Contents
Why digitise client intake
In most firms, client intake happens by phone, email and messaging apps. Documents arrive out of order, through several channels, and staff spend time chasing them. The client, for their part, does not know what is missing or why it is being requested.
For files subject to Law 43-05, this scattering becomes a risk: incomplete identification, an undocumented beneficial owner or a copy of a national ID card (CIN) lost in a messaging app. A structured journey solves both problems at once.
The eight-step journey
| Step | What the client sees | What the firm obtains | Reference rule |
|---|---|---|---|
| 1. Appointment | Slot chosen online, confirmation | A qualified request | Minimal collection (Law 09-08, Art. 3) |
| 2. First-contact form | A few questions about the need | File type, within AML/CFT scope or not | Informing the client (Art. 5) |
| 3. Identity and beneficial owner | Fields adapted to a natural or legal person | Structured identification | Law 43-05, Art. 4 |
| 4. Risk questions | Simple, explained questions | Inputs for classification | Law 43-05, Art. 3 |
| 5. Document upload | Clear list, secure upload | Documents filed in the case file | Security (Law 09-08, Art. 23) |
| 6. Engagement letter | Reading and signature | A formalised mandate | Professional practice |
| 7. Information and consents | Readable notice, separate tick boxes | Evidence that the client was informed | Law 09-08, Art. 4 and 5 |
| 8. Follow-up and closure | File status | Traceability, retention | Law 43-05, Art. 7 |
Appointment and first contact
The client chooses a slot and describes their need in a few lines. At this point the form asks for neither an identity document nor a CIN number: nothing justifies it yet. Its purpose is to route the request and to spot whether the file falls within the scope of Article 5 of Law 43-05 (property sale, company formation, fund management).
Identity, beneficial owner and risk questions
For files within scope, the journey asks for what the law requires: identity, the representative's powers, the ownership structure up to the natural persons, the purpose of the transaction, the source of funds. The questions are worded simply and come with a sentence explaining why they are being asked. The answers feed the classification provided for by the risk-based approach, which the professional validates.
Secure document upload
The client receives a list of documents tailored to their file and uploads them to an encrypted area with access control. Each document is attached to the file, dated and marked "received", "to be completed" or "validated". Staff can see at a glance what is missing.
Engagement letter
The engagement letter is presented online, with the scope of the work and the basis on which fees are set. The client reads and signs it, then receives a copy.
Information and consent: keep them separate
Data required by Law 43-05 rests on the legal obligation (Article 4 of Law 09-08), not on consent. The client must be informed of this (Article 5): who processes their data, why, for which recipients and how to exercise their rights. Consent is requested only for optional items, such as a newsletter, in a separate box that is not pre-ticked. Processing the CIN number requires prior authorisation from the CNDP, Morocco's data protection authority (Article 12). The guide to KYC and Law 09-08 sets out these rules in detail.
The limits of WhatsApp
WhatsApp is the channel clients use spontaneously. It has its place in the journey, but not for everything:
- Useful for: confirming an appointment, reminding the client that a document is awaited, sending the link to the secure area.
- To avoid for: receiving identity documents, articles of association, statements or any other document in the file.
The reasons are practical: documents arrive on a phone, often a personal one; the firm controls neither access, archiving nor deletion; and the service is hosted outside Morocco, which raises the question of transfers of data abroad.
Retention and closure
On closure, the file is frozen: documents, due diligence analysis, engagement letter, correspondence. Files within the scope of Law 43-05 are kept for ten years (Article 7); other files follow the retention period set for their purpose. The file is stored in a restricted-access area, then deleted according to a deletion schedule. The client receives a closing message summarising what has been done and how to contact the firm.
What KaperX builds and what we measure
We start from the scoping of each project to understand where files get stuck, then assemble the relevant digital building blocks: appointment booking, conditional forms, upload area, signature, tracking dashboard. In parallel, we prepare the information notices and the elements of the CNDP authorisation application, which the firm files in its own name.
| Indicator | What it reveals |
|---|---|
| Time from first contact to complete file | How smoothly client intake runs |
| Share of files complete at first upload | How clear the requests made to the client are |
| Number of reminders per file | Avoidable administrative workload |
| Files within AML/CFT scope with complete identification | The quality of documented due diligence |
| Documents received outside the secure area | Channel leaks to fix |
These indicators are measured at launch and again at the 90-day follow-up. How the client experiences these steps matters as much as compliance: see trust from the first contact.
Next step
Tell us how clients currently start working with your firm and which files take up most of your time. We will reply with an initial assessment and, if relevant, a proposal for a diagnostic.
Further reading
- 2 min read
Solutions
Who we build for - 7 min read
- 7 min read
- 7 min read
Frequently asked questions
Can an online journey replace identity verification by the professional?
No. The journey collects and organises the information and documents; verification and the due diligence analysis remain the responsibility of the professional subject to Law 43-05. The journey makes verification faster and better documented, but it does not make the decision.
Can identity documents be received via WhatsApp?
This is not recommended for a file subject to Law 43-05. The firm controls neither access to, nor archiving of, nor deletion of documents received on a phone, which is often a personal one. WhatsApp remains useful for setting up an appointment or flagging that a document is awaited, with a link to the secure area.
Should the journey ask for the client's consent?
Not for data required by Law 43-05, which rests on the legal obligation. The client must, however, be informed of the processing. Consent is requested only for optional items, such as a newsletter, and in a separate tick box.
How long does it take to set up such a journey?
It depends on the number of file types, the existing tools and the CNDP formalities to be completed. Design generally takes a few weeks, and the journey is rolled out gradually, starting with the most frequent type of file.
Does the journey work in Arabic?
Yes. We design the forms, information notices and messages in French and Arabic, with an English version if your clients include non-residents.
General information, not legal advice.
Report an errorReferences (3)
- Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (Law No. 09-08 on the protection of individuals with regard to the processing of personal data), Dahir No. 1-09-15 of 18 February 2009. (opens in a new tab)
- Office des Changes. Loi n° 43-05 relative à la lutte contre le blanchiment de capitaux (Law No. 43-05 on combating money laundering), updated and consolidated version. (opens in a new tab)
- CNDP. Filing an application for prior authorisation. (opens in a new tab)