Indian Ocean

Mauritius — VASP License (FSC / VAITOS 2021) 2026

The Mauritius VASP license from the FSC under VAITOS 2021 is the premier offshore crypto authorization for exchanges, custodians, wallet providers, and investment advisors targeting Africa, Asia, and global markets. Five license classes, ~3% effective corporate tax, FATF Travel Rule aligned, 45+ DTAAs, and ISO 27001-recommended IT infrastructure. Zitadelle AG: 5+ Mauritius VASPs licensed since 2024.

REGULATOR
FSC (Financial Services Commission) Mauritius
FRAMEWORK
VAITOS 2021
EFFECTIVE TAX
~3%
LAST UPDATED
March 2026

Why Mauritius for VASP Licensing?

Mauritius is consistently Zitadelle AG's most recommended offshore VASP jurisdiction for crypto businesses targeting Africa, Asia, the Middle East, and global markets. The Financial Services Commission (FSC) operates the VASP framework under VAITOS 2021 — the Virtual Assets and Initial Token Offerings Services Act — providing a comprehensive, FATF-aligned regulatory structure with five license classes covering the full range of virtual asset service activities.

Unlike many offshore alternatives, Mauritius combines genuine regulatory substance with compelling tax efficiency (~3% effective corporate tax via the partial exemption regime), strong international banking relationships, and a network of 46+ double taxation agreements that create real commercial advantages for international crypto businesses. Zitadelle AG has licensed 5+ Mauritius VASPs since 2024 and operates an administration office at 1F River Court, 6 St. Denis Street, Port Louis — providing direct FSC access.

~3% Effective Corporate Tax

Mauritius GBC entities benefit from an 80% partial exemption on foreign-sourced income — reducing the effective corporate tax rate to approximately 3% on qualifying income. Capital gains: 0%. Withholding tax on dividends: 0%. The most favorable tax rate among regulated offshore VASP jurisdictions with genuine regulatory substance.

Full FATF Travel Rule Compliance

Mauritius FSC-licensed VASPs are fully integrated into global FATF Travel Rule networks — collecting, transmitting, and retaining originator and beneficiary information per FATF Recommendation 16. Mauritius VASP holders are accepted as Travel Rule counterparties by major global exchanges operating in regulated jurisdictions.

46+ Double Taxation Agreements

Mauritius's extensive DTAA network covers India, China, South Africa, the UAE, France, Germany, Singapore, and 39+ other jurisdictions. For VASP operators with cross-border crypto flows and fiat settlement, these treaties provide material tax efficiency unavailable from Seychelles, SVG, or most other offshore VASP jurisdictions.

Strong Offshore Banking Access

Mauritius FSC VASP holders access significantly better banking relationships than Seychelles FSA, SVG, or Caribbean VASPs. MCB (Mauritius Commercial Bank), SBM, AfrAsia Bank, and international EMI partners provide banking access that supports meaningful exchange operations.

Gateway to Africa and Asia

Mauritius's unique geographic and regulatory position between Africa and Asia makes it the optimal offshore jurisdiction for crypto businesses targeting both regions simultaneously. The FSC's relationships with African and Asian regulators provide commercial credibility that Caribbean or Pacific jurisdictions cannot match.

English Common Law Framework

Mauritius operates under English common law — the same legal infrastructure as the UK, Singapore, and the Cayman Islands. All VASP contracts, regulatory submissions, and corporate documentation operate under familiar common law principles.

VASP License Classes: The Five Options

The FSC issues five distinct VASP license classes under VAITOS 2021 — each covering different virtual asset service activities with different capital requirements. Selecting the correct class (or combination of classes) before application is critical.

ClassCodeServices CoveredMin. Capital (MUR)Min. Capital (USD approx.)FSC Processing FeeAnnual FSC Fee
Broker-DealerVA-1.1 (M)VA-to-VA and VA-to-fiat exchange; crypto broker-dealerMUR 2,000,000~USD $44,000$1,500–$2,500$1,900–$3,000
Wallet & TransferVA-1.2 (O)Wallet services, VA transfer, custody-light12 months working capitalOperational$1,000–$2,000$1,900–$3,500
Custodian/RegistryVA-1.3 (R)Custodian of virtual assets; VA registry servicesMUR 5,000,000~USD $110,000$2,000–$3,000$3,000–$4,500
Investment AdviceVA-1.4 (I)Investment advice on virtual assetsSufficient for operationsOperational$1,000–$1,500$1,900–$2,500
Marketplace/ExchangeVA-1.5 (S)Full crypto exchange marketplace; multi-asset trading platformMUR 6,500,000~USD $143,000$2,500–$3,000$4,000–$5,000

Class Selection Note: Most crypto exchanges with spot trading (both crypto-to-fiat and crypto-to-crypto) require either Class M (Broker-Dealer) or Class S (Marketplace/Exchange) — depending on whether you operate as a principal or as a marketplace matching buyers and sellers. Custody-heavy operations require Class R. Multi-activity operators may need multiple class authorizations within a single FSC license. Zitadelle AG advises on the correct class structure for your specific business model during the initial consultation.

2025–2026 Regulatory Updates: What Changed

The FSC has significantly enhanced its VASP supervisory framework since 2024. Any guidance predating March 2025 should be treated as incomplete.

1

Mandatory AI-Driven AML Monitoring (March 2025)

The FSC now mandates automated transaction monitoring for all licensed VASPs — moving beyond manual review to AI-driven or algorithm-based suspicious transaction detection. Manual-only AML/CTF monitoring is no longer considered adequate by the FSC. New applicants must demonstrate their technology infrastructure includes automated monitoring capability.

2

Real-Time Cross-Border Transfer Reporting (March 2025)

Real-time reporting of cross-border virtual asset transfers to the FSC is now required. This significantly increases the operational infrastructure requirements for VASPs conducting high-volume cross-border activity.

3

Stricter UBO Disclosure Requirements (2025)

Enhanced beneficial ownership verification requirements — including more frequent UBO updates and stricter documentation standards for complex ownership structures. All UBOs must be verified to FSC standards regardless of the number of intermediary layers.

4

DeFi, Staking, and DAO Activities (2024–2025)

DeFi protocols, staking services, and DAO-related activities have been brought within the VAITOS licensing framework. VASPs providing these services must ensure their license class covers the specific activity.

5

Stablecoin 1:1 Reserve Requirement

All FSC-licensed stablecoin issuers must demonstrate full 1:1 fiat reserve backing with reserves held in segregated accounts. This aligns Mauritius with MiCA's EMT reserve requirements.

6

Mandatory Cybersecurity Audit (Annual)

Annual independent cybersecurity audits are now mandatory for all licensed VASPs. ISO 27001 compliance is strongly recommended by the FSC — in practice, applicants demonstrating ISO 27001 alignment receive more favorable FSC assessments.

7

72-Hour Cybersecurity Incident Reporting

All material cybersecurity incidents must be reported to the FSC within 72 hours of discovery — aligned with the DORA framework in the EU and global FATF cybersecurity guidance.

Complete Cost Breakdown: Setup and Annual Ongoing (2026)

One-Time Setup Costs

ItemEstimated USD
GBC1 company incorporation$4,000–$7,000
FSC VASP application fee$1,000–$3,000
Business plan and compliance framework$10,000–$25,000
IT audit / ISO 27001 assessment$5,000–$15,000
Insurance and banking setup$3,000–$10,000
Minimum required capital (Class M)~$44,000
Minimum required capital (Class S)~$143,000
Total setup (Class M, typical)~$55,000–$100,000
Total setup (Class S, full exchange)~$150,000–$250,000

Annual Ongoing Costs

ItemEstimated USD/year
FSC annual license fees$2,000–$6,000
Compliance staff (MLRO, Compliance Officer)$20,000–$55,000
Annual audit and filings$5,000–$10,000
Cybersecurity audit (mandatory 2025)$5,000–$15,000
Registered office and local directors$5,000–$12,000
Total annual ongoing (typical)$37,000–$98,000

Zitadelle AG track record: Asian Exchange (Class S) approved in 4.5 months at a total setup cost of ~USD $45,000 via our Mauritius team. EU Wallet Provider (Class O) achieved live operations post ISO audit with 15% annual tax savings. These case studies reflect well-prepared applications with complete documentation submitted at first pass — minimizing FSC review rounds and timeline.

Regulatory and Legal Framework

The Mauritius VASP regulatory framework operates across three primary legislative instruments:

  • VAITOS 2021 (Virtual Assets and Initial Token Offerings Services Act) — the primary VASP licensing law; defines permitted virtual asset service activities and the five license classes
  • Financial Services Act 2007 — corporate governance, FSC oversight authority, and ongoing supervisory framework for all FSC-licensed entities
  • Financial Intelligence and Anti-Money Laundering Act (FIAMLA) — AML/CFT obligations; Travel Rule compliance; transaction monitoring; suspicious activity reporting
  • FATF Recommendation 15 implementation — Mauritius has fully implemented FATF R.15 requirements into its VASP framework; FSC-licensed VASPs are FATF Travel Rule compliant

FSC Supervision Emphasis in 2026

  • AI-driven AML monitoring — not optional; manual-only monitoring will fail FSC review
  • ISO 27001-aligned cybersecurity — strongly recommended; practically expected for Class S applications
  • Fit and proper assessment — CEO, MLRO, and Compliance Officer minimum 3–5 years relevant experience
  • Corporate substance — resident directors, local office, and genuine management involvement in Mauritius

10-Step Application Process

Zitadelle AG manages the full Mauritius VASP application in ten structured stages:

1

Business Model Assessment and Class Selection (1 week)

Zitadelle AG evaluates the VASP's specific activities, target markets, and operational model to determine the correct FSC license class(es). We assess capital adequacy relative to the specific class and advise on any pre-application structuring required.

2

GBC1 Company Incorporation (2–3 weeks)

Incorporate a Mauritius Global Business Company (GBC1/GBL) with the correct corporate purpose covering virtual asset services. Prepare constitutional documents, shareholder structure, and appoint resident directors.

3

Key Personnel Recruitment (concurrent — 4–8 weeks)

Appoint CEO with minimum 5 years crypto/financial services experience, MLRO with FATF AML/CTF compliance expertise, and Compliance Officer. All must pass FSC's fit and proper assessment. Zitadelle AG sources qualified candidates via HRFinEase for all three roles.

4

AML/CFT Framework Development (3–5 weeks)

Develop the complete AML/CFT compliance programme — Travel Rule implementation, transaction monitoring policies (AI-driven), KYC/KYB procedures, suspicious activity reporting protocols, and staff training programme.

5

IT Infrastructure Documentation (3–6 weeks)

Document technology infrastructure — wallet architecture (multi-signature recommended), cybersecurity framework (ISO 27001 aligned), penetration testing, business continuity and disaster recovery plan, and 72-hour incident reporting protocol.

6

Website and KYC Tool Setup (concurrent)

Establish FSC-compliant website with required regulatory disclosures. Integrate KYC/KYB tools — identity verification, PEP/sanctions screening, and transaction monitoring software.

7

Platform Pilot and Insurance

Conduct platform pilot testing and obtain professional indemnity and cyber liability insurance appropriate for the specific VASP activities and transaction volumes.

8

Document Compilation and FSC Application

Compile the complete FSC application package — 3-year business plan with financial projections, UBO disclosure documentation, organizational chart, all compliance policies, and FSC prescribed forms. Submit via the FSC One portal.

9

FSC Review and Correspondence Management (3–6 months)

The FSC conducts 2–4 rounds of review and requests additional information. Zitadelle AG manages all FSC correspondence — drafting responses, coordinating additional documentation, and tracking application status.

10

Conditional License and Operational Launch

Upon FSC approval, the conditional VASP license is granted. Complete any remaining conditions (typically IT audit confirmation or insurance certificate submission). Commence regulated virtual asset operations.

Timeline summary: 4–12 months total — shorter for simpler Class O/I applications; longer for Class S full exchange applications with complex ownership structures.

Mauritius VASP vs. Competing Offshore Jurisdictions

FeatureMauritius FSCSeychelles FSABVI FSCCayman CIMADubai VARA
Regulator qualityHighModerateHighVery HighHigh
Effective tax~3%1.5%0%0%0%
Banking accessHighModerateModerateVery HighHigh
FATF alignmentYesYesYesYesYes
Travel RuleFullFullFullFullFull
DTAA network46+LimitedLimitedLimitedUAE treaties
Africa/Asia accessExcellentModerateLimitedLimitedGood (MENA)
Min. capital (exchange)~$143,000$100,000None fixed$100,000+AED 300K+
Timeline4–12 months7–8 months4–6 months4–10 months4–8 months
Setup cost$55K–$150K$20K–$50K$30K–$60K$50K–$150K$150K–$400K+
Best forAfrica/Asia/globalCost-efficientOffshore prestigeInstitutionalMENA institutional

Mauritius vs. Seychelles

The most frequent comparison is Mauritius FSC vs. Seychelles FSA. Seychelles is faster (7–8 months vs. Mauritius 4–12 months) and cheaper at setup ($20K–$50K vs. $55K–$150K for Class S). However, Mauritius delivers materially better banking access, a more established DTAA network, and stronger FSC regulatory credibility — particularly for operators needing African and Asian institutional relationships. For operators where banking access is the primary commercial constraint (which it typically is for crypto businesses), Mauritius consistently outperforms Seychelles on total commercial value delivered.

Banking and Tax in Detail

Banking

Mauritius FSC VASP holders access a range of banking options at the upper end of what is available to offshore crypto businesses globally. MCB (Mauritius Commercial Bank), SBM Bank, AfrAsia Bank, and international EMIs including Transact365 and similar crypto-friendly payment institutions provide banking and payment infrastructure. Banking access is not guaranteed and depends on the VASP's business model, client geography, and AML/CFT framework quality. Zitadelle AG provides banking introductions and due diligence preparation as part of the VASP licensing engagement.

Tax

The ~3% effective tax rate is achieved through Mauritius's partial exemption regime — 80% of eligible foreign-sourced income is exempt from the 15% statutory rate. This requires demonstrating substance (CIGA — Core Income Generating Activities) in Mauritius. If substance requirements are not met, the effective rate reverts toward 15%. Zitadelle AG advises on CIGA requirements as part of the post-licensing compliance service to maintain the ~3% rate.

FSC Approval Compliance Checklist

  • Personnel — CEO, MLRO, Compliance Officer all with 3–5+ years relevant experience; FSC fit and proper assessments passed
  • GBC1 entity — incorporated with correct VASP corporate purpose; resident directors appointed; local office established
  • AML/CFT — Travel Rule implementation, automated transaction monitoring, KYC/KYB procedures, SAR reporting to FIU
  • IT and security — multi-sig wallet architecture, ISO 27001-aligned cybersecurity, penetration testing completed, business continuity plan
  • Cybersecurity audit — independent annual audit conducted; 72-hour incident reporting protocol documented
  • Client asset segregation — client virtual assets and fiat funds segregated from operational funds
  • Financial projections — 3-year projections demonstrating capital adequacy relative to proposed activities
  • Insurance — professional indemnity and cyber liability insurance in place
  • FSC reporting — quarterly regulatory reporting schedule established; FSC One portal access configured

How Zitadelle AG Assists

  • License class selection — M, O, R, I, S assessment against your specific business model
  • GBC1 company incorporation — complete Mauritius company registration
  • CEO, MLRO, and Compliance Officer sourcing — FSC-approvable candidates via HRFinEase
  • AML/CFT framework development — AI-driven monitoring, Travel Rule implementation, KYC/KYB integration advisory
  • IT infrastructure documentation — ISO 27001 alignment, penetration testing coordination, cybersecurity framework
  • FSC application preparation — business plan, 3-year projections, UBO documentation, compliance policies
  • FSC submission and liaison — all FSC correspondence managed from our Port Louis, Mauritius office
  • Banking introductions — MCB, SBM, AfrAsia, and EMI partner introductions
  • Stablecoin and ITO advisory — Class S (marketplace) and stablecoin reserve structure advice
  • Post-licensing compliance — annual FSC reporting, cybersecurity audit coordination, CIGA substance maintenance

Mauritius Office

Zitadelle AG's administration office at 1F River Court, 6 St. Denis Street, Port Louis, 11328, Mauritius provides direct FSC access, resident director services, local compliance officer outsourcing, and banking introductions. Our track record: 5+ Mauritius VASPs licensed since 2024. Fastest approval: 4.5 months (Class S). Average first-pass FSC submission rate: high — we do not submit incomplete applications.

Frequently Asked Questions

Ready to obtain your Mauritius VASP License?

Zitadelle AG provides end-to-end Mauritius VASP licensing from our Port Louis, Mauritius office — from license class selection and GBC1 incorporation through FSC application management, AI-driven AML framework setup, ISO 27001 cybersecurity documentation, banking introductions, and ongoing annual compliance.

Related Licenses

This page is provided for informational purposes only and does not constitute legal or regulatory advice. FSC Mauritius and VAITOS requirements may change. Always consult a qualified advisor before initiating a licensing process. Last updated: March 2026.