AML/CFT Legislation Explained for Business Owners

If you run a company in Mauritius, you will hear the phrase "AML/CFT Act" in conversations with banks, auditors and service providers. There is no single statute with exactly that title. The AML/CFT Act in Mauritius is the shorthand most people use for the Financial Intelligence and Anti-Money Laundering Act (FIAMLA), Act 6/2002, which has been in force since 10 June 2002. Searches for the "FIAMLA Act Mauritius" lead to the same text.

This page gives a plain-English map of that law: what it is for, who has to comply, what the main duties look like and how breaches are handled. It is general information, not advice. Whether a given duty applies to your company depends on what it does and who it deals with, so that point needs a professional's analysis.

What the FIAMLA is and where it stands today

The FIAMLA is the backbone of Mauritius's framework against money laundering, terrorist financing and the financing of proliferation. It does three broad things:

• it creates the Financial Intelligence Unit (FIU), established by section 9, with its functions listed in section 10;
• it sets preventive duties for businesses and professions that are exposed to misuse, mainly in Part IV;
• it creates offences and sanctions for those who fail to meet those duties.

The FIU publishes a consolidated version of the Act, updated in 2026. That version incorporates Act No. 3 of 2026, which amended Part IV (the measures against money laundering, terrorist financing and proliferation) with effect from 18 April 2026. The amendments touch, among other things, the duty to report suspicious transactions and the risk assessment obligation. When you read older commentary, check it against the consolidated text.

Who the Act applies to

The Act does not target every company in the same way. It places its heaviest duties on "reporting persons": businesses and professions listed in its schedule. Your own company may fall into that list, or it may simply be a customer of one that does. The distinction matters because a bank, a lawyer or a corporate service provider will ask your company for identity and ownership documents precisely because the Act obliges them to.

The listed activities include:

• Company service providers. The Registrar of Companies is the regulatory body for this profession. The Act's wording covers, for example, acting as a formation agent for a legal person (a company, a foundation, a limited liability partnership or another prescribed entity) that a third party wants to incorporate, register or set up.
• Professionals. Accountants, law firms, lawyers, notaries and estate agents are covered, with regulation shared among bodies such as the FIU and the Mauritius Institute of Professional Accountants.
• Casinos and dealers. Casinos under the Gambling Regulatory Authority and dealers in jewellery and precious metals are included.

Auditors have their own reporting duty under the Act as well. For the question of how a corporate service provider is licensed and supervised, see the licensing material elsewhere; this page stays on the substantive law.

What this means for an ordinary operating company

A trading company that is not itself a reporting person still feels the Act in three ways. It is asked for customer due diligence documents by its bank, advisers and some suppliers. It must hold accurate information on its own beneficial owners. And its directors and staff can commit offences if they knowingly help a transaction under a false identity or tip someone off about a report.

Legal persons are inside the scope too. The consolidated FIAMLA includes a foundation in its definition of a legal person and names the Registrar of Foundations among the relevant authorities, so beneficial ownership transparency applies to foundations as well as to companies.

The core duties in plain English

Part IV can look dense. Most of it reduces to a handful of ideas.

Customer due diligence

Section 17C requires due diligence when an account or business relationship is opened. For an occasional customer, it applies to a transaction of Rs 500 000, or the equivalent in foreign currency (or the prescribed amount), whether single or linked, and to any domestic or cross-border wire transfer. The practical content is covered in the KYC checklist for corporate clients: who the customer is, who owns and controls it, and what it expects from the relationship.

Higher-risk jurisdictions

Under section 17H, the Minister may, on the recommendation of the National Committee, designate as high risk a jurisdiction that the Financial Action Task Force has identified as having strategic deficiencies. Enhanced due diligence then applies to transactions involving that country. This is why a customer's links to a listed country can change the paperwork a bank requests, even when nothing else about the business has changed.

Cash reports and prohibited accounts

Section 17G requires a reporting person to send the FIU a report on any cash transaction that reaches the prescribed amount, including linked transactions, within the prescribed time and in the prescribed form. Section 17B bars fictitious and anonymous accounts altogether.

Records

Under section 17F, CDD records (identity documents of customers and beneficial owners) must be kept for at least 7 years after the business relationship ends. Transaction records must be kept for 7 years after the transaction, and copies of suspicious transaction reports for at least 7 years after filing. For the broader picture of what a company holds and for how long, see company records and retention.

Reporting suspicion to the FIU

The reporting duty is the part of the law most likely to affect day-to-day behaviour. Under section 14, a reporting person or an auditor who becomes aware of a suspicious transaction must report it to the FIU as soon as they know, and no later than 5 working days after the suspicion arose. The guide to suspicious transaction reports walks through what a good report contains, and the page on registering with the FIU and using goAML covers the filing channel.

Two points are often misunderstood:

• The test is suspicion, not proof. You do not need to establish that a crime took place. The role of the report is to hand the facts to the FIU, which analyses them.
• Silence about the report is mandatory. Telling a third party that a report is being or has been filed is the offence known as tipping-off. The Act allows one exception: compliance exchanges within a group that are protected by confidentiality safeguards.

The FIU also provides general feedback to reporting persons and supervisors on their reporting obligations (section 14(1A)-(1B)). That feedback is not case-specific, so it will not tell you what happened to a particular report.

Risk assessment and the compliance function

Since the 2026 amendments, the risk assessment obligation sits at the centre of Part IV. Rather than applying the same checks to everyone, a reporting person is expected to assess where its own business is exposed (customers, countries, products and delivery channels) and scale its controls accordingly. The page on business risk assessment for AML purposes explains how to build one.

In practice, a reporting person also needs someone responsible for the programme. The role is described in the Money Laundering Reporting Officer guide, and the broader compliance picture for a company is on the AML/CFT overview page.

Beneficial ownership and the registers

The FIAMLA works hand in hand with the Companies Act 2001. The Registrar of Companies keeps a Beneficial Ownership Register. According to the Companies Act as updated to 15 May 2026, it is open to all competent authorities and to other prescribed public authorities; the Act does not describe it as a public register. The CBRD has also published a guidance note on identifying beneficial owners under the Companies Act 2001, dated 5 October 2026. Its detailed content is not summarised here, so read it directly before relying on it.

For the mechanics of what a company must record and keep current, see the guide to the Beneficial Ownership Register.

What happens when duties are missed

The Act uses criminal penalties and administrative sanctions. The main ones are set out below.

Separately, a regulatory body that has reason to believe one of its members has breached the FIAMLA may impose an administrative sanction. It must first notify its intention and allow 21 days for written representations (section 19N). The page on penalties for failing anti-money laundering duties compares the routes in more detail.

These are ceilings set by the statute. The outcome in a real case depends on the facts, the conduct and the decision of the court or regulator.

A short orientation checklist

Use this as a conversation starter, not a compliance programme:

• Work out whether your company or its advisers are listed reporting persons
• Confirm who your beneficial owners are and that the information is up to date
• Keep CDD files and transaction records for the statutory period
• Know who decides whether a suspicion is reported, and how fast
• Brief staff that they must not disclose a report to the person concerned
• Review your exposure to any jurisdiction designated as high risk

If you want a tailored view of which duties apply to your structure, you can send a request through the site's form and it will be passed to an FSC-licensed corporate service provider (Management Licence).