Mauritius

Government Notice 128 of 2021 contains rules made by the Financial Services Commission under section 93 of the Financial Services Act. The Rules may be cited as the Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021. The Rules came into operation on June 12, 2021, and the Commission made them on that day. The Rules apply to a person holding a Robotic and Artificial Intelligence Enabled Advisory Services licence issued under the Act.

The Rules define Robotic and Artificial Intelligence Enabled Advisory Services as the provision of digital and personalized advisory services through a computer program or artificial intelligence enabled algorithms with limited human intervention. No person may carry out those services without a Robotic and Artificial Intelligence Enabled Advisory Services licence issued by the Commission.

An application for a Robotic and Artificial Intelligence Enabled Advisory Services licence is made in accordance with Part IV of the Financial Services Act. A person already carrying out the services in Mauritius when the Rules began had to apply for a Robotic and Artificial Intelligence Enabled Advisory Services licence within 3 months of commencement, and a person who fails to apply in that time commits an offence under section 14 of the Financial Services Act.

A licensee must at all times have its principal bank account in Mauritius, establish an office and relevant infrastructure in Mauritius for its services, implement adequate internal controls, risk management including cyber risk management and governance policies and procedures, and put in place a business continuity and disaster recovery plan.

A licensee must at all times preserve the integrity and privacy of its clients' information in conformity with the applicable Data Protection Laws of Mauritius, be managed by a board of at least three directors including an independent director resident in Mauritius, employ an adequate number of competent officers, and have a code of conduct and ethics that binds its officers.

Where clients' information is stored and processed through cloud computing facilities for analytics, a licensee must ensure it is maintained with adequate security and access controls and is accessible to the licensee at all times and to the Commission on request.

With the Commission's approval, a licensee may collect limited information on the financial situation of clients if it demonstrates that its advisory services are fully automated with no human intervention in the advisory process, that the limited information does not compromise the adequacy and quality of its advisory services, and that appropriate control mechanisms, including pop-up boxes and back-end data analysis, identify and follow up inconsistent client responses.

A licensee must at all times maintain a minimum unimpaired stated capital of MUR 600,000 or its equivalent in a foreign currency. A licensee must subscribe to a professional indemnity insurance policy that indemnifies the company, its employees and any person acting on its behalf against liability of at least MUR 2 million, or a higher amount the Commission may determine, for any act, error or omission in the conduct of the advisory services.

A licensee must keep clients' funds separate from its own funds, in an account with a duly licensed bank. A licensee must conduct appropriate due diligence on its clients in accordance with the Financial Intelligence and Anti-Money Laundering Act, the Financial Intelligence and Anti-Money Laundering Regulations 2018 or similar regulations, and the United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act.

A licensee must ensure that any investment advice given through its platform is suitable for the client, by assessing the client's needs, objectives and financial situation and, to the extent relevant, the client's risk tolerance, knowledge, experience and understanding of the risks involved.

The board of directors of a licensee is responsible for ensuring that the licensee has at all times adequate policies, processes and controls so that its algorithms continue to perform as intended, a robust framework for designing, monitoring and testing the algorithms through periodic and random reviews, and competent officers for developing and reviewing the methodologies of the algorithms, even if those functions are outsourced.

A licensee must not outsource the key processes and management of its client-facing tools. A licensee must give clients clear, fair and non-misleading information about the nature and scope of its services, including the types of products, how it determines whether they suit the client's investment objective, and the risks involved.

A licensee must disclose in writing to its clients any actual or potential conflict of interest arising from any connection to or association with a product provider, including any material information or facts that may compromise its objectivity or independence. A licensee must enter into a service-level agreement with its clients before providing any services to them.

The service-level agreement must state any exclusivity agreements the licensee has with a particular financial services provider and the specific conditions or triggers that can result in discontinuing its services and possibly using or replacing human judgment.

A licensee must display prominently in its service-level agreement, on its website and on its platform a notice that the Commission does not vouch for the correctness of any information or statements published by the licensee on its robotic or artificial intelligence interface or platform, and that clients are not protected by any statutory compensation arrangements in Mauritius if the company fails.

Before providing any services, a licensee must obtain written confirmation from its clients that they understand the scope and nature of the advisory services together with the associated risks and limitations.

In addition to the requirements of section 29 of the Financial Services Act, a licensee must keep a copy of the advice given through the services and the output of the investment, the information received from the client that it relied on to generate the advice, and details of all algorithms and software it uses. A licensee must submit its audited financial statement for every financial year in accordance with section 30 of the Financial Services Act.

A licensee must submit independent evaluation reports on its algorithms and software systems to the Commission at least once every two years from the date of its license and after any material change, and must seek the Commission's prior approval before appointing the independent persons or experts who carry them out.

A controller must notify the Commissioner of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, giving reasons for any later notification, and a processor must notify the controller without undue delay.

Where a breach is likely to result in a high risk to a data subject's rights and freedoms, the controller must also communicate it to the data subject without undue delay, unless the affected data was rendered unintelligible (for example by encryption), the risk has been neutralised by later measures, or individual communication would involve disproportionate effort and a public communication is made instead.

The Data Protection Act 2017 establishes the Data Protection Office, headed by the Data Protection Commissioner, and requires every controller or processor to process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose.

Processing must rest on one of a listed set of grounds, including the data subject's consent, contractual necessity, a legal obligation, or the controller's legitimate interests, and a contravention of this lawful-processing duty is itself an offence. No person may process the personal data of a child below 16 unless the child's parent or guardian has consented, and the controller must make a reasonable effort to verify that consent, taking into account available technology.

A controller or processor may transfer personal data to another country only where it has given the Commissioner proof of appropriate safeguards, the data subject has given explicit informed consent, the transfer is necessary for a contract or legal claim, or another listed condition applies. The Commissioner may require a person transferring data to demonstrate the effectiveness of its safeguards and may prohibit, suspend or condition a transfer to protect data subjects' rights.

Section 38 gives every data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, unless the decision is necessary for a contract with them, is authorized by a law with safeguards, or rests on their explicit consent. Any automated processing intended to evaluate personal aspects of an individual must not be based on special categories of personal data.

Where one of the three exceptions applies, the controller's information notice under section 23 must disclose that this kind of decision-making exists and what effects it is expected to have. Where the exception is the contract or the consent ground specifically, the controller must also implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests.

Every data subject has a right of access to their personal data, and a right to rectification, erasure or restriction of processing and to object to processing.

Regulation 3(1) requires every controller to designate a data protection officer from a staff member of the organisation. Where a controller designates more than one data protection officer, regulation 3(3) requires it to designate a lead data protection officer, who is the primary point of contact with the Office and the data subjects.

Regulation 3(4) requires the controller to communicate the officer's particulars to the Office within 14 days of the designation, and any change in them within 14 days of the change. Regulation 4 gives the officer tasks that include the protection of data subject rights and data protection impact assessment. Regulation 4 also requires the officer to report to the highest management level of the organisation.

Regulation 5 requires the officer to be designated on the basis of professional qualifications that include evidence of certification issued by the Office or by an accredited training institution the Office approves. Regulation 6 requires the controller to ensure that the officer carries out the officer's functions independently without unlawful interference. Regulation 6 also bars the controller from dismissing, suspending or otherwise penalising the officer for lawfully performing the duties.

Regulation 8(1) requires the controller to publish the officer's contact details at a conspicuous place on its premises or on its website. Contravening regulation 3(4) or 8(1) is an offence liable on conviction to a fine not exceeding 100,000 rupees and imprisonment not exceeding 5 years. The Minister made the regulations on 17 June 2026 under section 55 of the Data Protection Act. The regulations come into operation on 1 January 2027.

Where the Commissioner considers that a controller or processor has contravened, is contravening, or is about to contravene the Act, the Commissioner may serve an enforcement notice requiring specified steps within a specified period, with a right of appeal.

Unlawfully disclosing personal data outside the purpose for which it was collected, or without the controller's or processor's prior authority, is a separate offence, and any offence for which no specific penalty is provided, or any other contravention of the Act, carries a general penalty.

Special categories of personal data, defined to include racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, physical or mental health, sexual orientation, and genetic or biometric data uniquely identifying a person, may be processed only on a specific ground: the general lawful-processing test plus a not-for-profit body's legitimate activity with appropriate safeguards, data manifestly made public by the data subject, or necessity for a legal claim, healthcare, carrying out an obligation or exercising a right of the controller or the data subject, or protecting vital interests.

Health data processed for preventive or occupational medicine or healthcare must be handled by or under a person bound by professional secrecy.

Section 7 makes it an offence for a person to gain unauthorised access to any program or data held in a computer system, carrying a fine of up to 1,000,000 rupees and penal servitude of up to 10 years. Access is unauthorised where the person is not entitled to control access of that kind and has not been authorised by someone who is. A related offence, unauthorised modification of computer data under section 11, carries the same fine but penal servitude of up to 20 years.

The Act repealed and replaced the Computer Misuse and Cybercrime Act 2003, defining the unauthorised-access offence in substantially the same terms; because the trigger is unauthorised access rather than defeating a security measure, whether reading a public, unauthenticated page without any such access falls within the offence has not been tested by a Mauritian court.

Sections 16 to 22 permit reproduction or quotation of a work without the copyright owner's authorisation only within narrow bounds: private reproduction for personal use (excluding a database in digital form or a computer programme except as separately provided), quotation compatible with fair practice but only for caricature, parody or pastiche, utilisation for scientific research or teaching illustration, reprographic reproduction for face-to-face teaching or by libraries and archives, and reproduction or broadcasting of short excerpts for reporting current events.

There is no text-and-data-mining-specific exception. A person who, without authorisation, publishes, distributes, reproduces or communicates a work to the public for commercial gain commits an offence under section 56, liable on a first conviction to a fine not exceeding 300,000 rupees and imprisonment not exceeding 2 years, rising on a second or subsequent offence to a fine not exceeding 500,000 rupees and imprisonment not exceeding 8 years.

The Act protects a database only where it is original by reason of the selection or arrangement of its contents, as a compilation work, and confers no separate sui generis database right.

The Guideline applies to all financial institutions licensed or authorised by the Bank of Mauritius. The Guideline is issued under the authority of section 50 of the Bank of Mauritius Act 2004, section 100 of the Banking Act 2004 and section 17 of the National Payment Systems Act 2018. The Guideline came into effect on 29 May 2023.

Paragraph 5 makes the board responsible for reviewing and approving at least annually the technology strategy, the cyber and technology risk management strategy and framework and the related policies. Paragraph 74 requires the critical systems, services, infrastructures and other assets of a financial institution to be subject to vulnerability assessment by independent specialists on an annual basis.

Paragraph 81 requires penetration testing by independent specialists of internet-facing systems and critical infrastructure immediately after deployment or major changes and annually thereafter. Paragraph 102 required financial institutions to take the measures necessary to comply fully with all provisions of the Guideline by the end of June 2024.

Section 100(4) of the Banking Act 2004 makes it an offence to fail to comply with guidelines or instructions made under that section, punishable on conviction by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 2 years.

Regulation 4(1) lets the National Cybersecurity Committee, in consultation with the regulatory body, designate a system as a critical information infrastructure in accordance with the criteria in section 33(2) of the Cybersecurity and Cybercrime Act 2021. The Committee must give public notice of a designation by notice published in the Gazette.

Regulation 5 requires every owner of a designated critical information infrastructure to comply with the directions of the regulatory body under section 34 of the Act. Regulation 6 bars anyone other than a person authorised in writing by the regulatory authority from access to information about a critical information infrastructure, including its architecture, vulnerability and security aspects. The Committee must review each designation every 3 years and may then maintain or revoke it.

An owner who fails to comply with the regulations commits an offence liable on conviction to a fine not exceeding 100,000 rupees and imprisonment not exceeding 5 years. Regulation 9 gives every owner of a critical information infrastructure 12 months from the coming into operation of the regulations to comply. The regulations were published in Government Gazette of Mauritius No. 45 of 20 June 2026. They come into operation on 1 June 2026.

Section 33(1) of the Cybersecurity and Cybercrime Act 2021 lets the National Cybersecurity Committee, after consulting the regulatory authority in control of an information infrastructure identified as a potential critical information infrastructure, identify the information structures that need to be declared critical information infrastructures.

Section 33(2) selects a system as a critical information infrastructure if a disruption of the system or its data would interrupt a life sustaining service such as the supply of water, health services and energy, have an important effect on the economy, cause massive casualties or fatalities, or cause failure or substantial disruption of the money market.

Section 34 requires the regulatory authority of a critical information infrastructure, in consultation with the Committee, to direct the owner to assess the threats, vulnerabilities, risks and probability of a cyber-attack on it. Section 34 also has the regulatory authority direct the owner to conduct periodic IT security risk assessments, implement an incident reporting policy and develop a security awareness programme.

Section 37(1) requires the owner of a critical information infrastructure to carry out an independent IT security audit every year or where there is a major upgrade or change in the IT infrastructure. Section 37(2) requires the report of the independent IT security audit to be submitted to the National Cybersecurity Committee to evaluate compliance.

Section 37(4) makes it an offence for the owner to fail to carry out the audit or to submit its report, punishable on conviction by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 5 years. The Act was assented to by the Acting President on 24 November 2021. The Information and Communication Technologies Authority of Mauritius lists the Act as proclaimed on 10 December 2021.

The Guideline applies to all financial institutions licensed or authorised by the Bank of Mauritius. The Guideline came into effect on 29 May 2023. Paragraph 96 of the Guideline requires financial institutions to report cyber and technology events and incidents to the Bank in such manner and format as the Bank prescribes. Paragraph 97 requires financial institutions to share cyber and technology threat intelligence information with the Bank in such manner and format as the Bank prescribes.

Paragraph 95 requires financial institutions to submit to the Bank the findings of all audits, assessments and testing exercises together with the remediation plan within 90 days from the date of completion of the respective exercise.

Paragraph 55(viii) lists, among the minimum contents of a response and recovery plan, the details of internal and external stakeholders, including the Bank, the information that has to be shared and reported together with relevant timeframes, including in case of emergency.

Section 100(4) of the Banking Act 2004 makes it an offence to fail to comply with guidelines or instructions made under that section, punishable on conviction by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 2 years.

Section 35(1) of the Cybersecurity and Cybercrime Act 2021 requires the owner of a critical information infrastructure to report to the Committee any cybersecurity incident impacting the national security, public safety or public interest and the action the owner intends to take to mitigate the incident. Section 35(2) has the Committee, on receipt of a report, direct CERT-MU to advise the owner of the critical information infrastructure on the mitigation of the incident.

Section 34(f) has the regulatory authority direct the owner to implement an incident reporting policy. Section 33(3)(f) has the regulatory authority monitor and report to the Committee on reporting to CERT-MU, by the owners of critical information infrastructure, of cybersecurity incidents impacting national security, public safety and public interest. The Act was assented to by the Acting President on 24 November 2021. The Information and Communication Technologies Authority of Mauritius lists the Act as proclaimed on 10 December 2021.

Section 21 permits, without the author's or copyright owner's authorisation, the reproduction in a newspaper or periodical, or the broadcasting or other communication to the public, of an article published in a newspaper or periodical on current economic, political or religious topics, unless the right to authorise that reproduction, broadcasting or communication is expressly reserved by the author or owner on the copies or in connection with the broadcast, and separately permits reproducing and broadcasting short excerpts of a work seen or heard in reporting current events, to the extent justified by that purpose, in each case subject to indicating the source and the author's name so far as practicable.

Section 18 permits quotation from a lawfully published work compatible with fair practice, but only where used for the purpose of caricature, parody or pastiche.