Crypto License in Mauritius 2026

What is regulated in Mauritius: legal framework for virtual assets

The legal framework for crypto regulation in Mauritius is built around the Virtual Asset and Initial Token Offering Services Act, 2021 (VAITOS Act). The Act establishes the licensing perimeter for virtual asset service providers, sets out categories of regulated activity, and creates the legal basis for supervision by the Financial Services Commission Mauritius.

The VAITOS Act does not operate in isolation. Licensed entities must also comply with the Financial Intelligence and Anti-Money Laundering Act, 2002 (FIAMLA), FSC AML/CFT rules and guidance, sanctions screening obligations, corporate law requirements, and, where the business model intersects with fiat payment flows or banking relationships, additional rules and approvals outside the VASP regime may become relevant.

The practical hierarchy is:

• Primary statute: VAITOS Act for licensing, scope, and supervisory powers;
• AML layer: FIAMLA and related AML/CFT obligations;
• FSC rules and guidance: application criteria, governance, and supervisory expectations;
• Sanctions and international standards: UN sanctions implementation and FATF-aligned VASP obligations.

A useful technical distinction is that the law regulates activities, not marketing labels. Calling a product a “wallet”, “platform”, or “DeFi interface” does not determine the outcome. The FSC and legal advisers will usually analyze who controls private keys, who executes or arranges transfers, who matches orders, who holds client assets, and who has the ability to intervene in the transaction flow.

For founders comparing jurisdictions, Mauritius sits between pure registration regimes and full-scale EU-style prudential frameworks. It is more structured than many offshore options, but still requires local substance and credible compliance architecture. For broader comparisons, see our crypto license 2026 and crypto regulations resources.

Class M, O, R, I, S explained in plain English

Class M is generally used for a broker-dealer style model in virtual assets. In practice, this is often relevant for an OTC desk, dealing service, or intermediary that buys, sells, or arranges transactions in virtual assets. The key regulatory question is whether the firm is acting as principal, agent, or both, and how conflicts, pricing, and best execution-type issues are managed.

Class O covers wallet services. This is typically relevant where the provider offers hosted or administered wallet functionality and retains a meaningful control layer over transfers, access, or user asset administration. The legal analysis becomes more complex if the product markets itself as non-custodial but still controls transaction routing, recovery, whitelisting, or policy enforcement.

Class R is the custodian class. It is usually the right starting point where the business controls private keys or otherwise safeguards client virtual assets. Custody applicants should expect deeper scrutiny of segregation, reconciliation, key management, insolvency treatment, and incident response than almost any other class.

Class I covers advisory services. This may fit research, strategy, and investment recommendation models focused on virtual assets. The main boundary issue is whether the firm remains advisory-only or also crosses into arranging, dealing, placement, or token sale intermediation.

Class S is the virtual asset marketplace class. This is the most obvious fit for an exchange or platform operating an order book, matching engine, or other marketplace logic. It usually requires the strongest governance around market integrity, surveillance, system resilience, and operational continuity.

A useful founder test is simple: if your product can hold, move, match, or advise on client virtual assets, you should map each function separately before choosing the licence class.

Timeline: how long does a crypto license in Mauritius really take?

A realistic Mauritius crypto license timeline is usually 3-6+ months from scoping to approval, and sometimes longer for custody, marketplace, or hybrid models. The reason is simple: the legal review clock starts only after the application is complete enough to be treated as complete.

Practical timeline model:

• Scoping and structuring: 1-3 weeks
• Company incorporation and local setup: 1-3 weeks
• Document drafting and evidence pack: 4-8 weeks
• FSC filing and completeness review: variable
• FSC substantive review after complete filing: statutory decision window often cited as 30 days, subject to completeness and queries
• Remediation and Q&A: 2-8+ weeks depending on application quality
• Banking and payment onboarding: often 1-4+ months in parallel or post-approval

The biggest delay factors are usually not legal formalities but weak AML manuals, unclear ownership structures, shallow tech documentation, or lack of substance evidence. A common example is a founder who says the model is “non-custodial” while the technical flow still gives the operator enough control to trigger a custody-style review.

The best way to shorten the process is to front-load the hard work: define the exact activity perimeter, prepare the governance pack early, and treat banking as a separate project track. At RUE, we build timeline assumptions around the real bottlenecks, not headline statutory numbers.

Documents required for a Mauritius VASP application

A strong VASP license Mauritius application is built in document layers. The FSC does not review the business plan in isolation; it cross-checks the plan against ownership, financial forecasts, AML controls, tech architecture, and local substance evidence.

Core document buckets

• Corporate documents: certificate of incorporation, constitution, share register, group structure chart, registered office details;
• Ownership and personal documents: UBO declarations, IDs, proof of address, CVs, police clearances, source of wealth/source of funds evidence;
• Business documents: business plan, service description, target markets, customer types, prohibited jurisdictions, revenue model, outsourcing map;
• Financial documents: opening balance sheet, capital evidence, three-year forecasts, assumptions memo, working capital analysis;
• Compliance documents: AML/CFT manual, sanctions policy, onboarding procedures, EDD matrix, suspicious transaction escalation process, complaints handling, conflicts policy;
• Technology and security documents: system architecture, custody policy, wallet design, access control matrix, incident response plan, BCP/DR, vendor due diligence;
• Substance documents: office lease, staffing plan, local governance calendar, board terms of reference, role descriptions.

Class-specific depth

Exchange, wallet, and custody models usually need a deeper technical pack than advisory-only models. For example:

• Marketplace applicants: order handling logic, matching engine description, market surveillance controls, listing standards, abuse monitoring;
• Custodians: key management, segregation model, reconciliation frequency, recovery procedures, incident escalation;
• Wallet providers: hosted vs non-hosted flow analysis, transfer authorization logic, recovery controls, Travel Rule workflow.

A useful practical rule is this: if the regulator cannot reconstruct how a customer is onboarded, how assets move, who approves a transfer, and how an alert is escalated, the application is not yet regulator-ready.

RUE also aligns the licence file with the future banking file so the same evidence can be reused for account opening and PSP onboarding.

AML, KYC, sanctions and Travel Rule compliance

AML/CFT compliance is a core licensing condition in Mauritius, not a post-approval add-on. Under FIAMLA and the FSC supervisory framework, a VASP must operate a risk-based system for customer due diligence, transaction monitoring, sanctions screening, suspicious transaction reporting, and recordkeeping.

The FSC is likely to scrutinize:

• How customer risk scoring is built and updated;
• Whether source of funds and source of wealth checks are proportionate to the model;
• How the business handles higher-risk geographies, PEPs, nested relationships, and legal persons;
• Whether blockchain analytics or wallet screening is integrated into onboarding and ongoing monitoring;
• How suspicious activity is escalated to the MLRO and documented;
• Whether sanctions screening is applied not only to customers but also to counterparties, wallet addresses, and payment flows.

What the Travel Rule means operationally

The Travel Rule requires relevant originator and beneficiary information to accompany certain virtual asset transfers between VASPs. In practice, this means the compliance framework must define:

• When the Travel Rule is triggered;
• Which data fields are collected and transmitted;
• How hosted-to-hosted and hosted-to-unhosted wallet flows are risk-scored;
• How missing or inconsistent data is handled;
• Whether the business uses a vendor or interoperability layer based on standards such as IVMS101.

A technical nuance that often matters in regulator and bank reviews: Travel Rule compliance is not only about sending data. It is also about proving that the receiving or sending counterparty VASP is identified, screened, and handled under a documented risk framework. This is especially important for cross-border transfers and for businesses serving multiple jurisdictions.

For broader AML architecture support, see our legal services and preparation of compliance documents resources, which reflect the same regulator-facing drafting discipline we apply in Mauritius projects.

ITOs, marketing rules and token classification issues

Mauritius does not treat all token activity as the same legal event. A VASP licence and an ITO-related regime are separate analytical tracks. If a project plans to issue tokens, market them to the public, or facilitate an initial token offering, the legal review must cover white paper obligations, disclosures, distribution mechanics, and the actual rights attached to the token.

Key classification questions include:

• Does the token function mainly as exchange medium, utility, governance instrument, claim on assets, or investment right?
• Is there a redemption promise, profit expectation, or entitlement that could trigger another regulatory regime?
• Is the offer private, public, exchange-listed, or cross-border?
• Who controls issuance, treasury, vesting, and secondary-market support?

NFTs, stablecoins, and tokenized assets require extra analysis. A label such as “NFT” does not automatically exclude regulation if the token is fractionalized, standardized, marketed as an investment, or functionally interchangeable. A so-called stablecoin may also fall outside a simplistic VAITOS-only analysis if its structure resembles a payment, e-money, collective investment, or other regulated product. The correct method is function over form.

Another practical point: marketing language can reshape regulatory risk. If a token is described as low-risk, guaranteed, redeemable, or income-generating, that language may create legal issues even before the technology is analyzed. For this reason, token projects should align legal classification, white paper drafting, and public communications from the start.

Tax, banking and operational reality

The operational reality of a crypto company in Mauritius is shaped by three parallel workstreams: licensing, banking/payment access, and tax/substance structuring. Treating them as separate later-stage tasks is one of the most expensive mistakes founders make.

Tax: Mauritius generally applies a 15% corporate income tax, but the real outcome depends on structure, deductibility, management location, transfer pricing, and the nature of the revenue. A custody business, token issuer, advisory company, and principal trading desk may not produce the same tax profile.

Banking: a licence helps, but does not remove the need for a separate risk review by the bank or EMI. In practice, banking success often depends on whether the business can show clean ownership, credible AML controls, clear fiat flow maps, and a customer base that fits the institution’s risk appetite.

Operations: local substance costs are real. Office, directors, governance, accounting, compliance tooling, audit, and incident response capability all affect both licensing and long-term survivability. That is why RUE usually scopes Mauritius not as a cheap paper licence, but as a regulated operating base for businesses willing to maintain discipline.

If your strategic priority is EU passporting, compare Mauritius with our MiCA license in Europe and Malta crypto license pages. If your priority is a non-EU regulated base with cross-border flexibility, Mauritius can be compelling when matched to the right model.

Official sources and legal disclaimer

This page is based on the regulatory framework applicable in 2026, including the Virtual Asset and Initial Token Offering Services Act, 2021, the Financial Intelligence and Anti-Money Laundering Act, 2002, relevant FSC Mauritius rules and guidance, and public information from the FSC Register of Licensees, the Bank of Mauritius, and the Mauritius Revenue Authority.

Primary official sources to verify before filing:

• Financial Services Commission, Mauritius;
• VAITOS Act, 2021;
• FIAMLA, 2002;
• FSC AML/CFT guidance and application criteria;
• FSC register of licensees;
• Bank of Mauritius guidance where the model intersects with banking or payment activity;
• Mauritius Revenue Authority for tax administration.

Legal disclaimer: this content is for general informational purposes only and does not constitute legal, tax, regulatory, or investment advice. Licence class, token classification, tax treatment, and banking outcomes depend on the exact facts of the business model and should be assessed case by case.