Mauritius

**Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS Act 2021):** This Act defines various virtual asset services and mandates licensing for providers.

**FSC Rules (Virtual Asset and Initial Token Offering Services) 2022:** These rules provide specific details and requirements for implementing the VAITOS Act.

**Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA 2002)**

**Guidance Notes on Anti-Money Laundering and Combating the Financing of Terrorism for Virtual Assets and Virtual Asset Service Providers (VASPs)**

**Definition of Custodian Wallet Service (Section 2, VAITOS Act 2021):** "a service to safeguard virtual assets or instruments enabling control over virtual assets, on behalf of natural or legal persons."

**Licensing Process:** Applicants must submit a detailed application to the FSC, including:

Evidence of "fit and proper" persons for directors, beneficial owners, and senior management.

Robust governance arrangements, including internal controls, risk management systems (operational, financial, IT, cybersecurity).

**Minimum Stated Capital (Schedule 1, FSC Rules (VAITOS) 2022):**

A licensee providing "Custodian Wallet Service" must maintain a minimum stated capital of **MUR 1,500,000** (approximately USD 37,500, subject to exchange rate fluctuations).

**VAITOS Act 2021 (Section 13(1)(g)):** A VASP shall "manage client virtual assets and money received from clients in a manner that protects the interests of clients, and, in particular, ensures that they are segregated from the assets of the VASP."

**FSC Rules (VAITOS) 2022 (Rule 12 - Client Virtual Assets and Money):**

Mandates that a licensee must maintain separate accounts for client virtual assets and money received from clients, distinct from its own assets.

Requires the licensee to clearly identify and account for client virtual assets and money, and to maintain proper records.

Prohibits the use of client virtual assets or money for the licensee’s own benefit or for the benefit of any third party without explicit client consent and where permitted by law.

**Minimum Stated Capital:** The requirement for minimum stated capital (MUR 1.5 million) serves as a financial buffer.

**Risk Management Framework (Section 13(1)(b) of VAITOS Act and Rule 9 of FSC Rules (VAITOS) 2022):** Licensees are required to have "robust risk management policies and procedures" covering operational risks, technology risks, and financial risks. This implies that firms should consider professional indemnity insurance or other risk transfer mechanisms as part of their overall risk mitigation strategy, especially given the high-value nature of custodial services.

The FSC may, on a case-by-case basis or through further guidance, require specific insurance coverage if deemed necessary for the protection of clients.

**VAITOS Act 2021 (Section 13(1)(d)):** A VASP shall "implement adequate systems and controls for safeguarding client virtual assets, including cryptographic keys."

**FSC Rules (VAITOS) 2022 (Rule 9 - Risk Management and Internal Controls):** Requires licensees to establish and maintain robust systems and controls, including:

**Cybersecurity Policies:** Procedures for protecting against unauthorized access, use, disclosure, disruption, modification, or destruction of information.

**Key Management:** Secure procedures for the generation, storage, and backup of cryptographic keys.

**Business Continuity and Disaster Recovery Plans:** Ensuring continued operation and recovery of services and data in case of disruption.

While not explicitly stating "cold storage," the emphasis on safeguarding cryptographic keys, robust cybersecurity, and recovery plans strongly implies that cold storage, multi-signature wallets, and hardware security modules (HSMs) are best practices expected to meet these requirements, particularly for significant holdings.

Demonstrating robust operational, technical, and risk management capabilities.

Adhering to strict AML/CFT obligations.

Having fit and proper personnel.

Undergoing regular supervision and audits by the FSC.

**Amendments and Updates:** The FSC continuously monitors the virtual asset landscape and international best practices (e.g., FATF guidance). As such, there may be ongoing updates, amendments to the existing Rules, or new Guidance Notes issued to clarify or strengthen specific aspects of VASP operations, including custody.

**Consultation Papers:** The FSC typically publishes consultation papers before introducing significant changes to allow industry feedback. It's advisable for market participants to monitor the "Laws & Regulations" and "Publications" sections of the FSC website for any such announcements.

**FSC Website (Virtual Assets section):** https://www.fscmauritius.org/en/legal-framework/virtual-assets

Applicants must maintain a minimum unimpaired stated capital or reserves as prescribed by the FSC.

As per the **Virtual Asset and Initial Token Offerings Services (Licence for Virtual Asset Service Providers) Rules 2022**, the minimum unimpaired stated capital for a VASP (holding a full licence) is **MUR 1,200,000 (approximately USD 26,000 - USD 30,000, depending on exchange rates)**.

This capital must be maintained at all times.

Robust AML/CFT policies, procedures, and controls are paramount. VASPs are considered "reporting entities" under the **Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA)**.

Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) for higher-risk clients.

Reporting suspicious transactions to the Financial Intelligence Unit (FIU).

Appointing an AML/CFT Compliance Officer.

Compliance with the FSC's AML/CFT Handbook and national AML/CFT legislative framework is mandatory.

Applicants must demonstrate adequate local presence and economic substance in Mauritius. This typically includes:

A physical office in Mauritius.

Local directors and skilled employees, proportionate to the nature and scale of the business. At least one director must be ordinarily resident in Mauritius.

Adequate operational and management infrastructure.

Books and records to be kept in Mauritius.

All directors, shareholders, senior management, and beneficial owners must satisfy the "fit and proper" criteria established by the FSC. This involves checks on honesty, integrity, reputation, competence, and financial soundness.

A comprehensive business plan outlining the proposed activities, target market, operational procedures, risk management framework, financial projections, and technological infrastructure.

Robust IT systems, cybersecurity measures, data protection protocols, and disaster recovery plans are essential to safeguard virtual assets and customer data. Independent security audits may be required.

A sound risk management framework covering operational, financial, legal, and reputational risks associated with virtual asset services.

Shares, debentures, bonds, unit trusts, futures contracts, options, and any other instrument that is commonly known as a security or is capable of being traded in a capital market.

An interest in a collective investment scheme.

**An investment of money (or virtual assets):** Where an investor contributes capital.

**In a common enterprise:** Where the fortunes of the investor are interwoven with those of the promoter or issuer, or a third party.

**With an expectation of profits:** The primary motivation for acquiring the token is financial gain.

**Deriving solely or substantially from the efforts of others:** The success of the investment depends largely on the managerial or entrepreneurial efforts of the issuer, promoter, or a third party, rather than the active participation of the token holder.

**Payment Token:** A virtual asset intended to be used as a means of exchange or for payment.

**Utility Token:** A virtual asset intended to provide access to a specific application, service, or product.

**Security Token:** Explicitly defined as a virtual asset that **"meets the definition of a 'security' under the Securities Act 2005."** This is the direct link.

**Hybrid Token:** A virtual asset combining characteristics of two or more of the above categories.

**Security Tokens:** These are tokens that represent traditional securities such as:

**Equity tokens:** Represent ownership in a company, with rights like dividends, voting rights, or a share in profits.

**Debt tokens:** Represent a loan or debt instrument, offering interest payments or repayment of principal.

**Asset-backed tokens:** Represent fractional ownership in real-world assets like real estate, art, or commodities, where the token holder expects returns from the asset's performance or management by others.

**Tokens granting a share of future profits/revenue:** Where the token holder's return is tied to the success or performance of an underlying business or project managed by the issuer.

**Hybrid Tokens with Security Characteristics:** If a hybrid token possesses features that grant rights typically associated with securities (e.g., profit-sharing, governance rights in a centralized entity, or a promise of returns tied to the efforts of others), it will likely be treated as a security.

**Securities Act 2005 Compliance:** Issuers of security tokens must comply with the Securities Act 2005. This typically entails:

**Prospectus Requirements:** Issuing a prospectus (or other approved disclosure document) and registering it with the FSC, unless an exemption applies (e.g., private placement, small offering, offer to sophisticated investors). The prospectus must contain all material information necessary for investors to make an informed decision.

**Licensing:** The issuer or any party involved in the distribution or marketing of the security token may require appropriate licenses (e.g., Investment Dealer, Investment Adviser) from the FSC.

**VAITOS Act 2021 Compliance for ITOs:** Even if it's a security token, an Initial Token Offering (ITO) falls under the VAITOS Act. This requires:

**Prior Approval from the FSC:** An issuer must obtain prior approval from the FSC for any ITO.

**Submission of Documents:** This includes a whitepaper, legal opinion, business plan, AML/CFT compliance framework, and other prescribed information. The whitepaper must disclose all relevant information about the token, project, risks, and use of proceeds.

**Compliance with AML/CFT:** Strict Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) requirements apply.

**VAITOS Act 2021 Compliance:** Issuers of non-security tokens still require **prior approval from the FSC for an ITO**.

**Whitepaper and Disclosure:** A comprehensive whitepaper must be submitted to and approved by the FSC, providing clear and transparent information about the token, its functionality, risks, and the project.

**AML/CFT Compliance:** Strict AML/CFT measures must be in place.

**Regulated Exchanges:** Secondary trading of security tokens is generally expected to occur on a licensed securities exchange (like the Stock Exchange of Mauritius for traditional securities) or an FSC-approved market specifically designed for security tokens.

**VASP Licensing:** Any platform or entity facilitating the secondary trading of security tokens, acting as an exchange, broker, or custodian, must be licensed as a Virtual Asset Service Provider (VASP) under the VAITOS Act.

**Market Conduct Rules:** These platforms must adhere to market conduct rules, transparency requirements, and investor protection measures akin to traditional securities markets.

**VASP Licensing:** Secondary trading of non-security tokens typically takes place on virtual asset exchanges. These exchanges must be licensed by the FSC as Virtual Asset Service Providers (VASPs) under the VAITOS Act.

**AML/CFT Compliance:** VASPs are subject to stringent AML/CFT obligations, including customer due diligence (CDD) and transaction monitoring.

**Operational Requirements:** Licensed VASPs must meet capital requirements, IT security standards, and other operational guidelines set by the FSC.

**Issuing Warnings and Guidance:** The FSC regularly issues communiques and guidance notes to inform the public and industry participants about the regulatory requirements and risks associated with virtual assets and token offerings.

**Licensing and Compliance:** The primary enforcement mechanism is ensuring entities comply with licensing requirements under the VAITOS Act (for VASPs and ITOs) and the Securities Act (for security tokens). Operating without the necessary license or approval would be a significant breach.

**Anti-Money Laundering (AML) Compliance:** A significant area of enforcement and supervision for the FSC relates to AML/CFT compliance for all virtual asset service providers and ITOs, aligning with FATF standards.

**Sandbox Approach:** Mauritius also operates a Regulatory Sandbox Licence, allowing innovative businesses (including blockchain and crypto projects) to test their products and services in a controlled environment before full market rollout, thereby reducing the likelihood of non-compliance.

**Significant Fines:** Both for individuals and corporate entities.

**Imprisonment:** For serious offenses, particularly related to operating without a license or engaging in fraudulent activities.

**Revocation of Licenses:** For licensed entities.

**Cease and Desist Orders:** To stop illegal offerings or activities.

**Financial Services Commission (FSC) Mauritius:**

Available through the Attorney General's Office or FSC publications.

Link (often found in FSC Library or government portal): https://www.fscmauritius.org/media/1335/securities-act-2005.pdf (PDF on FSC site)

**FSC Guidance Notes and Communiques:**

The FSC regularly publishes guidance. Check the "Laws & Regulations" and "Publications" sections on the FSC website for the latest communiques and guidance notes on virtual assets and ITOs.

A useful starting point is often under the "Circulars and Communiques" or "Legal Framework" sections on their site. Specific guidance for VAITOS Act implementation will be found there.

**The Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS Act 2021):** This is the cornerstone legislation specifically regulating virtual assets and VASPs. It designates VASPs as "reporting entities" and brings them under the scope of AML/CFT obligations. It provides for the licensing, regulation, and supervision of VASPs by the Financial Services Commission (FSC).

**The Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA 2002) (as amended):** This is the overarching AML/CFT legislation in Mauritius. It establishes the general AML/CFT framework, defines "money laundering," sets out the obligations of reporting entities (including VASPs by virtue of the VAITOS Act), and empowers the Financial Intelligence Unit (FIU).

**The Prevention of Terrorism Act 2002 (POTA 2002) (as amended):** This Act provides the legal framework for combating the financing of terrorism and related offenses.

**FSC Rules for Virtual Asset and Initial Token Offering Services 2022:** These rules, issued by the FSC under the VAITOS Act, provide detailed requirements for VASPs, including specific AML/CFT obligations.

**FSC Guide to Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) for Licensed Institutions:** While a general guide, it applies to all licensed entities, including VASPs, providing guidance on implementing AML/CFT programs.

**Identification and Verification of Customers:**

Obtain reliable identifying information for all customers (natural persons and legal entities).

**Natural Persons:** Full name, date of birth, place of birth, nationality, residential address, unique identification number (e.g., passport, national ID card). Verification requires independent, reliable source documents (e.g., certified copies of ID, utility bills).

**Legal Entities:** Legal name, legal form, proof of incorporation/registration, address of registered office and principal place of business, names of directors/partners/trustees, and identification of individuals authorized to act on behalf of the entity. Verification typically involves corporate documents.

Identify and take reasonable measures to verify the identity of the **beneficial owner(s)** of the customer.

For legal entities, this means identifying the natural person(s) who ultimately own or control 25% or more of the entity, or who otherwise exercise control through other means.

Understand the ownership and control structure of the customer.

**Purpose and Nature of Business Relationship:**

Understand the purpose and intended nature of the business relationship or occasional transaction (e.g., source of funds, source of wealth, intended types of virtual asset transactions).

Continuously monitor the business relationship to ensure that transactions being conducted are consistent with the VASP's knowledge of the customer, their business and risk profile, including, where necessary, the source of funds.

Regularly update customer information and beneficial ownership data.

Applied in higher-risk situations, including:

Customers who are **Politically Exposed Persons (PEPs)**, their family members, or close associates.

Customers from high-risk geographic areas (as identified by FATF or local regulators).

Transactions involving new or developing technologies or products that favour anonymity.

Complex, unusually large transactions, or unusual patterns of transactions that have no apparent economic or lawful purpose.

EDD measures include obtaining senior management approval, taking reasonable measures to establish the source of wealth and source of funds, and conducting enhanced ongoing monitoring.

Permitted in situations where the risks of money laundering and terrorist financing are low, and specific conditions are met. This must be justified by the VASP's risk assessment.

**Obligation to Report:** Any VASP that has reasonable grounds to suspect that a transaction (or attempted transaction) involves funds or virtual assets that are the proceeds of crime, or are linked to terrorist financing, *must* report it.

**To Whom:** All Suspicious Transaction Reports (STRs) must be filed with the **Financial Intelligence Unit (FIU) Mauritius**.

**Timelines:** Reports must be made *without delay* after forming the suspicion.

**"No Tipping-Off":** VASPs and their employees are prohibited from disclosing to the customer or any third party that an STR has been filed or that information relating to a potential STR is being sought or provided.

**Transaction Records:** All records related to virtual asset transactions (e.g., transaction date, type, amount, parties involved, virtual asset addresses/identifiers).

**Customer Identification Data:** All documents and information obtained during the CDD process (e.g., copies of identification documents, beneficial ownership information, risk assessments).

**Business Correspondence:** Records of internal and external communications related to customer accounts and transactions.

**Training Records:** Records of AML/CFT training provided to staff.

**Internal Reports:** Any internal suspicious activity reports or related analyses.

**Retention Period:** Records must be retained for a minimum period of **7 years** after the business relationship is terminated or the occasional transaction is completed.

**Financial Services Commission (FSC) Mauritius:**

**Role:** The FSC is the integrated regulator for the non-bank financial services sector and global business in Mauritius. Under the VAITOS Act 2021, the FSC is responsible for licensing, regulating, and supervising VASPs, including ensuring their compliance with AML/CFT obligations. They conduct regular inspections, reviews, and enforce compliance through administrative penalties.

**Financial Intelligence Unit (FIU) Mauritius:**

**Role:** The FIU is the central national agency responsible for receiving, analyzing, and disseminating financial intelligence related to money laundering and terrorist financing to law enforcement agencies. VASPs report their suspicious transactions directly to the FIU. While the FSC supervises AML program implementation, the FIU is the recipient and primary analyzer of STRs.

**Comprehensive:** Mauritius has enacted specific primary legislation, the Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS Act), along with accompanying rules and guidelines, to regulate the virtual asset sector from end-to-end. This covers licensing, conduct of business, consumer protection, and AML/CTF.

**Proactive:** The regulatory framework was designed to align with international best practices and recommendations for virtual assets and Virtual Asset Service Providers (VASPs).

**Not a Ban or Partial:** Crypto trading and related services are not banned; instead, they are legally permitted but subject to stringent licensing and oversight.

**Role:** The FSC is the primary regulator responsible for licensing, supervising, and regulating Virtual Asset Service Providers (VASPs) and Initial Token Offerings (ITOs) under the VAITOS Act. It oversees the conduct of business, prudential requirements, and compliance with AML/CTF obligations for licensed entities.

**Role:** While the BoM is the central bank responsible for monetary policy and the stability of the financial system, it does not directly license or regulate VASPs. Its role in the virtual asset space is more focused on monitoring macroeconomic implications and broader financial stability, and potentially providing a regulatory sandbox for innovative solutions that might involve central bank digital currencies (CBDCs) or other novel payment systems.

**Role:** The FIU, established under the FIAMLA, is responsible for receiving, analyzing, and disseminating suspicious transaction reports (STRs) and suspicious activity reports (SARs) related to money laundering and terrorist financing. VASPs are reporting entities to the FIU.

**Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS Act 2021)**

**Date:** Enacted in December 2021, and its provisions came into full effect in stages, largely operational by early 2022.

**Purpose:** This is the cornerstone legislation. It provides a comprehensive legal framework for:

Defining "Virtual Asset" and "Virtual Asset Service Provider (VASP)."

Establishing a licensing regime for VASPs.

Regulating Initial Token Offerings (ITOs).

Setting out requirements for customer due diligence, record-keeping, AML/CTF compliance, cybersecurity, and consumer protection.

Empowering the FSC to issue rules and guidelines.

https://www.fscmauritius.org/en/legal-framework/acts (Search for "Virtual Asset and Initial Token Offering Services Act 2021").

*Direct Link (if available and stable, check FSC for latest)*: Often available through a legal database like `https://www.lexisnexis.com/` (paid service) or directly from FSC. As laws are updated, the FSC's legal framework page is the most reliable source for the current version.

**Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA 2002, as amended)**

**Date:** Originally enacted in 2002, but has undergone several amendments to align with evolving FATF standards, including those relating to virtual assets.

**Purpose:** This Act forms the primary legal basis for Mauritius's AML/CTF regime. It mandates reporting obligations for designated institutions (including VASPs under the VAITOS Act) regarding suspicious transactions, sets out the functions of the FIU, and establishes penalties for AML/CTF offenses.

**URL:** Also found on the FSC's legal framework page or the FIU's website:

The FSC has issued specific rules under the VAITOS Act, such as:

Virtual Asset and Initial Token Offering Services (Licensing) Rules 2022

Guidelines on Risk Management and Internal Controls for VASPs.

**URL:** These are typically found in the "Regulatory Framework" or "Rules & Guidelines" section of the FSC website:

**Licensing is Mandatory:** Any entity wishing to operate as a VASP in Mauritius must obtain a license from the FSC. This includes:

Operating a virtual asset exchange (for trading between virtual assets and fiat, or between different virtual assets).

Providing custody and/or administration of virtual assets.

Participating in and providing financial services related to an issuer’s offer and/or sale of a virtual asset (e.g., ITOs).

Providing portfolio management, advisory services, or other financial services related to virtual assets.

**Stringent Compliance:** Licensed VASPs are subject to:

**AML/CTF Obligations:** Strict customer due diligence (KYC), suspicious transaction reporting, record-keeping, and internal controls in line with FATF recommendations.

**Capital Requirements:** Specific minimum capital requirements based on the type of VASP license.

**Operational Requirements:** Robust cybersecurity frameworks, data protection, business continuity plans, and internal governance.

**Consumer Protection:** Requirements for clear disclosures, transparent fee structures, and handling of client assets.

**Reporting:** Regular reporting to the FSC on their activities and financial health.

**Investor Protection:** The regulatory framework aims to protect investors by ensuring licensed entities meet specified standards for security, transparency, and integrity.

https://www.fscmauritius.org/en/legal-framework/acts (Search for "Financial Intelligence and Anti-Money Laundering Act 2002").

**Compliance Requirement:** Mauritius directly implements all UN Security Council Resolutions, particularly those related to terrorism financing, proliferation financing, and targeted sanctions against specific individuals, entities, and countries.

**Legal Basis:** The **United Nations (Financial Prohibitions, Travel Bans and Arms Embargoes) Sanctions Act 2019** (often referred to as the UN Sanctions Act) provides the legal framework for the domestic implementation of UNSC sanctions. This Act mandates the freezing of assets, prohibition of financial services, and other restrictions against designated persons and entities listed by the UN.

**Obligations for VASPs:** VASPs licensed in Mauritius are legally obligated to screen their customers and transactions against the UN Consolidated List and immediately freeze any assets belonging to designated persons or entities.

**OFAC (US) and EU Sanctions (Indirect Impact):**

**Extraterritorial Reach:** While Mauritius does not *directly* enforce OFAC or EU sanctions, these regimes have significant extraterritorial reach.

**Risk Mitigation:** Mauritian VASPs that engage with US persons, entities, or financial systems, or transact in US dollars, or have exposure to the EU financial system, are *indirectly* subject to OFAC and EU sanctions. Non-compliance, even if unintended, can lead to severe penalties from US or EU authorities, denial of access to correspondent banking, and reputational damage.

**Practical Necessity:** Therefore, it is a best practice and a de facto requirement for Mauritian VASPs to screen against OFAC's Specially Designated Nationals (SDN) List and other relevant OFAC lists, as well as the EU's Consolidated List of persons, groups, and entities subject to financial sanctions, to manage their risk effectively.

The **FSC has issued specific guidance for VASPs** to ensure compliance with AML/CFT obligations, including sanctions. This guidance implements FATF Recommendations, notably Recommendation 15 (new technologies) and 16 (the "Travel Rule").

VASPs are considered "financial institutions" for AML/CFT purposes under FIAMLA.

**Risk-Based Approach (RBA):** VASPs must implement a risk-based approach to identify, assess, and mitigate their exposure to money laundering, terrorist financing, and proliferation financing risks, including sanctions risks.

Identify and verify the identity of customers and beneficial owners.

Screen all new and existing customers (and their beneficial owners) against relevant sanctions lists.

Conduct ongoing monitoring of business relationships and transactions.

**Transaction Monitoring:** VASPs must monitor transactions for suspicious activities and potential links to sanctioned entities, individuals, or jurisdictions. This includes monitoring virtual asset addresses for known sanctioned entities or high-risk activity patterns.

**Mandatory:** UN Consolidated List (issued by the FIU Mauritius).

**Prudent Practice:** OFAC SDN List, EU Consolidated List, UK HMT Financial Sanctions List, and potentially other national lists relevant to their client base and operational footprint.

**Timing of Screening:** Screening should occur during customer onboarding, periodically during ongoing monitoring, and prior to executing transactions.

**Freezing of Assets:** Upon identifying a match with a sanctioned individual or entity, VASPs are legally required to immediately freeze all virtual assets and fiat funds associated with that designated person or entity and report the freezing action to the Financial Intelligence Unit (FIU) Mauritius without delay.

**Prohibition of Services:** No services (financial or otherwise) should be provided to sanctioned individuals or entities.

**Travel Rule Compliance:** VASPs must collect and transmit originator and beneficiary information for virtual asset transfers above a certain threshold, consistent with FATF Recommendation 16. This information can then be used for sanctions screening.

**UN Sanctioned Jurisdictions:** Any country subject to comprehensive UN sanctions (e.g., North Korea) would be effectively off-limits for Mauritian VASPs due to the direct implementation of UNSC resolutions.

**High-Risk Jurisdictions:** VASPs must apply enhanced due diligence to transactions and relationships involving jurisdictions identified by the FATF as high-risk or subject to increased monitoring (e.g., those on the FATF "grey list" or "black list").

**OFAC/EU Designated Jurisdictions:** For practical risk management, Mauritian VASPs will generally avoid engaging in transactions or providing services to jurisdictions under comprehensive OFAC or EU sanctions (e.g., Cuba, Iran, Syria, Venezuela, Crimea region), given the potential for secondary sanctions or being cut off from global financial infrastructure.

**Under the UN Sanctions Act 2019:**

Any person who contravenes a prohibition or restriction specified in the Act, or fails to comply with a direction, commits an offence.

**Penalties:** Can include substantial fines (up to MUR 10 million for corporate bodies, MUR 5 million for individuals) and terms of imprisonment (up to 5 years for individuals).

**Under FIAMLA 2002 and FIAMLR 2018:**

**Administrative Penalties:** The FSC and BOM can impose administrative penalties, including fines, directives, public censures, and even suspension or revocation of licenses for non-compliance with AML/CFT requirements.

**Criminal Penalties:** Failure to comply with various provisions (e.g., CDD, reporting suspicious transactions, freezing assets) can lead to criminal charges, with penalties including significant fines and imprisonment.

**Reporting Obligations:** Failure to report a suspicious transaction or asset freezing to the FIU is a serious offence.

**Primary Sanctions List:** The **UN Consolidated List** is the foundational sanctions list that Mauritian VASPs are legally obliged to screen against. The FIU Mauritius typically issues circulars or guidance to regulated entities to ensure they access and comply with the latest UN lists.

**Domestic Implementation:** The UN Sanctions Act 2019 enables the Minister (upon advice from the Attorney General) to publish a notice in the Gazette to give effect to any UN Security Council Resolution for targeted financial sanctions. This effectively makes the UN list enforceable domestically.

**No Crypto-Specific List:** There is no separate Mauritian list of "sanctioned crypto entities" or "sanctioned crypto addresses" distinct from general sanctions lists. However, VASPs are expected to integrate sanctions screening into their blockchain analytics and transaction monitoring tools to identify sanctioned wallets or addresses.

**The Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA):**

Often available through the Attorney General's Office or various legal databases.

*General Source (may require searching for latest consolidated version):* https://attorneygeneral.govmu.org/

*FSC publication (may not be the latest consolidated version but useful):* https://www.fscmauritius.org/media/79183/financial-intelligence-and-anti-money-laundering-act-2002.pdf

**The United Nations (Financial Prohibitions, Travel Bans and Arms Embargoes) Sanctions Act 2019 (UN Sanctions Act):**

*Official Source (e.g., Government Gazette):* You may need to search the Government Gazette archives.

The FSC regularly updates its guidance documents. Look for "Guidance Notes on AML/CFT for Virtual Asset Service Providers" or similar.

*FSC Publications Page (search for relevant documents):* https://www.fscmauritius.org/en/legal-framework/publications

**Financial Intelligence Unit (FIU) Mauritius:**

The FIU provides guidance and issues circulars regarding sanctions lists.

**UN Security Council Consolidated List:**

*FATF Website (for recommendations and high-risk jurisdictions):* https://www.fatf-gafi.org/

**Issuing warnings against unregulated activities.**

**Refusing or revoking licenses for non-compliance.**

**Regulator Name:** Financial Services Commission (FSC) Mauritius

**Entity Targeted:** The General Public and Unlicensed Entities

**Violation Type:** Engaging in or promoting unregulated virtual asset services, pyramid schemes, or other illicit activities involving virtual assets.

**Penalty Amount:** N/A (warnings do not carry a direct penalty amount for the warning itself, but non-compliance with regulations could lead to severe penalties or legal action if a regulated entity were involved).

**Date:** Various dates within the last 3 years (e.g., 2021, 2022, 2023, 2024). These are ongoing advisories.

**Outcome:** Increased public awareness, discouragement of participation in fraudulent schemes, and a clear signal that the FSC is monitoring the space. The warnings emphasize that entities operating without a license are illegal.

**Source URL Example (General Warning):** While a specific "crypto enforcement action" with a penalty isn't found, the FSC regularly issues public notices regarding unregulated activities:

**FSC Public Notices Page (where such warnings would be found):** https://www.fscmauritius.org/en/news-media/public-notices

**Entity Targeted:** All financial institutions and VASPs subject to AML/CFT regulations.

**Violation Type:** Previous strategic deficiencies in the AML/CFT regime identified by FATF.

**Penalty Amount:** N/A (the "penalty" was the grey-listing itself, which impacted the country's financial reputation).

**Date:** October 2021 (Mauritius officially exited the FATF grey list). Ongoing since then with continuous monitoring and updates to AML/CFT frameworks.

**Outcome:** Enhanced AML/CFT measures across the financial sector, including more stringent requirements for VASPs. This means *proactive enforcement* through regulation and licensing to prevent future violations. Entities that fail to meet these high standards face license denial or revocation.

**FATF Statement on Mauritius's removal:** https://www.fatf-gafi.org/content/fatf-gafi/en/publications/High-risk-and-other-monitored-jurisdictions/Outcomes-plenary-october-2021.html

**FSC Announcement (related to regulatory framework strength):** https://www.fscmauritius.org/en/news-media/fsc-mauritius-statement-on-the-delisting-of-mauritius-from-the-fatf-grey-list

**Focus on Licensing & Prevention:** Mauritius's strategy for virtual assets is heavily focused on comprehensive licensing and strong AML/CFT compliance *before* an entity can operate. This means many non-compliant entities are prevented from entering the market or have their applications rejected, rather than being fined after operating illegally.

**Smaller Market:** Compared to major global financial centers, the number of large-scale crypto operations (and thus potential high-profile violations) in Mauritius is smaller.

**Enforcement Action Publication Policy:** While the FSC publishes enforcement actions, they might not always detail specific financial penalties for every type of breach, especially if it leads to license revocation or denial rather than a fine for a fully licensed entity. Public notices are more likely to cover broad warnings or general licensing updates.