Operating a crypto exchange without the right licence in Mauritius exposes the business to regulatory enforcement, sudden banking termination and the loss of institutional counterparties who check your regulated status before onboarding. The VAITOS Act 2021 (the Virtual Asset and Initial Token Offering Services Act) created a statutory licensing regime administered by the Financial Services Commission (FSC) of Mauritius, bringing exchanges and other virtual asset service providers inside a formal authorisation structure. For any inbound business weighing Mauritius against competing offshore hubs, the first question is not whether to licence but which licence category applies and what the application requires.
Mauritius sits in a distinctive position: it combines a common-law legal system, a network of double-taxation treaties, and a dedicated VASP (virtual asset service provider) framework that aligns, at least structurally, with FATF Recommendation 15 on virtual assets. That combination attracts exchange operators who need a credible regulatory address that also supports banking and fund-flow across Africa, Asia and Europe. This page maps the legal requirements for a crypto exchange setup in Mauritius, the process an inbound operator should expect, and the cross-border considerations that shape a viable structure.
What Is the Legal Basis for Crypto Exchange Regulation in Mauritius?
The VAITOS Act 2021 is the primary legal instrument governing virtual asset service providers in Mauritius, and the FSC is the supervising authority for all licence categories under it. The Act defines a virtual asset broadly and captures exchange activity – the buying, selling and trading of virtual assets against fiat or other virtual assets – as a regulated service. A business operating an exchange without FSC authorisation commits an offence under the Act. There is no registration-only track for exchanges; full licence authorisation is required.
The FSC has published rulebooks and guidance notes that set out, in operational terms, what a licensed exchange must maintain. These cover AML/CFT policies, governance requirements, cybersecurity standards, and client asset safeguarding. The regime is explicitly risk-based: the FSC assesses the applicant's business model, its beneficial ownership chain, its AML programme and the fitness and propriety of its key controllers. Operators we advise are often surprised by the depth of governance documentation the FSC expects at the outset.
In the regional context, Mauritius sits between the lighter-touch BVI FSC regime under the VASP Act 2022 and the more capital-intensive regimes of Singapore's MAS under the Payment Services Act or Hong Kong's SFC VATP licensing. The FSC's expectations are substantive but reachable for a well-prepared applicant. A cross-border business that also serves EU clients should note that Mauritius authorisation does not carry MiCA passporting rights; EU-facing services require a separate CASP authorisation under MiCA administered by a national competent authority.
What Licence Categories Apply to a Crypto Exchange in Mauritius?
The VAITOS Act creates distinct categories for virtual asset activities, and a crypto exchange will typically need a Virtual Asset Exchange licence – the FSC category that covers operating a platform on which users buy, sell or exchange virtual assets for fiat or for other virtual assets. Where the same entity also holds client assets between trades, custody may be captured as a separate regulated activity requiring its own authorisation or an additional licence endorsement.
The FSC also recognises categories for virtual asset advisory, brokerage, portfolio management and initial token offering facilitation. A business that combines exchange services with any of these activities needs to ensure its licence scope covers each service line. Running an unlicensed ancillary activity inside a licensed exchange is an enforcement risk that the FSC has signalled it will pursue actively.
Operators in our cross-border practice regularly encounter a structural question at this stage: should the exchange function and the custody function sit in the same Mauritius entity, or should custody be separated into a dedicated subsidiary? The answer depends on the FSC's current guidance on combined-activity applications, the operator's banking arrangements and the structural preferences of institutional liquidity providers. We routinely map that split before a client submits its first application, because restructuring mid-process is costly.
The CTA below is for operators who are meeting this question for the first time. The process described is the standard path. Your entity structure, user base and banking relationships will change the analysis significantly.
To scope which licence categories your exchange model requires, contact OBOLUS at info@oboluslaw.com – or map your options at Map your options.
How Does the FSC Licence Application Process Work?
A Mauritius crypto exchange licence application involves a multi-stage FSC review that covers corporate structure, AML compliance, governance and technical readiness before the authority issues an in-principle approval. The process begins with the incorporation of a Mauritius company – the FSC licences entities formed under Mauritius company law, not foreign branches – followed by the submission of a formal application with a defined package of supporting documents.
That documentation package typically includes: a detailed business plan with a financial model; a description of the exchange's technology infrastructure; AML/CFT policies and procedures certified by a qualified compliance officer; fit-and-proper questionnaires for all controllers and substantial shareholders; and source-of-funds documentation for the applicant's shareholders. The FSC has the authority to request additional information at any stage; delays most commonly arise from incomplete AML documentation or unclear ownership chains.
Timeline varies by application complexity. A straightforward, single-category application with complete documentation tends to move through FSC review in a matter of months; multi-activity or complex group-structure applications take longer. The FSC does not publish a statutory decision period comparable to some EU NCAs, so applicants should plan for a process measured in calendar months rather than weeks. Operators we advise typically achieve an in-principle approval within a timeframe that is broadly comparable to other offshore hubs at a similar stage of VASP regulation.
Following in-principle approval, the applicant satisfies any outstanding conditions – often including the appointment of a local compliance officer, the finalisation of banking arrangements and the completion of a technology audit – before the FSC issues the full licence. The exchange may not begin operations until the full licence is in hand.
What AML and Travel Rule Obligations Apply?
Licensed exchanges in Mauritius must implement a full AML/CFT programme aligned with FATF Recommendation 15 and the broader FATF Recommendations that apply to financial institutions and VASPs. This means customer due diligence, enhanced due diligence for high-risk clients, transaction monitoring, suspicious transaction reporting to the Financial Intelligence Unit (FIU) of Mauritius, and internal controls that the FSC can inspect at any time.
The Travel Rule – the obligation to pass originator and beneficiary data with a virtual asset transfer above the applicable threshold – applies to licensed VASPs in Mauritius. Mauritius has aligned its Travel Rule implementation with FATF's framework, and exchanges must have a technical solution in place to transmit and receive the required data. The precise de-minimis threshold at which the Travel Rule applies is set by FSC guidance and is subject to revision; operators should verify the current figure against FSC publications before going live.
In our practice, the AML programme is often the most time-intensive element of an FSC application. Regulators in the leading offshore hubs increasingly expect the programme to be built before submission, not drafted as a post-licence exercise. A programme that looks adequate on paper but lacks a credible implementation plan will draw questions in the FSC's review. Operators arriving from jurisdictions with lighter AML expectations should budget both time and compliance spend accordingly.
How Do Banking and Tax Interact for a Mauritius Exchange?
A Mauritius-licensed exchange needs banking – fiat on-ramp and off-ramp relationships – and the interaction between the FSC licence, the exchange's banking structure and its tax position is where many operators make costly assumptions. Holding a VAITOS licence is necessary but not sufficient to secure a banking relationship: Mauritian banks apply their own risk appetite assessments to virtual-asset clients, and not every local bank accepts exchange business.
Mauritius has an extensive tax treaty network – covering many African, Asian and European jurisdictions – which makes it an attractive holding location for a regional operating group. The Global Business Company (GBC) regime provides the vehicle through which treaty benefits are accessed; the exchange's operational entity will typically be a GBC holding the FSC licence. The interaction of the GBC regime with the exchange's actual economic substance is the subject of FSC and Mauritius Revenue Authority scrutiny: Mauritius has committed to OECD substance standards, and a Mauritius exchange that is a brass-plate operation will not satisfy either regulator.
For a business serving clients in multiple regions, the cross-border structure raises additional questions. A Mauritius exchange serving EU retail clients will face MiCA's rules on third-country provider access; one serving US persons may encounter FinCEN and, depending on the instruments traded, SEC or CFTC perimeter questions. Banking in a jurisdiction that is comfortable with VASP clients – and that clears in the currencies the exchange needs – must be identified alongside, not after, the licence application. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams; the alternative routinely produces a licensed exchange with no viable fiat rails.
If a prior application stalled or a banking relationship was declined, a second read of the structure often surfaces the underlying issue. Contact OBOLUS or Map your options to discuss the route forward.
A Cross-Border Exchange Licence: An Illustrative Matter
In a recent licensing matter, a digital-asset exchange operator incorporated in a common-law offshore jurisdiction approached us after receiving an adverse response from its target banking partner – the bank had declined to open an account without sight of a credible Mauritius FSC application in progress. The operator had not yet begun the application. We mapped the licence categories required for the exchange's combined spot-trading and custody model, identified a gap in the ownership disclosure chain that would have stalled the FSC's fit-and-proper review, and restructured the shareholder documentation before the application was filed. The FSC review proceeded without a documentation-related pause. Banking discussions reopened on the strength of the in-principle approval. The matter concluded in the second half of the year and is now operational under a full VAITOS licence.
Which Operator Profile Should Choose Mauritius?
Mauritius is not the right choice for every exchange operator, and a clear-eyed assessment of your profile against the jurisdiction's strengths and constraints is essential before committing to the application cost and timeline.
Profile A – An exchange targeting African and Asian markets that needs a common-law-governed, treaty-networked, FATF-aligned licence. Mauritius offers a credible regulatory address, a GBC tax structure with treaty access, and an FSC that engages with well-prepared applicants. The timeline and documentation burden are comparable to other mid-tier offshore hubs. The key risk is that banking relationships are harder to establish than in, say, Lithuania or Switzerland; identifying the banking partner before filing the application is essential.
Profile B – An exchange with primarily EU clients seeking a single licence to serve the whole EU. Mauritius does not provide this. MiCA CASP authorisation in an EU member state – Lithuania and Malta both offer active CASP pathways – is the correct instrument. A Mauritius holding entity is compatible with an EU operating subsidiary but does not replace one.
Profile C – An exchange operator who needs to move quickly and has limited administrative infrastructure to support a substance-intensive jurisdiction. Mauritius's GBC substance requirements and FSC governance expectations make it less suitable for a minimal-footprint operation. The BVI VASP Act 2022, or the Cayman VASP registration track, may offer a faster entry point with a lower substance requirement – though they provide less treaty access and less banking comfort for institutional counterparties.
These profiles are illustrative, not prescriptive. The right answer depends on your user geography, your technology model, your investor profile and your banking access. We map the licence, banking and tax stack for each client's specific build before any commitment is made.
What Are the Most Common Mistakes in a Mauritius Exchange Application?
The FSC application process rewards preparation and punishes shortcuts. The mistakes we see most consistently are: submitting an application before banking is identified; presenting an AML programme that lacks a qualified compliance officer to own it; failing to disclose the full beneficial ownership chain in the fit-and-proper questionnaires; and underestimating the substance requirement for the GBC entity. Each of these creates a material delay or, in the worst case, a declined application that is difficult to revive.
A common assumption in the market is that a single offshore VASP licence is sufficient to serve clients in any jurisdiction globally. That assumption is wrong, and it is one of the more consequential errors an exchange operator can make. A Mauritius VAITOS licence authorises the operation of the exchange under Mauritius law. It does not authorise the solicitation of EU clients under MiCA, US persons under FinCEN or federal securities law, or UK clients under FCA financial promotion rules. Each market the exchange accesses adds a legal layer that the Mauritius licence does not automatically satisfy. Operators who plan to serve clients across multiple regions need a jurisdiction map built before the exchange goes live, not after the first enforcement inquiry.
The FSC also expects active regulatory engagement post-licence. Annual returns, FSC inspection cooperation, and prompt notification of material changes to the business or ownership structure are ongoing obligations. Operators who treat the licence as a once-and-done exercise accumulate compliance debt that eventually surfaces in a banking review or an FSC inquiry.
Self-Assessment: Are You Ready to File?
Before submitting a VAITOS licence application to the FSC, a well-prepared exchange operator should be able to confirm the following. The Mauritius company is incorporated and the GBC application is in progress or complete. The full beneficial ownership chain is documented and all controllers have passed a preliminary fit-and-proper review. An AML/CFT programme is drafted and a qualified compliance officer is identified or in place. The exchange's technology architecture is documented and a cybersecurity posture can be evidenced. A banking partner has been identified or is in active discussion. The exchange's target markets have been reviewed for additional regulatory requirements beyond the Mauritius licence.
If any of these items is outstanding, the application is not ready to file. Filing early with incomplete documentation does not accelerate the process; it prolongs it, because the FSC will query the gaps and the clock runs from the date of a complete submission, not from the date of a partial one.
We map the licence stack across operating, custody and payment layers before a client commits to an application. That pre-filing review typically surfaces structural issues – in ownership, in the AML programme, or in the banking plan – that are far cheaper to fix before the application than during it.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full scope of OBOLUS licensing practice across 70+ jurisdictions.
- Lithuania vs Switzerland: where to licence a crypto business – comparative analysis for operators choosing between two leading European hubs.
- Smart contract legal review in Switzerland – FINMA's technology-neutral legal analysis and what it means for exchange infrastructure.
FAQ
How long does a crypto licence take to obtain?
In Mauritius, a VAITOS licence application typically takes a matter of months from submission of a complete file to in-principle approval, with additional time to satisfy any post-approval conditions. Timeline depends on the complexity of the licence category, the completeness of the AML documentation, and the clarity of the ownership chain. Across other jurisdictions – Singapore's MAS, Hong Kong's SFC, or an EU CASP authorisation under MiCA – timelines vary considerably by regime and by application volume at the regulator. Every licence window is influenced by preparation quality; a complete, well-structured submission materially reduces the risk of delay.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right choice depends on your target markets, the activities you will conduct, your banking requirements, your tax position and the substance you can commit to the jurisdiction. Mauritius suits operators targeting African and Asian markets who need treaty access and a common-law framework. Lithuania and Malta suit EU-facing exchanges needing MiCA CASP authorisation. Singapore and Hong Kong suit Asia-Pacific institutional models. A jurisdiction map built against your specific operating model is the correct starting point; a decision made on cost or speed alone rarely holds under banking or regulatory scrutiny.
Do I need a separate custody licence?
Under the VAITOS Act in Mauritius, holding client virtual assets as part of an exchange operation may be captured as a distinct regulated activity requiring its own FSC authorisation or an additional endorsement on the exchange licence. The answer depends on how custody is structured within the business model and on current FSC guidance. In most flagship jurisdictions – MiCA, Singapore's Payment Services Act, Hong Kong's SFC VATP regime – custody is a separately regulated activity. Combining exchange and custody services in a single entity without addressing the custody perimeter is a common structural error that creates enforcement exposure.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams, and we map the licence stack across operating, custody and payment layers before clients commit. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound exchange and VASP licence applications across offshore and emerging-market regulatory regimes, with a particular focus on the VAITOS framework and Africa-Asia operator structures.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.