A digital-asset business preparing to serve African, European and Asian markets faces a pointed question at the outset: where to hold the licence. Mauritius has moved with deliberate speed to answer that question. The Financial Services Commission of Mauritius administers the VAITOS Act (Virtual Asset and Initial Token Offering Services Act 2021), a purpose-built regime that brought virtual asset service providers under formal regulatory supervision. For an operator weighing time-to-market against credibility, Mauritius offers a serious option – but the application demands structured preparation and a clear understanding of what the regime covers, what it does not, and how the licence interacts with the jurisdictions where your clients actually sit.
Operating without the right licence risks enforcement action, frozen banking rails and the loss of the institutional counterparties that a regulated business can command. The analysis below maps the VAITOS regime from first principles, sets out the application process, identifies the cross-border friction points that most inbound operators underestimate, and addresses the moment to engage counsel.
What does the Mauritius VAITOS regime actually cover?
The VAITOS Act 2021 is the primary legislative instrument governing virtual asset service providers in Mauritius. It defines a virtual asset service provider (VASP) as any person that, as a business, carries on one or more specified activities: exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer of virtual assets, safekeeping and administration of virtual assets, and participation in and provision of financial services relating to an issuer's offer or sale of a virtual asset. The Financial Services Commission (FSC Mauritius) is the competent authority for authorisation, supervision and enforcement under the Act.
The Act also establishes a framework for Initial Token Offerings, requiring issuers to file a token offering document with the FSC before approaching investors. The two streams – VASP authorisation and ITO filings – are legally distinct, though a single entity may require both if it both issues and trades virtual assets.
Classification matters here. An operator that merely develops software infrastructure or provides non-custodial wallets to its own employees is unlikely to fall within the defined activities. An operator offering a retail exchange, a custodial wallet, or an OTC desk almost certainly does. The substance of the activity – not the label the business applies to itself – determines whether authorisation is required. In our cross-border practice, we regularly see operators misjudge this boundary and begin operations without authorisation, triggering remediation processes that are far more expensive than a pre-launch legal opinion.
Who needs a VASP licence in Mauritius?
Any entity carrying on virtual asset service activities in or from Mauritius must hold a valid authorisation from the FSC. The "in or from" formulation is significant. A Mauritius-incorporated entity conducting its business entirely offshore is still subject to the regime. Equally, a foreign entity with a registered presence in Mauritius that directs VASP activities through that presence will require authorisation.
The FSC has made clear that holding companies, management companies and technology-service entities that do not themselves carry on the defined activities sit outside the direct licensing requirement – though they may still carry ancillary obligations, including AML/CFT registration. The boundary can be narrow. A group structure that routes client flows through a Mauritius entity, even for treasury or settlement purposes, may bring that entity within the perimeter.
Operators we advise routinely encounter a second ambiguity: the position of a non-Mauritius entity that markets services to Mauritius-resident users. The Act's territorial reach on that question should be assessed against the FSC's published guidance and the specifics of the business model before any marketing or onboarding commences.
For a scoped assessment of whether your entity structure triggers the VAITOS authorisation requirement, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
How does a VASP licence application in Mauritius work?
The FSC authorisation process follows a structured sequence: entity incorporation, fit-and-proper assessment of controllers and senior managers, submission of the application dossier, FSC review and query rounds, and the issuance of the authorisation certificate. Each stage has dependencies, and omissions at the early stages reliably extend the overall timeline.
The application dossier typically covers the following:
- Business plan – detailing the virtual asset services to be provided, the intended client base, the jurisdictions of operation, projected transaction volumes and the technology infrastructure supporting the platform.
- Governance documentation – constitutional documents, group structure chart, beneficial ownership register, board composition and delegation of authority framework.
- Fit-and-proper materials – personal questionnaires, professional CVs, criminal record checks and regulatory history declarations for each director, ultimate beneficial owner and senior manager. The FSC applies a substantive assessment; prior regulatory sanctions in any jurisdiction are scrutinised closely.
- AML/CFT programme – a written policies-and-procedures manual aligned to the Financial Intelligence and Anti-Money Laundering Act and FATF Recommendation 15, including the Travel Rule obligations applicable to virtual asset transfers.
- Compliance function – details of the Money Laundering Reporting Officer (MLRO) and compliance officer, together with their qualifications and proposed arrangements for ongoing regulatory reporting.
- Technology and cybersecurity documentation – infrastructure architecture, data-protection arrangements and, for custody activities, the proposed segregation and safeguarding methodology.
- Capital and financial projections – the FSC requires evidence that the applicant holds sufficient own funds for the class of authorisation sought. The precise threshold varies by category; consult current FSC guidance before budgeting.
Query rounds are the stage most operators underestimate. The FSC may issue one or more rounds of written questions following initial review. Responses must be substantive. A thin or delayed response resets the review clock. In our experience, operators who present a complete, well-prepared dossier at the point of submission reduce the number of query rounds materially.
Overall timeline from submission to authorisation varies. Based on current FSC practice, a well-prepared application can expect a process measured in months rather than weeks; complex structures or incomplete submissions extend this further. We describe timelines qualitatively because the FSC's review pace is subject to caseload and application quality – any specific guarantee would be unreliable.
What are the AML and Travel Rule obligations under VAITOS?
FATF Recommendation 15, which requires countries to regulate and supervise VASPs for AML/CFT purposes, underpins the compliance expectations embedded in the VAITOS regime. The FSC expects applicants not merely to have written policies, but to demonstrate that those policies are operational and proportionate to the risk profile of the business.
The Travel Rule – the obligation to pass originator and beneficiary data with a virtual asset transfer – applies to Mauritius-licensed VASPs. The mechanics of Travel Rule compliance require the operator to assess its transaction volumes, the counterparty VASP universe and the technical solution it will use to transmit the required data. FATF-aligned jurisdictions increasingly expect that solution to be in place, not merely planned, at the point of authorisation.
Customer due diligence, transaction monitoring, suspicious transaction reporting to the Financial Intelligence Unit and record retention all require written procedures and designated responsibility. The MLRO must be a suitably qualified individual, independent from the commercial functions of the business. A board-level AML champion is increasingly expected.
Operators we advise that have previously held a lighter-touch registration in another jurisdiction often find the Mauritius compliance expectations materially more demanding. The FSC treats the AML programme as a substantive gatekeeping document, not a box-checking exercise. Programmes that read as copied-and-pasted from generic templates draw the most critical scrutiny.
How does a Mauritius VASP licence interact with tax and banking?
The Mauritius licence does not, by itself, confer the right to operate in other jurisdictions. This is the myth most inbound operators carry: that a single offshore authorisation is sufficient to serve clients globally. It is not. A Mauritius VASP may be fully authorised by the FSC and still face restrictions when marketing to EU-resident clients under MiCA, to UK clients under FCA rules, or to Singapore clients under the Payment Services Act administered by the Monetary Authority of Singapore. The geographic scope of permitted activity must be assessed jurisdiction by jurisdiction, driven by where the clients are, not only where the entity sits.
On banking: Mauritius-authorised VASPs have access to the domestic banking sector, and several international banks operating in Mauritius have developed compliance frameworks for licensed virtual asset businesses. That access is not automatic. Banks conduct their own due diligence on VASP clients, and the quality of the FSC authorisation dossier – and the ongoing compliance posture of the business – influences the outcome. We have seen well-structured operators secure banking relationships in parallel with the FSC process, and we have seen operators with valid licences struggle for months because their compliance documentation did not satisfy their bank's correspondent-bank requirements.
Tax: Mauritius operates a territorial tax regime with a competitive statutory rate and an extensive network of double-taxation agreements. Virtual asset businesses need to assess the tax treatment of their specific activities – exchange income, staking rewards, management fees – against both domestic law and any applicable treaty. Tax residency of the operating entity and the substance requirements that underpin treaty access are live questions for any group structuring work. Consult qualified tax counsel before committing to a Mauritius structure.
In a recent matter, an exchange operator expanding from a Gulf hub sought to add Mauritius as a secondary licensing pillar to service African institutional clients. We mapped the licence interaction, identified a gap between the Mauritius perimeter and the operator's proposed Kenyan marketing activity, and restructured the client-facing entities before the FSC application was submitted. The application proceeded without the jurisdictional ambiguity that would have attracted FSC questions on extraterritorial scope.
If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Write to OBOLUS at info@oboluslaw.com. Map your options.
How does Mauritius compare for an inbound digital-asset operator?
Mauritius sits in a distinct tier among the established offshore and mid-shore licensing options. It is not a passporting regime like MiCA, which gives an EU CASP authorisation access to the entire EEA market. It is not a high-volume, high-cost hub like Singapore or Hong Kong. It occupies a different position: a credible, FATF-compliant, common-law jurisdiction with a functional regulator, a territorial tax regime and improving banking access – calibrated for operators whose primary markets are in Africa, the Indian subcontract, the Middle East or emerging Asia.
Decision branches, in broad terms, look like this:
Profile A – A crypto exchange targeting African institutional and retail clients, with no EU marketing intent. Mauritius is a strong primary-hub candidate. The FSC authorisation provides regulatory credibility, the territorial tax structure is commercially attractive, and the jurisdiction's bilateral investment and tax treaty network covers several target markets. The timeline and cost of entry are proportionate to the scale of the business at launch.
Profile B – A token issuer seeking to raise capital from EU-qualified investors and then list on a Mauritius-licensed exchange. Mauritius alone is insufficient. The issuer will require analysis of MiCA's whitepaper obligations, the jurisdictions in which the offering is conducted, and the applicable prospectus or token-offering rules in each. A Mauritius ITO filing under VAITOS can be a component of a multi-jurisdiction structure, but it cannot substitute for EU-specific analysis.
Profile C – A custody-focused operator serving family offices and funds across the Middle East and East Africa. Mauritius offers a viable authorisation path for custody services. The cross-border question is whether the funds themselves – if domiciled in ADGM, Cayman or another jurisdiction – require the custodian to hold concurrent authorisation in those jurisdictions. That assessment drives the group structure before any single licence application is filed.
What are the most common mistakes in a Mauritius VASP application?
Incomplete fit-and-proper documentation is the single most frequent cause of extended review timelines. Controllers and beneficial owners who hold or have held regulated functions in other jurisdictions need to disclose that history in full. Partial disclosure, discovered in the FSC's own checks, can result in a refusal or a prolonged supplementary review.
A second recurring issue is a compliance programme that is well-drafted on paper but cannot be demonstrated operationally. The FSC will ask how the programme runs, not only what it says. The MLRO must be genuinely capable and demonstrably independent.
A third mistake is applying for a broader category of authorisation than the business model actually requires. Broader authorisation attracts higher capital expectations and more intensive supervision. Operators who map their activities precisely to the minimum necessary authorisation category before applying avoid costs and complexity they do not need.
A common assumption among inbound operators is that the Mauritius regime is a light-touch registration similar to what existed in earlier years in some European jurisdictions. That assumption is outdated. The FSC has developed a substantive supervisory posture, and applications that reflect the older expectation typically require significant rework.
Self-assessment checklist before filing
Before submitting a VASP licence application to the FSC, an operator should be able to confirm each of the following:
- The Mauritius entity is incorporated and has a registered office with a licensed management company.
- The activity to be carried on maps to one or more defined VASP activities under the VAITOS Act.
- All directors, senior managers and ultimate beneficial owners have completed fit-and-proper declarations and supporting documentation.
- The business plan covers jurisdiction-by-jurisdiction market analysis, not only Mauritius.
- An AML/CFT programme compliant with FATF Recommendation 15 and the Travel Rule is documented and operationally ready.
- An MLRO has been designated, is adequately qualified, and is independent from the commercial function.
- Capital levels meet the FSC's category-specific requirements as of the date of submission.
- A banking analysis has been conducted in parallel, not deferred until after authorisation.
- The interaction between the Mauritius licence and the jurisdictions of intended client activity has been assessed by qualified counsel.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – how OBOLUS maps the full licence, banking and tax stack across operating jurisdictions.
- VASP licence application in Malta – the MFSA regime, the VFA-to-MiCA transition, and the EU passporting question.
- Cross-chain bridge legal risk in Bermuda – structural and regulatory risk analysis for bridge operators in an offshore common-law seat.
FAQ
How long does a crypto licence take to obtain?
In Mauritius, the FSC authorisation process for a well-prepared application is typically measured in months. Timeline depends on application completeness, the complexity of the group structure, the number of FSC query rounds, and current regulatory caseload. Operators that submit a complete, well-documented dossier at first instance materially reduce the review period. No regulator – in Mauritius or elsewhere – provides a binding timeline commitment at the point of application.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on your client base geography, your product type, your capital, your banking needs and your tax objectives. Mauritius suits operators targeting Africa, the Indian subcontinent and parts of the Middle East who require a credible, FATF-compliant base without EU passporting. Businesses targeting EU clients need MiCA coverage. Those focused on institutional Asian markets should assess Singapore or Hong Kong. We map the full options matrix before our clients commit.
Do I need a separate custody licence?
Under the VAITOS Act, custody and administration of virtual assets is a defined VASP activity requiring FSC authorisation. If your business model includes holding client assets – whether as a primary custodian or as an incidental function of an exchange – you will need the applicable authorisation category to cover that activity. In a multi-jurisdiction group, the question of whether custody of assets held for clients in other jurisdictions requires concurrent local authorisation must be assessed separately for each relevant regime.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We map the licence stack across operating, custody and payment layers before our clients commit to a structure – not after. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in digital-asset authorisation across African, Middle Eastern and offshore common-law regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.