Compliance Checklist for Online Sellers Using an Offshore Company

Selling online through a company incorporated in Mauritius means answering to several parties at once: the Financial Services Commission (FSC), the Mauritius Revenue Authority (MRA), your bank, the payment platform, and the tax and consumer authorities of the countries where your customers live. This online seller compliance checklist for an offshore company groups those checks into six areas, so you can see which ones are done and which are still open.

It is not a substitute for the start-up list in the checklist before you start or for the recurring calendar in the yearly checklist. It sits between the two: the controls specific to a business that takes orders and payments from the public. The site gives general information only; where an answer depends on your situation, a qualified adviser has to analyse it.

How to use this checklist

Work through the six areas in order. The first three (entity, ownership, bank) decide whether the structure can operate at all. The last three (VAT and consumer rules, personal data, filings) decide whether it can sell lawfully once it operates.

1. The entity: is the company what you think it is?

An Authorised Company is not just a company with a Mauritian address. Under section 71A(1) of the Financial Services Act 2007 (FSA), a company incorporated under the Companies Act must apply to the FSC for authorisation where a non-citizen of Mauritius holds or controls the majority of its shares or voting rights, it does business mainly outside Mauritius, and its central management and control sit outside Mauritius. That last element matters for a seller: it is a condition of the status, not a detail.

A company that operates as an Authorised Company without the authorisation commits an offence, with a fine of up to MUR 1 000 000 (sections 71(5) and 71A(12) FSA). So the first control is documentary.

• Hold the FSC authorisation and the certificate of incorporation, and confirm the company name matches what appears on your storefront and contracts
• Confirm your registered agent is a FSC-licensed corporate service provider (Management Licence); this verification guide explains how
• Check that the activities you actually run are not among those the FSA reserves in its Fourth Schedule, which an Authorised Company cannot carry on
• Record where decisions are really taken, because central management and control must stay outside Mauritius (managing the company from abroad explains the practical side)

The Fourth Schedule point is worth a second look if your shop touches financial products, payment services or digital assets. Retail sale of goods and digital products is a different matter, but the boundary is a legal question, not a marketing one.

2. Ownership: the beneficial owner on record

Every Mauritian company must keep identifying its beneficial owner and, where relevant, any nominee, and record them in a separate register (Companies Act 2001, section 91(3A), as updated on 15 May 2026). The register holds the full name and residential address, the national identity or passport number, the nationality, and the holding structure that leads to the ultimate beneficial owner.

The company must also keep a trace of the steps taken to identify the beneficial owner, including a written declaration from the beneficial owner. The owner, in turn, has to tell the company when their status changes. For an online seller this is a live issue: a new co-founder, an investor or a change of shareholder can alter who the beneficial owner is overnight.

• Give your registered agent a signed declaration and keep a copy
• Inform the company promptly of any change in shareholding or control
• Check the company's separate register against reality every time shares move

The Registrar of Companies keeps a Beneficial Ownership Register that competent authorities and certain prescribed public authorities can consult. The Companies Act does not describe it as a public register. If privacy is a concern for you as a seller, the page on ownership privacy goes further.

3. Bank and payment accounts

Banks and payment providers look at what the company says it does and compare it with what the account does. A mismatch between the declared activity and the actual flow of customer money is the usual reason for friction. Two documents help: a business description that is specific, and a record of the sources of funds.

Under the Common Reporting Standard (CRS), Mauritian financial institutions report each year to the MRA on financial accounts held by non-residents, for exchange with treaty partners. Under the MRA guidance notes (September 2016, amended April 2019), account data reach the MRA by 31 July of the year following the reported period. Your own bank will therefore ask about tax residence, and the answers should match what you tell every other counterparty.

• Describe the shop, the products and the countries served in the same terms in the bank file, on the payment platform and on the storefront
• Keep contracts, supplier invoices and platform statements ready for the bank's questions
• Read why banks refuse offshore company accounts before approaching a second institution
• Check which payment methods your platform will actually activate for a Mauritian company (online payments with an offshore company)
• Review the options in banking for an offshore company if one account has to serve several currencies

4. VAT and consumer-law exposure in customer countries

The Mauritian company statute does not settle your VAT position abroad. Sales to customers in the European Union, the United Kingdom or elsewhere can trigger registration, collection and reporting duties in those places, depending on what you sell, to whom, and where goods or services are delivered. The guide on VAT for EU sales sets out the logic; this checklist only asks whether you have made the mapping at all.

Tax residence is a second, separate layer. A company incorporated in Mauritius is treated as resident if it is incorporated there or if its central management and control are there (section 73 of the Income Tax Act). Section 73A treats a company incorporated in Mauritius as non-resident when it is centrally managed and controlled outside Mauritius, yet it must still file an income tax return under section 116. Where the people running the business sit, and what they do from there, can also raise permanent establishment risk in another country.

• List the countries where your customers are, and the type of customer in each
• Decide, with a tax adviser, where registration or collection duties could arise
• Keep invoices consistent with the invoicing guide
• Note the consumer-protection rules that apply to distance selling in your main markets (withdrawal rights, refunds, delivery information)

5. Legal notices and personal data on the storefront

The storefront is where compliance becomes visible. A customer, a platform reviewer or a regulator can see in seconds whether the seller is identifiable.

Legal notices

• Display the full registered company name, its legal form and its country of incorporation
• State a registered office address and a means of contact (the form-based channel or support page you actually monitor)
• Publish terms of sale, a returns and refund policy, and a delivery policy that match what the shop really does
• Show prices in a way that makes clear what is included, in line with the rules of the markets you serve
• State clearly that your contracting party is the company, not you personally

Personal data

If you collect names, addresses or payment details, you are processing personal data, and the Mauritian Data Protection Act 2017 applies to a company that is a controller or processor in Mauritius. Customers in other countries may also bring their own regime into play; that point needs separate advice.

Two provisions are worth knowing. On a personal data breach, the controller must notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of it; otherwise it must justify the delay (section 25). On transfers outside Mauritius, a controller or processor may transfer personal data if it has given the Commissioner proof of appropriate safeguards, or with the explicit consent of the data subject after being informed of the risks (section 36). Both matter if your e-commerce platform, email tool or fulfilment partner stores data on servers abroad.

• Publish a privacy notice that lists what you collect, why, who receives it and where it is stored
• Keep a short list of every tool that holds customer data and in which country
• Write a breach procedure that names who decides, who informs the Commissioner and how you record the decision
• Check the legal basis for each cross-border transfer before adding a new supplier
• Review whether the Data Protection Act requires you to register as a controller or processor

6. Filings: what the registered agent files and what you still owe

Your registered agent handles a good part of the paperwork. Under section 71A(8) FSA, it ensures the filing of the returns and documents required by the FSA, the Income Tax Act or the Companies Act, passes on communications with the FSC, the MRA and the Registrar, carries out anti-money laundering and countering the financing of terrorism (AML/CFT) measures, and keeps the records (minutes, resolutions, transaction documents). A change of registered agent requires the fee set by the FSC Rules (section 71A(7)(b)); the page on changing provider covers the process.

Two filings are worth highlighting for a seller:

• An Authorised Company must file with the FSC every year, no later than six months after its financial year-end, a financial summary in the form of the Ninth Schedule to the Companies Act, or other documents specified by the FSC Rules (section 71A(10) FSA).
• Because section 73A requires an income tax return under section 116 even for a company treated as non-resident, "no tax payable" does not mean "no return".

Your sales records are what make these filings possible. A shop produces a large number of small transactions, and the platform reports, payout statements, refunds and chargebacks must reconcile to the accounts. The bookkeeping guide suggests a routine; the wider calendar sits in annual obligations.

• Ask the registered agent which filings it handles and which documents it expects from you
• Reconcile platform payouts with bank receipts each month
• Keep supplier invoices, shipping documents and refund records for the whole record-keeping period set by the law
• Diary the financial summary deadline against your year-end

A short self-assessment before you scale

Run through this list before a major launch, a new market or a change of provider. A "no" is not a failure; it marks where to ask.

• The company holds a valid Authorised Company authorisation and operates within it
• Management and control genuinely stay outside Mauritius
• The beneficial owner is recorded, declared and up to date
• The bank file, the payment account and the storefront tell the same story
• VAT and consumer rules are mapped for each customer country
• Legal notices and the privacy notice are live and accurate
• The registered agent's filings and your own records are reconciled

If several of these remain open, send a request through the site's form and the licensed provider that receives it can discuss your situation. This is general information, not tax or legal advice.