“AML/CFT test will be won in files, not in speeches”

Naushaad Khalid Malleck, Barrister & Chairperson of the Real Estate Agent Authority Board (REAA)

Mauritius is entering a decisive phase in its fight against financial crime, with the forthcoming ESAAMLG evaluation set to test not just the strength of its laws, but their effectiveness in practice. For Naushaad Khalid Malleck, the challenge is clear: results must be demonstrated through evidence, enforcement and changed behaviour. As the real estate sector comes under tighter regulatory scrutiny, he argues that Mauritius must prove its AML/CFT framework works where it matters most, that is, in practice.

You have highlighted how attractive real estate can be to financial criminals. What makes property particularly vulnerable to money laundering?

Property does several jobs for a criminal at once and that is what makes it exceptional. A single transaction absorbs a sum that would take months to move through a bank in structured deposits. The asset does not depreciate, it appreciates, so the exercise pays for itself. It can be lived in, let, or used to run a business. It can be borrowed against, which converts criminal proceeds into a clean bank facility and, over several years, into a documentary history of respectable financing. And another very important thing to understand is that ownership confers standing: a man with an address has a story he can tell.

In our jurisdiction there is a sixth attraction. An acquisition above the prescribed threshold under our property schemes carries a residence permit. That is lawful and deliberate policy and I’m not criticising it, but it means the property here is not only a store of value. It is a gateway to status and to presence.

How significant is that risk in Mauritius today, and where are the main vulnerabilities in our real estate sector?

Our Second National Risk Assessment rates national money laundering risk as Medium-High. It rates the real estate sector Medium-High, with a residual vulnerability assessed as High — and the notaries who sit in the same transaction, Medium-High as well. Those are serious numbers and I would not soften them.

But when one reads the assessment carefully, the diagnosis is a precise one. We have been failing on vulnerability, not on threat. Threat is what the criminal does whereas vulnerability is what we leave open to him. The principal vulnerability of this sector was simply that there was no door at the entrance to it. Anyone could hold himself out as a real estate agent. There was no register, no fit-and-proper test, no bar on a person convicted of a financial crime offence or named on a United Nations sanctions list.

That is a vulnerability we can actually fix, and it is the one the Act has now closed. Not only do we now have a door, but there is a lock.

Property transactions can involve companies, trusts, nominees and several intermediaries. How difficult is it in practice to establish who the ultimate beneficial owner — and the real source of the money — actually is?

The answer is: difficult, and the difficulty is not evenly distributed. 

Identifying a beneficial owner on paper is usually achievable. Establishing whether the paper reflects reality is harder and establishing where the wealth came from is harder still.

The distinction that matters is between source of funds and source of wealth. Source of funds is where this money came from for this purchase whereas source of wealth is how the person came to have money at all. A well-advised purchaser can almost always document the first. It is the second where the story tends to break.

Two features make it harder here specifically. The first is the prête-nom (acquisition in the name of a relative, for example) which our own Financial Intelligence Unit identifies as a Mauritian vulnerability and which is culturally so ordinary that it can pass without a second thought. The second is that in a chain of five professionals, each holds one fragment of the picture, and no single one of them holds the two facts that would make the whole thing obvious.

Mauritius has strengthened the licensing and supervision of real estate professionals. What weaknesses is this new framework intended to address, and are there still operators or activities falling outside the regulatory net?

The framework addresses entry, which was the sector’s central weakness. Since 1 August 2026, no person may act as a real estate agent unless registered; registration carries a fit-and-proper test and an entry standard; every registered agent must register with the Financial Intelligence Unit; compliance officers and reporting officers are approved by the Authority; a Code of Conduct and Practice has been issued; and failure to report a suspicious transaction is a criminal offence carrying up to one million rupees and five years.

Are there gaps? Yes, and I would rather say so than pretend otherwise. Registration is proceeding in phases: agency work, property development and land promotion first, with rental and the remaining activities to follow. And there are operators who have simply never intended to come inside, particularly those advertising on social media, where the barrier to holding yourself out as an agent is a photograph and a telephone number.

That is why the Act has a criminal limb as well as a supervisory one. Unregistered practice is an offence, and an unregistered person cannot sue in any court to recover his fee. We will be pursuing that work with the Financial Crimes Commission. A gate is of no use if walking round it costs nothing!

Real estate involves agents, developers, lawyers, banks and other professionals. When suspicious funds enter a property transaction, where does responsibility lie, and are these professionals sufficiently equipped to identify the red flags?

Responsibility lies with each of them, undivided. It is not shared out and it is not discharged because another regulated professional was also present. Our own Act puts it in these terms for my licensees: the anti-money-laundering obligations are in addition to, and not in derogation from, the Financial Intelligence and Anti-Money Laundering Act.

The practical failure is rarely dishonesty. It is assumption. The agent assumes the notary will verify the source of funds. The notary assumes the bank checked when the account was opened. The bank treats a notarial transaction as lower risk precisely because a notary is involved. The real danger is when everybody has reasonably assumed and nobody has actually looked. The launderer’s most reliable ally is not the corrupt professional; those are rare and are eventually caught. It is the honest professional who assumes someone else did the work.

As for how well equipped they are: unevenly. Banks and management companies have mature compliance functions. The agency sector is at the beginning, which is why training and continuing professional development are being built with the Financial Services Institute and the University of Mauritius rather than left to chance.

How do you strike the balance between rigorous AML/CFT controls and keeping Mauritius attractive and business-friendly for legitimate property investment?

I would resist the framing a little, because it treats rigour and attractiveness as opposites. They are not. A market in which prices are distorted by buyers who are not price-sensitive, because they are not really buying, is not an attractive market for anyone trying to trade in it honestly. And the most business-unfriendly thing that can happen to this jurisdiction is a grey listing.

That said, proportionality is real and we take it seriously. Our approach is a blend of regulation and self-regulation. Registration is phased and risk-based. The fee was deliberately set in line with the trade fee licence that preceded it, so that this is a change of regime rather than a new tax. The e-licensing portal was pilot-tested with agents from the sector and their input was taken on board before it went live. 

We will not have the optimum mix perfectly balanced from the word go and I do not claim otherwise. But we aim to be business-friendly and we are open to suggestions.

You suggested that if Mauritius were placed on the grey list again, getting off it could take at least two years. Why could the consequences and the process be more difficult this time?

That is not what I said. What I said is that last time it took us two years. This round is about effectiveness and that will make matters considerably more complicated for any jurisdiction which does not pass and finds itself on the grey list.

The coming ESAAMLG evaluation will not be about the statute book. It will be about effectiveness and effectiveness is demonstrated by evidence accumulated over time: supervision that changed behaviour, reports that produced outcomes, cases that were pursued. You can amend a statute in one sitting. You cannot manufacture years of enforcement evidence.

The consequences would also be less forgiving. A first listing reads, externally, as a jurisdiction still building. A second reads as a relapse, and correspondent banking relationships, once they have narrowed, do not widen again quickly. The friction arrives without announcement and it recedes slowly.

We are now talking much more about “effectiveness”. How will the forthcoming assessment differ from the previous one Mauritius underwent? Is having the right laws, regulations and institutions in place no longer sufficient?

Correct. Having the right laws, regulations and institutions is necessary, but not sufficient. The methodology assesses two distinct things. Technical compliance asks whether the legal and institutional framework meets the standard. Effectiveness asks whether the framework produces results and it is measured against a set of Immediate Outcomes rather than against the text of the law.

Technical compliance asks whether the law exists. Effectiveness asks whether anybody has felt it.

Practically, that changes what a country must be able to produce. Not an instrument, but evidence and evidence of a kind that cannot be assembled at short notice. It also changes who is examined. Assessors do not evaluate an authority in the abstract. They sit across a table from working supervisors, compliance officers and reporting officers and ask what risks the business faces and what is done about them. The quality of those answers is part of the grade.

Taking all this into account, are you confident that Mauritius can demonstrate that its AML/CFT framework is working effectively in practice and avoid returning to the grey list?

I am confident about the framework. This country has built, in a relatively short period, a legal and institutional architecture that stands comparison with jurisdictions far larger than ours, and the closing of the real estate perimeter this year removed one of the last significant gaps in it.

Confidence about the outcome is a different thing, and it has to be earned between now and 2028. It will be earned in files, not in speeches. Effectiveness is not a quality a jurisdiction announces about itself, it is a finding somebody else makes after examining what we actually did.

What I would say is this: the work required is entirely achievable, it is understood by the institutions that must do it, and none of it depends on anything outside our control. 

I would far rather this Authority find its own weaknesses in 2026 than have them found for us in 2028, and if every institution in the chain takes that view, I think we will be in a position to demonstrate what we need to demonstrate.