Fintech and Payment Institution Licensing in Morocco: A Legal Guide
Morocco's digital-payments ecosystem is undergoing its most significant structural reform in two decades. New licensing categories, the dismantling of a long-standing acquiring monopoly, and an evolving regulatory posture toward digital assets are reshaping the market. This guide provides a practitioner-oriented overview of the legal framework governing fintech and payment institution licensing in Morocco, with particular attention to issues facing foreign investors and cross-border operators.
1. The Regulatory Landscape
Bank Al-Maghrib as Primary Regulator
Bank Al-Maghrib (BAM), Morocco's central bank, is the primary regulator and supervisor of credit institutions and payment institutions. Licensing decisions (agrement) are issued by the Governor of BAM following the opinion of the Credit Institutions Committee.
Law No. 103-12 on Credit Institutions and Similar Bodies
The cornerstone legislation is Law No. 103-12, promulgated by Dahir No. 1-14-193 of 24 December 2014, governing banks, payment institutions, micro-credit associations, offshore banks, and financial companies. The law was amended and supplemented, with implementing decrees published in early 2022. Under this framework, payment institutions are legally assimilated to credit institutions and may be incorporated as either a societe anonyme (SA) or a societe a responsabilite limitee (SARL).
Trust Services and Electronic Signatures
Law No. 43-20 on trust services for electronic transactions, which entered into force on 13 July 2023, replaced the former Law 53-05 and governs electronic signatures (simple, advanced, and qualified), electronic seals, time-stamping, and registered electronic delivery. Oversight is exercised by the DGSSI, which accredits trust service providers (PSCo). Payment institutions relying on digital onboarding or electronic contract execution must ensure compliance with this framework.
Data Protection
The Commission Nationale de controle de la protection des Donnees a caractere Personnel (CNDP) is Morocco's data protection authority, operating primarily under Law No. 09-08 on personal data protection. Payment institutions handling customer data must register with the CNDP and comply with data processing, consent, and cross-border transfer requirements.
2. The Recent Market Shift
Morocco's First Payment Institution Licence
On 15 October 2025, Bank Al-Maghrib granted Morocco's first-ever payment institution licence to Chari, a Casablanca-based B2B fintech platform backed by venture capital. The licence, announced alongside a USD 12 million Series A funding round (led by SPE Capital and Orange Ventures, bringing Chari's total funding to USD 17 million), allows Chari to issue IBANs and debit cards, process domestic and international transfers, and offer ancillary services including micro-insurance. This marked the first time BAM licensed a VC-backed company—rather than a bank-affiliated entity—as a payment institution.
End of the CMI Monopoly
Under Competition Council Decision No. 152/D/2024, the long-standing quasi-monopoly of the Centre Monetique Interbancaire (CMI) over merchant acquiring and electronic payment acquisition was formally dismantled. CMI had been the sole operator in acquiring and switching since 2004. BAM opened switching to competition from 2015, and full acquiring competition followed the 2024 decision.
Behavioral commitments under the decision include: CMI was barred from soliciting new merchants from 1 November 2024; BAM capped interchange fees at 0.65 percent for domestic card transactions (subsequently reduced to 0.50 percent by a BAM regulatory decision signed 6 July 2026); and these fees may not be re-invoiced to consumers by merchants.
Merchant-Contract Transfer Deadlines
CMI must transfer its entire portfolio of approximately 55,000 merchant affiliation contracts and its online payment gateway services to newly licensed acquirers. The transfer deadlines are:
- 31 January 2026 for private and commercial merchant contracts.
- 30 April 2026 for contracts with government bodies and public administrations.
Notifications to merchants began on 1 December 2025. Failure to meet the deadline exposes CMI to daily penalties.
New Licensed Acquirers
As of the market opening (from 1 May 2025), approximately 11 operators had received BAM approval to compete in merchant acquiring, including bank-affiliated acquirers (e.g., Attijari Payment, Chaabi Payment) and independent fintech challengers (e.g., NAPS). CMI itself has repositioned as a neutral multi-acquirer processor rather than a commercial acquirer. For context, roughly 74 percent of Moroccan transactions remained cash-based as of 2025, and only around 71,000 EFT-POS terminals were deployed against an estimated pool of over two million merchants—underscoring the scale of the market opportunity.
3. Types of Licence and Permitted Activities
Under Law 103-12 and BAM regulations, the principal licence categories relevant to fintech operators include:
- Payment Institution: Authorizes the provision of payment services, including account management, fund transfers, and payment initiation. This is the broadest category and the licence type granted to Chari.
- E-Money Issuance: Permits the issuance of electronic money (stored-value instruments), including prepaid cards and digital wallets.
- Merchant Acquiring: Authorizes the acceptance and processing of electronic payment transactions on behalf of merchants, including POS and online gateway services.
- Money Remittance: Permits domestic and international fund transfers on behalf of customers, subject to Office des Changes rules for cross-border flows.
- Payment Aggregation: Allows an entity to aggregate payment flows for multiple merchants or service providers under a single acquiring relationship.
Minimum capital requirements vary by licence category. Commercial banks face a minimum of MAD 200 million; payment institutions are subject to separate, lower prudential capital thresholds set by BAM regulation. The agrement process involves submission of a detailed application file to BAM, review by the Credit Institutions Committee, and a final decision by the Governor.
4. Licensing Requirements and Process
Fit-and-Proper Review
BAM conducts a fit-and-proper assessment of all significant shareholders, beneficial owners, and proposed senior managers. Applicants must demonstrate integrity, professional competence, and financial soundness.
AML/CFT Programme
Applicants must submit a comprehensive anti-money laundering and counter-terrorist financing (AML/CFT) programme, compliant with Law 43-05 and BAM circulars (including Circular 5/W/2017 on customer due diligence). Suspicious transaction reporting is directed to the Autorite Nationale du Renseignement Financier (ANRF), Morocco's financial intelligence unit. Morocco exited the FATF grey list in February 2023 after completing a 15-point action plan, and supervisory expectations have intensified accordingly.
IT, Security, and Data Localization
BAM expects robust IT governance, cybersecurity frameworks, and annual PCI-DSS compliance validation by qualified assessors. Card, merchant, and transaction data are generally required to be hosted in Morocco, with limited exceptions for cross-border processing tied to international card schemes. Outsourcing arrangements must be documented and approved.
Application File and Timeline
The application file includes detailed business plans, operational manuals, shareholder and beneficial ownership documentation, governance structures, and compliance frameworks covering AML/CFT, data protection, cybersecurity, and consumer protection. BAM review of significant ownership changes typically takes 30 to 90 days depending on complexity; initial licensing applications may take longer.
No Passporting
There is no cross-border passporting regime for payment institutions in Morocco. Every entity offering licensed payment services in Morocco must hold its own BAM licence via a locally incorporated entity (SA or SARL). Foreign fintech operators cannot serve the Moroccan market under a home-country licence.
5. Foreign Investors
Foreign investors may own Moroccan payment institutions—foreign shareholding is generally permitted subject to BAM's fit-and-proper review. However, the licensed entity itself must be a Moroccan-incorporated company; there is no direct cross-border licensing option. A foreign fintech wishing to operate in Morocco must therefore either incorporate a local subsidiary or partner with a locally licensed entity.
Foreign Exchange Constraints
The Office des Changes governs cross-border currency flows under Law 41-05. The Moroccan dirham operates under a controlled convertibility regime and is not fully convertible. The updated Instruction Generale des Operations de Change (IGOC 2026), effective 1 January 2026, introduced certain liberalization measures (e.g., higher business travel allowances, easier repatriation for long-term investors, permission for residents to grant representations and warranties to non-resident buyers in M&A transactions), but did not establish full convertibility. Foreign investment inflows that are properly registered benefit from Morocco's transferability guarantee for dividends, reinvestment, and repatriation of sale or liquidation proceeds. Cross-border payment flows remain subject to exchange-control constraints that must be factored into product design.
Casablanca Finance City (CFC)
CFC status, under Law No. 44-10, offers tax and operational incentives to companies in financial services, professional services, holding companies, and regional headquarters (including a five-year corporate tax exemption followed by a reduced rate, streamlined company formation, and multicurrency banking). However, the CFC preferential tax regime explicitly does not apply to credit institutions or insurance/reinsurance companies. Because payment institutions are legally assimilated to credit institutions under Law 103-12, they remain subject to the ordinary sectoral tax regime—a nuance frequently overlooked by foreign operators planning their Moroccan structure.
6. Adjacent Regimes
Crowdfunding
Crowdfunding is governed by Law No. 15-18 on collaborative financing, supplemented by nine BAM circulars. Crowdfunding companies (Societes de Financement Collaboratif, SFC) must be incorporated as SA or SARL with minimum fully paid-up capital of MAD 300,000. Funding per project is capped at MAD 5 million.
Open Banking
BAM's fintech strategy contemplates a move toward open banking, although a binding regulatory framework has not yet been adopted. Market participants should monitor BAM's consultative publications for developments in API access and data-sharing obligations.
Crypto-Assets
Morocco imposed a prohibition on cryptocurrency transactions in 2017, enforced via foreign-exchange rules backed by the Office des Changes, BAM, and the Moroccan Capital Market Authority (AMMC). This ban remains technically in force. In November 2025, the Ministry of Economy and Finance, working with BAM and AMMC, published Draft Bill No. 42.25, which would create a comprehensive licensing and supervisory framework for digital assets—including stablecoins, trading, custody, and advisory services—aligned with IMF, BIS, and FATF recommendations. As of mid-2026, the bill remains in the legislative process with no confirmed enactment date. No exchange or virtual-asset service provider is currently licensed in Morocco.
Consumer Protection and Data
BAM supervises consumer protection for payment institution customers. Data protection is governed by Law 09-08, enforced by the CNDP. Payment institutions must implement transparent fee disclosure, complaint-handling procedures, and data processing safeguards.
7. Practitioner Insights
- Engage BAM early. Informal pre-application dialogue with the regulator is common practice and can significantly reduce the risk of a deficient application.
- Capital and operational substance are gating factors. BAM expects demonstrable financial capacity and a genuine operational presence in Morocco, not a shell structure.
- The AML/CFT programme is typically the make-or-break element of the file. Applications with insufficiently detailed customer due diligence procedures, transaction monitoring frameworks, or ANRF reporting protocols are routinely returned for supplementation.
- Time your application against the merchant-acquiring transition window. The restructuring of CMI's portfolio and the entry of new acquirers create a narrow window of market opportunity for well-prepared operators.
- Do not underestimate Office des Changes constraints. Cross-border payment products must be designed within the controlled convertibility framework; failure to obtain necessary exchange-control authorizations can delay or block product launches.
8. Frequently Asked Questions
Can a foreign company own 100 percent of a Moroccan payment institution?
Yes. Foreign shareholding is generally permitted, and there is no statutory cap on foreign ownership of a payment institution. However, all significant shareholders are subject to BAM's fit-and-proper review, and the licensed entity itself must be a Moroccan-incorporated company (SA or SARL).
How long does BAM licensing take?
There is no published statutory maximum. BAM review of ownership changes typically takes 30 to 90 days. Initial licensing applications, which involve a more comprehensive review of business plans, governance, and compliance frameworks, may take longer. Applicants should budget six to twelve months from submission to decision, accounting for potential requests for supplemental information.
Is crypto legal in Morocco?
Transactions in cryptocurrencies remain prohibited under foreign-exchange rules dating to 2017. Draft Bill No. 42.25, published in November 2025, would create a licensing regime for digital assets, but it has not been enacted as of mid-2026. No virtual-asset service provider is currently licensed.
What happened to CMI's monopoly?
The Competition Council, under Decision No. 152/D/2024, dismantled CMI's historic monopoly over merchant acquiring. CMI was required to transfer its approximately 55,000 merchant contracts to newly licensed acquirers by 31 January 2026 (private/commercial) and 30 April 2026 (government/public administration). Approximately 11 new acquirers have been approved by BAM. CMI has repositioned as a neutral technical platform.