October 20, 2026 · Jurisdiction Briefing

Mauritius: what the Bank of Mauritius virtual asset guideline asks of banks on AML/CFT

The Bank of Mauritius issued its Guideline for Virtual Asset related Activities on 13 November 2024, under reference BOM/BSD 778. Much of it is prudential: classification of virtual assets into groups, capital add-ons, liquidity treatment. But the paragraphs in section 4 headed “Money Laundering and Terrorism Financing and Proliferation Risk”, and the red flags in Annex 2, belong on the MLRO’s desk. This briefing reads those parts, and the governance around them.

Which text this is, and whether it is current

The document. Guideline for Virtual Asset related Activities, Bank of Mauritius, November 2024, signed off “Bank of Mauritius, 13 November 2024”. The Bank’s guideline listing shows it under that date.
Authority. It is issued under section 50 of the Bank of Mauritius Act 2004 and section 100 of the Banking Act 2004.
Basis. The Bank says it is based on standards of the Basel Committee on Banking Supervision on cryptoassets exposures.
Timing. It applied with immediate effect, and its transitional provision gave banks until 31 May 2025 to ensure full compliance. That date has passed; the full text now applies.

Who it applies to

The guideline applies to banks licensed under the Banking Act 2004 that are involved in virtual asset related activities, as the guideline defines them. It does not reach other financial institutions by its own terms.

The definition is what makes it relevant to more banks than the title suggests. “Virtual asset related activities” includes, but is not limited to, the activities of virtual asset service providers and issuers of initial token offerings; direct and indirect exposure to virtual assets through investment, trading, credit exposures and collateral; investments in entities with significant dealings in virtual assets; and, in the words that matter most for compliance, the “provision of services to virtual asset service providers, issuers of initial token offering and to customers dealing in virtual assets”.

So a bank that never holds a token, but opens an account for a licensed exchange or for a customer who trades crypto, is inside the definition. Read it that way before concluding the guideline is someone else’s problem.

Banking a VASP needs no prior approval, but other steps do

Paragraph 3.6 says the Bank’s approval is not required for the provision of banking services to virtual asset service providers, issuers of initial token offering and customers dealing in virtual asset related activities. It adds that this includes processing payments for the purchase, sale and redemption of virtual assets in exchange for fiat currencies.

Other steps do need the Bank. A bank must seek the Bank’s written approval before applying to the Financial Services Commission for a class “R” licence (Virtual Asset Custodian) or class “I” licence (Virtual Asset Advisory Services), or before applying through a subsidiary for a class “M” (Virtual Asset Broker-Dealer), class “O” (Virtual Asset Wallet Services) or class “S” (Virtual Asset Market Place) licence. The application must carry the board-approved risk assessment report.

No approval is not the same as no rules. The AML/CFT paragraphs below apply to the customer relationship whether or not the Bank was asked first.

Before the first relationship: board, risk assessment, licence check

The board’s duties come first in the guideline. Among them, the board shall ensure that a comprehensive risk assessment is conducted before the bank engages in virtual asset related activities, with controls and mitigants for the risks identified; the guideline says that risk assessment “should be duly documented and approved by the board”. The board shall also approve, and review at least annually, the strategy, risk appetite, risk limits, risk management framework and policies for these activities, and ensure that directors, senior management and relevant staff have appropriate expertise and training.

Paragraph 4.4 then lists what a bank shall do before engaging in any virtual asset related activity. One item is a direct compliance task: banks shall “satisfy themselves that the virtual asset related activities, including the virtual assets service providers are duly licensed and regulated.” For an MLRO, that is a licence check at onboarding, documented, for every VASP customer.

Customer due diligence

Paragraph 4.23 requires banks to put in place policies and procedures for customer due diligence (identification, verification and securing information on the ultimate beneficial owner) before opening an account or establishing a business relationship with a virtual asset service provider, an issuer of initial token offering, or a customer dealing in virtual assets. The bank should gather enough information at that stage to understand the customer’s nature of business and build a risk profile. That profile then determines the level and type of ongoing monitoring, and supports the decision to enter into, continue or terminate the relationship.

Paragraph 4.24 allows the profile to be built at customer level (its examples are the nature and volume of trading activity and the origin of virtual funds deposited) or at cluster level, where a group of customers shows homogenous characteristics, such as similar transactions or the same virtual assets.

Paragraph 4.25 ties this to the Bank’s existing rulebook: banks shall apply a risk-based approach as set out in the Guideline on Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation when serving VASPs, ITO issuers and customers involved in these activities, or when engaging in them directly or through subsidiaries.

Risk assessment, and a floor set by the National Risk Assessment

Paragraph 4.26 invokes section 17 of the FIAMLA. Banks shall identify, assess and understand the ML, TF and PF risks arising from VASPs’ activities, from virtual asset related activities and from customers involved in them, and take appropriate measures to manage and mitigate those risks. The measures should include a proper risk assessment that considers all relevant risk factors, timely reviews based on the risk category, and documentation.

Then comes the paragraph most likely to change a rating model. Paragraph 4.30 says banks shall always apply the risk threshold allocated to this type of business in the National Risk Assessment, notwithstanding that their own assessment of virtual asset risk may be lower. Paragraph 4.31 repeats the point for monitoring: the risk weight allocated to VASPs or customers involved in virtual asset related activities should not be below the NRA threshold.

In practice, the bank’s own methodology cannot rate a VASP customer below the national rating for that business type. If your model can, it needs a floor. The guideline does not restate the NRA’s rating; the MLRO has to take it from the National Risk Assessment itself.

Paragraph 4.29 adds a product-change duty. Banks shall continuously identify and assess ML/TF/PF risks from new products that VASPs develop and offer to customers, and shall ensure that the VASP has carried out a risk assessment before launching a new product, technology or delivery channel.

When the risk cannot be managed

Paragraph 4.28 is the exit rule. Where a bank cannot apply the appropriate level of due diligence, or its mitigation measures are not adequate to the ML/TF/PF risk, it shall abstain from entering into the relationship, or terminate an existing one, and consider filing an STR with the Financial Intelligence Unit under section 14 of the FIAMLA and in accordance with the FIAML Regulations 2018.

Note the verbs. Abstaining or exiting is a “shall”; on the STR the guideline says “consider”. Record that consideration, and its outcome, either way.

Transaction monitoring

Paragraph 4.31 requires adequate systems to monitor activity in the accounts of VASPs and of customers involved in virtual asset related activities, on a risk-based approach. Frequency and intensity of monitoring should match the customer’s risk profile.

Paragraph 4.32 says what goes into scenario design and calibration: the customer’s risk profile, information collected during CDD, information from law enforcement bodies and other authorities in the jurisdiction, and the approach to risk allocation in the National Risk Assessment.

Paragraph 4.33 points banks to the FATF report “Virtual Assets Red Flag Indicators of Money Laundering and Terrorist Financing”, which Annex 2 of the guideline summarises. The annex groups the indicators under six headings:

Transactions: for example, structuring in small amounts or below record-keeping or reporting thresholds, multiple high-value transactions, and depositing at an exchange then often immediately withdrawing or converting.
Transaction patterns: for example, a large initial deposit inconsistent with the customer profile, small transactions from multiple wallets converted as a whole into fiat, and exchanging at a potential loss.
Anonymity: features such as privacy coins, unhosted, hardware or paper wallets used to move virtual assets across borders, and darknet access to VASP platforms. Here the annex is not only descriptive: banks shall have controls in place and system design to detect and prevent such activities through their banking platforms.
Senders and recipients: for example, separate accounts under different names, customers declining KYC or source-of-funds requests, and frequent access from different IP addresses in a day.
Source of funds or wealth: for example, transactions to or from online gambling services, and cards linked to a wallet used to withdraw large amounts of fiat.
Geographical risks: source, destination and transit jurisdictions, and links to high-risk jurisdictions through the originator, the beneficiary, or the customer’s nationality, residence or place of business.

A bank sees the fiat side of these flows: the account that funds the exchange, the conversion that lands back in it. Build the scenarios there.

Sanctions screening and wallet addresses

Paragraph 4.34 says sanctions obligations apply to crypto and virtual asset service providers, exchanges, custodians and wallet providers as they do to other financial institutions. It warns that some sanction lists may now include wallet numbers in addition to, or instead of, names. And it says banks should implement robust screening that uses advanced technology to detect and prevent, in real time, transactions involving sanctioned individuals, entities or jurisdictions, as well as VASPs or exchanges and digital wallet identification numbers.

The paragraph is written with “should”, not “shall”. It is still the Bank’s stated expectation, and a screening set-up that matches names only does not address the wallet-identifier point.

Paragraph 4.35 is firmer: banks shall comply with the Bank’s relevant guidelines and instructions in dealing with VASPs, and “are strictly prohibited to engage in or support anonymous virtual asset related activities.”

Oversight, reporting and disclosure

Section 8 gives the compliance function its own duty: periodic reviews of adherence to applicable laws and regulations in respect of virtual asset related activities. Internal audit shall regularly review the risk management and internal control framework for these risks. Banks shall also send the Bank a quarterly report on virtual asset related activities, and disclose their material virtual asset related activities in their annual reports at least annually.

What to do with this

Map your exposure to the definition. List every VASP, ITO issuer and customer dealing in virtual assets you bank. If the list is not empty, the guideline applies to you.
Evidence the licence check. For each VASP customer, keep a dated record that you satisfied yourself it is duly licensed and regulated.
Put the NRA floor into the model. Confirm that no VASP or virtual-asset customer can be rated below the National Risk Assessment’s threshold for that business type, and document where the threshold comes from.
Write the exit rule into procedure. Abstain or terminate where due diligence or mitigation falls short, and record the STR consideration.
Calibrate monitoring to Annex 2. Map each red-flag heading to a scenario on the fiat side, using the inputs paragraph 4.32 lists.
Test screening for wallet identifiers. Check whether your screening can match wallet numbers where a list provides them, and in real time.
Plan the compliance review. Schedule the periodic review section 8.2 requires.

SonarPulse in this jurisdiction: AML/CFT screening software for Mauritius

Sources

This article draws on the following sources. Follow the links for the original text.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator Mauritius