AML/CFT Compliance for Mauritian Companies

AML/CFT compliance in Mauritius is the set of rules that stops companies from being used to launder money or finance terrorism. If you own or manage a Mauritian company, you meet these rules from two directions: duties that fall on the company and its owners, and duties that fall on the professionals who serve it. Most confusion comes from mixing the two.

This page maps both sides. It covers the legal base, the beneficial ownership obligations that every company carries, the programme that a regulated provider must run (risk assessment, compliance officer, records, reporting, training), and what you can expect when you onboard with a provider. It is general information, not advice: how the rules apply to your structure depends on your facts and should be confirmed with an adviser.

The legal base: FIAMLA and the Companies Act

The core statute is the Financial Intelligence and Anti-Money Laundering Act, known as FIAMLA (Act 6/2002), in force since 10 June 2002. The consolidated version published by the Financial Intelligence Unit (FIU) in 2026 incorporates Act No. 3 of 2026. FIAMLA creates the offence of money laundering, sets the duties of "reporting persons", and gives the FIU its role as the national centre receiving and analysing suspicious transaction reports.

Two further layers matter for companies:

• The Companies Act 2001, which requires every company to identify and record its beneficial owner (section 91 and related provisions) and to keep that information accurate and available.
• The Financial Services Act, which sets out what a registered agent of an Authorised Company must do, including AML/CFT measures.

For a plain-language walk through the legislation itself, see AML/CFT legislation explained for business owners — a companion to this overview.

Who carries which duty

The most useful starting point is a split of responsibilities. An ordinary operating company is not, in itself, a "reporting person" in the way a corporate service provider is. Yet the company is never a bystander: it must hold ownership information and cooperate with the provider's checks.

The provider side matters because, under FIAMLA, the Company Service Provider is one of the listed regulated professions, with the Registrar of Companies as its supervisory body. FIAMLA also treats acting as a formation agent as a company-service activity: assisting a third party to incorporate, register or set up a legal person, whether a company, a foundation, a limited liability partnership or another prescribed entity.

What the company itself must do: beneficial ownership

Every Mauritian company must, at all times, identify its beneficial owner and, where relevant, any nominee. The Companies Act (section 91(3A), as updated on 15 May 2026) says what the separate register must contain:

• the full name and residential address;
• the national identity card or passport number;
• the nationality;
• the holding structure that leads to the ultimate beneficial owner.

The beneficial owner is the natural person who ultimately owns or controls the company, or on whose behalf a transaction is carried out. Ownership or control can be direct or indirect: through shares above a prescribed percentage, voting rights, an ownership interest or control by other means. The earlier definition in section 91 used 25 % of voting rights, and the wording was reshaped by Act 10/2024 (Government Gazette No. 77 of 25 July 2024). Do not rely on a single percentage when you analyse a structure: control "by other means" can make someone a beneficial owner even below a share threshold. The page on who counts as a beneficial owner in Mauritius works through typical cases.

Evidence, updates and access

The company must keep a record of the steps it took to identify the beneficial owner. These steps include a written declaration from the beneficial owner. The beneficial owner, for their part, must tell the company about any change in status. The company then has to make sure that any register or information about beneficial owners is accurate, up to date and available to the competent authorities without delay when they ask.

A company that existed before these provisions took effect (Finance Act 2025, Act No. 18 of 2025, Government Gazette No. 66 of 9 August 2025) had until 30 June 2026 to comply. If your company falls in that group and you have not yet documented the position, treat it as an overdue item rather than a future one.

The Registrar's register

Separately, the Registrar of Companies keeps a Beneficial Ownership Register. It is open to all competent authorities and to other prescribed public authorities. The Companies Act does not describe it as a public register, so you should not assume that a third party can search it. Practical guidance on keeping your own register is in the beneficial ownership register guide.

What a provider must run: the AML/CFT programme

A regulated provider is expected to run a written programme proportionate to its size and risk. The building blocks are the same across the sector, and understanding them helps you judge whether a provider is serious.

Business risk assessment

The risk-based approach is the organising idea of the whole regime. The provider first assesses its own business risk (its client base, the countries it deals with, the products and the channels it uses), then rates each client. The result decides how deep the due diligence goes. A holding company with a clear commercial purpose and transparent owners is treated differently from a layered structure with unexplained links. For the method, read the business risk assessment guide.

Customer due diligence

At onboarding, the provider identifies and verifies the client, understands the purpose of the relationship and establishes who is behind the company. For corporate clients that means documents on incorporation, the register of shareholders, the directors, and proof of identity and address for each beneficial owner. Higher-risk cases call for more: the origin of the funds, the origin of the wealth, and a plausible explanation of the structure.

Clients are sometimes surprised by the volume of paperwork. It is not a sign of distrust; it is the provider meeting a legal duty that it cannot waive. A ready-made KYC checklist for corporate clients shows what is normally requested, so you can prepare it before the first call.

The registered agent of an Authorised Company

An Authorised Company must always have a registered agent in Mauritius, and that agent must be an FSC-licensed corporate service provider (Management Licence). Under article 71A(8) of the Financial Services Act, the agent's tasks include filing the returns and documents required by the Financial Services Act, the Income Tax Act or the Companies Act, relaying communications with the FSC, the MRA and the Registrar, carrying out AML/CFT measures, and keeping the records: minutes, resolutions and transaction documents.

In other words, for this kind of company the AML/CFT burden is concentrated in the agent. That does not remove the owners' duty to supply honest, complete and timely information.

The MLRO: the person who owns the programme

A Money Laundering Reporting Officer (MLRO) is the senior individual in a reporting person who receives internal reports of suspicion, decides whether they warrant an external report, and answers to the regulator for how the programme works. A deputy covers absences. The role cannot be a name on paper: the officer needs seniority, access to client files and independence from the commercial pressure to keep a client.

For a company that is not itself a reporting person, you generally do not appoint an MLRO. If your group runs its own regulated activity, however, the position changes, and it is worth asking an adviser whether FIAMLA applies to you directly. The page on the Money Laundering Reporting Officer role and appointment explains who qualifies and what the MLRO signs off.

Suspicious transaction reporting

When an employee of a provider suspects that funds are linked to crime or terrorist financing, they report internally to the MLRO. If the MLRO shares the suspicion, a report goes to the FIU, using the FIU's electronic reporting system (goAML). Two points deserve attention:

1. Reporting is not optional once suspicion exists. Good faith reporting in the manner the law prescribes is protected, while failing to report is an offence.
2. Tipping off is prohibited. The provider may not tell the client that a report has been made or that an investigation is under way. If your provider suddenly slows a transaction without a full explanation, this may be the reason.

Read suspicious transaction reports in Mauritius for the triggers and the content of a report.

Records: what is kept and why

AML/CFT records serve two purposes. They let the provider prove that it did its checks, and they let the authorities reconstruct a transaction if they need to. The legislation prescribes a minimum retention period that runs from the end of the relationship or the date of the transaction; check the current text or ask your provider for its schedule rather than relying on an informal figure.

In practice, expect the following to be kept:

• identification documents and evidence of verification;
• the risk rating and the reasons behind it;
• records of transactions and the supporting documents;
• internal and external suspicion reports and the MLRO's decisions;
• training logs and audit reports.

The company has its own, separate record duty. Besides the beneficial ownership register, it keeps its statutory registers and board records. Late or missing filings can also attract separate penalties: for example, a change of director or secretary must be notified to the Registrar within 28 days, and failure is an offence carrying a fine of up to Rs 200 000 for each director and the secretary (Companies Act, section 142). That rule is outside AML/CFT strictly speaking, but it shows why clean corporate records support clean AML files.

Training and independent audit

A programme that exists only on paper fails the first inspection. Staff need regular training adapted to their role, and the programme itself should be tested by someone who does not run it. The scope, frequency and reporting line for training and audit are developed in AML/CFT training and independent audit.

Penalties and supervision

Non-compliance can lead to criminal liability for individuals, administrative sanctions on firms and, for a licensed provider, regulatory action up to the licence itself. Reputational damage often costs more than the sanction, because banks and counterparties react quickly. For the structure of sanctions, see penalties for failing anti-money laundering duties.

Choosing a provider with a credible AML/CFT culture

Some signs suggest that a provider takes the matter seriously:

• it explains in advance which documents it needs and why;
• it can name the MLRO function and describe the escalation route;
• it applies the same rules to every client, including long-standing ones;
• it does not promise to "skip" due diligence or to speed it up for a fee;
• it asks about the real activity of the company, not only its legal form.

Be wary of a provider that treats AML questions as an irritation. When an AML file is thin, the weak point can end up being your own account or your own licence application. The page on how to choose a corporate services provider in Mauritius gives the wider selection criteria.

Fees and procedures change from year to year, and some obligations differ between a domestic company, a company holding a Global Business Licence and an Authorised Company. The legal differences are real: a Global Business Company must be managed and controlled from Mauritius and administered by an FSC-licensed corporate service provider (Management Licence), whereas an Authorised Company has its central management and control outside Mauritius and a Mauritian registered agent. If you want your own structure reviewed, you can send a request through the contact form.

Practical checklist for the year

• Confirm who the beneficial owners are and update the company's register after any change
• Keep the beneficial owners' written declarations on file
• Collect identity, address and structure documents before onboarding or renewal
• Ask your provider when your risk rating was last reviewed
• Respond to due diligence requests within the time the provider gives you
• Notify directors and secretary changes to the Registrar within the statutory deadline
• Keep minutes, resolutions and transaction support in an organised file
• Do not discuss any internal suspicion report with the client or third parties