A payments company expanding into East Africa or the Indian Ocean region quickly discovers that Mauritius is not merely a tax-efficient holding location. Under the VAITOS Act 2021 (Virtual Asset and Initial Token Offering Services Act), the island has established a supervised, registration-based regime for VASPs (virtual asset service providers) that carries real compliance obligations and real enforcement teeth. Operating without the correct authorisation exposes a business to regulatory censure, blocked banking relationships and, in the worst case, forced cessation of the service. The Financial Services Commission (FSC) of Mauritius administers the regime, and it has signalled that it will treat unlicensed activity as a material risk to the financial system.
This page explains the legal basis for VASP licensing in Mauritius, the application process an inbound business must work through, the cross-border tax and banking dynamics that affect the decision, and the questions a general counsel or founder should answer before committing capital to the structure.
What is the legal basis for VASP licensing in Mauritius?
The VAITOS Act 2021 is the primary statute governing virtual asset and initial token offering services in Mauritius. It gives the FSC the authority to license, supervise and enforce against any person providing a defined virtual asset service from or in Mauritius. The Act created a dedicated licence category for VASPs, distinct from the general financial services licensing regime, and introduced complementary obligations on anti-money laundering controls, governance and custody standards that track closely to the Financial Action Task Force (FATF) Recommendation 15 framework for virtual assets.
Mauritius sits within the FATF membership through the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG). That membership shapes the FSC's supervisory posture. The FSC expects applicants to demonstrate that their AML/CFT programme is genuinely functional – not a paper policy drafted to satisfy a checklist. In our cross-border practice, we have seen regulators in mid-size common-law hubs reject applications precisely because the AML programme was lifted wholesale from a template rather than calibrated to the applicant's actual transaction flows, user geographies and risk exposure.
Contextual bridge: The standard path above describes the regulatory structure. Your specific facts – the entity's ownership structure, the categories of service you intend to provide, and the geographies of your user base – change the analysis considerably. For a scoped assessment of your Mauritius VASP application, contact OBOLUS at info@oboluslaw.com.
Who needs a VASP licence in Mauritius?
Any business providing virtual asset services – including exchange services, transfer services, custody services and participation in and provision of financial services related to an issuer's offer or sale of a virtual asset – requires a VASP licence under the VAITOS Act if it operates from Mauritius or targets Mauritius-based clients. The FSC takes a substance-based view: a business incorporated in Mauritius but managed from elsewhere, or a foreign business directing marketing at Mauritius residents, may fall within scope regardless of where it nominally sits.
The licence categories are activity-based. An exchange operator, a custodian and a token issuer each present a different regulatory profile and may require separate or additional authorisations depending on the combination of services they intend to run. An entity providing only exchange services does not automatically secure authorisation to take custody of client assets; the FSC treats custody as a distinct regulated activity with its own governance and safeguarding expectations.
For international groups, the FSC's nexus analysis matters. A holding company incorporated in Mauritius that merely owns a foreign operating entity may not require a VASP licence itself. But if that holding company exercises control over the foreign entity's virtual asset activities, the FSC may look through the structure. We regularly advise international groups on drawing this line before they file – a clean analysis early avoids a forced restructure after incorporation.
What does the VASP application process in Mauritius involve?
The FSC application for a VASP licence is a multi-stage process that demands preparation well in advance of filing. The applicant must submit a business plan, a detailed description of the services to be provided, AML/CFT policies, a compliance manual, governance documents, evidence of fit-and-proper status for each director and beneficial owner, and – where applicable – documentation of technology infrastructure, custody arrangements and key staff qualifications. The FSC may request supplemental information at any stage, and the clock on the formal review period generally does not run until the application is considered complete.
Timelines vary by application complexity. A straightforward exchange application from a well-organised applicant with clean ownership and a functional compliance programme can move through the process in a matter of months. Applications involving layered ownership, multi-activity authorisation or novel business models take longer. The FSC retains discretion to request site visits, interviews with key staff and third-party assessments of the AML programme. Applicants who underestimate the depth of that scrutiny invariably incur delay.
In practice, the most common points of failure we observe in inbound applications are three: a beneficial ownership structure that the FSC cannot map to natural persons without extensive supplemental inquiry; an AML risk assessment that does not address the specific virtual assets and geographic corridors the business operates; and a governance structure in which the Mauritius-based compliance officer lacks genuine authority or operational independence. Each of these is correctable before filing. None is correctable quickly after a formal objection has been raised.
How does Mauritius handle AML and Travel Rule obligations?
The VAITOS Act operates alongside Mauritius's broader AML/CFT legislative architecture, which aligns to FATF Recommendation 15 and requires VASPs to implement the Travel Rule – the obligation to pass originator and beneficiary data with each virtual asset transfer above the applicable threshold. The FSC expects VASPs to have a technical solution in place for Travel Rule compliance, not merely a policy that acknowledges the obligation. The de-minimis threshold and precise data-field requirements are set by regulation and are subject to change; operators should verify current requirements with counsel rather than relying on older guidance.
Customer due diligence expectations under the Mauritius regime follow the FATF risk-based approach. Enhanced due diligence is mandatory for high-risk geographies, politically exposed persons and non-face-to-face onboarding. The FSC has signalled particular sensitivity to the use of privacy-enhancing technologies and to transactions routed through mixing services; an applicant whose business model involves either should engage with the FSC's expectations early.
For cross-border groups, the interaction between Mauritius's Travel Rule implementation and the requirements of the jurisdiction where the counterparty VASP is licensed creates a practical complication. Where the counterparty jurisdiction has not yet implemented the Travel Rule, or where its de-minimis threshold differs materially from Mauritius's, the Mauritius-licensed entity must manage the gap. This is not a theoretical risk – it is a daily operational question for exchange operators. We advise clients to map the counterparty-VASP Travel Rule matrix before launch.
What are the cross-border tax and banking dynamics?
Mauritius has long been valued as a cross-border holding and operating location because of its treaty network, its Global Business Company (GBC) regime and its territorial corporate tax approach. For a VASP, those advantages interact with the VAITOS Act licensing requirement in a way that demands integrated planning. A business that licenses in Mauritius but holds most of its substance elsewhere may find that the GBC tax benefits it expected are constrained by the substance requirements the FSC applies to the VASP licence itself – the regulator expects key management decisions to be made on the island, not merely rubber-stamped there.
Banking access for Mauritius-based VASPs remains a live question. The island's banking sector is internationally connected, but correspondent banking sensitivity to crypto-related flows is a global phenomenon that Mauritius is not immune to. In our practice, we have seen clients obtain a VASP licence in Mauritius and subsequently discover that their preferred banking relationship – either local or cross-border – required more extensive due diligence than anticipated, or in some cases was not available at all for the specific virtual asset activity they intended to run. Pre-application banking outreach is not optional; it is a material input into the go/no-go decision on jurisdiction.
The interaction between Mauritius's treaty network and the tax treatment of virtual asset income is jurisdiction-specific and depends on the characterisation of the income in both Mauritius and the counterparty jurisdiction. Mauritius does not apply VAT to financial services, and there is no capital gains tax, but the practical effect on a VASP's tax position depends heavily on how the income streams are structured and how the other side of the transaction is taxed in the client's home jurisdiction. Tax counsel in both Mauritius and the relevant counterparty states should be engaged before the structure is finalised.
How does Mauritius compare to other licensing options for an inbound business?
Mauritius occupies a specific position in the international licensing environment: it is a common-law jurisdiction with a functioning VASP-specific statute, a treaty network that makes it useful for holding and operating structures with African and Asian counterparties, and a regulatory body that is resource-constrained relative to the leading EU or Gulf hubs but increasingly sophisticated in its expectations. That combination makes it attractive for certain profiles and less suited to others.
For a business primarily serving EU clients, the MiCA passporting mechanism – obtainable through a CASP authorisation in any EU member state – offers single-market access that a Mauritius licence cannot replicate. For a business serving clients across sub-Saharan Africa, South Asia or the wider Indian Ocean region, Mauritius may offer practical and treaty advantages that a European licence does not provide. For a global exchange seeking a primary regulatory home, the FSC's current resource level and the relative novelty of the VAITOS Act mean that the business must weigh the regulatory brand and institutional depth of the FSC against those of the SFC in Hong Kong, MAS in Singapore or VARA in Dubai.
A common assumption we encounter is that a single Mauritius licence is sufficient to serve clients across all of these geographies without further regulatory analysis. That assumption is incorrect. Mauritius licensing authorises service provision from Mauritius. It does not override the local licensing or registration requirements of the jurisdictions where clients are resident. A Mauritius-licensed exchange serving UK clients is still subject to FCA registration requirements. One serving EU retail clients must consider MiCA's reach. The jurisdiction-of-client analysis is always a second step after the jurisdiction-of-entity analysis.
A practical example from cross-border licensing work
In a recent licensing engagement, a digital-asset transfer and custody business sought to establish a regional operating hub for its East African client base. The business had previously operated under a transitional exemption that was approaching expiry. We advised on entity structuring within the GBC framework, mapped the beneficial ownership chain to satisfy the FSC's fit-and-proper requirements, and drafted an AML programme calibrated to the business's specific transaction corridors – including enhanced-due-diligence procedures for the higher-risk geographies in the client's user base. The application was filed with a complete compliance manual and banking pre-engagement already in place. The FSC's review proceeded without a formal request for additional information. The licence was granted within the indicative window the FSC had communicated at pre-application stage. The client entered operation without a gap in regulatory cover.
Which business profile is best suited to a Mauritius VASP licence?
A business whose primary user base sits in sub-Saharan Africa, South Asia or the Middle East and Indian Ocean region, and whose ownership structure can be cleanly mapped to identifiable natural-person beneficial owners, is the profile best suited to pursue a Mauritius VASP licence as its primary regulatory base. The timeline is manageable for a well-prepared applicant, the operating cost environment is lower than the Gulf or Singapore, and the treaty network provides genuine tax structuring optionality. Key risk: banking access must be pre-confirmed.
A business primarily targeting EU or UK retail clients should first assess whether a MiCA CASP authorisation or FCA registration is the correct primary licence, with Mauritius playing a secondary structuring role. The EU passporting benefit is material. A Mauritius licence adds cost and regulatory load without providing the market-access equivalent of a MiCA passport for that specific user geography.
A business seeking to list tokens or run an exchange for institutional counterparties with complex ownership structures – multiple corporate layers, institutional investors, offshore holding entities – should budget significantly more time for the FSC's fit-and-proper review than a simple operating company structure would require. The FSC's capacity is real but not unlimited; complex applications take proportionally longer. If the institutional model requires rapid market entry, the FSC timeline may be a constraint that weighs toward an alternative jurisdiction.
If you have previously attempted a Mauritius application that stalled, or if a banking relationship associated with a VASP structure has been closed, a structural review can identify the source of the problem and the route forward. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw.
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – how we map the full licence stack across operating, custody and payment layers before you commit capital.
- Malta vs Switzerland: Where to License a Crypto Business – a comparative analysis for operators choosing between two leading European licensing hubs.
- AML and Travel Rule Regime in the UAE under VARA (Dubai) – how the VARA regime addresses AML, Travel Rule obligations and cross-border compliance for Dubai-licensed VASPs.
FAQ
How long does a crypto licence take to obtain?
In Mauritius, a well-prepared VASP application to the FSC typically progresses within a matter of months once accepted as complete. Timeline depends on the complexity of the ownership structure, the number of regulated activities applied for, and the FSC's current workload. Applications that arrive incomplete, or that require the FSC to request supplemental information on AML controls or beneficial ownership, take materially longer. Pre-engagement with the FSC and complete documentation at filing are the most reliable ways to manage timeline risk.
Which jurisdiction is best for licensing my crypto business?
There is no single correct answer. Mauritius suits businesses whose primary markets are sub-Saharan Africa, South Asia or the Indian Ocean region, and whose ownership can be clearly mapped to identifiable persons. Businesses targeting EU retail clients should weigh a MiCA CASP authorisation for its passporting benefit. Gulf operators may prefer VARA in Dubai or the FSRA in ADGM. The right answer depends on user geography, ownership structure, banking access and the timeline available. We map these axes for every client before a jurisdiction is chosen.
Do I need a separate custody licence?
Under the VAITOS Act, custody of virtual assets is a distinct regulated activity. An exchange licence does not automatically extend to taking custody of client assets. If your business model involves holding client assets on their behalf – whether as part of an exchange, a fund administration service or a standalone custody offering – the FSC's expectations around segregation, safeguarding and governance apply separately. Some businesses require a combined authorisation. The FSC's activity-based approach means the answer depends on how your services are actually delivered, not how they are labelled.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence, banking and tax stack across operating, custody and payment layers before our clients commit capital to a structure. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or reach us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound VASP licensing, multi-jurisdictional regulatory mapping and pre-application FSC engagement for digital-asset operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.