Mauritius: technology regulation at a glance

Framework: Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS Act), in force 7 February 2022, supervised by the Financial Services Commission (FSC). The Bank of Mauritius governs payment/legal-tender status.

Crypto is legal in Mauritius and comprehensively regulated under the VAITOS Act 2021, which entered into force on 7 February 2022. The FSC licenses five classes of Virtual Asset Service Providers (VASPs) — brokerage, wallet, custody, advisory and marketplace — and separately registers Initial Token Offering (ITO) issuers, with detailed AML/CFT, capital, custody, cyber and disclosure rules. Cryptocurrencies are not legal tender (Bank of Mauritius public notice), but are recognised as having value.

Framework: National AI Strategy 2025-2029 ('AI for Mauritius'/AIM) and FAIR Guidelines, supported by FSC Fintech Series Guidance Notes No. 4 (September 2025) and the Data Protection Act 2017

Mauritius has no comprehensive AI law in force and no AI bill formally tabled in parliament as of May 2026. Its primary AI governance instruments are the National AI Strategy 2025-2029 and FAIR Guidelines, both voluntary frameworks launched on 9 April 2026, built around the pillars of Fairness, Accountability, Inclusiveness, and Integrity. Binding AI-specific rules exist only in a narrow financial-services niche (FSC Robo-Advisory Rules 2021 and FSC Guidance Notes September 2025), while the Data Protection Act 2017 applies to AI-driven personal-data processing.

Framework: Data Protection Act 2017 (Act 20/2017), supervised by the Data Protection Office under the Data Protection Commissioner

Mauritius has a comprehensive, GDPR-aligned personal data protection regime under the Data Protection Act 2017, which entered into force on 15 January 2018 and supersedes the Data Protection Act 2004. The independent Data Protection Office (DPO), headed by the Data Protection Commissioner, is the supervisory authority with broad investigatory, audit, and enforcement powers. The government's Digital Transformation Blueprint 2025-2029 signals forthcoming reforms to deepen alignment with the EU GDPR, including a new Data Management Office and updated online-privacy regulations.

Framework: National Payment Systems Act 2018 and the National Payment Systems (Authorisation and Licensing) Regulations 2021, administered by the Bank of Mauritius (BoM)

Mauritius operates a dedicated, in-force licensing regime for digital payments and e-money. The Bank of Mauritius licenses payment service providers (including payment initiation, account information, money remittance) and electronic money issuers under the National Payment Systems Act 2018, with the implementing Regulations operational since 1 June 2021. Instant payments run over the BoM's MauCAS national switch, while open banking and BNPL remain at an early/exploratory stage with no dedicated rules yet.

Framework: Mauritius Premium Visa (Economic Development Board Act / Immigration Act), administered by the Economic Development Board (EDB) and the Passport and Immigration Office (Ministry of Foreign Affairs, Regional Integration and International Trade)

Mauritius launched a dedicated Premium Visa in October 2020 specifically for remote workers, digital nomads, retirees, and long-stay visitors wishing to live and work from the island. It is a 1-year, multi-entry, renewable visa requiring proof of foreign-sourced income of at least USD 1,500/month. Longer-term pathways exist via a Self-Employed Occupation Permit (10 years) and a Permanent Residence Permit (20 years) for those willing to invest.

Framework: Information and Communication Technologies Act 2001 (as amended); Cybersecurity and Cybercrime Act 2021; ICTA (Information and Communication Technologies Authority)

Mauritius regulates online content through a patchwork of laws rather than a single comprehensive online-safety statute. The ICT Act 2001 (Section 46, amended 2018) criminalises sharing offensive, false or harmful online messages with penalties up to 10 years' imprisonment, while the Cybersecurity and Cybercrime Act 2021 replaced the 2003 Computer Misuse Act and established CERT-MU. The ICTA holds administrative powers to block illegal and harmful internet content, which it controversially exercised in November 2024 to impose a short-lived social-media ban ahead of general elections.

Framework: Cybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021), supplemented by the Data Protection Act 2017 (Act No. 20 of 2017); administered by ICTA, CERT-MU, and the Data Protection Commissioner

Mauritius enacted a comprehensive Cybersecurity and Cybercrime Act in 2021, replacing the earlier Computer Misuse and Cybercrime Act 2003, establishing a National Cybersecurity Committee, a Critical Information Infrastructure (CII) protection regime, and mandatory annual security audits for designated CII operators. The Data Protection Act 2017 runs in parallel, requiring 72-hour breach notification to the Data Protection Commissioner for personal data incidents. Mauritius also operates an active National Cybersecurity Strategy 2023-2026 and a government-run CERT (CERT-MU).

Framework: Companies Act 2001 and Business Registration Act 2002, administered by the Corporate and Business Registration Department (CBRD); foreign investment facilitated by the Economic Development Board (EDB) under EDB Act 2017

Mauritius permits 100% foreign ownership in most sectors with no statutory minimum share capital for incorporation. Company registration is conducted fully online via the CBRIS platform and typically completed within half a day to three working days. The EDB serves as a single-window gateway for foreign investors, and the country is consistently ranked among Africa's most open business environments.