October 3, 2026 · Jurisdiction Briefing

Mauritius and ESAAMLG: what the follow-up reports re-rated, and what they left out

ESAAMLG's third-round assessments calendar lists Mauritius's last evaluation as July 2018, a possible on-site visit in January/February 2028 and a possible plenary discussion in August/September 2028. Those are scheduled windows, not events that have…

ESAAMLG’s third-round assessments calendar lists Mauritius’s last evaluation as July 2018, a possible on-site visit in January/February 2028 and a possible plenary discussion in August/September 2028. Those are scheduled windows, not events that have happened. Before the next round starts, it is worth knowing exactly where the second round left the country. That record sits in a series of ESAAMLG follow-up reports.

ESAAMLG’s Mauritius page lists five follow-up reports after the 2018 mutual evaluation. The most recent it lists is the 5th Enhanced Follow-up Report & Technical Compliance Re-Rating, September 2022, approved by the ESAAMLG Task Force of Senior Officials at its September 2022 meeting. It is the document this briefing is built on. Everything below describes the position ESAAMLG recorded in 2022, not the position today.

Where 2018 started

The report recalls that the Mutual Evaluation Report of Mauritius was adopted by the Task Force in April 2018 and approved by the Council of Ministers in July

Its Table 2.1 reproduces the July 2018 technical compliance ratings, and

they were weak: Recommendations 1, 6, 7, 8, 10, 13, 15, 16, 17, 22, 23, 24 and 28 were all rated non-compliant. In the light of those results, Mauritius was placed in the enhanced follow-up process — which the report describes as ESAAMLG’s policy for members with significant shortcomings in technical compliance or effectiveness, involving a more intense follow-up.

Five follow-up reports

ESAAMLG’s own summaries of the follow-up reports on its Mauritius page trace the climb:

Follow-up report	What ESAAMLG’s summary records
April 2019	Re-rated on 11 of the 40 Recommendations
2nd, September 2019	Re-rated on 19 of the 40 Recommendations, at the September 2019 meeting in Eswatini
3rd, December 2020	Progress on Recommendations 26 and 32, previously rated partially compliant
4th, September 2021	Progress on Recommendations 8 and 24 (previously non-compliant) and 33 (previously partially compliant)
5th, September 2022	Progress on Recommendation 15, previously rated partially compliant

The September 2022 report sums up the net effect in its own words: since the adoption of the MER, 29 Recommendations were re-rated (upgraded) to largely compliant and compliant, while one — R.15 — was downgraded from compliant to partially compliant before being re-rated again.

Its Table 4.1, Technical compliance ratings, June 2022, is the end point. With R.15 moved up to largely compliant, the table shows no Recommendation at partially compliant or non-compliant. The ratings still at largely compliant are R.8, R.11, R.15, R.24, R.25, R.26, R.28, R.32, R.34 and R.36 to R.40; the rest of the table reads compliant.

Recommendation 15: the one that went backwards

R.15 — new technologies — is the only Recommendation that moved in both directions, and the reason is that the standard itself moved. The report explains that in June 2019 R.15 was revised to add obligations on virtual assets and virtual asset service providers: understanding their ML/TF risks, licensing or registration of VASPs, risk-based supervision (including sanctions) by a competent authority, and applying preventive measures and international co-operation to VASPs.

Mauritius was rated non-compliant on R.15 in the 2018 MER, re-rated compliant in its 2nd enhanced follow-up report, and then downgraded to partially compliant in December 2020 when the FATF’s revisions came into force. The September 2022 re-rating to largely compliant rests on what followed:

A risk assessment. In 2021 Mauritius ran a National Risk Assessment of the ML/TF risks from virtual asset activities and VASPs. The public version was published in February 2022, and ML/TF risks from VAs and VASPs were considered Very High.
A licensing law. The Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS Act) provides for mandatory registration and licensing of all VASPs in Mauritius, with AML/CFT Guidance Notes for VASPs and issuers of initial token offerings.
A supervisor. The Financial Services Commission is designated as the VASP supervisor, with powers to obtain information, inspect premises and records, and give directions.

The reviewers’ conclusion was that Mauritius had met most of the new requirements, and “minor deficiencies remain”.

The caveats the reviewers wrote down in 2022

The re-rating came with reservations that are more useful to a compliance team than the rating itself. As at the report’s date:

It was premature to determine whether the FSC’s supervision is risk-based, because the FSC had not yet issued any VASP licence. Its risk-based supervisory tools applied to VASPs but were yet to be applied to risks specific to the VASP sector.
On unlicensed activity, the reviewers said it was not yet clear whether the actions taken were sufficient to capture all unregistered VASPs, noting that Mauritius had so far suspected seven individuals residing in Mauritius of carrying on business requiring a VAITOS licence. The sanctions available against unregistered VASPs were yet to be applied. A three-month grace period from February to May 2022 had been given for players to apply for a licence.
VASPs were subject to most wire transfer obligations, but not to other wire transfer obligations, in particular those relating to intermediary financial institutions.
The report also suggested the country could benefit from prioritising mitigating measures against high-proceeds predicate offences — drug trafficking and fraud — identified in the risk assessment as major threats.

None of this tells you where those points stand in 2026. It tells you which points the reviewers found open in the most recent follow-up report ESAAMLG lists for Mauritius.

What the follow-up reports did not measure

The most important sentence in the September 2022 report is in its first paragraph. The report does not analyse any progress Mauritius has made in improving its effectiveness. That progress, it says, would be assessed as part of a subsequent follow-up assessment and, if found sufficient, may result in re-ratings of Immediate Outcome ratings at that time.

The report closes on the same note: Mauritius would remain in enhanced follow-up and continue to inform ESAAMLG of its progress in improving the implementation of its AML/CFT effectiveness measures.

So the table above is a technical compliance table, and on the report’s own terms it does not measure effectiveness. That question is left to a later assessment.

Three things worth doing

Don’t read “compliant” as a verdict on your firm. A C on a Recommendation is a rating of the country’s framework. If effectiveness is what gets looked at next, part of the picture is how firms like yours apply that framework — your files, your STRs, your risk assessments.
If you bank, onboard or pay VASPs, reread the 2022 caveats. Risk-based VASP supervision, unlicensed providers and intermediary wire transfer obligations were the open points ESAAMLG wrote down. Check your own exposure to each against the current FSC and FIU requirements rather than the 2022 position.
Plan on the calendar’s dates, not on rumour. ESAAMLG lists a possible on-site window of January/February 2028. Work back from it: which records you would want to be able to produce on a sample of cases, and for how many years back.

SonarPulse in this jurisdiction: AML/CFT screening software for Mauritius

Sources

This article draws on the following sources. Follow the links for the original text.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator Mauritius