Mauritius has emerged as a regulated and progressive jurisdiction for virtual asset service providers (VASPs), thanks to its Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS) and robust financial ecosystem. But with this opportunity comes the responsibility of navigating strict compliance obligations—particularly in Know Your Customer (KYC) and Anti-Money Laundering/Counter Financing of Terrorism (AML/CFT) measures.

In this article, we break down what crypto companies need to know about staying compliant in Mauritius, and how the legal requirements apply even to DeFi and non-custodial platforms.

1. The Legal Backbone: FIAMLA & VAITOS
   
   

Mauritius’ AML/CFT framework is governed by:

• FIAMLA 2002 (Financial Intelligence and Anti-Money Laundering Act)
• The VAITOS Act 2021 (specific to VASPs and ITO issuers)
• FSC-issued Guidelines and Rules (e.g. Client Disclosure Rules 2022, AML/CFT Guidelines for VASPs)

Crypto companies are classified as reporting persons and must comply with full AML/CFT obligations, regardless of whether they handle fiat or only crypto.

2. When Is KYC Required?
   
   

Mauritian regulations follow a risk-based approach to KYC. VASPs must apply full Customer Due Diligence (CDD):

• Before entering a business relationship

• When a transaction equals or exceeds MUR 100,000 (~USD 2,200), whether single or linked
• If there is a suspicion of money laundering, regardless of transaction size
• If prior documents or customer identity details are in doubt
  
  

This applies to both custodial and non-custodial platforms, including DeFi protocols offering yield, swaps, or staking services.

3. Core KYC Requirements

VASPs must collect and verify:

• For individuals: Full legal name, date of birth, address, national ID/passport, proof of address
• For entities: Certificate of incorporation, registered address, UBOs (ultimate beneficial owners), directors, business nature
  
  

Verification must be performed using reliable, independent source documents. Electronic KYC (eKYC) tools are allowed if compliant with FSC standards.

4. AML Program Essentials

Every licensed VASP in Mauritius must implement a robust AML/CFT program including:

• AML/CFT Manual (covering identification, monitoring, reporting)
• Appointment of MLRO and Deputy MLRO
• Ongoing transaction monitoring and screening
• Filing of Suspicious Transaction Reports (STRs) to the Financial Intelligence Unit (FIU)
• Sanctions screening under UN Sanctions Act (report to National Sanctions Secretariat within 24 hours)
• Staff training and independent audits

5. DeFi, Smart Contracts & KYC

Even if your platform is non-custodial or decentralized:

• You are still subject to KYC/AML laws if you operate “in or from Mauritius”
• Smart contract automation does not exempt from compliance
• You must demonstrate how user identity and transaction risk are assessed, even if via frontend integrations or on-chain analytics tools
  
  

Platforms using third-party tools (e.g. KYC/AML providers, chain analytics, decentralized ID systems) must ensure service provider vetting and accountability.

6. Compliance Pitfalls to Avoid

• Relying only on wallet addresses without KYC linkage
• No transaction risk scoring or anomaly detection
• Failing to appoint a qualified MLRO with local presence
• Not registering/reporting under the UN sanctions regime
• Inadequate client disclosure (terms, risks, rights)
  
  

The FSC performs audits and has full power to suspend, revoke licenses or refer cases for criminal prosecution.

7. Final Thoughts

Mauritius takes compliance seriously—and expects VASPs to do the same. The MUR 100,000 KYC threshold, combined with robust AML governance, means even early-stage DeFi or wallet-based businesses must be proactive.

Get your compliance infrastructure right from day one. Whether you’re building a centralized platform or a smart contract-based protocol, aligning with Mauritian standards will earn regulatory goodwill and user trust.