Risk & compliance: what applies, to whom, and when

In Morocco, Law No. 43-05, as amended by Law No. 12-18 published in the Official Bulletin on 2 September 2021, brings lawyers, notaries, adouls, accountants and real estate agents, among others, within the anti-money laundering regime. Legal and accounting professions are covered only for certain transactions: real estate, fund management, companies. In those cases they must identify their clients and beneficial owners, keep records for ten years and report their suspicions to the ANRF, Morocco's financial intelligence unit.

7 min read

A European client that entrusts data or a service to a Moroccan provider must check that provider's guarantees: the GDPR requires it to choose only processors offering sufficient guarantees and to be able to audit them (Article 28). The questionnaire generally covers six domains: security, data protection, sub-processors, use of AI, continuity and ethics. The strongest response rests on an evidence room that is kept up to date.

7 min read

Bank Al-Maghrib publishes every year, in its banking supervision report, the number and nature of the complaints it receives. Circular No. 10/W/16 of 10 June 2016 requires banks to have a dedicated unit, to acknowledge receipt immediately, to reply within 40 working days and to file quarterly returns.

5 min read

The Moroccan Centre for Banking Mediation (CMMB, "Al Wassit Al Banki"), set up in 2013 and operational since 2014, offers free mediation after a complaint has gone without a satisfactory reply for 40 working days. It handles the case within 30 working days, a period that can be extended. Its proposal, if the customer accepts it, binds the institution up to 200,000 MAD for a bank. In 2024 it received 5,536 cases (+15%), and around half of the cases handled ended in an agreement.

5 min read

In Morocco, the beneficial owner is the natural person who ultimately owns or controls a client, even through a chain of companies (Article 1 of Law 43-05). Decree No. 2-21-708 of September 2021 uses, among other criteria, holding at least 25% of the capital or voting rights, and sets up a public register kept by OMPIC. Professionals subject to the law must identify and verify this information and keep it for ten years.

7 min read

A compliance culture exists when employees follow the rules because they understand why they matter, and feel able to report a problem without fear. The COSO framework makes it a principle in its own right: without culture, even the best-designed controls fail. It rests on leadership by example, a clear code of conduct, training, a protected whistleblowing mechanism and sanctions applied to everyone.

3 min read

According to COSO, risk appetite is the types and amount of risk, on a broad level, that an organisation is willing to accept in pursuit of value. It is distinct from risk tolerance, which sets the acceptable variation in performance around an objective. Formalised in a statement approved by senior management, it guides strategic decisions and the allocation of control resources.

3 min read

Morocco's financial sector is the most heavily regulated when it comes to GRC. Banks fall under Bank Al-Maghrib (Morocco's central bank), which requires in particular a compliance function (Directive No. 49/G/2007) and an internal control system (Circular No. 4/W/2014). Insurers fall under ACAPS (the insurance and pensions supervisor) and the capital markets under AMMC (the capital markets authority). On top of this come anti-money laundering rules, data protection and, since December 2025, sector-specific governance codes.

4 min read

Traditional compliance addresses obligations one by one, often through checklists managed by separate teams. A GRC approach integrates governance, risk management and compliance under a single management system: a shared register of risks and obligations, shared controls and a single view for senior management. It reduces duplication and surfaces risks earlier.

3 min read

ACAPS received 4,941 insurance complaints in 2024 (+4%), plus 541 relating to social welfare, according to its activity report published in April 2026. Motor insurance accounts for around two thirds, and 62% of cases arrive through the reclamation.acaps.ma platform, opened in 2017. An insurance mediator, appointed by ACAPS and the FMSAR, completes the system. No circular requiring insurers to have a complaints unit has been identified.

5 min read

In Morocco, Article 9 of Law 43-05 requires reporting entities, including lawyers, notaries, accountants and real estate agents within the scope of Article 5, to report without delay to the ANRF any funds or transactions suspected of being linked to money laundering or terrorist financing. The report is made in writing and remains mandatory even after the transaction has been carried out (Article 11), and professional secrecy cannot be invoked against the ANRF. Tipping off the client is a criminal offence (Article 29).

7 min read

The COSO ERM framework, published in 2017 under the title "Enterprise Risk Management — Integrating with Strategy and Performance", structures risk management around five components and twenty principles. It does not treat risk as a list of threats to avoid, but as a dimension of strategy: risks must be managed in order to create, preserve and realise value.

4 min read

Article 3 of Law 43-05 requires reporting entities, including law firms, notaries, accountants and real estate agents, to identify, assess and mitigate their money laundering and terrorist financing risks. In practice, every client and every file is given a risk level based on the client, geography, the transaction and the delivery channel. That level determines simplified, standard or enhanced due diligence, which is documented and updated periodically.

7 min read

Third-party risk management means identifying, assessing and monitoring the risks created by an organisation's suppliers, service providers, subcontractors and partners. It follows a six-step lifecycle: inventory, criticality ranking, due diligence, contract, monitoring and exit. In Morocco, it intersects with Law 09-08 on personal data protection (processors and transfers), the cloud rules of Bank Al-Maghrib (Morocco's central bank) for banks and Law 05-20 on cybersecurity for critical infrastructure entities.

4 min read