Confidentiality is workable so long as the regulated firm can identify the parties and disclose on demand. Encrypted amounts are not the thing being restricted.
What Mauritius actually says
Mauritius matters here out of proportion to its size, because a great many crypto entities are domiciled in it. Its regime is mature rather than minimal: a licensing act in force since 2022, five distinct licence classes with capital requirements, and seven detailed rules covering everything from custody to cybersecurity. What it does not contain, anywhere we could find across the act, the rules and independent reviews of both, is any restriction on anonymity-enhancing assets, mixers or self-hosted wallets. That silence is the finding. It is not a considered permission and should not be read as one, but it does make Mauritius the most accommodating jurisdiction in the region on confidentiality, purely by not having addressed it.
The instruments that matter
- VAITOS Act 2021, in force 7 February 2022
- five licence classes covering broker-dealer, wallet services, custodian, advisory and marketplace, each with its own capital floor
- Seven FSC Rules from 1 July 2022
- covering capital, client disclosure, custody of client assets, cybersecurity, advertising, risk management and statutory returns
- No located restriction on anonymity-enhancing assets
- across the Act, all seven rules and independent reviews of them, we found no mention of privacy coins, mixers or self-hosted wallets
- Anti-money-laundering under FIAMLA
- customer due diligence, ongoing transaction monitoring, a seven-year record retention minimum and mandatory compliance and reporting officers
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- GhanaMiddle East & Africa · The regulator that put self-custody in writing
- IsraelMiddle East & Africa · Light on-chain, heavy on data protection
- ItalyEurope · Customer-level reporting to a public registrar
- NigeriaMiddle East & Africa · Securities-first, with banking access restored
- RwandaMiddle East & Africa · Anonymity defined out of the regime rather than banned
- SeychellesMiddle East & Africa · No anonymity rule, but the offshore route is closing
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.