Crypto License in Mauritius 2026: Requirements, Costs & How to Apply

• Mature, tested regulatory framework — The VAITOS Act 2021 has been fully operational since February 2022. The FSC has processed applications across all five VASP license classes and maintains a public register of licensed entities — so you can verify how many operators the framework has already approved in practice, not just in theory.
• Gateway to Africa and Asia — Mauritius sits at the crossroads of two of the fastest-growing crypto markets. Its network of 46+ double taxation agreements and membership in COMESA and SADC makes it an ideal base for businesses targeting emerging markets across both continents.
• Competitive tax regime — A flat 15% corporate tax rate with no capital gains tax, no withholding tax on dividends, and access to the Global Business License (GBL) structure for international operations. Effective tax rates can be significantly lower through available credits and exemptions.
• Credible with correspondent banks — FSC supervision and FATF compliance are precisely the credentials that EU and Asian banking partners look for when onboarding a VASP client. Unlike pure offshore structures, a Mauritius VASP license is routinely accepted by banking partners as evidence of regulatory standing — directly affecting your ability to open business accounts and process cross-border payments.
• No regulatory reversals since launch — Since the VAITOS Act came into force in February 2022, Mauritius has not imposed sudden licensing freezes, retroactive capital requirements, or abrupt policy changes. The FSC has consistently expanded its guidance and updated the framework rather than restricting access — the kind of predictability that matters when you are planning a multi-year business.
• FATF compliance — Removed from the FATF grey list in 2021, confirming full FATF compliance.

A Class M license authorizes a business to act as a broker or dealer in virtual assets — buying and selling virtual assets on behalf of clients or for its own account. This is one of the most frequently sought license classes.

Examples: OTC desks, crypto brokerages, trading firms that execute orders for retail or institutional clients, payment processors that convert fiat to crypto on behalf of merchants.

Minimum capital requirement: MUR 2,000,000 (~USD 44,000)

A Class O license covers businesses that provide custodial wallet services for virtual assets — safeguarding, storing, or managing clients’ virtual assets and private keys on their behalf. Class O is suited to retail-facing wallet providers and smaller-scale custodial operations. If your business serves institutional clients or holds assets at scale, you will likely need a Class R license instead.

Examples: mobile wallet apps (e.g. Trust Wallet–style products), hosted wallet providers for retail users, fintech apps with a built-in crypto wallet feature.

Minimum capital requirement: Operating capital sufficient for at least 12 months of operations

A Class R license authorizes the provision of custodial services for virtual assets at institutional scale — fund-grade custody, segregated cold storage, and multi-signature infrastructure. The higher MUR 5M capital threshold reflects the larger asset volumes and the stricter security and governance requirements the FSC applies to institutional custodians versus retail wallet providers (Class O).

Examples: institutional custody providers (Fireblocks-style), crypto fund administrators holding client assets, prime brokers offering segregated custody to hedge funds.

Minimum capital requirement: MUR 5,000,000 (~USD 110,000)

A Class I license covers businesses providing advisory and consulting services related to virtual assets, including investment advice, portfolio recommendations, and market analysis for clients.

Examples: crypto investment advisors, portfolio management consultants recommending token allocations, research firms that provide paid trading signals or asset ratings to subscribers.

Minimum capital requirement: Determined by the FSC on a case-by-case basis, taking into account the scope of advisory services, client base, and risk profile of the applicant

A Class S license authorizes the operation of a virtual asset exchange or marketplace — a platform that brings together buyers and sellers of virtual assets. This is the most capital-intensive license class, reflecting the higher risks associated with exchange operations.

Examples: centralised crypto exchanges (Binance/Kraken-style), NFT marketplaces with secondary trading, peer-to-peer trading platforms that match buyers and sellers via an order book.

Minimum capital requirement: MUR 6,500,000 (~USD 143,000)

Most real-world crypto businesses combine several activities, and the VAITOS Act requires a separate license for each class of service you provide. Common combinations include:

• Exchange + custody (Class S + Class R) — if your exchange holds user funds in its own wallets rather than using a third-party custodian, you need both licenses
• Broker-dealer + wallet (Class M + Class O) — an OTC desk or brokerage that also maintains hosted wallets for client balances
• Exchange + broker + custody (Class S + Class M + Class R) — a full-service platform that operates an order book, executes trades on behalf of clients, and custodies their assets
• Advisory + broker (Class I + Class M) — a firm that both advises clients on crypto investments and executes trades for them

The FSC reviews each license class application on its own merits, and capital requirements are cumulative — for example, applying for Class S + Class R means meeting the MUR 6.5M and MUR 5M thresholds respectively. We help clients identify exactly which combination they need and structure the application accordingly.

Every VASP must be incorporated as a company in Mauritius under the Companies Act 2001. The corporate structure must demonstrate genuine local substance and governance:

• Minimum 2 directors with at least 1 senior executive officer resident in Mauritius
• All directors and shareholders must pass fit and proper assessments by the FSC, covering good repute, competence, financial soundness, and absence of criminal convictions
• A registered office and physical presence in Mauritius
• Clear organizational structure with defined roles, reporting lines, and segregation of duties
• Appointment of a Compliance Officer and a Money Laundering Reporting Officer (MLRO)
• Appointment of a Company Secretary who is a natural person ordinarily resident in Mauritius (required for all companies except small private companies)

Each license class has its own minimum capital requirement as outlined in the table above. Beyond the initial capital threshold, VASPs must:

• Maintain ongoing capital adequacy throughout the term of the license
• Submit audited financial statements annually to the FSC
• Hold professional indemnity insurance or equivalent financial guarantees where required
• Demonstrate the ability to meet operational costs for a minimum period as specified by the FSC

All VASPs must comply with the Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA) and the VAITOS Act. VASPs must implement a comprehensive anti-money laundering program that includes:

• KYC/CDD procedures — customer identification, verification, and ongoing due diligence proportionate to risk
• Transaction monitoring — automated systems to detect suspicious patterns and flag unusual activity
• Suspicious Activity Reporting (SAR) — timely filing of reports with the Financial Intelligence Unit (FIU)
• Travel Rule compliance — collecting and transmitting originator and beneficiary information for VASP-to-VASP transfers, in line with FATF Recommendation 16
• Sanctions screening — real-time screening against UN, EU, and national sanctions lists
• Staff training — regular AML/CFT training programs for all employees

The FSC imposes rigorous technology and cybersecurity requirements on all licensed VASPs:

• Cybersecurity framework — documented policies covering access controls, encryption, intrusion detection, and vulnerability management
• 72-hour incident reporting — VASPs must report any cybersecurity incident to the FSC within 72 hours of detection
• Annual cybersecurity audits — independent third-party audits of IT infrastructure and security controls
• Data protection — compliance with the Mauritius Data Protection Act 2017, including secure storage and processing of client data
• Business continuity and disaster recovery — documented BCP/DRP plans with regular testing

The FSC charges fixed fees for license applications and annual renewals:

• Application fee: USD 1,000–3,000 (depending on license class)
• Annual license fee: MUR 25,000 (Class M, O, I) or MUR 50,000 (Class R, S)

All figures are estimates. Actual costs depend on the complexity of your business model and the specific requirements of the FSC. Capital figures are converted at approximate exchange rates and should be verified at the time of application.

• Quarterly risk assessments for crypto fund managers and operators handling client assets
• Notify the FSC within 7 days of any material changes to your business, including changes in directors, shareholders, registered office, or business model
• Annual audited financial statements submitted to the FSC within the prescribed timeline
• Incident reports within 72 hours for any cybersecurity breaches or operational disruptions

The Client Disclosure Rules 2022 require VASPs to provide clients with detailed information before entering into any transaction. Key disclosure obligations include:

• Clear description of each virtual asset service offered
• All fees, charges, and commissions (including hidden costs)
• Risk warnings specific to the virtual assets being offered
• Custody and safeguarding arrangements for client assets
• Complaint handling procedures and escalation paths
• Information about the VASP’s regulatory status and license class
• Data protection, privacy policies, terms and conditions of service (including termination rights)
• Language availability, technology requirements for accessing the VASP’s services, and platform accessibility standards
• Conflicts of interest policies and how they are managed
• Applicable law and jurisdiction for dispute resolution

Licensed VASPs must maintain fair and orderly markets through:

• Anti-manipulation measures — systems to detect and prevent market manipulation, wash trading, and spoofing
• Suspicious activity monitoring — ongoing surveillance of trading activity with automated alerts
• Conflict of interest management — documented policies to identify, manage, and disclose conflicts
• Best execution obligations — ensuring client orders are executed on the most favorable terms

We prepare all required compliance policies and disclosure documents as part of our licensing packages — see packages.

Mauritius has established specific rules for stablecoin issuance in addition to standard VASP licensing requirements. Key requirements include:

• 1:1 fiat reserve requirement — stablecoins must be backed by an equivalent amount of fiat currency held in segregated accounts at Mauritian banks
• Quarterly attestation — an independent auditor must verify the reserve backing on a quarterly basis and submit attestation reports to the FSC
• White paper requirement — a detailed white paper describing the stablecoin’s mechanism, reserve composition, redemption process, and risk factors must be published and submitted to the FSC
• Issuer requirements — stablecoin issuers must hold a VASP license and meet additional capital and governance requirements

When classifying NFTs, the FSC looks at the actual function of the NFT, not its label. The regulatory treatment depends on the characteristics and use case of the NFT:

• Pure collectibles — unique, non-fungible digital assets used solely for collection purposes fall outside the VAITOS Act regulatory perimeter
• Fractional NFTs — NFTs that have been fractionalized or exhibit fungible characteristics may be classified as securities under the Securities Act 2005, requiring additional regulatory compliance
• Other NFTs — NFTs that function as payment instruments, investment vehicles, or otherwise meet the definition of a virtual asset require VAITOS Act registration

If you are unsure how your NFT project will be classified, we can help you assess the regulatory implications and determine the appropriate compliance path.

The FSC takes a substance-over-form approach to decentralized finance, consistent with FATF guidance on virtual asset intermediaries. If a DeFi project has identifiable persons or entities providing virtual asset services, those activities fall under the VAITOS Act regardless of how they are marketed.

DeFi lending platforms, yield farming protocols, and liquidity provision services that involve an identifiable operator are classified under Class M (Broker-Dealer) when they facilitate the exchange or transfer of virtual assets on behalf of users. The minimum capital requirement of MUR 2,000,000 applies.

Truly decentralized protocols without any controlling entity may be exempt, but the FSC evaluates this on a case-by-case basis.

Following 2024 FSC guidance notes, staking-as-a-service providers — entities that pool user assets for proof-of-stake validation and distribute rewards — are required to obtain a VASP license. The applicable license class depends on whether the provider holds custody of staked assets (Class R — Custodian) or acts as an intermediary (Class M — Broker-Dealer).

The 2024 FSC guidance also addresses DAOs. Where a DAO has identifiable founders, developers, or governance token holders who exercise material control over the organization’s operations, the FSC may require those individuals or entities to obtain VASP licenses for the activities conducted through the DAO.

If your DAO has identifiable founders operating from Mauritius, you should apply for the appropriate VASP license class before commencing operations.

The VAITOS Act exempts the following activities from VASP licensing requirements:

• Central Bank Digital Currencies (CBDCs) — digital representations of fiat currencies issued by central banks, including the Bank of Mauritius Digital Rupee pilot, are classified as fiat currency and fall outside the VAITOS Act
• Securities under the Securities Act 2005 — financial instruments already regulated under the Securities Act 2005 are excluded from the virtual asset definition, though security token offerings may require separate FSC registration
• Closed-loop items — digital tokens that cannot be transferred, exchanged, or used outside of a specific, limited ecosystem (e.g., loyalty points, in-game currencies) are not considered virtual assets
• Peer-to-peer platforms without custody — platforms that merely match buyers and sellers without ever holding, managing, or transferring virtual assets on behalf of users do not require a VASP license
• Banks and national payment system operators — institutions licensed under the Banking Act 2004 require written authorization from the Bank of Mauritius (not the FSC) before conducting virtual asset activities
• Pure collectible NFTs — unique digital assets used solely for collection purposes (see NFT Classification above)

If you are unsure whether your activity requires a VASP license, we can assess your business model and determine the appropriate regulatory path.

The VAITOS Act establishes a mandatory registration regime for all Initial Token Offerings conducted from or within Mauritius. All ITOs must meet these requirements:

• Registration with the FSC — mandatory before any tokens can be offered to the public
• White paper submission — a comprehensive white paper describing the project, token economics, team, use of proceeds, and risk factors must be submitted to the FSC
• Application documents — certificate of incorporation, detailed business plan, AML/CFT policies, and proof of the team’s technical and managerial competence
• Investor protection measures — clear disclosure of risks, lock-up periods, and redemption mechanisms

Penalties for non-registration: Operating an unregistered ITO carries severe penalties of up to MUR 5,000,000 (approximately USD 110,000) and up to 5 years imprisonment. The FSC has broad powers to investigate and prosecute unauthorized token offerings. Penalties for operating as a VASP without a license are even more severe (see FAQ).

For detailed guidance on the ITO registration process, refer to the FSC Guidance Notes on Security Token Offerings.

We manage the full ITO registration process, from white paper drafting to FSC submission.