MauritiusFinancial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.fscmauritius.org/media/101852/annex-1-128_the-financial-services-robotic-and-artificial-intelligence-enabled-advisory-services-r…In force since .
An AI sector rules rule binding private bodies.
- Enforcement body
- Financial Services Commission of Mauritius
- Instrument type
- a regulation made under an act
- Obligation class
- Licensing, Governance, Disclosure, Reporting
- Audit expectation
- periodic
- Who audits it
- Independent third party
- Where the report goes
- Filed with regulator
As of .
What it requires
- It reaches you if you provide digital and personalized advisory services through a computer program or artificial intelligence enabled algorithms with limited human intervention, which the Rules call Robotic and Artificial Intelligence Enabled Advisory Services: do not carry out those services without a Robotic and Artificial Intelligence Enabled Advisory Services licence issued by the Financial Services Commission of Mauritius, and apply for it in accordance with Part IV of the Financial Services Act (clauses 2, 3 and 4). A person already carrying out the services when the Rules began had to apply within 3 months of commencement (clause 14).
- At all times keep your principal bank account in Mauritius, an office and relevant infrastructure in Mauritius, adequate internal controls, risk management (including cyber risk management) and governance policies and procedures, a business continuity and disaster recovery plan, a board of at least three directors with one independent director resident in Mauritius, an adequate number of competent officers, and a code of conduct and ethics that binds your officers (clause 5(1)).
- Preserve the integrity and privacy of clients' information in conformity with the applicable Data Protection Laws of Mauritius, and where clients' information is stored and processed through cloud computing facilities for analytics, keep it under adequate security and access controls, accessible to you at all times and to the Commission on request (clause 5(1)(e) and (2)).
- Maintain at all times a minimum unimpaired stated capital of MUR 600,000 or its equivalent in a foreign currency, and a professional indemnity insurance policy for at least MUR 2 million or a higher amount the Commission may determine (clauses 6 and 7).
- Keep clients' funds separate from your own, in an account with a duly licensed bank (clause 8).
- Conduct due diligence on your clients under the Financial Intelligence and Anti-Money Laundering Act, the Financial Intelligence and Anti-Money Laundering Regulations 2018 or similar regulations, and the United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act, and make sure any investment advice given through your platform is suitable for the client after assessing the client's needs, objectives, financial situation and, to the extent relevant, risk tolerance, knowledge, experience and understanding of the risks involved (clause 9).
- Through your board, keep adequate policies, processes and controls so that your algorithms continue to perform as intended, a robust framework for designing, monitoring and testing them through periodic and random reviews, and competent officers to develop and review their methodologies even if that work is outsourced; do not outsource the key processes and management of your client-facing tools (clause 10).
- Give clients clear, fair and non-misleading information about your services, products, suitability method and risks, and disclose in writing any actual or potential conflict of interest (clause 11(1) and (2)).
- Enter into a service-level agreement with each client before providing any services, stating any exclusivity agreements and the conditions or triggers that can discontinue the service and allow human judgment to be used or to replace it; display the Commission's notice that it does not vouch for the correctness of information on your robotic or artificial intelligence interface and that clients are not protected by statutory compensation arrangements in Mauritius, in the agreement, on your website and on your platform; and obtain each client's written confirmation, before providing services, that the client understands the scope, nature, risks and limitations of the advisory services (clause 11(3) to (6)).
- Keep, in addition to the records required by section 29 of the Financial Services Act, a copy of the advice given and the output of the investment, the client information relied on to generate the advice, and details of all algorithms and software you use (clause 12).
- Submit audited financial statements for every financial year, and independent evaluation reports on your algorithms and software systems to the Commission at least once every two years from the date of your license and after any material change, seeking the Commission's prior approval before appointing the independent persons or experts (clause 13).
If you get it wrong
Criminal exposureYes
Criminal exposure note
Clause 14(2) of the Rules provides that a person who was carrying out the services immediately before the Rules began and fails to apply for a license within 3 months of commencement commits an offence under section 14 of the Financial Services Act.
What this law does
Government Notice 128 of 2021 contains rules made by the Financial Services Commission under section 93 of the Financial Services Act. The Rules may be cited as the Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021. The Rules came into operation on , and the Commission made them on that day. The Rules apply to a person holding a Robotic and Artificial Intelligence Enabled Advisory Services licence issued under the Act.
The Rules define Robotic and Artificial Intelligence Enabled Advisory Services as the provision of digital and personalized advisory services through a computer program or artificial intelligence enabled algorithms with limited human intervention. No person may carry out those services without a Robotic and Artificial Intelligence Enabled Advisory Services licence issued by the Commission.
An application for a Robotic and Artificial Intelligence Enabled Advisory Services licence is made in accordance with Part IV of the Financial Services Act. A person already carrying out the services in Mauritius when the Rules began had to apply for a Robotic and Artificial Intelligence Enabled Advisory Services licence within 3 months of commencement, and a person who fails to apply in that time commits an offence under section 14 of the Financial Services Act.
A licensee must at all times have its principal bank account in Mauritius, establish an office and relevant infrastructure in Mauritius for its services, implement adequate internal controls, risk management including cyber risk management and governance policies and procedures, and put in place a business continuity and disaster recovery plan.
A licensee must at all times preserve the integrity and privacy of its clients' information in conformity with the applicable Data Protection Laws of Mauritius, be managed by a board of at least three directors including an independent director resident in Mauritius, employ an adequate number of competent officers, and have a code of conduct and ethics that binds its officers.
Where clients' information is stored and processed through cloud computing facilities for analytics, a licensee must ensure it is maintained with adequate security and access controls and is accessible to the licensee at all times and to the Commission on request.
With the Commission's approval, a licensee may collect limited information on the financial situation of clients if it demonstrates that its advisory services are fully automated with no human intervention in the advisory process, that the limited information does not compromise the adequacy and quality of its advisory services, and that appropriate control mechanisms, including pop-up boxes and back-end data analysis, identify and follow up inconsistent client responses.
A licensee must at all times maintain a minimum unimpaired stated capital of MUR 600,000 or its equivalent in a foreign currency. A licensee must subscribe to a professional indemnity insurance policy that indemnifies the company, its employees and any person acting on its behalf against liability of at least MUR 2 million, or a higher amount the Commission may determine, for any act, error or omission in the conduct of the advisory services.
A licensee must keep clients' funds separate from its own funds, in an account with a duly licensed bank. A licensee must conduct appropriate due diligence on its clients in accordance with the Financial Intelligence and Anti-Money Laundering Act, the Financial Intelligence and Anti-Money Laundering Regulations 2018 or similar regulations, and the United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act.
A licensee must ensure that any investment advice given through its platform is suitable for the client, by assessing the client's needs, objectives and financial situation and, to the extent relevant, the client's risk tolerance, knowledge, experience and understanding of the risks involved.
The board of directors of a licensee is responsible for ensuring that the licensee has at all times adequate policies, processes and controls so that its algorithms continue to perform as intended, a robust framework for designing, monitoring and testing the algorithms through periodic and random reviews, and competent officers for developing and reviewing the methodologies of the algorithms, even if those functions are outsourced.
A licensee must not outsource the key processes and management of its client-facing tools. A licensee must give clients clear, fair and non-misleading information about the nature and scope of its services, including the types of products, how it determines whether they suit the client's investment objective, and the risks involved.
A licensee must disclose in writing to its clients any actual or potential conflict of interest arising from any connection to or association with a product provider, including any material information or facts that may compromise its objectivity or independence. A licensee must enter into a service-level agreement with its clients before providing any services to them.
The service-level agreement must state any exclusivity agreements the licensee has with a particular financial services provider and the specific conditions or triggers that can result in discontinuing its services and possibly using or replacing human judgment.
A licensee must display prominently in its service-level agreement, on its website and on its platform a notice that the Commission does not vouch for the correctness of any information or statements published by the licensee on its robotic or artificial intelligence interface or platform, and that clients are not protected by any statutory compensation arrangements in Mauritius if the company fails.
Before providing any services, a licensee must obtain written confirmation from its clients that they understand the scope and nature of the advisory services together with the associated risks and limitations.
In addition to the requirements of section 29 of the Financial Services Act, a licensee must keep a copy of the advice given through the services and the output of the investment, the information received from the client that it relied on to generate the advice, and details of all algorithms and software it uses. A licensee must submit its audited financial statement for every financial year in accordance with section 30 of the Financial Services Act.
A licensee must submit independent evaluation reports on its algorithms and software systems to the Commission at least once every two years from the date of its license and after any material change, and must seek the Commission's prior approval before appointing the independent persons or experts who carry them out.
When LexLint raises it
When your app profile says your app provides financial services or makes high-risk automated decisions.