“Tokenisation changes the rails of finance. AI changes the intelligence on those rails. Cybersecurity determines whether institutions, regulators, and investors can trust either.”

Trust will play a significant role in determining whether Mauritius achieves its ambitions as an international financial hub. Firms handling cross-border capital need to protect sensitive information and maintain services across jurisdictions and time zones, while adding AI or tokenisation to those operations raises new questions about access, authority, and accountability. Institutions need to know who can authorise transactions and access client data before they use these services.

Mauritius has experience with the scrutiny that accompanies international finance. The Financial Action Task Force placed Mauritius under increased monitoring in February 2020 and lifted that status in October 2021 after the country addressed the anti-money laundering and counter-terrorist financing deficiencies identified in its action plan. That process concerned financial-crime controls. In digital finance, firms also need to demonstrate that their controls work.

That focus on trust and resilience is reflected in the country’s policy agenda. Mauritius’ Digital Transformation Blueprint 2025-2029 places cyber resilience, trust, data governance, and AI within the country’s plans. The Financial Services Commission also supervises virtual asset service providers and issuers of initial token offerings under the Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS).

As a Group CISO, those are the questions I ask first: can a firm control access, recover from an incident, and account for the decisions its systems make? For Mauritius, the opportunity is to position itself as a trusted provider of digital financial services that meet the security, governance, and operational standards expected by institutional clients.

What institutions need to trust AI and tokenisation

Tokenisation involves a chain of responsibilities across issuance, transfer, distribution, and the ongoing administration of securities. Security needs to cover each stage, including the identities permitted to transact, the keys that grant access, and the smart contracts that execute instructions. Where assets move across several blockchains, the connections between those systems also need scrutiny.

Consider a hypothetical case: an AI agent receives a fraudulent instruction to transfer a tokenised asset. The instruction appears to come from a person with the authority to give it. The agent has access to a transaction tool, and the receiving wallet is technically valid. Before anything moves, the firm needs controls that establish whether the instruction is genuine, whether the agent has authority to act, and whether the recipient is permitted to receive the asset.

That case brings cybersecurity and financial-crime checks into the same workflow. A valid identity or wallet does not, on its own, establish that a transaction is legitimate. Firms need to assess the parties involved and the purpose of the transfer, alongside the technical permissions that allow it to proceed. Where a transfer can become irreversible within minutes, checks intended to prevent an improper transfer need to operate before execution. Post-transaction monitoring remains necessary, but it cannot substitute for those checks. Human approval should be required where the risk warrants it, with a record of the decision.

AI security therefore extends across models, agents, data, identities, tools, application programming interfaces, external providers, guardrails, and the actions taken as a result of its outputs. A review limited to the application would miss those dependencies.

Security by design means addressing these questions before deployment. Institutions should be able to explain how access is controlled, who can approve changes, and how an incident would be handled. The review should also cover administration, incident response, and recovery.

We are positioning Apex Digital 3.0 as institutional infrastructure connecting traditional and on-chain finance. Apex Tokeny extends that proposition across the lifecycle of tokenised securities. The competitive advantage is not blockchain alone. It is the ability to make digital assets operationally credible: governed, secure, compliant, serviceable, and scalable.

The decisions boards and CEOs need to own

Boards and CEOs should treat cyber resilience as part of their responsibility for business continuity and client services. As a Group CISO, I bring expertise across many areas, including cyber risk, but decisions about risk appetite, acceptable risk, investment, and recovery priorities require the involvement of the CRO and executive boards.

Executive boards now understand which services a firm must maintain during a cyber incident, which external providers those services depend on, and what evidence supports its recovery plans. If access to a transaction platform is lost, who can suspend activity? How will the firm establish which instructions were completed? What must be restored before service can safely resume?

Resilience and recovery exercises show whether the people, systems, and suppliers named in the plan can perform as expected. The same discipline should apply when approving AI or digital-asset services. Leadership needs a clear understanding of the proposed use case, its risks, and the controls required before it goes into production. Where capability or security gaps remain, those gaps should be visible to the people making the decision.

ISO/IEC 27001 sets requirements for an information security management system, while the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 provides guidance for managing cyber risk. Firms can use these as a basis for consistent assessment. Their practical value depends on how firms apply them, test their controls, and address weaknesses.

Firms providing technology services to financial entities in the European Union may also be asked for evidence that supports those entities’ obligations under the Digital Operational Resilience Act (DORA). Applying and testing these controls would help Mauritian firms meet the expectations of international clients.

Building cyber expertise in Mauritius

Our Mauritius operations have grown over 20 years through acquisitions and local investment. Around 1,000 professionals now support complex fund structures, private capital strategies, and financial reporting across jurisdictions. That work connects Mauritius with international capital and markets across Africa, the Middle East, and India.

It also requires sustained investment in skills. As financial operations incorporate AI and tokenisation, staff need to understand how these technologies affect the processes for which they are responsible and the benefits they can deliver. Cyber expertise needs to sit alongside knowledge of fund operations, data governance, and financial crime. Technical teams need access to business expertise; business teams need to understand when a technology decision changes risk.

Employers can support this through training and practical experience, while also working with educational institutions to develop relevant skills. The Blueprint makes digital skills one of its four pillars. The aim should be to give people the confidence and knowledge to question an instruction, identify a weakness, or escalate a concern before it affects a client.

A board approving a digital financial service should ask for a demonstration: trace an instruction through its approval and execution, then test what happens when a system or provider fails.

Ultimately, institutional confidence will depend on evidence that firms can maintain control under pressure, respond effectively when things go wrong, and act on risks before they affect clients.