AML/CFT Training and Independent Audit

AML cft training Mauritius is often treated as a box to tick once a year. In practice it is one of the first things a supervisor or an auditor looks at, because people, not policies, are what spot an odd instruction from a client. Together with an independent audit, training is how a business shows that its anti-money laundering and counter-terrorism financing (AML/CFT) rules are applied and not merely written down.

This page covers the two controls that sit around the day-to-day programme: teaching staff what to look for, and having someone independent test whether the programme works. The wider framework is described in AML/CFT compliance for Mauritian companies.

Where the duties come from

The anti-money laundering law of Mauritius is the Financial Intelligence and Anti-Money Laundering Act (FIAMLA), Act 6/2002, in force since 10 June 2002. The consolidated version published by the Financial Intelligence Unit (FIU) in 2026 incorporates Act No. 3 of 2026. That Act amended Part IV of the FIAMLA, which contains the measures against money laundering, terrorism financing and proliferation financing, with effect from 18 April 2026. The changes touched, among other things, suspicious transaction reporting and risk assessment.

The FIU itself is established by section 9 of the FIAMLA, and section 10 lists its functions. For a plain-English walk through the statute, see AML/CFT legislation explained for business owners.

Training and audit are not stand-alone obligations floating free of the rest. They belong to the internal controls a reporting person must maintain, alongside the business risk assessment, customer due diligence and reporting. The exact wording and the level of detail expected come from the Act, the regulations and the guidelines issued by the relevant supervisor, so read those for your own sector before settling a programme. Our page on reading the AML/CFT guidelines and handbook explains how to approach them.

Who has to train and audit

The obligations fall on "reporting persons", that is, the professions and businesses listed in the FIAMLA schedule. For readers of this site the most relevant entries are:

• the company service provider, with the Registrar of Companies as its regulatory body (schedule, row 12);
• accountants, law firms, lawyers, notaries and real estate agents;
• casinos supervised by the Gambling Regulatory Authority;
• dealers in jewellery and precious metals.

For FIAMLA purposes, company service provider activities include acting as a formation agent for a legal person (a company, foundation, limited liability partnership or other prescribed entity) that helps a third party to incorporate, register or set it up. Where a licensed firm acts for your company, the firm is a reporting person in its own right; your company may or may not be one, depending on what it does.

That distinction matters. An ordinary trading company that is not itself a reporting person is not normally expected to run an internal AML audit, but it will still be on the receiving end of the due diligence its providers carry out. Our guide on the KYC checklist for corporate clients shows what such providers will ask you for.

For a company that uses a registered agent, note that the agent's duties include AML/CFT measures and the keeping of records such as minutes, resolutions and transaction documents (section 71A(8) of the Financial Services Act, for an Authorised Company). This is a duty of the agent, not a reason for the company to stop looking at its own records.

Staff training: what it should achieve

The purpose of training is simple: every person whose work could expose the business to money laundering or terrorism financing should recognise a warning sign and know what to do next. The role of the Money Laundering Reporting Officer is covered separately in Money Laundering Reporting Officer: role and appointment; here the focus is on everyone else.

Who should be trained

Do not limit training to compliance staff. A sensible scope covers:

• directors and senior managers, who carry responsibility for the programme;
• client-facing and onboarding staff, who collect identity documents and explain the structure of a client;
• finance and operations staff, who see payments and unusual patterns;
• new joiners, before they handle client files;
• anyone covering a role temporarily.

What the content should cover

Content should be tied to the business's own risks rather than copied from a generic course. The starting point is the firm's business risk assessment for AML purposes: the higher the risk it identifies, the more specific the training should be on that risk.

Typical topics include:

• the offences of money laundering and terrorism financing and the personal exposure of staff;
• customer due diligence, beneficial ownership and the handling of politically exposed persons;
• sanctions and how lists are checked;
• red flags in transactions and in client behaviour;
• the internal escalation route and the rule against tipping off;
• how and when a suspicion becomes a report to the FIU.

On reporting, the FIAMLA is explicit that a reporting person or an auditor must report a suspicious transaction to the FIU as soon as they become aware of it, and no later than 5 working days after the suspicion arises (section 14). Failing to report within that period is an offence which, on conviction, carries a fine of up to Rs 1 million and imprisonment of up to 5 years (section 14(3)). Staff should hear this figure in training, because it explains why a doubt must be escalated the same day rather than parked. The mechanics are set out in suspicious transaction reports in Mauritius and registering with the FIU and using goAML.

The FIAMLA also provides that the FIU gives general feedback to reporting persons and supervisors on their reporting obligations (section 14(1A)-(1B)). Bringing that feedback into the next training cycle is a practical way to keep content current.

Rhythm and format

The law and the guidelines of your supervisor determine any set frequency, so check them rather than relying on a rule of thumb. What is common to every well-run programme is:

• induction training before a new person starts client work;
• refresher sessions at regular intervals, plus ad hoc updates when the law, the risk assessment or a typology changes;
• a mix of formats, since a short case discussion often sticks better than a slide deck;
• a short test or case exercise, so that completion is not confused with understanding.

Since Part IV of the FIAMLA was amended in 2026, programmes written before that change deserve a review against the consolidated text.

Keeping evidence of training

If you cannot prove that training took place, a supervisor will treat it as if it did not. Keep a simple training file:

Retention periods for these records follow the legislation and your own record-keeping policy; see company records: what to keep and for how long for the general approach.

The independent AML/CFT audit

Training teaches people the rules. The independent audit asks a different question: does the whole programme work, and is it applied in practice? The auditor tests the programme from outside the day-to-day function, which is why independence is the key word.

What independence means

The person or firm carrying out the audit should not be the one that designed, runs or is paid to defend the programme. In a small firm this is the hardest condition to meet. Depending on size and risk, an external reviewer may be the more credible choice; whether an internal audit function is acceptable is a question to settle against your supervisor's guidance and, where in doubt, with an adviser.

What an audit usually examines

An AML/CFT audit does not repeat the whole compliance function. It samples and tests. Typical work includes:

1. reading the written policies and procedures against the current law and the risk assessment;
2. testing a sample of client files for due diligence, beneficial ownership information and ongoing monitoring;
3. checking how internal reports were escalated and whether any suspicious transaction report was filed within the statutory deadline;
4. reviewing screening for sanctions and politically exposed persons;
5. checking the training file described above;
6. reporting findings, ranked by seriousness, with recommendations and a response from management.

Training versus audit at a glance

After the audit: acting on findings

An audit report that sits in a drawer is worse than none, because it documents known weaknesses. Management should:

• assign an owner and a target date to each finding;
• reflect serious findings in the next risk assessment;
• feed lessons into the next training session;
• keep the report, the response and the proof of closure together.

The consequences of leaving gaps open are described in penalties for failing anti-money laundering duties.

A short checklist

• Confirm whether your business is a reporting person under the FIAMLA schedule
• Identify which supervisor's guidance sets your training and audit expectations
• Map every role that touches clients or payments to a training module
• Tie the training content to the current business risk assessment
• Brief staff on the reporting deadline and the offence for missing it
• Keep an attendance log, course material and test results
• Choose an auditor who is independent of the compliance function
• Record management's response and the closure of each finding

Where to get help

Whether a company needs its own audit, and how often, depends on its activity, its size and the supervisor that regulates it. If you are unsure, send a request through the contact form and it will be passed to an FSC-licensed corporate service provider (Management Licence) for an assessment of your situation. This page is general information, not advice.