Mauritius — VASP License (FSC / VAITOS 2021) 2026
The Mauritius VASP license from the FSC under VAITOS 2021 is the premier offshore crypto authorization for exchanges, custodians, wallet providers, and investment advisors targeting Africa, Asia, and global markets. Five license classes, ~3% effective corporate tax, FATF Travel Rule aligned, 45+ DTAAs, and ISO 27001-recommended IT infrastructure. Zitadelle AG has licensed 5+ Mauritius VASPs since 2024.
— Last updated: April 2026 · 8 min read
Why Mauritius for VASP Licensing?
Mauritius is consistently Zitadelle AG's most recommended offshore VASP jurisdiction for crypto businesses targeting Africa, Asia, the Middle East, and global markets. The Financial Services Commission (FSC) operates the VASP framework under VAITOS 2021 — the Virtual Assets and Initial Token Offerings Services Act — providing a comprehensive, FATF-aligned regulatory structure with five license classes covering the full range of virtual asset service activities.
Unlike many offshore alternatives, Mauritius combines genuine regulatory substance with compelling tax efficiency (~3% effective corporate tax via the partial exemption regime), strong international banking relationships, and a network of 46+ double taxation agreements that create real commercial advantages for international crypto businesses. Zitadelle AG has licensed 5+ Mauritius VASPs since 2024.
~3% Effective Corporate Tax
Mauritius GBC entities benefit from an 80% partial exemption on foreign-sourced income — reducing the effective corporate tax rate to approximately 3% on qualifying income. Capital gains: 0%. Withholding tax on dividends: 0%. The most favorable tax rate among regulated offshore VASP jurisdictions with genuine regulatory substance.
Full FATF Travel Rule Compliance
Mauritius FSC-licensed VASPs are fully integrated into global FATF Travel Rule networks — collecting, transmitting, and retaining originator and beneficiary information per FATF Recommendation 16. Mauritius VASP holders are accepted as Travel Rule counterparties by major global exchanges operating in regulated jurisdictions.
46+ Double Taxation Agreements
Mauritius's extensive DTAA network covers India, China, South Africa, the UAE, France, Germany, Singapore, and 39+ other jurisdictions. For VASP operators with cross-border crypto flows and fiat settlement, these treaties provide material tax efficiency unavailable from Seychelles, SVG, or most other offshore VASP jurisdictions.
Strong Offshore Banking Access
Mauritius FSC VASP holders access significantly better banking relationships than Seychelles FSA, SVG, or Caribbean VASPs. MCB (Mauritius Commercial Bank), SBM, AfrAsia Bank, and international EMI partners provide banking access that supports meaningful exchange operations.
Gateway to Africa and Asia
Mauritius's unique geographic and regulatory position between Africa and Asia makes it the optimal offshore jurisdiction for crypto businesses targeting both regions simultaneously. The FSC's relationships with African and Asian regulators provide commercial credibility that Caribbean or Pacific jurisdictions cannot match.
English Common Law Framework
Mauritius operates under English common law — the same legal infrastructure as the UK, Singapore, and the Cayman Islands. All VASP contracts, regulatory submissions, and corporate documentation operate under familiar common law principles.
VASP License Classes: The Five Options
The FSC issues five distinct VASP license classes under VAITOS 2021 — each covering different virtual asset service activities with different capital requirements. Selecting the correct class (or combination of classes) before application is critical.
| Class | Code | Services Covered | Min. Capital (MUR) | Min. Capital (USD approx.) | FSC Processing Fee | Annual FSC Fee |
|---|---|---|---|---|---|---|
| Broker-Dealer | VA-1.1 (M) | VA-to-VA and VA-to-fiat exchange; crypto broker-dealer | MUR 2,000,000 | ~USD $44,000 | $1,500–$2,500 | $1,900–$3,000 |
| Wallet & Transfer | VA-1.2 (O) | Wallet services, VA transfer, custody-light | 12 months working capital | Operational | $1,000–$2,000 | $1,900–$3,500 |
| Custodian/Registry | VA-1.3 (R) | Custodian of virtual assets; VA registry services | MUR 5,000,000 | ~USD $110,000 | $2,000–$3,000 | $3,000–$4,500 |
| Investment Advice | VA-1.4 (I) | Investment advice on virtual assets | Sufficient for operations | Operational | $1,000–$1,500 | $1,900–$2,500 |
| Marketplace/Exchange | VA-1.5 (S) | Full crypto exchange marketplace; multi-asset trading platform | MUR 6,500,000 | ~USD $143,000 | $2,500–$3,000 | $4,000–$5,000 |
Class Selection Note
2025–2026 Regulatory Updates: What Changed
The FSC has significantly enhanced its VASP supervisory framework since 2024. Any guidance predating March 2025 should be treated as incomplete.
- 1Mandatory AI-Driven AML Monitoring (March 2025): The FSC now mandates automated transaction monitoring for all licensed VASPs — moving beyond manual review to AI-driven or algorithm-based suspicious transaction detection. Manual-only AML/CTF monitoring is no longer considered adequate by the FSC. New applicants must demonstrate their technology infrastructure includes automated monitoring capability.
- 2Real-Time Cross-Border Transfer Reporting (March 2025): Real-time reporting of cross-border virtual asset transfers to the FSC is now required. This significantly increases the operational infrastructure requirements for VASPs conducting high-volume cross-border activity.
- 3Stricter UBO Disclosure Requirements (2025): Enhanced beneficial ownership verification requirements — including more frequent UBO updates and stricter documentation standards for complex ownership structures. All UBOs must be verified to FSC standards regardless of the number of intermediary layers.
- 4DeFi, Staking, and DAO Activities (2024–2025): DeFi protocols, staking services, and DAO-related activities have been brought within the VAITOS licensing framework. VASPs providing these services must ensure their license class covers the specific activity.
- 5Stablecoin 1:1 Reserve Requirement: All FSC-licensed stablecoin issuers must demonstrate full 1:1 fiat reserve backing with reserves held in segregated accounts. This aligns Mauritius with MiCA's EMT reserve requirements.
- 6Mandatory Cybersecurity Audit (Annual): Annual independent cybersecurity audits are now mandatory for all licensed VASPs. ISO 27001 compliance is strongly recommended by the FSC — in practice, applicants demonstrating ISO 27001 alignment receive more favorable FSC assessments.
- 772-Hour Cybersecurity Incident Reporting: All material cybersecurity incidents must be reported to the FSC within 72 hours of discovery — aligned with the DORA framework in the EU and global FATF cybersecurity guidance.
Complete Cost Breakdown: Setup and Annual Ongoing (2026)
One-Time Setup Costs
| Item | Estimated USD |
|---|---|
| GBC1 company incorporation | $4,000–$7,000 |
| FSC VASP application fee | $1,000–$3,000 |
| Business plan and compliance framework | $10,000–$25,000 |
| IT audit / ISO 27001 assessment | $5,000–$15,000 |
| Insurance and banking setup | $3,000–$10,000 |
| Minimum required capital (Class M) | ~$44,000 |
| Minimum required capital (Class S) | ~$143,000 |
| Total setup (Class M, typical) | ~$55,000–$100,000 |
| Total setup (Class S, full exchange) | ~$150,000–$250,000 |
Annual Ongoing Costs
| Item | Estimated USD/year |
|---|---|
| FSC annual license fees | $2,000–$6,000 |
| Compliance staff (MLRO, Compliance Officer) | $20,000–$55,000 |
| Annual audit and filings | $5,000–$10,000 |
| Cybersecurity audit (mandatory 2025) | $5,000–$15,000 |
| Registered office and local directors | $5,000–$12,000 |
| Total annual ongoing (typical) | $37,000–$98,000 |
Zitadelle AG track record
Regulatory and Legal Framework
The Mauritius VASP regulatory framework operates across three primary legislative instruments:
- •<strong>VAITOS 2021</strong> (Virtual Assets and Initial Token Offerings Services Act) — the primary VASP licensing law; defines permitted virtual asset service activities and the five license classes
- •<strong>Financial Services Act 2007</strong> — corporate governance, FSC oversight authority, and ongoing supervisory framework for all FSC-licensed entities
- •<strong>Financial Intelligence and Anti-Money Laundering Act (FIAMLA)</strong> — AML/CFT obligations; Travel Rule compliance; transaction monitoring; suspicious activity reporting
- •<strong>FATF Recommendation 15 implementation</strong> — Mauritius has fully implemented FATF R.15 requirements into its VASP framework; FSC-licensed VASPs are FATF Travel Rule compliant
FSC Supervision Emphasis in 2026
- •<strong>AI-driven AML monitoring</strong> — not optional; manual-only monitoring will fail FSC review
- •<strong>ISO 27001-aligned cybersecurity</strong> — strongly recommended; practically expected for Class S applications
- •<strong>Fit and proper assessment</strong> — CEO, MLRO, and Compliance Officer minimum 3–5 years relevant experience
- •<strong>Corporate substance</strong> — resident directors, local office, and genuine management involvement in Mauritius
10-Step Application Process
Zitadelle AG manages the full Mauritius VASP application in ten structured stages:
- 1Business Model Assessment and Class Selection (1 week): Zitadelle AG evaluates the VASP's specific activities, target markets, and operational model to determine the correct FSC license class(es). We assess capital adequacy relative to the specific class and advise on any pre-application structuring required.
- 2GBC1 Company Incorporation (2–3 weeks): Incorporate a Mauritius Global Business Company (GBC1/GBL) with the correct corporate purpose covering virtual asset services. Prepare constitutional documents, shareholder structure, and appoint resident directors.
- 3Key Personnel Recruitment (concurrent — 4–8 weeks): Appoint CEO with minimum 5 years crypto/financial services experience, MLRO with FATF AML/CTF compliance expertise, and Compliance Officer. All must pass FSC's fit and proper assessment. Zitadelle AG sources qualified candidates via HRFinEase for all three roles.
- 4AML/CFT Framework Development (3–5 weeks): Develop the complete AML/CFT compliance programme — Travel Rule implementation, transaction monitoring policies (AI-driven), KYC/KYB procedures, suspicious activity reporting protocols, and staff training programme.
- 5IT Infrastructure Documentation (3–6 weeks): Document technology infrastructure — wallet architecture (multi-signature recommended), cybersecurity framework (ISO 27001 aligned), penetration testing, business continuity and disaster recovery plan, and 72-hour incident reporting protocol.
- 6Website and KYC Tool Setup (concurrent): Establish FSC-compliant website with required regulatory disclosures. Integrate KYC/KYB tools — identity verification, PEP/sanctions screening, and transaction monitoring software.
- 7Platform Pilot and Insurance: Conduct platform pilot testing and obtain professional indemnity and cyber liability insurance appropriate for the specific VASP activities and transaction volumes.
- 8Document Compilation and FSC Application: Compile the complete FSC application package — 3-year business plan with financial projections, UBO disclosure documentation, organizational chart, all compliance policies, and FSC prescribed forms. Submit via the FSC One portal.
- 9FSC Review and Correspondence Management (3–6 months): The FSC conducts 2–4 rounds of review and requests additional information. Zitadelle AG manages all FSC correspondence — drafting responses, coordinating additional documentation, and tracking application status.
- 10Conditional License and Operational Launch: Upon FSC approval, the conditional VASP license is granted. Complete any remaining conditions (typically IT audit confirmation or insurance certificate submission). Commence regulated virtual asset operations.
Timeline summary: 4–12 months total — shorter for simpler Class O/I applications; longer for Class S full exchange applications with complex ownership structures.
Mauritius VASP vs. Competing Offshore Jurisdictions
| Feature | Mauritius FSC | Seychelles FSA | BVI FSC | Cayman CIMA | Dubai VARA |
|---|---|---|---|---|---|
| Regulator quality | High | Moderate | High | Very High | High |
| Effective tax | ~3% | 1.5% | 0% | 0% | 0% |
| Banking access | High | Moderate | Moderate | Very High | High |
| FATF alignment | Yes | Yes | Yes | Yes | Yes |
| Travel Rule | Full | Full | Full | Full | Full |
| DTAA network | 46+ | Limited | Limited | Limited | UAE treaties |
| Africa/Asia access | Excellent | Moderate | Limited | Limited | Good (MENA) |
| Min. capital (exchange) | ~$143,000 | $100,000 | None fixed | $100,000+ | AED 300K+ |
| Timeline | 4–12 months | 7–8 months | 4–6 months | 4–10 months | 4–8 months |
| Setup cost | $55K–$150K | $20K–$50K | $30K–$60K | $50K–$150K | $150K–$400K+ |
| Best for | Africa/Asia/global | Cost-efficient | Offshore prestige | Institutional | MENA institutional |
Mauritius vs. Seychelles
Banking and Tax in Detail
Banking
Mauritius FSC VASP holders access a range of banking options at the upper end of what is available to offshore crypto businesses globally. MCB (Mauritius Commercial Bank), SBM Bank, AfrAsia Bank, and international EMIs including Transact365 and similar crypto-friendly payment institutions provide banking and payment infrastructure. Banking access is not guaranteed and depends on the VASP's business model, client geography, and AML/CFT framework quality. Zitadelle AG provides banking introductions and due diligence preparation as part of the VASP licensing engagement.
Tax
The ~3% effective tax rate is achieved through Mauritius's partial exemption regime — 80% of eligible foreign-sourced income is exempt from the 15% statutory rate. This requires demonstrating substance (CIGA — Core Income Generating Activities) in Mauritius. If substance requirements are not met, the effective rate reverts toward 15%. Zitadelle AG advises on CIGA requirements as part of the post-licensing compliance service to maintain the ~3% rate.
FSC Approval Compliance Checklist
- •Personnel — CEO, MLRO, Compliance Officer all with 3–5+ years relevant experience; FSC fit and proper assessments passed
- •GBC1 entity — incorporated with correct VASP corporate purpose; resident directors appointed; local office established
- •AML/CFT — Travel Rule implementation, automated transaction monitoring, KYC/KYB procedures, SAR reporting to FIU
- •IT and security — multi-sig wallet architecture, ISO 27001-aligned cybersecurity, penetration testing completed, business continuity plan
- •Cybersecurity audit — independent annual audit conducted; 72-hour incident reporting protocol documented
- •Client asset segregation — client virtual assets and fiat funds segregated from operational funds
- •Financial projections — 3-year projections demonstrating capital adequacy relative to proposed activities
- •Insurance — professional indemnity and cyber liability insurance in place
- •FSC reporting — quarterly regulatory reporting schedule established; FSC One portal access configured
How Zitadelle AG Assists
- License class selection — M, O, R, I, S assessment against your specific business model
- GBC1 company incorporation — complete Mauritius company registration
- CEO, MLRO, and Compliance Officer sourcing — FSC-approvable candidates via HRFinEase
- AML/CFT framework development — AI-driven monitoring, Travel Rule implementation, KYC/KYB integration advisory
- IT infrastructure documentation — ISO 27001 alignment, penetration testing coordination, cybersecurity framework
- FSC application preparation — business plan, 3-year projections, UBO documentation, compliance policies
- FSC submission and liaison — all FSC correspondence managed
- Banking introductions — MCB, SBM, AfrAsia, and EMI partner introductions
- Stablecoin and ITO advisory — Class S (marketplace) and stablecoin reserve structure advice
- Post-licensing compliance — annual FSC reporting, cybersecurity audit coordination, CIGA substance maintenance
Zitadelle AG Track Record
Frequently Asked Questions
The Mauritius VASP license is issued by the FSC under VAITOS 2021 and covers five classes: VA-1.1 (M) Broker-Dealer for crypto exchange; VA-1.2 (O) Wallet and transfer services; VA-1.3 (R) Custodian and registry; VA-1.4 (I) Investment advice on virtual assets; and VA-1.5 (S) Marketplace/exchange platform operations. Multi-class authorizations are available for operators covering multiple activity types.
Ready to obtain your Mauritius VASP License?
Zitadelle AG provides end-to-end Mauritius VASP licensing — from license class selection and GBC1 incorporation through FSC application management, AI-driven AML framework setup, ISO 27001 cybersecurity documentation, banking introductions, and ongoing annual compliance.
Related Licenses
Quick Facts
Get a Free Quote
Transparent pricing and timeline for your application.
Disclaimer: This page is for informational purposes only and does not constitute legal or regulatory advice. Requirements, timelines, and fees are subject to change. Always consult directly with the relevant regulatory authority or a qualified professional for the most current information. Zitadelle Advisory Group LTD is not a law firm and does not provide legal representation.