Operating a digital-asset business without the right regulatory authorisation is not merely an administrative oversight. It exposes the business to enforcement action, loss of banking access and the kind of reputational damage that a later licence will not repair. Mauritius has built a virtual asset regulatory regime (the framework governing crypto-asset service providers under the VAITOS Act 2021) that attracts inbound operators precisely because it sits inside a well-regarded international financial centre with treaty networks, common-law courts and a functioning banking environment. The question is not whether to use it. The question is whether your structure, your activities and your cross-border user base actually qualify – and whether you have prepared the application correctly.
This page sets out the regulated basis, the application process, the cross-border interactions with tax and banking, and the structural decision point for businesses considering a VARA licence (virtual asset registration and authorisation under Mauritius law) as their primary or secondary licensing peg.
The Regulatory Basis in Mauritius
Mauritius regulates virtual asset activity through the Virtual Asset and Initial Token Offering Services (VAITOS) Act 2021, administered by the Financial Services Commission (FSC). The VAITOS Act introduced a formal authorisation regime for virtual asset service providers, aligning the jurisdiction with the FATF Recommendations on virtual assets and the Travel Rule. Before this regime, digital-asset businesses in Mauritius operated in a more permissive environment. Today, any business carrying on regulated virtual asset activities from or within Mauritius requires a licence or authorisation under the applicable provisions of the VAITOS Act – there is no registration-only path for active service providers.
The FSC is the competent authority for all financial services regulation in Mauritius, covering both the global business sector and domestic financial markets. Its approach to virtual assets reflects the dual mandate of attracting inbound investment-grade operators while maintaining the jurisdiction's clean-sheet standing with international standard-setters. Mauritius is a FATF member jurisdiction and takes Travel Rule compliance seriously. The FSC expects applicants to demonstrate a credible AML/CFT programme from day one of the application, not as an afterthought.
The VAITOS Act defines regulated activities by reference to the services provided – exchange, custody, transfer, administration and related investment services on virtual assets. Each category carries its own authorisation track. Businesses that combine categories (for example, an exchange that also offers custody) will need to address each regulated activity in the application, and the FSC will assess the governance and capital adequacy across the combined footprint.
Who Needs a Licence Under the VAITOS Act?
Any person carrying on virtual asset service activities in or from Mauritius requires authorisation under the VAITOS Act. The jurisdictional trigger is functional, not purely geographical: a business incorporated in Mauritius that provides services to users outside the island falls within scope, as does a business incorporated elsewhere that operates from a Mauritius-based office or uses Mauritius as its primary licensing peg for cross-border distribution.
The practical categories that require a licence include operators of virtual asset exchanges, providers of custody or wallet services for client assets, entities facilitating the transfer or transmission of virtual assets on behalf of clients, and platforms that offer investment or portfolio management services over virtual assets. Initial token offering (ITO) platforms have a distinct authorisation track under the VAITOS Act and are assessed separately from ongoing service-provider licences.
Businesses that are already licensed in another jurisdiction and wish to use a Mauritius entity to service a particular client base – for example, African markets or Indian Ocean regional distribution – need to analyse whether that secondary entity independently triggers the VAITOS threshold. In our cross-border practice, we have seen operators assume that a primary EU or UAE licence covers the Mauritius-incorporated subsidiary. It does not. Each regulated entity stands on its own licence.
To assess whether your specific structure requires a VAITOS authorisation, contact OBOLUS at Map your options. The process above describes the standard path. Your facts – the entity, the user base and the banking – change the analysis.
What Does the VAITOS Licence Application Process Involve?
The VAITOS application process is structured around the FSC's standard authorisation gateway, but with virtual-asset-specific requirements layered on top. The core documents include a detailed business plan, an AML/CFT programme, a technology and security assessment, a corporate governance framework and fit-and-proper documentation for every director, beneficial owner and senior manager. The FSC applies a substance test: the Mauritius entity must have genuine management presence in the jurisdiction, not merely a registered office address.
The application is filed with the FSC's Licensing Department. The FSC acknowledges receipt and conducts a completeness check before formal assessment begins. Incomplete applications are returned without substantive review, which in practice means that preparation quality at the filing stage directly determines how quickly the process advances. Operators we advise regularly underestimate the volume of governance documentation that the FSC expects – particularly the board-level AML policy, the technology risk framework and the third-party service-provider due diligence record.
Timeline is a function of application completeness and the FSC's current processing queue. The FSC's general practice is to issue a decision within a matter of weeks from the point at which the file is deemed complete, though complex applications or those requiring additional information exchange can extend that period materially. Applicants should plan for a realistic runway and should not depend on the licence being in place by a fixed commercial launch date unless that date allows adequate buffer.
Key milestones in a well-managed application include: pre-filing engagement with the FSC to confirm the correct licence category; preparation of the governance and AML documentation pack; entity incorporation and substance establishment (local director, registered office, banking infrastructure); filing of the formal application; FSC completeness check and initial queries; substantive review and fit-and-proper assessment; conditional approval and licence issuance. Each step requires attention; a stall at the fit-and-proper stage – the most common point of delay – can add significant time to the overall process.
AML, the Travel Rule and Ongoing Compliance Expectations
The FSC requires VAITOS licensees to operate a full AML/CFT programme aligned with the FATF Recommendations, including the Travel Rule (the obligation to pass originator and beneficiary identifying information with virtual asset transfers above the applicable threshold). Compliance with the Travel Rule is assessed both at the application stage and as an ongoing supervisory matter post-licence. The FSC expects licensees to have a Travel Rule solution in place – whether a dedicated inter-VASP messaging protocol or an integrated compliance tool – before operations commence.
AML obligations extend to transaction monitoring, suspicious transaction reporting, customer due diligence, and enhanced due diligence for high-risk clients and jurisdictions. The FSC has aligned its expectations with the Financial Intelligence and Anti-Money Laundering Act and the relevant FATF guidance on virtual assets. For operators serving clients in higher-risk geographies, the compliance burden is correspondingly higher, and the FSC may ask applicants to demonstrate how that risk is managed in the technology stack.
Post-licensing, the FSC conducts supervisory visits and requests periodic compliance reports. Licensees are expected to maintain their AML programme as a living document, updated to reflect changes in the business, the client base and the applicable FATF guidance. Failure to maintain an effective programme is grounds for licence suspension or revocation.
How Does the Mauritius Licence Interact With Tax and Banking?
A Mauritius virtual asset licence does not operate in isolation – it sits within a tax and banking architecture that is either an asset or a liability depending on how the structure is built. Mauritius has a network of double-tax treaties covering a significant number of jurisdictions. For businesses with cross-border revenue flows, this makes a correctly structured Mauritius entity genuinely tax-efficient, provided the substance requirements for treaty access are met. A shell with a licence and no genuine management presence will not qualify for treaty protection and may be treated as a tax resident of the jurisdiction where its controlling management actually sits.
Banking is the practical constraint that ambushes most operators. Mauritius has a developed banking sector, but international banks operating on the island apply their own risk-appetite filters to virtual asset business. Some banks will open accounts for FSC-licensed virtual asset service providers with strong governance documentation; others decline the sector entirely. In our cross-border practice, we have seen applications stall at the banking stage long after the FSC licence was issued, because the operator had not pre-qualified a banking partner before filing. The lesson is to run the banking process in parallel with the licence application, not sequentially.
For businesses with a global user base, Mauritius as a licensing peg does not automatically provide passporting rights into other jurisdictions. The EU's MiCA regime requires a separate CASP authorisation within the EU/EEA. The UAE's VARA regime applies to Dubai-based activity independently. Singapore's MAS Payment Services Act governs digital payment token services in Singapore on its own terms. A Mauritius licence provides a credible regulatory anchor and a compliant entity for certain markets, but an operator with European, Gulf or Southeast Asian users must map each regulatory trigger separately.
If your structure spans multiple jurisdictions and you need to map the licence, banking and tax stack before you commit, write to OBOLUS at Map your options. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back.
A Practical Illustration: Cross-Border Structure and the Mauritius Entity
In a recent licensing matter, a digital-asset exchange operator domiciled in a European holding structure sought to establish a dedicated entity to service African institutional clients. The operator had assumed that its EU regulatory authorisation would extend to the Mauritius-incorporated subsidiary by virtue of the group relationship. It did not. We mapped the VAITOS Act trigger, identified the correct licence category, and managed a parallel banking engagement with two Mauritius-based institutions while the FSC application was in preparation. The FSC licence was issued, banking infrastructure was confirmed before go-live, and the subsidiary commenced operations with a clean regulatory foundation. The cross-border tax position was addressed at the same time by confirming genuine local substance – a resident director with executive authority, local board meetings and a Mauritius-based compliance officer – so that the entity qualified for the applicable treaty network rather than being treated as tax-resident of the parent jurisdiction.
Decision Matrix: Is a Mauritius VAITOS Licence the Right Fit for Your Business?
Not every operator should anchor in Mauritius. The correct licensing jurisdiction depends on where the clients are, where the banking lives and what activities the entity actually conducts. The following profiles illustrate the decision logic.
Profile A – African-market distribution: A business with institutional or retail clients across sub-Saharan Africa or the Indian Ocean region, seeking a credible regulatory anchor with treaty network access and common-law courts. Mauritius is a strong primary licensing peg. The VAITOS Act covers the relevant activities, the FSC is a recognised regulator, and the treaty network is commercially relevant. Timeline is measured in months from a well-prepared application; the key risk is banking access, which must be addressed pre-filing.
Profile B – EU or Gulf primary, Mauritius secondary: A business that needs a primary licence in the EU (MiCA CASP) or the UAE (VARA, Dubai) and is evaluating Mauritius as a secondary entity for a specific client segment. Mauritius can serve this function, but the operator must treat the Mauritius entity as a genuinely separate regulatory person with its own governance and AML programme. The common mistake is treating it as an administrative subsidiary of the primary licensed entity.
Profile C – Global exchange seeking a low-complexity offshore peg: A business that wants a single offshore licence to serve clients in multiple major markets. This profile does not match the Mauritius VAITOS regime well. The FSC expects genuine substance and an AML programme calibrated to the actual client base. More importantly, a single Mauritius licence does not provide regulatory cover for EU, UK, US, Singapore or Hong Kong users. Operators that present this business model to the FSC typically receive requests for significant additional information on their geographic risk management.
The common thread across all profiles: the Mauritius licence is a credible, functional regulatory instrument for operators who understand what it covers and structure their entity accordingly. It is not a shortcut and it is not a global passport.
What Are the Most Common Mistakes in a VAITOS Application?
Incomplete governance documentation is the leading cause of delayed or unsuccessful VAITOS applications. The FSC expects a board-level AML policy, a detailed technology risk framework and director fit-and-proper packs that go beyond a standard CV. Operators who treat these as administrative attachments rather than substantive governance documents create avoidable delays.
A second common mistake is filing before banking is confirmed. The FSC may issue a licence, but without a functioning bank account the Mauritius entity cannot operate. Banking due diligence on virtual asset businesses takes time, and some institutions will decline regardless of the FSC authorisation. Running banking and licensing in parallel – not sequentially – is the operationally correct approach.
A third mistake, one we see repeatedly in inbound instructions, is the assumption that substance requirements are satisfied by appointing a local registered agent as director. The FSC applies a management-and-control test. The entity must have a director with genuine decision-making authority resident in Mauritius, board meetings physically or verifiably held on the island, and a compliance officer with local accountability. A nominee director who signs documents on instruction from an overseas controlling mind does not meet this standard.
A final structural error: treating the VAITOS licence as a substitute for legal analysis of the applicable regime in each client-facing jurisdiction. The Mauritius licence authorises activity from Mauritius. It does not authorise activity in the jurisdictions where clients are located. If those jurisdictions require local licensing – and the major markets increasingly do – the Mauritius entity is only one part of the required stack.
A Common Assumption: One Offshore Licence Is Enough
A common assumption among operators entering the virtual asset sector for the first time is that a single offshore licence provides a compliant basis for serving clients globally. This assumption is incorrect and potentially dangerous. The jurisdictions with the largest digital-asset user populations – the EU, the UK, Singapore, Hong Kong, Japan and the United States – each maintain their own licensing or registration requirements. Operating in those markets without the locally required authorisation exposes the entity to enforcement action in those jurisdictions, regardless of what the Mauritius FSC has authorised.
The Mauritius VAITOS regime is a well-constructed regulatory instrument. For the markets it covers and the client segments it serves, it is genuinely useful. But a general counsel advising a board on market entry strategy should treat it as one node in a multi-jurisdiction licensing map, not as a universal solution. Regulators in the leading hubs increasingly expect operators to hold local authorisation, not to rely on a distant offshore licence as a compliance backstop.
What the Mauritius licence does provide is a credible, FSC-supervised regulatory foundation, access to the Mauritius treaty network, and a common-law legal environment with functioning courts. For an operator building a compliant cross-border structure, that is a meaningful package – provided the application is prepared correctly and the entity is genuinely substantive.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the complete guide to VASP and exchange authorisation across 70+ jurisdictions
- Hong Kong vs United Kingdom: where to licence a crypto business – a comparative analysis of two leading common-law licensing hubs
- Fund domicile selection for digital-asset firms – legal counsel on structuring and domiciling digital-asset investment vehicles
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction and application quality. In Mauritius, a well-prepared VAITOS application can advance through the FSC process within a matter of months from filing, provided the file is complete and the fit-and-proper documentation is in order. Incomplete applications are returned before substantive review begins, which extends the process materially. Other jurisdictions – including Singapore, Hong Kong and the UAE – have their own processing timelines that vary by licence category and current regulatory queue. Plan conservatively and do not fix a commercial launch date that depends on a precise licence issuance date.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The correct answer depends on where your clients are located, where your banking relationships live, what activities your entity conducts and what your tax and substance position requires. Mauritius suits operators serving African or Indian Ocean markets and seeking a treaty-network-accessible common-law anchor. The EU's MiCA CASP regime suits operators targeting European users. VARA in Dubai suits businesses building in the Gulf. Singapore's MAS regime covers Southeast Asian distribution. Most serious cross-border operators hold more than one licence. We map the full stack before recommending a primary jurisdiction.
Do I need a separate custody licence?
In most flagship jurisdictions, custody of client virtual assets is a separately regulated activity, not an incidental feature of an exchange licence. Under the VAITOS Act in Mauritius, custody services require their own authorisation track. Under MiCA in the EU, crypto-asset custody is a distinct CASP activity category. Under the VARA regime in Dubai and the SFC regime in Hong Kong, custody is similarly ring-fenced. If your business model involves holding client assets – even temporarily, as part of a settlement process – you should assume that a custody authorisation is required and confirm with qualified counsel before operating.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so that the structure you build is the structure that holds. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound VASP and exchange licensing across African, Indian Ocean and Asia-Pacific jurisdictions, with a focus on substance requirements and cross-border licence stacking.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.