Glossary: Customer Experience, Data, AI and Compliance

Morocco's Insurance and Social Welfare Supervisory Authority. It supervises insurers in Morocco and receives complaints directly, notably through its online platform. See insurance complaints.

A European Commission decision recognising that a third country protects data sufficiently. Morocco does not benefit from one: a transfer requires appropriate safeguards (most often standard contractual clauses) or, exceptionally, a derogation. See the Moroccan processor of a European client.

Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744. It classifies uses of AI according to their risk and also applies to operators established outside the Union where the output of their systems is used there. See the AI Act for Moroccan BPOs.

The knowledge and skills needed to use AI in an informed way. Since the Omnibus, Article 4 of the AI Act asks providers and deployers to take measures to this end for their staff. See the AI Act for Moroccan BPOs.

Anti-money laundering and counter-terrorist financing: the system established in Morocco by Law 43-05, amended by Law 12-18. It covers banks but also non-financial professions: lawyers, notaries, adouls, accountants and real estate agents. See AML/CFT for non-financial professions.

Morocco's National Financial Intelligence Authority, which succeeded the UTRF under Law 12-18. It receives suspicious transaction reports from persons subject to Law 43-05. See suspicious transaction reports.

A free procedure through which the CMMB proposes a solution to a dispute between a customer and an institution, after a prior complaint has not received a satisfactory reply. See banking mediation.

Indications drawn from what customers do (repeat contacts, abandonments, cancellations, complaints), as opposed to what they say in surveys. See behavioural signals.

The natural person who ultimately owns or controls a client, or on whose behalf a transaction is carried out. Decree 2-21-708 sets a threshold of 25% of the capital or voting rights. See beneficial ownership in Morocco.

France's opt-out list for telemarketing calls. The scheme ended on 11 August 2026, the date on which France moved to prior consent. See the French telemarketing law.

An association offering free mediation between customers and credit, finance, microcredit and payment institutions. See banking mediation.

Morocco's data protection authority, responsible for enforcing Law 09-08. See data protection in Morocco.

An expression of dissatisfaction addressed to an organisation, which calls for a response. In Moroccan banking, Bank Al-Maghrib Circular 10/W/16 sets out how complaints are handled and the time limits. See banking complaints in Morocco.

A freely given, specific, informed and unambiguous indication of wishes. For telemarketing in France, it must result from a clear affirmative act and be revocable, and the burden of proving it lies with the business. See proof of consent.

The organisation that determines the purposes and means of processing personal data. It is accountable for compliance, including for what it entrusts to its processors. See Law 09-08 compared with the GDPR.

The tendency of some respondents to give a more favourable answer than their real opinion, out of politeness towards the interviewer or the company. Its extent varies with the survey method and the context. See courtesy bias.

The identification, verification and relationship-monitoring measures required by Law 43-05: identity of the client and the beneficial owner, purpose of the relationship, source of funds, monitoring of transactions. See AML/CFT for non-financial professions.

An indicator that measures the effort the customer perceives in settling a request, on a short scale. See NPS, CSAT and CES.

A satisfaction indicator, often expressed as the share of respondents satisfied with an interaction or a relationship. See NPS, CSAT and CES.

The communication of personal data to another country. In Morocco, Law 09-08 governs it (Articles 43 and 44); in the Union, the GDPR governs it (Articles 44 to 49). See transferring data abroad.

Under the AI Act, a person or organisation that uses an AI system under its own authority, other than for personal non-professional use. A call centre that uses a vendor's voicebot is generally a deployer. See provider or deployer.

An AI system that identifies or infers people's emotions or intentions from their biometric data, such as voice or face. Its use in the workplace has been prohibited since 2 February 2025, except for medical or safety reasons. See emotion analysis in call centres.

A dated, controlled document repository in which every answer given to a client or an auditor points to evidence: policy, procedure, contract, report. See a European client's questionnaire.

The share of requests settled without the customer having to contact the business again for the same reason. It is one of the central indicators of a contact centre's quality. See quality indicators.

The AI Act category subject to the heaviest obligations. It notably includes emotion recognition, recruitment and employee assessment; these rules apply from 2 December 2027. See the regulatory calendar.

A mediator appointed jointly by the ACAPS and the FMSAR for a renewable three-year term, who handles disputes between policyholders and insurers. See insurance complaints.

The set of measures for identifying and verifying a client and their beneficial owner. In Morocco, it must comply with both Law 43-05 and the proportionality principle of Law 09-08. See KYC and Law 09-08.

An indicator based on the likelihood of recommending a company, on a scale of 0 to 10: the share of promoters minus the share of detractors. See NPS, CSAT and CES.

A person who holds or has held a prominent public function, in Morocco or abroad. They, their family members and their close associates are subject to enhanced due diligence under Law 43-05. See the risk-based approach to AML/CFT.

An organisation that processes personal data on behalf of a controller, on its instructions. Article 28 of the GDPR and Article 24 of Law 09-08 require a written contract. See the Moroccan processor of a European client.

Under the AI Act, an organisation that develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. A deployer can become a provider if it substantially modifies a system or puts its brand on it. See provider or deployer.

A principle that adjusts the intensity of checks to the level of risk: enhanced measures for high risks, simplified measures for low risks, unless there is suspicion. Law 43-05 requires it of obliged persons. See the risk-based approach to AML/CFT.

The underlying origin of a problem, as opposed to its symptoms. Dealing with the root cause of a family of complaints prevents them from recurring. See complaint management.

Clauses adopted by the European Commission (Decision 2021/914) to provide safeguards for data transfers to a third country. They comprise four modules depending on the role of the exporter and the importer. See the Moroccan processor of a European client.

A service provider to which a processor in turn entrusts part of the processing: hosting provider, software vendor, AI provider. The GDPR requires the controller's prior authorisation and the same obligations to be passed on. See a European client's questionnaire.

A written report sent to the ANRF by an obliged person when a transaction or funds appear to be linked to money laundering or terrorist financing. Disclosing it to the client is a punishable offence. See suspicious transaction reports.

A call made to a consumer to offer them a good or a service. In France, since 11 August 2026, it has required the person's prior consent, subject to exceptions. See the French telemarketing law.

An assessment, carried out before a data transfer outside the Union, of the law and practices of the destination country and of the supplementary measures needed. The EDPB describes it in six steps. See the Moroccan processor of a European client.

The obligation, applicable since 2 August 2026, to inform people that they are interacting with AI, to mark generated content and to disclose deepfakes. See the obligation to tell customers they are talking to AI.