Mauritius has positioned itself as a credible mid-tier licensing hub for digital-asset businesses seeking regulated fiat access – but the practical question for an inbound operator is rarely just whether a PSP (payment service provider) agreement is available. It is whether the regulator, the acquirer and the correspondent bank will each accept the structure once it lands on their compliance desk. Getting that answer wrong costs months of onboarding time and, in the worst cases, frozen settlement rails mid-operation.
Under the VAITOS Act 2021 – the Virtual Asset and Initial Token Offering Services Act – Mauritius created a formal statutory basis for virtual-asset service providers operating in or from the island. The Financial Services Commission (FSC) supervises both the VASP licence and the broader financial-services regime within which payment and acquiring agreements sit. For a crypto business, the PSP relationship is downstream of the VASP licence: acquirers and EMIs consistently require a valid regulatory status before they will open settlement accounts or provide card-acquiring rails. This page maps the regulated basis, the inbound process, the cross-border tax and banking interaction, and the decision points that determine whether Mauritius is the right fit.
The regulated basis for PSP and acquiring in Mauritius
Mauritius offers a structured path, not a shortcut. The FSC administers a tiered licensing regime under the VAITOS Act 2021, and a VASP licence is a prerequisite for most payment-service and acquiring relationships in the jurisdiction. Without it, a crypto-facing business occupies an unregulated grey zone that no serious acquirer will accept.
The VAITOS Act 2021 covers a defined list of virtual-asset services – exchange, transfer, custody, administration and related activities. Each category carries its own regulatory obligations, including AML/CFT alignment with FATF Recommendation 15, fit-and-proper requirements for controllers and beneficial owners, and ongoing supervision by the FSC. A business that holds a valid VASP licence can then approach payment institutions and acquirers with a credible compliance narrative.
PSP agreements in Mauritius typically involve one of three structures: a direct relationship with a Mauritian-licensed payment service provider, an arrangement with a regional EMI that holds a Mauritius FSC authorisation, or a cross-border setup where the acquiring entity is licensed elsewhere but settles through Mauritius as the remittance-receiving jurisdiction. The FSC monitors all three models for substance requirements – an empty shell with a Mauritius address and no local operations will not satisfy current supervisory expectations.
In our practice, we see operators underestimate the sequencing. They pursue the PSP agreement before the VASP licence is in place, assuming the acquirer will wait. Most will not. The compliance queue at any regulated acquirer begins only when the applicant can produce a licence number, a compliance policy, and evidence of a beneficial-ownership register that satisfies FATF standards.
Who needs this structure – and who does not
Not every crypto business with a Mauritius connection needs a full PSP-plus-VASP stack. The analysis turns on three variables: where the business is incorporated, where its users are located, and where the fiat settlement actually lands.
A business incorporated in Mauritius, serving users in Africa and the Middle East, and settling in USD or EUR through a Mauritian bank clearly needs both. A business that is merely using a Mauritius holding company as a tax-efficient intermediary, with the operational entity licensed elsewhere, may only need a payment-flow agreement at the holding-company level – not a full VASP authorisation. And a business that is providing services exclusively to non-Mauritian persons on a global-business-licence basis may face a different regulatory posture altogether, depending on the FSC's current interpretation of the VAITOS Act's territorial reach.
The cross-border dimension is where errors accumulate. We regularly advise operators who have a Mauritius entity, a European EMI agreement, and a customer base that spans multiple continents. The licensing in each layer needs to be consistent – a VASP licence in Mauritius does not authorise the provision of services to EU residents under MiCA, nor does it substitute for a Singapore MAS digital payment token licence for users in Southeast Asia. A single offshore licence is not sufficient to serve clients globally.
The relevant decision framework is therefore: Mauritius VASP licence for the operating entity plus a PSP agreement for fiat settlement; allied counsel in each jurisdiction where users are actively served; and a group structure that keeps regulatory perimeters clean.
Operating without the right licence exposes the business to enforcement action, frozen settlement rails and the loss of banking relationships at the worst possible moment. The FSC has demonstrated willingness to act against unregistered VASP activity, and acquirers that discover a compliance gap mid-relationship will terminate the agreement rather than absorb the risk.
For a scoped assessment of your Mauritius structure and PSP readiness, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options
What does the inbound application process look like?
The FSC operates a defined application process for VASP licences under the VAITOS Act, and understanding each gate reduces the risk of a stalled submission. The process has five functional stages, and each one has compliance dependencies that downstream PSP onboarding will rely on.
Stage one is entity formation and substance establishment. A Mauritius FSC-supervised VASP must be incorporated in Mauritius (typically as a private company) and must demonstrate local substance – a registered office, at least one local director, and a compliance function that is not entirely outsourced. The substance requirement has tightened following international pressure on low-substance holding structures, and the FSC will scrutinise whether the Mauritius entity is the genuine operational centre or merely a registration convenience.
Stage two is the licence application itself. The applicant files with the FSC, providing a business plan, an AML/CFT manual aligned to FATF standards, details of all controllers and beneficial owners for fit-and-proper assessment, a risk framework, and evidence of adequate capital. The capital requirement varies by licence category under the VAITOS Act – figures are [VERIFY] and should be confirmed from current FSC guidance, as they are subject to revision.
Stage three is the FSC review and query process. The regulator will typically issue clarification requests – on ownership structure, on the technology stack, on the geographic scope of proposed services. Timeline varies. Operators we advise have experienced review periods ranging from a matter of weeks for straightforward applications to several months where the ownership chain is complex or the business model requires additional supervisory comfort.
Stage four is post-licence compliance activation. Before approaching a PSP or acquirer, the business must have its AML programme operational, its Travel Rule procedures documented, and its ongoing FSC reporting obligations mapped. A dormant licence – held but not actively maintained – is a red flag for acquirer compliance teams.
Stage five is the PSP and acquiring negotiation itself. At this point, the operator approaches prospective payment partners with a compliance package: the FSC licence, the AML manual, the beneficial-ownership register, the business plan, and (increasingly) a third-party compliance audit or an opinion letter from regulated-market counsel. Acquirers operating in Africa and the Indian Ocean region treat Mauritius FSC authorisation as a meaningful signal. Acquirers in the EU or UK will additionally require comfort that the Mauritius entity does not provide services to their regulated customers without its own authorisation in the relevant jurisdiction.
Why is cross-border banking the hardest part?
Fiat rails are the most constrained resource in the digital-asset industry, and Mauritius is not exempt from the pattern that affects every licensing hub: the licence is easier to obtain than the bank account that makes it operationally useful.
Mauritian commercial banks operate within a correspondent-banking network that remains sensitive to crypto-linked transaction flows. A VASP licensed by the FSC does not automatically obtain a business bank account. The bank's own compliance committee will assess the business model, the customer base, the transaction volumes, and the extent to which the operator's AML controls are genuinely embedded. Banks that have closed crypto accounts elsewhere – across the EU, the UK and the US – apply the same risk appetite to their Mauritian relationships.
In practice, this means that the banking engagement runs in parallel with the FSC application, not after it. We have seen operators complete a six-month licence process only to find that their preferred bank requires an additional three to four months of due diligence before opening a settlement account. The better approach is to identify the target bank, conduct early-stage outreach, and obtain informal comfort on the risk profile before significant capital is committed to the licensing process.
The Travel Rule – the FATF obligation to pass originator and beneficiary data with a virtual-asset transfer – intersects with the banking relationship at the onboarding stage. A Mauritius-licensed VASP that cannot demonstrate a Travel Rule solution (either a proprietary system or a connection to a recognised Travel Rule protocol) will struggle to satisfy both the FSC's ongoing obligations and the acquirer's correspondent-bank requirements. This is not a theoretical concern. It is a hard compliance gate that we address in every structuring engagement.
EMI relationships offer an alternative route. A Mauritius VASP that cannot secure a direct bank account may onboard with an EMI (electronic money institution) authorised in the EU, UK or another major jurisdiction. The EMI provides the fiat settlement infrastructure; the Mauritius entity provides the VASP-licensed front-end. This structure works, but it introduces a jurisdictional layering issue: the EMI's home regulator may require assurance that the Mauritius entity is not providing services to that regulator's protected customers without local authorisation.
How does the Mauritius tax regime interact with the PSP structure?
Mauritius has a well-established tax-treaty network and a corporate income tax rate that has historically made it attractive for holding and operating structures in Africa and South Asia. For a crypto business, the tax analysis is inseparable from the regulatory and banking analysis – the structure that optimises for licensing may not be the same as the structure that optimises for treaty access.
The island's standard corporate rate is set by the Income Tax Act, and companies with a Global Business Licence historically benefited from a deemed foreign-tax-credit mechanism. The interaction between that mechanism and a VASP licence under the VAITOS Act is a question that requires jurisdiction-specific tax advice from counsel familiar with current FSC and MRA (Mauritius Revenue Authority) guidance. We do not quote rates in this context because the applicable treatment varies by licence type, corporate residency, and the nature of the token or payment activity – figures should be confirmed from current official sources.
What we can say with confidence is that the tax tail should not wag the compliance dog. Operators who structure purely for tax efficiency and then retrofit the regulatory requirements tend to produce structures that satisfy neither the tax authority nor the FSC. The better architecture is: regulatory perimeter first, tax optimisation within that perimeter. Where the two objectives conflict, regulatory compliance takes priority.
Cross-border withholding tax on payment flows – from the PSP agreement to the parent entity or to customers – is a separate analysis. It depends on the treaty position between Mauritius and the counterparty jurisdiction, the characterisation of the payment (service fee, royalty, dividend, interest), and whether the Mauritius entity is treated as the beneficial owner or as a conduit. These questions require a full structuring review before the PSP agreement is signed.
A practical illustration: acquirer onboarding stalled mid-process
In a recent engagement, a payments business holding a Mauritius VASP licence approached a regional acquirer to establish a card-settlement relationship for its crypto-fiat exchange service. The acquirer's compliance team accepted the FSC licence documentation and the AML manual but identified a gap: the beneficial-ownership chain included a corporate shareholder in a jurisdiction the acquirer's correspondent bank classified as high-risk. The deal stalled for several months while the operator attempted to restructure the chain without disrupting its existing regulatory approvals.
We were engaged to map the regulatory consequences of each restructuring option – including the effect on the VASP licence, the FSC's change-of-control notification requirements, and the acquirer's own approval timeline for a revised ownership structure. The matter was resolved by a corporate reorganisation that satisfied both the FSC's substance test and the acquirer's correspondent-bank requirements. The settlement account was opened in the following quarter. The key lesson: acquirer onboarding is not merely a commercial negotiation. It is a multi-layer compliance exercise in which the legal structure, the ownership chain, and the AML framework are reviewed simultaneously.
Which operator profile should choose this structure?
The Mauritius PSP-plus-VASP structure suits a defined set of operator profiles. It does not suit every digital-asset business, and identifying the mismatch early saves significant time and capital.
Profile A – the Africa-focused exchange or remittance operator. A business whose primary customer base is in sub-Saharan Africa, East Africa or the Indian Ocean region, settling in USD or EUR, with a genuine local presence in Mauritius. For this profile, the Mauritius VASP licence is the natural anchor. The FSC is a recognised regulator in the region, the Mauritian banking system offers correspondent access to major African banks, and the tax-treaty network supports efficient settlement flows. The principal risk is the time required to obtain both the licence and the banking relationship – plan for a process measured in months, not weeks.
Profile B – the global operator using Mauritius as a secondary hub. A business with a primary licence in the EU (MiCA CASP), Singapore (MAS) or the UK (FCA), adding Mauritius as an operating entity for African or Middle Eastern customers. For this profile, the Mauritius VASP licence is a complement, not a substitute. The cross-border compliance obligation – ensuring that the Mauritius entity does not serve EU or MAS-regulated customers without separate authorisation – is the dominant legal question. The PSP agreement needs to be scoped to the Mauritius entity's permitted customer base, not the group's global book.
Profile C – the early-stage operator seeking speed. A business in the early stages of development, without a primary licence elsewhere, attracted by Mauritius because of perceived regulatory simplicity. This profile needs to recalibrate expectations. The FSC has materially strengthened its supervisory posture in recent years, and the VAITOS Act carries genuine compliance obligations. Operators who treat Mauritius as an easy first step often find that the PSP and banking requirements impose the same compliance burden as a more demanding jurisdiction, at a lower reputational premium. We advise this profile to either commit to the Mauritius structure fully or to reassess whether a more established hub – Malta under MiCA, or Singapore under the Payment Services Act – better fits the business model.
If a prior application stalled or a banking relationship closed, a structured second review can identify the underlying compliance gap and the path to resolution. To map the licence, banking and tax stack for your Mauritius build, write to info@oboluslaw.com. Map your options
What are the most common mistakes operators make?
Across the engagements we handle in this area, five errors recur with enough frequency to merit direct treatment.
The first is treating the VASP licence as the end point rather than the starting point. A licence without banking, without a Travel Rule solution, and without a functioning AML programme is commercially inert. Operators who celebrate the licence grant and then begin the PSP search from scratch lose months of runway.
The second is underestimating substance requirements. The FSC – and, by extension, the acquirers who rely on the FSC's supervisory credibility – will assess whether the Mauritius entity is real. A nominee director, a rented desk, and an outsourced compliance officer who has never visited the island does not constitute substance. The regulator has updated its guidance on this point, and the supervisory expectation is for a genuinely embedded local operation.
The third is misreading the geographic scope of the licence. A Mauritius VASP licence authorises the provision of virtual-asset services in or from Mauritius. It does not authorise the solicitation of EU residents (now governed by MiCA CASP requirements), UK consumers (FCA-regulated), or US persons (SEC/CFTC/FinCEN analysis applies). Operators who serve a global customer base from a single Mauritius entity without allied local authorisations are accumulating regulatory risk in each unaddressed jurisdiction.
The fourth is signing a PSP agreement before reviewing the acquiring bank's correspondent restrictions. The agreement may be valid and enforceable, but if the correspondent bank has a blanket exclusion on crypto-linked settlement, the agreement is commercially worthless. Correspondent-bank acceptability needs to be confirmed before the PSP contract is executed.
The fifth – and the one we encounter most in cross-border structuring – is misaligning the PSP agreement's currency settlement terms with the beneficial-owner's tax position. A USD settlement flow from a Mauritian PSP to a holding company in a high-tax jurisdiction may trigger withholding obligations that eliminate the operational efficiency the structure was designed to create. Tax counsel needs to review the payment flow before the PSP agreement is signed.
When and how should you engage legal counsel?
The right moment to engage counsel on a Mauritius PSP and acquiring structure is before the licence application is filed – ideally before the entity is incorporated. The sequencing decisions made at the formation stage determine whether the structure will satisfy the FSC, the acquirer's compliance team, and the correspondent bank simultaneously.
We regularly advise at three distinct stages: the structuring stage (entity design, ownership chain, regulatory perimeter mapping); the application stage (FSC submission, AML programme build, Travel Rule solution selection); and the commercial stage (PSP agreement review, acquirer onboarding support, correspondent-bank acceptance review). Operators who engage at the commercial stage alone – after the structure is set and the licence is held – typically face higher remediation costs than those who engaged at the structuring stage.
Allied counsel in Mauritius handles the local corporate and regulatory filings. OBOLUS coordinates the cross-border compliance and commercial layer – the interaction between the Mauritius structure and the operator's obligations in its primary market, the EMI or PSP agreement from a cross-border regulatory perspective, and the tax and banking stack across the group.
Related at OBOLUS
- Banking, Payments and EMI Onboarding – cross-border fiat access and PSP structuring for digital-asset businesses
- EMI onboarding for VASPs in the Seychelles – the regulatory process and banking stack for Seychelles-based virtual-asset operators
- VASP licensing in Switzerland – FINMA's token taxonomy and the licence routes available to digital-asset businesses
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because the business model generates transaction patterns that are difficult to reconcile with the bank's AML and correspondent-bank obligations. Without a valid VASP licence, a documented AML programme, a Travel Rule solution, and clear beneficial-ownership disclosure, the compliance cost of maintaining the relationship exceeds the commercial benefit. Banks also face pressure from their own correspondent institutions, which may impose blanket restrictions on crypto-linked settlement flows regardless of the local operator's licence status. A well-structured regulatory package materially reduces – though does not eliminate – this risk.
How can a VASP onboard with an EMI?
A VASP onboards with an EMI (electronic money institution) by presenting a compliance package that satisfies the EMI's own regulatory obligations in its home jurisdiction. That package typically includes the VASP licence, an AML/CFT manual, a beneficial-ownership register, a business plan, and evidence of a functioning Travel Rule solution. The EMI's compliance team will assess whether serving the VASP creates exposure under its home regulator's requirements – meaning a Mauritius VASP seeking EMI access in the EU must also satisfy MiCA-era expectations, even if it does not itself hold a MiCA CASP authorisation.
What does client-money safeguarding require?
Client-money safeguarding requires a licensed PSP or EMI to hold customer funds in a segregated account, separate from the operator's own assets, with a regulated credit institution or in qualifying liquid assets. The specific requirements vary by regime: under the VAITOS Act framework, the FSC sets the applicable standards for Mauritius-licensed entities; under EU payment-services rules, the relevant directive's safeguarding provisions apply. For a cross-border structure – a Mauritius VASP settling through a European EMI – both layers of safeguarding obligation must be satisfied simultaneously, and the structure must be reviewed by counsel in each relevant jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – and when a recovery clock is running, our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in VASP licensing, PSP onboarding and cross-border AML compliance for digital-asset operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.