Mauritius: crypto & digital assets regulation

Regulated

VASP licensing via FSC under VAITOS Act; Bank of Mauritius governs banking interface

Also involved
Bank of Mauritius (banking interface) · Financial Intelligence and Anti-Money Laundering Unit (AML/CFT)
Core law
Virtual Asset and Initial Token Offerings Services Act 2021
Entry capital
MUR 5m (VASP)
Approval timeline
3-6 months
Customer assets
Segregated custody required; express consent for use
Data protection
Data Protection Act 2017 · Data Protection Office
Sandbox
Yes - FSC Regulatory Sandbox

Mauritius regulates virtual asset service providers (VASPs) and initial token offering (ITO) issuers under the VAITOS Act 2021, supervised by the Financial Services Commission (FSC). The regime requires licensing for core activities, strict custody and cybersecurity standards, and AML/CFT compliance. Banks engaging in VA activities are separately regulated by the Bank of Mauritius (BoM) under prudential guidelines.

Which licence do you need?

Your activityRequirementCapitalTimelineAuthority
Exchange / trading platformLicenceVirtual Asset Service Provider (VASP) Licence[1][2][3]

Requires robust risk management and cybersecurity frameworks

MUR 5m3-6 monthsFinancial Services Commission (FSC)
Custody of client assetsLicenceVirtual Asset Service Provider (VASP) Licence[4][1]

Strict segregation and express consent rules apply

MUR 5m3-6 monthsFinancial Services Commission (FSC)
Token issuance / public offeringLicenceInitial Token Offering (ITO) Issuer Licence[5][6][7]

Security tokens regulated under Securities Act; exemptions for sophisticated investors

MUR 5m3-6 monthsFinancial Services Commission (FSC)
Broker-dealer / OTC deskLicenceVirtual Asset Service Provider (VASP) Licence[1]

OTC desks fall under VASP definition if facilitating VA transactions

MUR 5m3-6 monthsFinancial Services Commission (FSC)
Stablecoin issuanceLicenceVirtual Asset Service Provider (VASP) Licence[1]

Treated as virtual asset; reserve backing not explicitly mandated in provided docs

MUR 5m3-6 monthsFinancial Services Commission (FSC)
Crypto payments acceptanceLicenceVirtual Asset Service Provider (VASP) Licence[8][1]

VA transfers subject to Travel Rule obligations

MUR 5m3-6 monthsFinancial Services Commission (FSC)
Mining / staking servicesUncertainverify with regulator

Not explicitly defined in provided VASP guidance

Advisory / portfolio managementLicenceInvestment Advisory Licence[7]

VA advisory falls under general investment advisory regime

MUR 1.5m3-6 monthsFinancial Services Commission (FSC)

New — what changed recently

  • 2024-11-13Guideline for Virtual Asset related ActivitiesBoM issued comprehensive risk management and capital guidelines for banks engaging in VA activities.[9]
  • 2023-10-31Regulatory Sandbox GuidelinesFSC established a formal sandbox regime for fintech and VA innovation testing.[10]
  • 2023-01-01Financial Services (Administrative Penalties) (Amendment) Rules 2023Introduced fixed daily penalties for non-compliance with filing obligations.[11]

Market-entry checklist

  1. 1Secure VASP Licence from FSCApply for VASP licence with MUR 5m capital and robust risk management framework.
  2. 2Implement AML/CFT ComplianceDesignate VA providers as financial institutions under FIAMLA and implement CDD.
  3. 3Establish Segregated CustodyEnsure client assets are held in segregated accounts with express consent for use.
  4. 4Register for Data ProtectionComply with Data Protection Act 2017 and register with the Data Protection Office.
  5. 5Prepare Cybersecurity FrameworkImplement comprehensive cybersecurity measures as mandated by the 2022 Cybersecurity Rules.
This guide is compiled automatically from 11 primary-source documents published by Mauritius's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-07-12). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.