Back to Index of Cryptoasset Regulations

On March 1, 2019, the Financial Services (Custodian Services (Digital Asset)) Rules, issued by the Mauritius Financial Services Commission (FSC) to regulate the licensing and operations of custodian services, took effect. The Rules treat custodians as financial institutions and subject them to the requirements under the money laundering and counter-terrorism laws. The Rules also impose various conditions on custodians that appear to have been designed to protect customers, ranging from capital reserve requirements to infrastructure security for on-site storage of digital assets.

While the regulatory system related to investment in cryptoassets appears to be in its infancy, Mauritius recently recognized digital assets as a possible asset-class for investment by sophisticated investors, expert investors, expert funds, sophisticated collective investment schemes, and professional collective investment schemes.

I. Approach to Assets Created Through Blockchain

Based on the authority accorded to it in 2018 through amendments to the Financial Services Act of 2007, the Mauritius Financial Services Commission (FSC) issued the Financial Services (Custodian Services (Digital Asset)) Rules 2019 (the Rules) and the Financial Services (Consolidated Licensing and Fees) (Amendment) Rules 2019, both of which took effect on March 1, 2019.[1] 

The Rules regulate digital asset custodians in the digital assets market; other activities appear to remain unregulated.  The only recent source dealing with the regulation of investment in digital assets appears to be guidance issued by the FSC in 2018 recognizing digital assets as an asset-class and allowing certain investors to invest in them (see part IV, below).

One of the principal developments with the issuance of the Rules is the adoption a broad definition of the term “digital assets” that appears to include different versions of blockchain-based products. The Rules state as follows:

(a) ...any token, in electronic or binary form, which is representative of either the holder’s access rights to a service or ownership of an asset;

(b) includes a digital representation of value which –

(i) is used as a medium of exchange, unit of account, or store of value but which is not a legal tender, even if it is denominated in legal tender;

(ii) represents assets such as debt or equity; or

(iii) provides access to a blockchain-based application, service or product;

(c) excludes –

(i) any transaction in which a business, as part of an affinity or reward programme, grants value which cannot be exchanged for legal tender, bank credit or any digital asset; or

(ii) a digital representation of value issued for use within an online gaming platform.[2]

A. Financial Regulation and Consumer Protection

Many of the provisions under the Rules could be read as protections afforded to customers of custodian service providers (see part II, below).  The Rules impose specific directives regarding how custodians must treat customers and protect their assets.  For instance the “Communications with Clients” clause of the Rules states as follows:

1) A custodian shall have in place such procedures as may be required to ensure that –

(a) each client is provided with an original of the signed agreement regarding the custody of digital asset within 30 days from the date on which the agreement is signed; and

(b) each client is promptly informed of any action which is likely to impact on any provisions of the agreement and on digital asset being held in custody.

2) In the event that such disclosures are being made to a client through an internet-based service, a custodian shall have in place a multi-factor authentication system in line with best industry practices.[3]

The Rules also impose various restrictions regarding key and seed generation and storage as well as access of staff of a licensed custodian to keys, seeds, and other relevant information.[4]  A key is “cryptographic key which is used by cryptographic algorithm to transfer plain text into encrypted form or vice versa.”[5]  A seed is “an alphanumeric phrase generated through the process of entropy.”[6]  Entropy is “unpredictability or randomness within the source code which is used to generate a cryptographic seed which ensures that a seed cannot be simply recreated.”[7]

Significantly, the Rules include provisions on uninterrupted access for clients in certain circumstances and the segregation of client assets:

23. Uninterrupted Access

A custodian shall, subject to the custody agreement, provide its clients with uninterrupted access to their respective digital asset under its custody if –

(a) it is no longer able to abide by the custody agreement; or

(b) it ceases to operate; or

(c) it is requested to transfer the digital asset in accordance with the instructions of the client or such other mutually agreeable arrangements.

24. Segregation of client assets

(1) A custodian shall have adequate procedures to ensure that digital asset belonging to different clients are not pooled or not kept together at a single address or in a common wallet.

(2) A custodian shall ensure that an address or wallet is assigned to a single client and that the digital asset belonging to that client is kept in the assigned address or wallet.[8]

B.  Anti-Money Laundering Law

It appears that the country’s Financial Intelligence and Anti-Money Laundering Act and the Prevention of the Terrorism Act apply to custodians, which are considered financial institutions.  In a 2018 consultation paper the FSC noted that,

10.1 [a]s part of its application document pack, the applicant will be required to submit a detailed report containing an in-depth assessment of the potential money laundering and terrorist financing (“ML/TF”) risks posed by its operations as well as the measures, systems, controls and protocols which will be established in relation to those ML/TF risks. Once licensed, prior to starting its operations, the licensee will be required to have those ML/TF systems and controls in place.

10.2. For the sake of clarity, the FSC wishes to point out that the Custodian Services (Digital Asset) Licence will be issued under section 14 of the [Financial Services Act] and as such the holder of this licence, while being a licensee of the FSC, will simultaneously be considered as a “financial institution” under the [Financial Terrorism and Antti-Money Laundering Act].

10.3 Consequently, the holder of the Custodian Services (Digital Asset) Licence will be required to ensure strict adherence to the appropriate laws regulations and codes relating to [Anti-Money Laundering and Counter-Terrorist Financing] in Mauritius including the FSC Code on the Prevention of Money Laundering and Terrorist Financing, the FIAMLA and regulations made thereunder.

10.4. As part of its systems and controls to prevent ML/TF, the applicant must have in place procedures to conduct CDD and KYC as well as to ascertain the source of funds/wealth of potential clients prior to on-boarding.[9]

The Financial Services Act requires that a licensee “keep and maintain internal records of the identity of each of his customers.”[10]  The Act also notes that “guidelines issued by the Commission under any relevant Act or under section 18(1) of the Financial Intelligence and Anti-Money Laundering Act 2002 may specify the nature of customer identification documentation to be kept and maintained.”[11]  It further requires that the records kept “shall include account files and business correspondence” and shall be kept for at least seven years.[12]

The FSC 2012 guidance, the Code on the Prevention of Money Laundering and Terrorist Financing, provides more detailed requirements on the prevention of money laundering and terrorism financing.[13]

C. Taxation

No information was located regarding the taxation of digital assets in Mauritius.

Back to Top

II. Custodianship of Cryptocurrencies by Financial Institutions

The Rules primarily deal with custodianship. Under the Rules, custody means “the safekeeping of digital assets being held or transacted” and a custodian is “an entity entrusted with the custody of digital asset.”[14] 

Opening a custody service requires the acquisition of a license under the Financial Services Act.[15]  Anyone who operates a custodial service without a license commits a crime, on conviction, punishable by a fine of up to MUR1 million (about US$28,816) or custodial sentence not exceeding eight years.[16]  Among others, the Act requires that applicants for license provide

(a) a business plan or feasibility study outlining the proposed business activity of the applicant;
(b) particulars and information relating to customer due diligence verification of promoters, beneficial owners, controllers and proposed directors in such form as may be specified in FSC Rules . . .[17]

The Rules require that the “objects of a custodian . . . shall be limited to the safekeeping of digital assets and operations arising directly from it.”[18]

The Rules also require that a custodian (an entity entrusted with the custody of digital assets) “shall at all times, have . . .  an office in Mauritius from which it shall perform its core functions.”[19]  These are “functions relating to operational and governance protocols, safekeeping of digital assets and transaction management.”[20]  Operational and governance protocols include “fraud prevention in relation to the custody of digital assets.”[21]  Additional rules include a

• requirement to maintain a sound governance structure with sufficient oversight and internal controls;
• requirement to properly vet staff involved in the performance of core functions;
• requirement to prepare for disaster recovery and put in place a system for continuity of operations;
• requirement that a custodian maintain a capital reserve equal to 35 million Mauritius Rupees (MUR) (about US1.01 Million) or an amount representing six months’ operational expense, whichever is higher;
• requirement that a custodian develop and maintain a risk management program, including strategies for assessing and mitigating operational risks;
• requirement that a custodian shall not outsource any of its core functions without prior approval of the FSC;
• requirement on security infrastructure for on-site storage of digital assets;
• requirement for developing storage strategy for digital assets;
• requirement regarding procedures for security breaches;
• requirement that custodians adopt multi-signature authorization so that “no single person is able to initiate and complete” a digital asset transaction; and
• requirement for putting in place systems and procedures for detecting and reviewing suspicious or fraudulent transactions.[22]

Back to Top

III. Regulation of Cryptocurrencies as Financial Securities

It does not appear that digital assets are categorized as financial securities in Mauritius.[23]

Back to Top

IV. Treatment of Cryptoassets Not Considered Securities

Other than the warnings and guidance that the government has issued, it does not appear digital assets are currently regulated.  In 2017, the Bank of Mauritius issued a notice warning the public about the risks of investing in “’OneCoin’, a purported cryptocurrency.”[24]  In addition, in September 2018, the FSC issued a guidance note with the following three main points:

• Cryptocurrencies are not legal tender in Mauritius;
• Investments in digital assets and cryptocurrencies are unprotected by “any statutory compensation arrangements”; and
• Mauritius “recognises that Digital Assets including Cryptocurrencies may constitute an asset-class for investment” by “sophisticated investors”[25], “expert investors”[26], “expert funds”[27], “specialized collective investment schemes”[28] and “professional collective investment schemes.”[29]

Back to Top

V. Distinctions in Treatment of Different Categories of Cryptocurrencies

The Rules do not appear to make distinctions between different forms of cryptocurrencies.  This is evident in the seemingly sweeping definition of the term “digital assets” that the Rules have adopted (see part I, above).  In addition, the Rules require that custodians adopt “digital asset agnostic systems and procedure,” stating that

[t]he systems and procedures of a custodian shall be digital asset-agnostic and shall ensure the same level of regulatory compliance relating to the safekeeping, transaction management and custody operations of every digital asset type, irrespective of wallet functionality protocol.[30]

The term digital asset agnostic is defined as “the ability of the system and procedures of the custodian to operate properly irrespective of the type of digital assets kept in custody.”[31]

Back to Top

Prepared by Hanibal Goitom
Chief, Foreign, Comparative, and International Law Division I
April 2019

---

Back to Top

Last Updated: 12/30/2020