Virtual asset regulation in Mauritius: the complete guide to the VAITOS Act 2021
SC Legal · Beau Bassin, Mauritius · 24 July 2026
Mauritius was among the first jurisdictions in Eastern and Southern Africa to enact a dedicated virtual assets statute. For anyone building, licensing or investing in a virtual asset business in or from Mauritius, the Virtual Asset and Initial Token Offering Services Act 2021 is the starting point. This guide sets out who needs a licence, the five VASP classes, how initial token offerings and security tokens are treated, the AML/CFT regime, the penalties for getting it wrong, and the cross-border considerations — and where the regulatory perimeter really bites.
In this guide
- 1. What is the VAITOS Act 2021?
- 2. Who needs a VASP licence?
- 3. The five VASP licence classes
- 4. How are initial token offerings regulated?
- 5. The FSC’s rules and guidance beyond the Act
- 6. AML/CFT obligations
- 7. Security token or virtual asset — how is a token classified?
- 8. Penalties for non-compliance
- 9. Cross-border considerations
- 10. How SC Legal assists
1. What is the VAITOS Act 2021?
The Virtual Asset and Initial Token Offering Services Act 2021 (the “VAITOS Act”) is the Mauritius statute regulating virtual asset service providers (VASPs) and issuers of initial token offerings (ITOs). It came into force on 7 February 2022 and is administered by the Financial Services Commission (FSC). Anyone carrying on virtual asset business in or from Mauritius needs a licence or registration under it.
Mauritius was among the first jurisdictions in Eastern and Southern Africa to enact a dedicated statute for virtual assets, aligned with the Financial Action Task Force (FATF) standards, in particular Recommendation 15. The Act covers licensing, ITO registration, controllers and beneficial owners, governance, risk management, disclosure, custody of client assets and enforcement. It has since been amended a few times.
2. Who needs a VASP licence?
Anyone who, in or from Mauritius, exchanges, transfers, safekeeps or administers virtual assets, operates a virtual asset trading platform, or provides financial services connected with an issuer’s offer or sale of virtual assets must hold the relevant VASP licence. Operating without one is a criminal offence.
A “virtual asset” is a digital representation of value that can be traded or transferred and used for payment or investment. It excludes digital representations of fiat currency, and securities and other financial assets regulated under the Securities Act 2005 — the gateway to the classification question in section 7. The trigger is activity “in or from Mauritius”, so a Mauritius-incorporated entity serving only foreign clients is within scope. Because the Act regulates by function rather than label, automated or decentralised arrangements — staking, swaps, lending and other DeFi activity — are not outside it merely because no person intermediates each transaction; what matters is whether a VASP activity is performed in or targeting Mauritius.
3. The five VASP licence classes
The Act’s Second Schedule sets five VASP classes: Class M (Virtual Asset Broker-Dealer), Class O (Virtual Asset Wallet Services), Class R (Virtual Asset Custodian), Class I (Virtual Asset Advisory Services) and Class S (Virtual Asset Market Place). An applicant may hold several, subject to FSC approval and combined capital requirements.
Choosing the correct class
Class selection is the most consequential decision in an application. The recurring boundaries:
- Class M or Class S. Dealing as principal against clients is broker-dealer (M); operating a venue that matches third-party buyers and sellers is a market place (S). Hybrid models often need both.
- Class O or Class R. Transferring assets for clients is wallet services (O); safekeeping and administration, including holding private keys, is custody (R). Providers holding client keys often need both.
- Class I. Advising or arranging around an issuer’s offer — including ITO structuring — needs Class I even where the adviser never holds client assets.
Minimum stated unimpaired capital is prescribed by the FSC’s Capital Requirements Rules and scales with the class and the nature, scale and complexity of the activity. Where several classes are held, capital applies cumulatively. Application and annual fees vary by class and should be checked against the current FSC fee schedule.
4. How are initial token offerings regulated?
An ITO is an offer to the public of a virtual token in exchange for fiat currency or another virtual asset. Only a company incorporated in Mauritius may issue one, it must be registered with the FSC before any public offer, and a compliant white paper is mandatory.
The white paper must be signed by every member of the issuer’s governing body, fixing personal accountability for its contents. Purchasers have a right to rescission or damages where the white paper contains a material misrepresentation. Issuers must keep the FSC informed, including disclosing anything that could affect purchasers’ interests; failure is a criminal offence (see section 8). Where the token is in substance a security — conferring dividend, profit-share, debt or equivalent rights — the offer falls under the Securities Act 2005 and its prospectus and licensing requirements, not ITO registration. Classification therefore comes before structuring.
5. The FSC’s rules and guidance beyond the Act
The FSC supplements the Act with binding Rules — on capital, client disclosure, custody of client assets, cybersecurity, advertising, statutory returns and the travel rule — and with guidance notes on security tokens, security token offerings, NFTs and AML/CFT. Together they form the operative rulebook.
In outline, the principal Rules cover: capital and financial requirements (minimum unimpaired capital and liquidity, scaled to the activity); custody of client assets (segregation, protection of clients’ ownership rights, and no use of client assets for the VASP’s own account — a VASP holding client virtual assets must keep enough of each type to meet its obligations); client disclosure (clear, fair and not misleading); cybersecurity (systems and controls for operational and cyber risk); advertising standards; and statutory returns (periodic reporting and approval of material changes). Each Rule and guidance note should be cited by its full reference number and date in compliance documentation. Consistent with the Act’s functional approach, staking, DeFi and DAO-based arrangements fall within the licensing framework where they perform VASP activities in or targeting Mauritius, and must hold the class matching that activity.
6. AML/CFT obligations
VASPs and ITO issuers are reporting persons under the Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA). Core duties include customer due diligence, appointing an MLRO and deputy, transaction monitoring, suspicious transaction reporting to the Financial Intelligence Unit, record-keeping, an independent AML/CFT audit and travel-rule compliance.
AML/CFT is where the Act meets Mauritius’s wider FATF commitments, and it features prominently in both applications and ongoing compliance. Key elements:
- Risk-based CDD. Enhanced due diligence for higher-risk customers, source-of-funds and source-of-wealth checks, and screening against UN sanctions lists under the United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act 2019.
- Governance. A fit-and-proper MLRO and deputy, board-level ownership of AML/CFT risk, and documented business risk assessments.
- Travel rule. Under section 19 of the VAITOS Act, every transfer of virtual assets must carry originator and beneficiary information, with no de-minimis threshold — usually implemented through inter-VASP messaging. The USD 1,000 figure sometimes quoted is the FIAMLA customer-due-diligence threshold for occasional transactions, not a travel-rule floor.
- Independent audit. Periodic independent review of the AML/CFT programme.
A further development: the Anti-Money Laundering, Combatting the Financing of Terrorism and Countering Proliferation Financing (Miscellaneous Provisions) Act 2026 (Act No. 3 of 2026), in operation since 18 April 2026, adds proliferation-financing risk-assessment obligations for reporting persons. Expect proliferation financing to feature in business risk assessments going forward.
7. Security token or virtual asset — how is a token classified?
Classification is functional. A token carrying rights characteristic of a security — equity, debt, profit participation or collective investment — is a security token under the Securities Act 2005. A digital representation of value without those rights is a virtual asset under the VAITOS Act. A utility token can still be a virtual asset if it is tradeable and usable for payment or investment.
Classification drives everything downstream: the licence required, the offer-document regime (prospectus versus white paper), investor-protection rights and the marketing rules. The analysis looks through the label to the rights attached — calling something a “utility token” does not take it outside the Securities Act 2005 if it functions as an investment. Misclassification can expose an issuer to offences under both regimes and undermine the offer. Hybrid and asset-backed structures — tokens referable to real assets, funds or Shariah-compliant arrangements — need case-by-case analysis and often engagement with the FSC on classification before launch. SC Legal’s capital markets and Islamic finance teams handle these directly.
8. Penalties for non-compliance
Operating as a VASP in or from Mauritius without a licence (section 7(2)) is punishable by a fine of up to MUR 5 million and up to 10 years’ imprisonment. An ITO issuer that fails to notify the FSC or to disclose information affecting purchasers’ interests (section 29(2)) faces up to MUR 1 million and up to 5 years. A general default penalty applies to other contraventions of the Act (section 50(1)).
Beyond criminal liability, the FSC may issue remediation directions, impose licence conditions, and suspend or revoke a licence, as well as refer matters for prosecution. Compliance is assessed against the full set of FSC Rules, of which AML/CFT systems are a central part.
9. Cross-border considerations
A Mauritius VASP licence does not passport into other jurisdictions. Cross-border operators must reconcile the VAITOS framework with each target market — including the EU’s Markets in Crypto-Assets Regulation (MiCA) — and manage travel-rule interoperability, substance and beneficial-ownership differences.
Common friction points: differing travel-rule thresholds and messaging protocols between jurisdictions; the interaction between Mauritius’s beneficial-ownership register (accessible to competent authorities) and public-register mandates elsewhere; marketing restrictions in client jurisdictions despite a valid Mauritius licence; and economic-substance expectations for entities using the partial-exemption tax regime. None is a reason to avoid Mauritius; each is a reason to structure deliberately from the outset. Its treaty network and time zone make it a practical base for Africa- and Asia-facing virtual asset business.
10. How SC Legal assists
SC Legal advises licence applicants, operating VASPs, ITO issuers and their investors across the VAITOS lifecycle: licence-class scoping and applications, FSC correspondence, white papers and offer documents, token-classification opinions, AML/CFT frameworks and independent-audit support, and cross-border structuring through Mauritius. Most virtual asset mandates sit alongside the firm’s capital markets, corporate and Islamic finance work — a token project is, at once, a capital raising, a corporate structure and a regulatory-perimeter question
Talk to us
For advice on virtual asset licensing, ITOs, token classification or cross-border structuring through Mauritius:
shaheena@scarrimlegal.com | +230 5255 2410 | 410 Balfour House, Trotter Street, Beau Bassin 71507, Mauritius | www.scarrimlegal.com