Contents
What Article 3 requires
Law 43-05 on combating money laundering, as amended by Law No. 12-18, does not require the same checks to be applied to everyone. It requires effort to be concentrated where the risk is real. Article 3 provides for:
- internal control policies and procedures proportionate to the size and risks of the reporting entity;
- the identification, assessment and mitigation of risks;
- enhanced measures where risk is high, and simplified measures where risk is low, unless there is a suspicion;
- a documented internal risk assessment, updated periodically and provided to the supervisory authority.
This assessment exists at two levels: the firm as a whole, and each client or file. The guide to the AML/CFT obligations of non-financial professions sets out which files fall within scope.
Start from your sector's risk
The national risk assessment approved in January 2025 provides a starting point. It rates money laundering risk as high for real estate acquisitions, medium-high for legal professions and medium for accounting professions. A notary who mainly handles property sales therefore starts from a higher inherent risk than an accountant who keeps the books of local SMEs. The firm's assessment must explain how this sector risk translates into its own client base.
The four families of risk factors
| Family | Questions to ask | Examples of higher-risk signals |
|---|---|---|
| Client | Who is the client? Who controls it? Is it politically exposed? | Politically exposed person; beneficial owner hard to establish; complex structure with no apparent economic rationale |
| Geography | Where are the client, its funds and its counterparties based? | Country on the FATF lists of high-risk jurisdictions or jurisdictions under increased monitoring; funds coming from a country with no link to the transaction |
| Transaction or service | What service, for what amount, with what flows? | Property purchase paid largely in cash; serial company formations; share transfer at an inconsistent price |
| Channel | How is the relationship established? | Client never met; unknown intermediary; insistence on handling everything remotely and urgently |
Article 4 adds the assessment of risks linked to new technologies: remote signing or payment by a new method must undergo a risk assessment, preferably before being launched.
A simple scoring matrix
The law does not prescribe any model. Here is a grid a small firm can use and adapt:
| Factor | 1 point (low) | 2 points (medium) | 3 points (high) |
|---|---|---|---|
| Client | Known resident individual | Local company with a simple structure | PEP, complex structure, uncertain beneficial owner |
| Geography | Morocco only | Third country with no particular signal | High-risk jurisdiction |
| Transaction | Consistent amount, traceable funds | Large amount, funds from a bank | Cash, inconsistent price, unjustified urgency |
| Channel | Met in person | Remote, with verification | Remote, through an unidentified intermediary |
Suggested reading: 4 to 6 points, low risk; 7 to 9, medium risk; 10 or more, high risk. Two rules override the total: a PEP or a high-risk jurisdiction always triggers enhanced due diligence, and a suspicion rules out any simplified due diligence.
Simplified, standard or enhanced due diligence
| Level | Typical measures |
|---|---|
| Simplified | Basic identification and verification; less frequent updating; never where there is a suspicion |
| Standard | Identification of the client, its representatives and the beneficial owner; purpose of the relationship; source of funds |
| Enhanced | Evidence of source of funds and source of wealth; sign-off by a partner; closer monitoring; more frequent updating |
The measures listed for the simplified and enhanced levels reflect good practice: the law sets the principle, and the supervisory authorities may specify how it applies.
Politically exposed persons
Article 4 requires enhanced measures for Moroccan or foreign politically exposed persons, their family members and close associates. The law does not detail these measures; here is good practice for a firm:
- ask the client the question in the onboarding form;
- cross-check the answer against open sources or a screening tool;
- have a partner approve acceptance;
- document the source of the funds for the transaction;
- review the file at least once a year.
Being a politically exposed person is not a reason to refuse a client. It is a reason for vigilance.
Documenting the classification
A classification that is not written down does not exist when an inspection takes place. Each file should contain the risk level assigned, the factors behind it, the measures applied, and the date and author of the assessment. Article 8 also requires special scrutiny, recorded in writing, of any complex or unusual transaction. These records are kept for ten years (Article 7). They are personal data, so they are also governed by Law 09-08 as applied to KYC.
When should the risk level be reviewed?
The law refers to periodic updating without setting a frequency. As good practice:
- high risk: annual review;
- medium risk: review every two years;
- low risk: review every three years;
- in all cases, immediate review after an event: a new unusual transaction, a change of beneficial owner, new adverse information.
The firm-wide assessment is reviewed at least once a year. Work on risk appetite helps set what the firm will and will not accept.
Action plan
- Draft the firm's risk assessment, starting from the national assessment.
- Adopt a scoring grid and test it on twenty existing files.
- Define the measures attached to each level.
- Build the risk questions into the onboarding journey, for example with online client onboarding.
- Set the review schedule and appoint someone responsible for it.
- Train the team and keep a record of the training.
Further reading
- 7 min read
- 7 min read
- 7 min read
- 7 min read
- 3 min read
Frequently asked questions
Does Moroccan law require an AML/CFT risk map?
Article 3 of Law 43-05 requires reporting entities to identify, assess and mitigate their risks, to document that assessment, to update it periodically and to provide it to the supervisory authority. The law does not use the term "risk map", but that is the document that allows the obligation to be met.
When can simplified due diligence be applied?
Where the risk is low, Article 3 allows simplified measures, except where there is a suspicion of money laundering or terrorist financing. The firm must be able to explain why the risk was judged to be low.
Who is a politically exposed person?
Law 43-05 covers Moroccan and foreign politically exposed persons, as well as their family members and close associates. They call for enhanced due diligence measures, as do high-risk clients and countries.
How often should a client's classification be reviewed?
The law requires periodic updating without setting a frequency. As good practice, high-risk clients are reviewed every year, medium-risk clients every two years and low-risk clients every three years, and immediately after any significant event.
Does a small firm need the same framework as a bank?
No. Article 3 calls for policies and procedures proportionate to the size and risks of the reporting entity. A five-person firm can make do with a simple grid, provided it is applied, documented and reviewed.
General information, not legal advice.
Report an errorReferences (3)
- Office des Changes. Loi n° 43-05 relative à la lutte contre le blanchiment de capitaux (Law No. 43-05 on combating money laundering), updated and consolidated version. (opens in a new tab)
- Office des Changes. Practical guide to AML/CFT, December 2021. (opens in a new tab)
- ACAPS. Summary of the national assessment of money laundering and terrorist financing risks, July 2025. (opens in a new tab)