Skip to content

Risk & Compliance

GRC for Morocco's Financial Sector

By KaperX Editorial Team4 min read

Contents

Who supervises what

ActivityAuthorityKey texts
Banks and similar institutionsBank Al-MaghribLaw No. 103-12; Bank Al-Maghrib directives and circulars
Insurance and reinsuranceACAPSInsurance Code and ACAPS circulars
Capital markets, listed companiesAMMCCapital markets regulations
Anti-money launderingSupervisory authorities and the ANRF (Morocco's financial intelligence authority)Law No. 43-05, amended in particular by Law No. 12-18
Personal dataThe CNDP (Morocco's data protection authority)Law No. 09-08 on personal data protection

The pillars of the banking framework

  • The compliance function. Since Directive No. 49/G/2007 of 31 August 2007, credit institutions have been required to have a compliance function responsible for managing non-compliance risk.
  • Internal control. Circular No. 4/W/2014 sets out the internal control system for credit institutions.
  • Cloud outsourcing. Directive No. 4/W/2022 of 19 May 2022 sets minimum rules for cloud outsourcing, including prior approval for material outsourcing and audit rights. See third-party risk management.
  • Governance. The codes of good governance launched on 18 December 2025 include a code specific to credit institutions and a code specific to insurance and reinsurance companies.

Anti-money laundering

Morocco was removed from the FATF grey list on 24 February 2023, at the end of an action plan that strengthened its framework. For financial institutions, this means ongoing obligations: know your customer, transaction monitoring, suspicious transaction reporting to the ANRF, record retention and staff training. These obligations intersect with Law 09-08, because KYC data is personal data.

The three lines in a bank

  • First line: branches and business units, which manage risk in their day-to-day operations.
  • Second line: risk management and compliance, which set the framework and provide oversight.
  • Third line: internal audit, which provides independent assurance to the board.

Emerging priorities

  • AI in decision-making: credit scoring, fraud, customer relationships. See AI in banking.
  • Cyber risk and resilience, in connection with Law No. 05-20.
  • Third-party risk, as technology and cloud providers multiply.
  • Customer protection, in digital journeys as well as in branches.

Annual review checklist

  • Non-compliance risk map updated.
  • Compliance monitoring plan carried out and documented.
  • AML/CFT training delivered to all relevant staff.
  • Outsourcing arrangements inventoried, assessed and governed by contract.
  • Data processing operations notified to or authorised by the CNDP.
  • Report to the board on risk, compliance and culture.

Further reading

Frequently asked questions

Which directive governs the compliance function of banks in Morocco?

Bank Al-Maghrib Directive No. 49/G/2007 of 31 August 2007 on the compliance function. It requires credit institutions to have a function responsible for managing non-compliance risk.

Is Morocco still on the FATF grey list?

No. Morocco was removed from the FATF list of jurisdictions under increased monitoring on 24 February 2023.

Is there a governance code specific to Moroccan banks?

Yes. The codes of good governance launched on 18 December 2025 include a code specific to credit institutions and a code specific to insurance and reinsurance companies.

General information, not legal advice.

Report an error

Share

Share on LinkedIn (opens in a new tab)Share on WhatsApp (opens in a new tab)

References (8)

  • Law No. 103-12 on credit institutions and similar bodies.
  • Bank Al-Maghrib. Directive No. 49/G/2007 of 31 August 2007 on the compliance function.
  • Bank Al-Maghrib. Circular No. 4/W/2014 on internal control in credit institutions.
  • Bank Al-Maghrib. Directive No. 4/W/2022 of 19 May 2022 setting minimum rules for cloud outsourcing.
  • National Corporate Governance Commission (CNGE), Ministry of Investment and CGEM (18 December 2025). Codes of good corporate governance (general code and sector codes).
  • Law No. 43-05 on combating money laundering, as amended in particular by Law No. 12-18.
  • FATF (24 February 2023). Jurisdictions under increased monitoring: removal of Morocco.
  • The Institute of Internal Auditors (2020). The IIA's Three Lines Model.