Obtain a Mauritius VASP license under the VAITOS Act with FSC-facing legal, compliance, and structuring support for exchanges, wallets, custody, advisory, and token projects.
Prepared by RUE editorial team · Reviewed by Milana · Updated 12 May 2026
Book Free ConsultationMauritius regulates virtual asset service providers under the Virtual Asset and Initial Token Offering Services Act, 2021, supervised primarily by the Financial Services Commission. RUE helps founders structure the right license class, build regulator-ready documentation, and align substance, AML/CFT, and operational controls before filing.
"As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays."
RUE provides end-to-end support for Mauritius crypto licensing: license-class scoping, company structuring, application drafting, AML/CFT framework design, governance pack preparation, regulator correspondence, and post-licensing compliance setup.
We also support banking strategy, internal controls, outsourcing governance, and coordination with accounting, tax, and operational vendors so the project is built for approval and for actual go-live.
Mauritius has a dedicated legal regime for virtual asset service providers under the VAITOS Act, rather than relying only on generic AML registration.
The framework distinguishes broker-dealer, wallet, custodian, advisory, and marketplace models, which helps align the license with the actual product.
Mauritius is often considered by groups serving cross-border markets that need a regulated base outside the EU but with stronger legal architecture than many light-touch offshore options.
Applicants must evidence AML/CFT, sanctions screening, governance, recordkeeping, and Travel Rule controls in line with modern VASP supervision.
Obtaining a crypto license in Mauritius requires more than filing a form with the Financial Services Commission (FSC). The regulator reviews whether the applicant is a properly structured Mauritian entity, whether its controllers and officers are fit and proper, whether the business will be genuinely directed and managed from Mauritius, and whether AML/CFT and operational controls are proportionate to the proposed activity.
The legal base is the Virtual Asset and Initial Token Offering Services Act, 2021 (VAITOS Act), read together with the Financial Intelligence and Anti-Money Laundering Act, 2002 (FIAMLA), FSC rules, guidance notes, and applicable sanctions obligations. In practice, the FSC expects a complete file: ownership transparency, business plan, financial projections, tech and custody narrative, outsourcing map, and evidence that the applicant can operate safely from day one.
Below are the core requirements most Mauritius VASP applicants must satisfy. Exact thresholds depend on the license class and business model.
The applicant is generally expected to be a Mauritian company with real local presence. A virtual office alone is usually insufficient for a credible Mauritius VASP license application.
A practical nuance many founders miss: the FSC does not assess substance only as a corporate formality. Substance is also a supervisory proxy for accountability, AML oversight, incident response capability, and the regulator’s ability to interact with the licensee in real time.
Controllers, beneficial owners, directors, and key officers must pass a fit-and-proper assessment. This is one of the most important review areas in a Mauritius crypto license process.
The FSC typically scrutinizes whether key persons understand the actual business model. A polished CV without operational understanding of custody, exchange flows, sanctions risk, or transaction monitoring is a common weakness.
Capital expectations depend on the license class. For some classes, the rule is a fixed minimum; for others, the applicant must maintain sufficient working capital or 12 months forecasted working capital.
Regulatory capital is not the same as full launch budget. The FSC may still question whether the applicant can fund staffing, compliance tools, cybersecurity, audit, insurance, and remediation costs beyond the statutory minimum.
A Mauritius crypto license application must include a risk-based AML/CFT program aligned with FIAMLA, FSC AML expectations, and FATF standards for VASPs.
A technical nuance often omitted in generic guides: the Travel Rule is not just a policy statement. The FSC increasingly expects operationalization through workflow design, data fields, escalation rules, and, where relevant, vendor or messaging-layer integration based on standards such as IVMS101.
Applicants offering exchange, wallet, or custody services must explain how the platform is governed and secured. Generic statements such as “we use cold wallets” are not enough.
For custodians and marketplaces, the quality of the custody narrative often influences both licensing and later banking discussions. Banks and EMIs usually ask for the same control evidence the FSC asks for, but in a different format.
The FSC expects a business plan that explains the model in operational terms, not only in marketing language. The file should allow a reviewer to understand how money, crypto-assets, data, and responsibilities move through the business.
A strong application also explains what the business will not do. Clear exclusions, such as no privacy coins, no sanctioned geographies, no anonymous onboarding, or no retail leverage, reduce regulator ambiguity.
If the business touches client assets, the application must describe how those assets are identified, segregated, safeguarded, and reconciled.
One practical point: if the model mixes brokerage, dealing, and custody, the regulator will usually expect a much clearer explanation of conflict management and internal segregation than a pure advisory or software-only model.
A license helps credibility, but it does not guarantee a bank account. Banking and payment onboarding remain separate risk decisions by banks, EMIs, and PSPs.
At RUE, we treat banking readiness as a parallel workstream. In practice, the fastest license project can still stall at go-live if the applicant has no credible post-approval banking and payment strategy.
Compare Mauritius with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
The cost of a crypto license in Mauritius has three layers: official FSC fees, regulatory capital or working capital, and real operating spend needed to pass review and launch compliantly. Founders often budget only for the filing fee and miss the larger cost drivers: local substance, compliance drafting, staffing, cybersecurity, audit, and banking onboarding.
Important: these are official regulatory fees and capital thresholds, not full project pricing. Professional fees, company setup, office, key personnel, tech stack, insurance, audit, and compliance vendors are separate.
Mauritius generally applies a 15% corporate income tax. The actual tax outcome for a licensed crypto company depends on its legal structure, source rules, deductible expenses, transfer pricing, management location, and whether the business has genuine economic substance in Mauritius. Token issuance, treasury activity, proprietary trading, and service income may produce different tax analyses. Tax advice should therefore be obtained case by case rather than inferred from headline rates alone.
A realistic first-year model is:
For many applicants, the largest hidden cost is not the regulator fee but the evidence pack required to show operational readiness. For example, a custody or marketplace applicant may need stronger security architecture, reconciliation tooling, incident response procedures, and vendor due diligence than a pure advisory applicant.
A Mauritius VASP license creates continuous obligations under the VAITOS and AML/CFT framework. Approval is only the start; the FSC expects ongoing governance, reporting, control testing, and event-driven notifications.
A crypto license in Mauritius is generally required if a business carries on regulated virtual asset service provider activity under the Virtual Asset and Initial Token Offering Services Act, 2021. The main regulator for VASPs is the Financial Services Commission (FSC). In practical terms, Mauritius offers five main VASP license classes—M, O, R, I, and S—plus a separate regime relevant to initial token offering activity.
The right question is not “How fast can I get licensed?” but “Which class matches my business model, and can I evidence substance, AML/CFT, and operational readiness?” A hosted wallet, OTC desk, custodian, advisory desk, and order-book marketplace do not present the same regulatory risk. The FSC reviews them differently.
Timeline: the often-cited 30-day period relates to a decision window for a complete application under the statute. It is not the same as end-to-end launch timing. In practice, founders should budget 3-6+ months from scoping to approval, and often longer if banking, staffing, or tech documentation is not ready.
Key reality check: a Mauritius license improves credibility, but it does not automatically secure a bank account. Banking, EMI access, and fiat rails remain separate onboarding decisions based on AML quality, source of funds, jurisdictions served, and transaction profile.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
RUE assesses the business model, maps activities to Class M, O, R, I, S or ITO track, identifies boundary issues, and defines the licensing strategy. Duration: 1-2 weeks.
Incorporate the Mauritian company, establish registered office and substance plan, prepare governance structure, and align ownership disclosures and local management framework. Duration: 1-3 weeks.
Draft AML/CFT manual, sanctions policy, onboarding rules, Travel Rule workflow, complaints handling, outsourcing controls, and governance matrix tailored to the exact business model. Duration: 2-5 weeks.
Prepare business plan, service flow descriptions, financial projections, capital narrative, risk register, and operational model documentation. Duration: 2-4 weeks.
For exchange, wallet, and custody models, prepare architecture overview, key management narrative, reconciliation logic, incident response, BCP/DR, and vendor due diligence pack. Duration: 2-4 weeks.
Submit the complete application with official processing fee, supporting documents, ownership disclosures, and class-specific evidence. The quality of this stage determines the speed of review.
The FSC reviews the file, may issue questions or requests for clarification, and tests whether the application is complete, coherent, and proportionate to the proposed activity. Duration: 1-3+ months depending on complexity.
After approval, finalize post-licensing controls, annual compliance calendar, banking or EMI onboarding, accounting setup, and controlled operational launch. Duration: 2-8+ weeks depending on banking readiness.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
A realistic timeline is usually 3-6+ months, not 30 calendar days from zero. The commonly cited 30-day period is relevant only to the regulator’s decision window for a complete application under the statutory framework. In practice, founders must first complete company setup, substance planning, policy drafting, ownership disclosures, financial forecasts, and class-specific tech documentation. Banking and payment onboarding often add parallel time even after approval.
The main regulator for virtual asset service providers in Mauritius is the Financial Services Commission (FSC). The legal basis is the Virtual Asset and Initial Token Offering Services Act, 2021. The Bank of Mauritius may become relevant where the model intersects with banking or payment system activity, but it is not the default licensing authority for every VASP.
Mauritius generally distinguishes five main VASP license classes: Class M (broker-dealer), Class O (wallet services), Class R (custodian), Class I (advisory services), and Class S (virtual asset marketplace). There is also a separate legal track relevant to initial token offering activity. Hybrid products often need deeper analysis because one product can trigger more than one regulated function.
It depends on the class. As a high-level guide: Class M requires MUR 2,000,000, Class R requires MUR 5,000,000, and Class S requires MUR 6,500,000 in stated unimpaired capital. Class O is based on 12 months forecasted working capital, and Class I requires sufficient working capital to remain solvent. Regulatory capital is separate from the total launch budget.
The official FSC processing fee ranges from USD 1,000 to USD 3,000 depending on class, while the annual fee ranges from USD 1,900 to USD 5,000. However, the real first-year cost also includes company incorporation, office and substance, legal drafting, AML/CFT framework, staffing, audit, insurance, and technology vendors. For that reason, official fees alone do not represent the full cost of a Mauritius VASP project.
Yes, in practice a credible applicant is expected to have real local substance. This usually means a Mauritian company, registered and operational office, local governance, accessible records, and evidence that the business is directed and managed from Mauritius. A paper-only setup or mail-forwarding address is usually weak for both licensing and banking purposes.
Yes, foreign ownership is generally possible, but all controllers and beneficial owners must be fully disclosed and pass fit-and-proper review. The FSC will typically examine ownership transparency, source of funds, source of wealth, regulatory history, and whether the structure allows effective supervision. Foreign ownership does not remove the need for Mauritian substance and local governance.
No. A license helps credibility, but it does not guarantee banking. Banks and EMIs run a separate onboarding process and usually assess ownership transparency, AML/CFT controls, sanctions exposure, jurisdictions served, expected transaction volumes, custody model, and source of funds. Many VASP projects succeed faster when the banking pack is prepared in parallel with the license pack.
The core file usually includes incorporation documents, ownership chart, UBO documents, source of funds and source of wealth evidence, business plan, financial forecasts, AML/CFT manual, sanctions policy, governance documents, office and substance evidence, and class-specific technology or custody documentation. Exchange, wallet, and custodian applicants usually need deeper materials on key management, reconciliation, access control, incident response, and outsourcing oversight.
Licensed VASPs must comply with FIAMLA, FSC AML/CFT expectations, sanctions screening duties, suspicious transaction reporting, and Travel Rule obligations for relevant virtual asset transfers. In practice, this means risk-based onboarding, CDD/EDD, transaction monitoring, wallet screening, MLRO escalation, and operational handling of originator and beneficiary data. For cross-border VASP flows, interoperability standards such as IVMS101 are often relevant in implementation.
They may be, depending on function and structure. The correct test is not the label but the rights attached, transferability, degree of standardization, redemption mechanics, custody/control model, and how the token is marketed. Some NFTs may fall outside typical VASP analysis, while fractionalized or investment-like NFTs may not. Some stablecoin structures may also trigger legal analysis beyond a simple VAITOS reading. Case-by-case classification is essential.
Operating a regulated virtual asset business without the required license creates serious legal and enforcement risk. Depending on the facts, consequences may include supervisory action, cease-and-desist measures, reputational damage, banking refusal or termination, and exposure under applicable financial services and AML laws. Any founder planning to target Mauritius from a local base should obtain legal perimeter analysis before launch rather than relying on product labels or informal market practice.
