security token in a corporation;

Financial Services Commission Page 4 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 2.2.2 a debenture, where it constitutes or evidences the indebtedness of the issuer of the Security Token in respect of any money lent to the issuer by a holder of the Security Token; 2.2.3 a derivative, as defined under Section (2) of the SA; or 2.2.4 a unit in a collective investment scheme (“CIS”), where it represents a right or interest in a CIS including an option to acquire a right or interest in a CIS. 2.3 The list provided in paragraph 2.2 is not intended to be exhaustive. In determining whether a virtual token1 falls under the definition of “securities” under the SA, the FSC will consider the structure and characteristics of, including the rights attached to, the virtual token. 3. Security Token Offerings 3.1 An STO means the issuance of Security Tokens, as a method of raising funds from investors, in exchange for the ownership or economic rights in relation to assets.

1 A “virtual token” has the same meaning as in the VAITOS Act 2021.

Financial Services Commission Page 5 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 3.2 The offering of Security Tokens shall be subject to the SA and any Regulations or FSC Rules issued thereunder. 4. Issuers of Security Tokens 4.1 The following entities may issue Security Tokens – 4.1.1 Entities registered as Reporting Issuers as defined under section 86(1) of the SA as an issuer- (a) who by way of a prospectus, has made an offer of securities either before or after the commencement of the SA; or (b) who has made a takeover offer by way of an exchange of securities or similar procedure. 4.1.2 Collective Investment Schemes authorised as Expert Funds or Professional Collective Investment Schemes (“PCIS”). An expert fund shall only be available to expert investors and PCIS is a collective Investment schemes offering their shares:

Financial Services Commission Page 6 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org (a) solely to sophisticated investors; and (b) as private placements as defined in the SA. It is to be noted that: (a) Pursuant to Regulation 78(a) of the Securities (Collective Investment Schemes and Closed-end Funds) Regulations 2008 (“CIS Regulations”), an expert investor means: i. an investor who makes an initial investment, for his own account, of no less than US$ 100 000; or ii. a sophisticated investor2 as defined in the SA or any similarly defined investor in any other securities legislation. (b) A PCIS means a collective investment scheme or a closed-end fund (as may be applicable) referred to in Regulation 75 of the CIS Regulations.

2 The term “Sophisticated Investor” is defined in section 2 of the SA.

Financial Services Commission Page 7 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 4.1.3 Any such other issuer as may be deemed appropriate by the FSC. 4.2. Issuers of Security Tokens, which are registered as Reporting Issuers, will be required to comply with the disclosure requirements that are provided under Part VI of the SA and the Securities (Disclosure Obligations of Reporting Issuers) Rules 2007. 5. Method of offer 5.1 In Mauritius, securities may be offered in two ways, namely: (a) Public Offer; and (b) Preferential Offer. 5.2 Public Offer 5.2.1 When making an offer to the public, an issuer (including an issuer of corporate or green bonds) must register a prospectus with the Commission in line with the SA and the Securities (Public Offers) Rules 2007.

Financial Services Commission Page 8 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 5.2.2 Part V of the SA and the Securities (Public Offers) Rules 2007 provide for the conditions to be fulfilled when making an offer of securities to the public, as well as the contents of the prospectus. The Commission has also issued a Circular Letter regarding the procedures to register a prospectus. Please refer to https://www.fscmauritius.org/media/2425/circular-letter-procedures-for-registration￾of-prospectus-24-sep-15-89485.pdf. 5.2.3 The issuer has to make a compulsory registration with the Commission as a reporting issuer pursuant to section 86 of the SA and rule 3 of the Securities (Disclosure Obligations of Reporting Issuers) Rules 2007. 5.3 Preferential Offer 5.3.1 A preferential offer, as per rule 2 of the Securities (Preferential Offer) Rules 2017, is defined as: (i) an offer or issue of securities that is a private placement; (ii) an offer or issue of securities that is made only to sophisticated investors; or

Financial Services Commission Page 9 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org (iii) an offer or issue of securities only to related corporations of the issuer of the securities. PART II – SECURITY TOKEN TRADING SYSTEMS 6. Security Token trading systems 6.1 Security Token trading systems are trading systems which are designed to allow for the trading of Security Tokens. 6.2 Security Token trading systems are different from traditional securities exchanges inasmuch as they do not require clearing and settlement facilities. They are usually pre-funded allowing transactions to be cleared automatically on the systems on a T+0 basis. 6.3 Moreover, such systems may be accessed directly by clients to execute their trade without the requirement for a third-party intermediary to place the orders on their behalf.

Financial Services Commission Page 10 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 7. Licensing of Security Token trading systems 7.1 The FSC shall license Security Token trading systems under section 11 of the SA. Hence, any person wishing to establish, maintain or operate a system for the trading of Security Tokens in Mauritius shall apply for a Trading Securities System licence. 7.2 According to section 15 of the SA, a Securities Trading System (“STS”) may make rules, not inconsistent with the SA, any regulations made under the SA or any FSC Rules, for or with respect to the operation of the STS. 7.3 Prior to the granting of the licence, the FSC shall ensure that the rules of the STS include the following – 7.3.1.1 The types of Security Tokens that will be traded on the STS; 7.3.1.2 The client on-boarding process including customer due diligence checks, admission criteria and other procedures to trade on the STS; 7.3.1.3 The listing process and the minimum listing requirements;

Financial Services Commission Page 11 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 7.3.1.4 The order execution rules; 7.3.1.5 The arrangements put in place for the safekeeping of the Security Tokens and fiat currency; 7.3.1.6 Details regarding whether access to trading information is equitable for all investors; 7.3.1.7 Post trade reporting and publication; 7.3.1.8 Compliance with prudential and other requirements designed to support the operations of the STS and reduce the risk of trade failure; 7.3.1.9 Procedures in cases of trading disruptions; 7.3.1.10 The arrangements made by the STS for the monitoring of the STS to ensure fairness, efficiency, transparency and investor protection as well as compliance with the SA; 7.3.1.11 Governance, internal controls and risk management procedures put in

Financial Services Commission Page 12 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org place; 7.3.1.12 Cybersecurity measures put in place; 7.3.1.13 Measures to prevent market abuse, including but not limited to insider dealing, fraudulent behaviours, false trading or market rigging; 7.3.1.14 AML/CTF systems in place; and 7.3.1.15 Arrangements to ensure compliance with applicable legislation of the jurisdiction in which the Security Tokens will be offered for trading, where appropriate. 7.4 A STS needs to demonstrate that it has adequate arrangements in place to monitor compliance with the rules of the STS. 8. Minimum Capital Requirements 8.1 A STS shall, at all times, maintain a minimum stated unimpaired capital of 6.5 million rupees or its equivalent in any other currency, or such higher amount as the FSC

Financial Services Commission Page 13 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org may determine taking into account the nature, scale and complexity of its activities and the risks to which it is or could be exposed. 8.2 Capital must be held in fiat currency. 9. Professional Indemnity Insurance The holder of a STS licence shall subscribe to an adequate professional indemnity insurance policy which shall indemnify the STS, its employees and any person acting on its behalf against liability for any act, error or omission in the conduct of its operations. 10. Management and Control 10.1 The STS shall comply with all requirements applicable under the relevant Acts. 10.2 The STS shall — (a) perform its functions so as to ensure fairness, efficiency and transparency of transactions effected through the STS;

Financial Services Commission Page 14 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org (b) publish daily and periodic information, indices and averages on its activities in order to ensure transparency and equity to investors; (c) submit to the FSC its trading logs and the information at sub-paragraph (b) at such intervals as the FSC may request. 10.3 The STS shall also comply with the relevant and applicable Principles for Financial Market Infrastructures (FMIs) issued by the Committee on Payments and Market Infrastructures (CPMI) of the International Organization of Securities Commissions (IOSCO). 10.4 A STS shall, at all times: (a) be controlled and managed from Mauritius; (b) demonstrate adequate office premises and IT infrastructure from which it shall perform its core functions in Mauritius; and (c) be managed by a Board composed of a minimum of 3 directors, of which at least – (i) 30 per cent shall be independent directors; and

Financial Services Commission Page 15 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org (ii) one shall be resident in Mauritius. 10.5 The Board of a STS shall, at all times, consist of adequate number of directors having experience in the operations of such STS. 10.6 A director of a STS has a duty to act in the best interests of investors and, where there is an actual and/or potential conflict between the interests of the investors and the interests of the STS, the director shall give priority to the interests of the investors. 11. IT Audit 11.1 The STS shall be required to appoint an external and independent third party to undertake an audit of its IT systems and processes at least once every year (in line with its Financial Year end). 11.2 The external and independent third party shall be required to have the appropriate competence in line with best industry standards and practices.

Financial Services Commission Page 16 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 11.3 The STS shall notify the FSC (within 10 days of the appointment) of the identity of the external and independent third party, and shall submit to the FSC – (a) full particulars of the external and independent third party; and (b) an undertaking that the external independent third party is fit and proper to undertake the IT audit. The FSC may object to the appointment of the external and independent third party if it considers that the external and independent third party is not fit and proper to undertake the IT audit. 11.4 The STS shall submit the report of the external and independent third party for the consideration of its Board and shall address any shortcomings identified in the report. 11.5 Records of such audits and any remedial actions implemented shall be maintained by the STS and made available to the FSC for inspection, upon request.

Financial Services Commission Page 17 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 12. Cybersecurity 12.1 The STS shall be required to develop and apply proper safeguards to ensure that its systems and networks are fully protected, consequently limiting or containing the impact of a possible cybersecurity breach. In so doing, a STS should have regard to- (1) confidentiality: information should be accessible only to persons or systems with appropriate authority, which may require firewalls within a system, as well as entry restrictions; (2) integrity: safeguarding the accuracy and completeness of information and its processing; (3) availability and authentication: ensuring that appropriately authorised persons or systems have access to the information when required and that their identity is verified; (4) non-repudiation and accountability: ensuring that the person or system that processes information cannot deny their actions.

Financial Services Commission Page 18 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 12.2 The STS shall be required to identify a person to act as Chief Technology Officer (“CTO”) or any other relevant designation. The CTO shall be responsible for establishing, maintaining and overseeing the internal cybersecurity architecture of the STS. 12.3 The CTO shall carry out a self-assessment, at least once every year, to examine the probability of a cyber-attack, and other threats affecting the cyber security of the STS as well as the impact or magnitude of such attack. 12.4 The CTO shall assess the cyber risk appetite of the STS and its capabilities (including strong and weak points). 12.5 The CTO shall determine weakest links within the STS and its surroundings, including, without limitation, any third party service or product on which the STS is reliant, and shall perform a cost-benefit analysis of aspects relating to the cybersecurity architecture. 12.6 In order to manage possible threats, the STS shall be required to consider various threat scenarios to determine its state of security and have adequate

Financial Services Commission Page 19 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org ‘situational awareness’ to differentiate between normal and abnormal or irregular activities as well as back-up systems as appropriate to the likelihood and potential impact of any possible threats. 12.7 The cyber security architecture of the STS shall be based on, or at least take into account, internationally and/or nationally recognised standards on cybersecurity and related risk and data management requirements. 12.8 The STS shall be required to develop and implement suitable activities for the appropriate identification and minimisation of loss in the occurrence of a cybersecurity event. 13. Custody Services 13.1 The STS has to make use of custodians to hold both the Security Tokens and fiat currency. 13.2 The custody of Security Tokens shall be held with a custodian licensed by the FSC or such other custodian regulated in jurisdictions which are signatories to the IOSCO MMOU and acceptable to the FSC.

Financial Services Commission Page 20 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 13.3 On the other hand, the custody of fiat currency shall be held with a licensed commercial bank in Mauritius. 14. Clearing and Settlement facilities 14.1 If a STS uses Distributed Ledger Technology (DLT) to enable instantaneous settlement of transactions, it is not mandatory to appoint a clearing and settlement facility. 14.2 If no clearing and settlement facility is used, the STS shall ensure that adequate systems and controls are in place for the transfer of Security Tokens and/or fiat currency between participants on the STS, for instance by using a pre-funded model. 14.3 In a pre-funded model, the accounts of the participants are pre-loaded with Security Tokens and/or fiat currency, which are respectively kept with custodians in accordance with paragraph 13.2, or with a licensed commercial bank in Mauritius in accordance with paragraph 13.3. Once the transaction is effected on the STS, instructions are given to the custodians or licensed

Financial Services Commission Page 21 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org commercial bank, as the case may be, to transfer the Security Tokens and/or fiat currency to the participants’ accounts on a T+0 basis.

14.4 Should the STS opt to use the services of a clearing and settlement facility, the latter shall be licensed by the FSC under section 10 of the SA or regulated in jurisdictions which are signatories to the IOSCO MMOU and acceptable to the FSC. PART III – CONDUCT OF BUSINESS 15. Market Conduct 15.1 All licensees involved in Security Token offerings and trading shall maintain good market conduct, and safeguard market integrity which is an essential prerequisite for an efficient, transparent and integrated financial market. 15.2 Any market abuse, including but not limited to insider dealing, fraudulent behaviours, false trading or market rigging, shall be prohibited.

Financial Services Commission Page 22 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 15.3 The STS shall investigate misconduct or apparent misconduct that could affect investors or other participants. Where an investigation is initiated, the STS shall promptly report to the FSC the details of such investigations and of the persons involved. 16. Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) Obligations All licensees involved in Security Token offerings and trading shall be required to ensure strict adherence to the applicable laws, regulations and guidelines relating to AML/CFT in Mauritius (including the FSC’s AML/CFT Handbook). 17. Data Protection All licensees involved in Security Token offerings and trading shall comply with the Data Protection Laws applicable in Mauritius, including seeking the approval of the data subject prior to sending personal data outside Mauritius or keeping personal data on servers outside Mauritius.

Financial Services Commission Page 23 of 23 FSC House, 54 Cybercity Ebene, 72201 Mauritius T: (+230) 403-7000 • F: (+230) 467-7172 E: fscmauritius@intnet.mu www.fscmauritius.org 18. Cautionary note to investors 18.1 The FSC urges all prospective investors to fully assess the related risks prior to committing any funds for investment in Security Tokens. 18.2 In addition, the FSC reiterates that any investment in Security Tokens is at the investors’ own risks and that they are not protected by any statutory compensation arrangements in Mauritius. 23 August 2022 Financial Services Commission