November 3, 2026 · Jurisdiction Briefing · 8 min read

Mauritius: record keeping under the FIAML Act and the Bank of Mauritius Guideline, and where the seven-year clocks differ

Section 17F of the Financial Intelligence and Anti-Money Laundering Act (FIAMLA) sets a seven-year record-keeping rule. Chapter 10 of the Bank of Mauritius AML/CFT Guideline restates it and adds to it. The number is the same throughout. The event that starts the clock is not, and on one point, the FIU’s power to extend retention after a suspicious transaction report (STR), the January 2020 Guideline does not read like the Act as it now stands. This briefing sets the two side by side.

Which texts these are, and whether they are current

The Act. We use the consolidated FIAMLA the FIU uploaded on 25 August 2026. It records amendments by Act No. 3 of 2026, with effect from 18 April 2026. The Economic and Financial Measures (Miscellaneous Provisions) Act 2026, Act No. 13 of 2026, assented to on 12 August 2026, also amends FIAMLA, in sections 2, 18 and 19Q and the Fifth Schedule; none of those is a provision used here.
The Guideline. The Bank’s Guideline on Anti-Money Laundering and Combating the Financing of Terrorism and Proliferation is dated January 2020. The Bank’s listing shows it under 15 January 2020. The newer entries we checked on that listing on 2 November 2026 are on other topics.
The Regulations. Chapter 10 draws on the FIAML Regulations 2018. The copy we read is a 2022 consolidation: the one the FIU uploaded on 3 August 2022. A search of the FIU’s media library on 2 November 2026 returned no later copy. That does not rule out a later government notice, so check the Gazette before relying on the regulation text.
The Banking Act 2004. We read section 33 in the Bank’s online copy, which carries references up to Act No. 3 of 2026. Its note to section 33 lists amendments by Act No. 14 of 2005 and Act No. 18 of 2008.

Under paragraph 2.13 of the Guideline, where it uses “shall”, “must” or “should”, “it is a mandatory requirement”. Several retention paragraphs below say “should”. Under 2.13 the Bank treats them as mandatory.

Who each text applies to

Section 17F and regulations 6 and 14 put their duties on a reporting person. Section 33 of the Banking Act applies to every financial institution, for the purposes of the banking laws. The Guideline applies to its own “financial institutions”: banks, non-bank deposit taking institutions, cash dealers and money lenders licensed by the Bank under the Banking Act 2004, and licensees under the National Payment Systems Act 2018.

What to keep, and when the clock starts

Record	Statute or regulation	Guideline
CDD records, account files, business correspondence, identity documents	Not less than 7 years after the business relationship has ended (s.17F(2)(a))	Not less than 7 years after the completion of the transaction to which it relates, closure of the account or cessation of the business relationship (10.13)
Results of analysis	With the CDD records: “records and the results of any analysis undertaken in accordance with this Act”, not less than 7 years after the business relationship has ended (s.17F(2)(a))	Analysis or findings on the background and purpose of complex, unusual or suspicious transactions: not less than 7 years after the date the finding was made (10.18)
Transaction records	7 years after completion of the transaction, sufficient to permit reconstruction of each individual transaction, for account holders and non-account holders (s.17F(2)(b)); at least 7 years after completion (Banking Act s.33(3)(b))	Not less than 7 years after completion (10.15)
STRs and other reports to the FIU, with accompanying documentation	At least 7 years from the date the report was made (s.17F(2)(c))	The same for STRs (10.23); reports by the MLRO to the FIU, not less than 7 years after the report date (10.17)
Internal reports to the MLRO	Not listed in s.17F(2)	Not less than 7 years after the report date (10.17)
Beneficial-owner verification steps and difficulties met	Records required by regulation 6(2), which states no period	Retained for a period similar to CDD documentation (10.13)
Wire data that cannot travel with a related domestic transfer	Intermediary keeps everything received for at least 7 years (regulation 20(7))	Restated at 10.07
Electronic payments and messages		Treated like any other record and kept for the 10.10 period (10.20)
Records relating to ongoing investigations		Retained until the authorities confirm the case has been closed (10.19)

Where the texts do not line up

The FIU’s retention notice after an STR

Paragraphs 10.03 and 10.24 of the Guideline describe the power this way: the Director of the FIU may (10.24 says “can”), by written notice, not later than 15 days before the end of the 7th year following completion of the transaction, require the institution to keep the records for a specified period.

Section 13(5) of the Act, in the FIU’s August 2026 copy, reads differently: where an STR is made under section 14, the Director “shall, by written notice, require” the reporting person or auditor to keep the records for the period specified in the notice. It contains no 15-day limit. Nor is this a 2026 change: the FIU’s copy of the Act updated to November 2020 has the same wording. Section 13(5) also does not say what happens to the records where no notice has been received.

Our reading: the Act is the higher text and the current one. Do not build a destruction rule that treats the absence of a notice 15 days before year seven as clearance. For records linked to an STR, make the check a manual step and ask the FIU if the position is unclear.

Analysis and findings

Section 17F(2)(a) groups the results of analysis with CDD records, on the end-of-relationship clock. Paragraph 10.18 runs from the date of the finding. Our reading: both are minimums, and a finding on a long-running customer could pass seven years under 10.18 while the relationship continues. Whether a given finding is “analysis undertaken in accordance with this Act” is a judgement for you; the safer course is to keep such findings until the later date.

CDD documentation

Paragraph 10.13 lists three events, and does not say which governs. Section 17F names one: the end of the business relationship. Our reading: for a customer with an open relationship, a transaction completed seven years ago does not free the CDD file. Run the CDD clock from the end of the relationship.

What the records must be able to do

The texts also set a usability standard.

Reconstruction. Regulation 14(1) requires records in a form that enables the prompt reconstruction of each individual transaction. Paragraph 10.16 says the same, for domestic and international transactions.
Names on request. When answering an FIU request under section 13(2), or a request from a regulatory body or supervisory authority, regulation 14(2) requires you to provide, for each transaction record, the full name of the party making the payment and of the party receiving it.
Speed. Regulation 14(3) and paragraph 10.12 require CDD information and transaction records to be kept so that they are swiftly made available on request. Under section 13(4) of the Act, a request under section 13(2) or (3) must be met promptly but not later than 15 working days after the request.
Content. Paragraph 10.15 lists nine items that transaction records should include, so that authorities can compile an audit trail and a financial profile of a suspect account: the volume of funds through the account; the source of funds, including full remitter details; the form in which funds were offered or withdrawn; the identity of the person undertaking the transaction and of the beneficiary; counterparty details; the destination of funds; the form of instruction and authority; the date; and the type and identifying number of any account involved.
Form and place. Banking Act section 33(3) requires records in written form or on microfilm, magnetic tape, optical disk or another storage and retrieval mechanism the central bank may determine; at the principal office, or another place the central bank may approve; and in chronological or sequential order, as appropriate.
Currency. Under paragraph 10.14, you may set your own updating frequency, provided higher-risk clients are updated at least annually and whenever the circumstances warrant.

What breach can cost

Section 19(1) of the Act. A reporting person, or a director, employee, agent or other legal representative of one, who knowingly or without reasonable excuse fails to comply with section 17F, or destroys or removes a record required under the Act or regulations, commits an offence: a fine not exceeding 10 million rupees and imprisonment for a term not exceeding 5 years, on conviction.
Section 13(8) of the Act. Failing to supply information requested under section 13(2), (3) or (6) by the date specified, or falsifying, concealing or destroying material likely to be relevant to such a request, is an offence: a fine not exceeding one million rupees and imprisonment for a term not exceeding 5 years, on conviction.
The Guideline. The Bank says failure to meet it will be dealt with under its Sanctions Framework, which may mean non-monetary sanctions, monetary penalties and, in very serious instances, revocation of the licence.

What this means for an MLRO

Our view: a retention schedule with one line, “seven years”, is not enough here. The same number sits on different triggers, and the practical test is whether a given record is still there on the day it is wanted. Deletion is the control point: section 19(1) reaches destruction as well as failure to keep.

Six things worth doing

Rewrite the schedule by trigger. List each record type in the table above with the event that starts its clock, not just the period.
Gate deletion. Before any destruction run, screen for an STR on the customer or transaction, an FIU notice, and any ongoing investigation not yet confirmed closed.
Keep notices on a register. Record each section 13(5) notice, the records it covers and its end date, and link it to the deletion gate.
Time a retrieval. Pick closed accounts and reconstruct sample transactions against the nine items in paragraph 10.15, from request to delivery.
Decide where findings live. Store background-and-purpose findings where they follow the customer’s retention, not in a place with a shorter life.
Check where the records sit. If records are held anywhere other than the principal office, find the central bank’s approval under section 33(3)(c).

SonarPulse in this jurisdiction: AML/CFT screening software for Mauritius

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator Mauritius