Verifying Client Identity without Over-collecting: KYC and Law 09-08

Two laws, one file#

Law 43-05 on combating money laundering requires firms to identify the client, its representatives and its beneficial owner, to verify this information using reliable documents and to keep it for ten years. Law 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data governs all processing of personal data. Both apply at the same time to the same file. They do not contradict each other: the first says what must be collected, the second says how to do it.

The reading below is our own. No single CNDP text sets it out, but it follows from how the two laws fit together.

The legal basis: obligation, not consent#

Article 4 of Law 09-08 makes consent the rule, with exceptions. One of them is compliance with a legal obligation. Data required by Law 43-05 rests on this exception: asking the client to "consent" to identity verification makes no sense, since they cannot refuse without the relationship coming to an end.

Consent becomes necessary again, however, for anything outside that obligation, for example sending a newsletter by email. Do not combine the two in a single tick box.

The CIN number: prior authorisation#

The CNDP, Morocco's data protection authority, states that processing involving the national identity card number is subject to the prior authorisation provided for in Article 12 of Law 09-08. A simple declaration is not enough. A firm that enters this number into its practice management software or tracking spreadsheet must file the application before processing begins. The CNDP compliance method explains the process in detail.

Processing data without the required formality is punishable by a fine of MAD 10,000 to 100,000 (Article 52). Unfair or fraudulent collection carries heavier penalties (Article 54). See the CNDP penalty schedule.

Informing the client#

Article 5 requires the following to be stated at the time of collection:

• the identity of the firm acting as controller;
• the purpose: compliance with the obligations of Law 43-05 and management of the file;
• the recipients, including the authorities empowered by law;
• the rights of access, rectification and objection, and how to exercise them.

The notice can appear in the onboarding form and in the engagement letter, in French and Arabic. It explains the general framework, without ever referring to a suspicious transaction report, which Article 29 of Law 43-05 prohibits.

Collect what the law requires, nothing more#

The right reflex: for every field in the form, be able to cite the obligation it serves. A field with no justification is removed.

Copies of identity documents#

We have not identified any CNDP deliberation dealing specifically with photocopies of the CIN. Deliberation No. 478-2013, sometimes cited on this point, actually concerns biometrics for access control.

The closest text is Deliberation No. 479-AU-2013 of 1 November 2013, a model authorisation for the management of bank customer accounts. It includes identity documents among the data that may be collected, cites Law 43-05, names the UTRF (now the ANRF) as a recipient and limits retention to the period necessary, unless a longer period is required by law. It shows how the CNDP reads know-your-customer requirements.

For a firm, a proportionate practice is to:

1. keep the copy only for files within the scope of Law 43-05, as evidence of the verification;
2. not photocopy the CIN for a simple appointment or an out-of-scope file;
3. store the copy in a restricted-access location, never in a personal mailbox;
4. record the date and author of the verification.

Keep for ten years, then delete#

Article 7 of Law 43-05 sets retention at ten years: from the end of the relationship for identification records, and from the transaction for transaction records. This is the necessary period within the meaning of Article 3 of Law 09-08. When it expires, the data is deleted or anonymised. A deletion schedule, kept in the record of processing activities, avoids holding on indefinitely to archives that no law justifies any longer.

Security and access#

Article 23 requires technical and organisational security measures; Article 24 requires a written contract and security guarantees with every processor, including software vendors and hosting providers. In practice: role-based access rights, logging of access to sensitive files, encryption of stored documents and a procedure for data breaches. If your tools are hosted outside Morocco, also check the rules on transferring data abroad.

Checklist#

• Every field in the KYC form is linked to an obligation under Law 43-05.
• The CNDP authorisation application covering the CIN number has been filed.
• The information notice appears in the form and the engagement letter.
• Copies of documents are stored in a secure, logged location.
• The ten-year deletion schedule has been defined.
• Contracts with service providers contain the security clauses.