· Jurisdiction Briefing

Mauritius: what the April 2026 high-risk country notice requires under section 17H

General Notice No. 358 of 2026 was published in the Government Gazette of Mauritius on 4 April 2026. It is headed "HIGH RISK COUNTRY", it comes from the Ministry of Financial Services and Economic Planning, and it names the Democratic People's Republic of…

Illustration for “Mauritius: what the April 2026 high-risk country notice requires under section 17H”

General Notice No. 358 of 2026 was published in the Government Gazette of Mauritius on 4 April 2026. It is headed “HIGH RISK COUNTRY”, it comes from the Ministry of Financial Services and Economic Planning, and it names the Democratic People’s Republic of Korea (DPRK), Iran and Myanmar. The Bank of Mauritius describes the step in one line: the Minister has “again identified the above three countries as high risk countries”. The earlier identification was General Notice No. 360 of 2023, published in the Gazette of 18 March 2023.

The names have not changed, so the notice is easy to file unread. That would be a mistake. The notice is as much a list of obligations as a list of countries: it restates what the Act already requires, adds directions with a calendar attached, and closes by saying that non-compliance is a criminal offence. This briefing reads it against the section it is made under.

Which texts this is

  • The notice. General Notice No. 358 of 2026, dated 04 April 2026, in the copy hosted on the Bank of Mauritius website.
  • The Act. Section 17H of the Financial Intelligence and Anti-Money Laundering Act, in the consolidated text on the FIU’s website. Its amendment note for section 17H cites Act No. 9 of 2019 and Act No. 10 of 2024.
  • The regulations. The Financial Intelligence and Anti-Money Laundering Regulations 2018, which came into operation on 1 October 2018, in the copy the FIU publishes. The amendment note under regulation 24 in that copy cites GN No. 122 of 2018 and Act No. 9 of 2019. If a decision turns on the exact wording of a regulation, check it against the gazetted text.

How a country gets on the list

Section 17H(1) sets the sequence. First, the Financial Action Task Force must have identified the jurisdiction as having significant or strategic deficiencies in its AML/CFT measures. Second, the Minister may, on the recommendation of the National Committee, identify that jurisdiction as a high risk country. The power is the Minister’s; the FATF statement alone does not do it.

The 2026 notice follows that sequence. It records that on 21 October 2022 the FATF issued its statement on high-risk jurisdictions subject to a call for action, and that in the light of the jurisdictions identified in that statement the Minister, on the recommendation of the National Committee, identified the three countries.

Regulation 24 says what is to be weighed in identifying a high risk country: strategic deficiencies in the country’s legal and institutional framework, the powers and procedures of its competent authorities, and the effectiveness of its system. Relevant evaluations, assessments or reports drawn up by international organisations and standard setters are to be taken into account.

The prescribed enhanced CDD

Section 17H(2) is short. A reporting person shall, with respect to business relationships or transactions involving a high risk country, apply such enhanced CDD measures as may be prescribed. The notice reminds reporting persons of this and points to the 2018 Regulations.

In the Regulations, the following provisions carry the weight.

Regulation 12(1)(c) requires enhanced CDD where a customer or an applicant for business is from a high risk third country.

Regulation 12(2) lists enhanced CDD measures that may be applied for higher risk business relationships. They include obtaining additional information on the customer and updating identification data more regularly, obtaining information on the source of funds or source of wealth, obtaining the approval of senior management to commence or continue the relationship, and conducting enhanced monitoring.

Regulation 12(3) is the exit rule. Where a reporting person is unable to perform enhanced CDD where the Regulations require it, the reporting person shall terminate the business relationship and file a suspicious transaction report under section 14 of the Act.

Regulation 24(3) adds a parallel duty: apply enhanced due diligence, proportionate to the risks, to business relationships and transactions with natural and legal persons from countries for which this is called for by the FATF.

Notice the difference in reach. Regulation 12(1)(c) speaks of a customer or applicant who is “from” a high risk third country. Section 17H(2) and the notice speak of business relationships or transactions “involving” a high risk country. A control that looks only at the customer’s own country answers the regulation. It does not obviously answer the Act. Build the trigger on the wider word.

Additional mitigating measures

Section 17H(3) applies in addition to subsection (2). A reporting person shall, where applicable and proportionate to the risks, apply one or more additional mitigating measures to persons and legal entities carrying out transactions involving a high risk country:

  • the application of additional elements of enhanced due diligence;
  • the introduction of enhanced relevant reporting mechanisms or systematic reporting of financial transactions;
  • the limitation of business relationships or transactions with natural persons or legal entities from the countries identified as high risk countries.

The notice repeats this, and uses the Act’s verb: reporting persons “shall”. The Bank of Mauritius page summarising the notice uses “should” at this point, and again for the directions that follow. Write your procedure to the notice and the Act. And because the test is “where applicable and proportionate to the risks”, record which measure you chose and why.

The directions in paragraph 5

Paragraph 5 of the notice says reporting persons shall:

  • consult the FATF public documents published on the FATF website at least 3 times a year, namely in February, June and October, and apply the countermeasures recommended by the FATF in those documents;
  • give special attention to business relationships and transactions with persons, both natural and legal, in those high risk countries, including companies, legal arrangements/trusts and financial institutions based there;
  • strengthen systems and controls in managing their exposure to the vulnerabilities identified by FATF; and
  • ensure that correspondent relationships, in particular, are not being used to evade countermeasures and risk mitigation practices.

The first of these is a dated task. It can be diarised and evidenced, and an examiner can ask to see the evidence.

It also explains how countermeasures reach you. Section 17H(4) says that where the Minister identifies a high risk country, he shall, on the recommendation of the FATF or the National Committee and having regard to the level of the risk, specify that one or more countermeasures shall apply to that country. The subsection’s list includes limiting business relationships or financial transactions with the identified country or persons in that country, and requiring reporting persons to review and amend, or if necessary terminate, correspondent banking and other similar relationships with institutions in the country concerned. The notice does not reproduce that list. Its instruction is the one in paragraph 5: apply the countermeasures the FATF recommends in its public documents.

Reliance on third parties

One consequence sits in a different regulation and is easy to miss. Regulation 21 allows a reporting person to rely on a third party to introduce business or to perform certain CDD measures. Regulation 21(3) closes that door for these countries: a reporting person shall not rely on a third party based in a high risk country referred to in regulation 24.

Who tells you, and who enforces

Under section 17H(5), the FIU shall immediately disseminate to reporting persons, in such manner as it may determine, any high risk country identified by the Minister, any countermeasures applicable to the country, the concerns regarding the weaknesses in that country’s AML/CFT systems, and any publicly available information published by the FATF on a jurisdiction it has identified.

On enforcement the notice is blunt:

> “Any non-compliance with the directions and specifications contained in this > Notice is a criminal offence under the Act and may further attract > administrative sanctions and penalties imposed by the supervisory > authorities under the Act.”

The Bank of Mauritius has said how it will act for its own population. Its licensees have been instructed to strictly comply with the directions and specifications at all times and to ensure that appropriate procedures and processes are implemented in their institutions. In case of non-compliance, the Bank says it will impose administrative sanctions and penalties as set out in section 18 of the Act.

What to do with this

  1. Cite the current notice. Add General Notice No. 358 of 2026 and its date to the country-risk policy and to the list your onboarding and payments teams work from.
  2. Test the trigger. Check that enhanced CDD fires on business relationships or transactions involving the three countries, and not only on a customer’s own country.
  3. Diarise February, June and October. Assign the FATF review to a named person, and keep a dated record of what was read and what changed.
  4. Document the additional measure. For each affected relationship, record which additional mitigating measure applies and the reasoning on proportionality.
  5. Check reliance and correspondent arrangements. Confirm that no third party relied on for CDD is based in one of the three countries, and review correspondent relationships against paragraph 5.
  6. Rehearse the exit. Make sure staff know that where enhanced CDD cannot be performed, regulation 12(3) requires termination and a suspicious transaction report.

SonarPulse in this jurisdiction: AML/CFT screening software for Mauritius

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu