Morocco

Promulgated by Dahir n° 1.21.36 of 21 April 2021, with 54 articles. It sets the Authority's missions (Art. 4), the receipt of reports and complaints (Arts. 21-24), the duty of administrations to cooperate (Art. 35) and protection for reporters and complainants (Art. 39). It succeeds the Central Authority for the Prevention of Corruption (Art. 53).

Promulgated by Dahir n° 1-20-69 of 25 July 2020 (BO 6906 of 6 August 2020). It provides for a national cybersecurity authority (Arts. 1, 38), incident declaration (Arts. 8, 30, 33), critical infrastructure and sensitive systems (Arts. 14-19), audits (Arts. 4, 20-24, 34) and penalties (Arts. 49-52). Decree 2-21-406 of 15 July 2021 implements it and designates the DGSSI as the authority.

Promulgated by Dahir n° 1-20-100 of 31 December 2020 (BO 6970 of 18 March 2021). Art. 3 lists the trust services: electronic signatures, seals, timestamps and registered electronic delivery, certificates for these and for website authentication, validation and preservation. Art. 32 reserves qualified trust services to approved providers. Art. 76 amends the Code of Obligations and Contracts so that a deed with a qualified electronic signature and qualified timestamp has the evidentiary force of an authenticated deed (Art. 417-3).

ACAPS circular homologated by arrêté n° 1662-19 of 19 November 2019 and published in BO 6848 of 16 January 2020. It requires a permanent vigilance system (Arts. 2-4), a senior responsible officer (Art. 9), client identification and risk classification (Arts. 13-19, 26, 33) and ten-year record keeping (Arts. 35-36).

Statute of the central bank, promulgated by Dahir n° 1-19-82 of 21 June 2019, which replaced the 2006 statute. Bank Al-Maghrib describes it as reinforcing the bank's independence and its monetary, exchange-rate and financial-stability missions. The full text was not machine-readable, so the article content was not checked.

The banking law, promulgated by Dahir n° 1.14.193 of 24 December 2014 (BO 6328 of 22 January 2015). It covers credit institutions (banks and finance companies), payment institutions (Arts. 15-17, 22) and participative banks (Arts. 54-58), and sets up a disciplinary committee that proposes sanctions (Art. 28, Art. 178).

Promulgated by Dahir n° 1-09-15 of 18 February 2009 and published in BO 5714 of 5 March 2009. It sets consent and notice rules (Arts. 4-5), data subject rights of access, rectification and objection (Arts. 7-9), prior declaration or authorisation by the CNDP (Arts. 12-15), security duties (Art. 23) and limits on transfers abroad (Arts. 43-44). No data breach notification duty appears in the text read.

Creates ACAPS as a public-law body with financial autonomy (Art. 1), gives it power to issue circulars (Art. 3), investigate complaints (Art. 7) and ensure compliance with the AML law 43-05 (Art. 8). It also sets up the disciplinary commission (Arts. 23-26), allows the Authority to publish its sanctions (Art. 50) and sends appeals to the administrative court of Rabat (Art. 51). The effective date is taken from ACAPS's own description of itself.