The right order of work is to describe the service, map the flow of funds and data, identify the competent authority, and seek guidance before developing an offering for the public. The FSC page “Your innovation journey in and from Mauritius” sets out a process that moves from classifying the model to using the sandbox and then applying for a licence under the applicable regime.
Key takeaways
- The FSC sandbox is used to test an innovation under a defined authorisation and set of limits.
- Crypto services covered by VAITOS require an assessment of the activity and the relevant licence class.
- A sandbox test does not automatically authorise general commercial operations.
Start with the activity, not the word “blockchain”
Technology alone does not determine regulatory status. A company may use a blockchain to record receipts, operate a client wallet, organise a marketplace, hold keys, provide investment advice or transfer payments. These functions may fall under different rules and authorities. Describing a product as “Web3” or “tokenised” does not replace a legal assessment of what it actually does. For more on the local context, also consult BrefCrypto’s in-depth guide to crypto in Mauritius.
The first questions concern customers and funds. Does the company receive rupees? Can it control or move assets? Does it match buyers and sellers? Does it execute an order on behalf of a client? Does it hold a private key, or does it only provide non-custodial software? Does it offer personalised advice? Does it issue a token or facilitate a sale? The answers determine which activities should be presented to the regulator.
The FSC describes the VAITOS framework as covering virtual asset service providers and issuers of initial token offerings operating “in or from Mauritius”. The categories notably include brokerage, wallet services, custody, advisory services and marketplaces. The FSC’s page on FinTech and virtual assets states that the law came into force on 7 February 2022. Companies must check the legislation, rules and criteria currently in force rather than relying solely on a blog post.
Domestic payments may fall within a different scope. The FSC distinguishes its non-bank activities from the Bank of Mauritius’s (BoM) role in local payments. Its innovation page states that payment services and domestic flows should be discussed with the relevant authority, particularly the BoM where domestic payments or the receipt of deposits are involved. A fintech combining crypto, electronic money and local transfers may therefore need to address more than one regulatory area.
Sandbox: a supervised, limited test subject to conditions
The FSC describes its Regulatory Sandbox as an environment in which a company can test a model, whether simulated or real, under supervision, for a defined period and subject to specific conditions. According to the official page, an admitted entity may receive an exemption from certain requirements during the test and then apply for a full licence after a successful exit. This does not mean that every activity is automatically exempt from all applicable laws.
The sandbox is intended for innovative models that do not clearly fit an existing regime or need to be tested within a controlled perimeter. Applicants must explain why the test is necessary, which customers or volumes will be involved, what limits protect participants and which measures will stop the pilot if an incident occurs. A prototype made available to the public without sandbox authorisation is not the same as a regulated experiment.
The scope of an RSA must be read in its document: the covered activity, duration, target population, amounts, geography, reporting requirements and exit conditions. A founder should not present an experimental authorisation as a permanent commercial licence. They should also avoid using an authority’s logo or suggesting that the FSC guarantees the product or will reimburse customers.
The sandbox is not a grant or a source of funding either. The FSC states that it supervises and authorises activities within its remit but does not provide startup capital. Founders must budget for their own legal, technical, compliance, security and capital requirements as they build their path forward.
VAITOS licensing: matching the class to the proposed service
When a company already knows that it will carry out a regulated activity, the process may proceed directly through a licence application. The law and FSC rules distinguish between several categories because a broker-dealer, wallet operator, custodian, adviser and marketplace operator do not control the same risks.
The FSC publishes licence criteria and categories in its codified list. The classes are shown with their legislative references, conditions and administrative fees. The list does not replace an assessment of the business model, and the amounts may change. Check the most recent dated version before preparing a budget or displaying a figure on the company’s website.
An exchange project may be tempted to choose the class whose name most closely resembles its interface. The classification should instead follow the functions: who receives the order, who holds the assets, who sets the price, who matches users and who executes the transaction. If several functions are combined, the company should ask whether multiple authorisations or ancillary activities apply.
Operational requirements extend beyond capital. The FSC publishes instruments covering the custody of client assets, cybersecurity, risk management, statutory filings, client disclosures, advertising and transfers. A credible business plan must explain how the company protects assets, responds to incidents, segregates funds and informs users about risks.
Prepare a file that describes the actual product
A good scoping document can begin with a one-page user journey. Describe who opens the account, who sends the funds, which provider receives the money, where the crypto-asset is held, who signs transactions and what happens in the event of a lost key or dispute. Add a diagram of the group companies and external providers. A clear diagram often reveals a regulated role that was not apparent in the commercial pitch.
Next, prepare a risk matrix covering money laundering and illicit financing, fraud, cybersecurity, asset custody, transaction errors, conflicts of interest, provider failure, cloud dependence, business continuity and customer complaints. For each risk, identify the responsible person, the controls, the evidence produced and the response plan. A generic statement such as “funds are protected by the blockchain” does not answer these questions.
The file should document partners, banks, KYC providers, wallet operators, liquidity providers and cloud services. Explain what they do, where they operate and what the company can do if one of them stops providing its service. Compliance cannot be outsourced to the point that the startup does not know who controls a critical step.
Also define the pilot’s limits: number of customers, maximum amount per user, total amount under custody, assets offered, duration, recruitment channels, territory, support hours and stop criteria. These limits enable the regulator and management to assess risk within a measurable experiment. Test results should be prepared as indicators, not merely promotional testimonials.
Separate the FSC and the Bank of Mauritius according to the flow
A project may touch several regulatory regimes. The FSC supervises the non-bank financial sector and its VAITOS framework. The BoM is the central bank and is involved, notably, in domestic payment systems and the relevant providers. An activity combining a crypto wallet service, a rupee on-ramp, a card and transfers between users cannot assume that a single regulatory contact covers every component.
The FSC page explains that its Innovation Office helps identify the appropriate regime and provides a point of contact, including finnovate@fscmauritius.org. It distinguishes payment services, virtual assets and other innovations. Submit a guidance request with concrete facts: a funds-flow diagram, entities, intended customers, functions and test scenario. A precise question is more likely to produce a useful answer than a general email asking “how to launch a crypto business”.
If the model involves a domestic payment service or the issuance of electronic money, also ask the BoM whether it falls within its remit. Do not interpret the presence of a banking partner as regulatory approval of the crypto product. Each participant remains responsible for its own obligations and contracts.
Foreign companies seeking to serve Mauritian residents should also examine the territorial scope of the law. The VAITOS Act applies to VASP activities or initial token offerings conducted in or from Mauritius; other rules may apply based on the customer’s location, marketing and flows. Mauritian advice does not replace obligations in other jurisdictions where the product is offered.
Authorisation does not replace customer protection
A product may be legally authorised while still carrying significant financial risk. Customer-facing documents should explain fees, the risk of loss, the irreversibility of transfers, withdrawal restrictions, asset management and complaint handling. A sandbox experiment does not guarantee returns or eliminate the possibility of loss; communications should say so plainly.
A custody project must establish rules for key access, asset segregation and recovery after an incident. Exchange services should explain how prices are formed, how conflicts of interest are managed and what happens during an interruption. An automated advisory service should inform users of the model’s limitations, assumptions and any incentives. These issues must be built into the product before it is opened to users.
Advertising is also a regulatory risk. A banner promising “guaranteed capital”, “certain returns” or “FSC-approved” may be misleading even if the fine print includes a disclaimer. Check the advertising rules applicable to VASPs and have materials reviewed by legal and compliance teams. Influencer promotions should clearly disclose commercial relationships and must not present a token as a recommendation without a proper basis.
The first 30 days: preparing the right authorisation path
What a founder should do in the first 30 days
Start by writing a product description without slogans, then map the funds and data. Identify the entities, roles, country of each customer and every function planned for the first version. Set aside optional features that blur the scope: derivatives, lending, yield and third-party custody may introduce separate obligations and risks.
Next, seek specialised legal advice and a guidance meeting with the Innovation Office. Assemble the business plan, security policy, revenue model, customer journey, complaint procedures and exit scenario. Review the latest FSC criteria and determine whether the model warrants a direct VAITOS application or an RSA before licensing.
At the same time, choose a technical testing environment that does not expose public funds and define the data that will be collected. If the pilot is to involve real users or real assets, first obtain written confirmation of the required authorisation and comply with the prescribed limits. A testnet demo is not the same as a financial service offered to customers.
Sandbox or licence: the decision depends on stage and risk
The sandbox is appropriate for a model that is innovative enough to justify a supervised test and defined enough for safeguards to be set. A full licence is appropriate for an activity that fits an existing regime and that the company intends to operate beyond a limited experiment. Some teams may go through the sandbox before applying for a licence; others must pursue approval or a service authorisation directly.
The decision is not a workaround for avoiding the law. A public application that receives funds while waiting to “be admitted” may already be conducting a regulated activity. The FSC page describes the path as a sequence of guidance, testing where necessary, a licence application, and then authorisation and supervision. Companies must follow the scope established by the Commission and must not market a future possibility as an authorisation already obtained.
Mauritius offers founders a regulatory framework and a point of contact for innovative projects, but credibility comes from a clear scope, strong governance and evidence that risks are controlled. Regulatory preparation is part of the product: it protects customers and helps the company determine which functions can genuinely be launched, when and under what conditions.
Before finalising the scope, compare exchange models and the controls proposed for crypto platforms in Africa.
For this part of the project, BrefCrypto’s guide to KYC controls and data protection provides practical additional guidance.
