Morocco

MA · MAR · Middle East & Africa

4 regulators · 8 laws & regulations · 8 obligations

Obligation	Timing	Regulator	Arises from	Source
All industries
Cybersecurity incident declaration to the national authority	Deadline As soon as the entity becomes aware (Art. 8); without delay (Art. 30)	—	Loi n° 05-20 relative à la cybersécurité (Law No. 05-20 on cybersecurity)	source
Art. 8 of Law 05-20 requires entities to report incidents affecting security to the national authority as soon as they become aware of them. Art. 30 requires telecom operators, internet service providers, cybersecurity providers, digital service providers and platform publishers to alert the authority without delay when they detect events that could affect their clients' systems. Art. 33 requires digital service providers to report incidents with a significant impact on service delivery. No fixed hour or day limit was found in the text read.
Data subject notice, consent and rights	Ongoing	—	Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (Law No. 09-08 on the protection of individuals with regard to the processing of personal data)	source
Art. 4 of Law 09-08 requires the data subject's unambiguous consent to processing, subject to listed exceptions such as legal obligation and contract performance. Art. 5 requires the controller to give clear notice of its identity and the purposes when collecting data directly. Arts. 7-9 give rights of access, rectification, erasure or blocking (Art. 8 refers to a ten-day deadline) and objection, including free objection to marketing use. Arts. 12-15 require prior declaration to, or authorisation from, the CNDP before certain processing.
Reporting channel and protection for corruption whistleblowers	Ongoing	INPPLC	Loi n° 46-19 relative à l'Instance nationale de la probité, de la prévention et de la lutte contre la corruption (Law No. 46-19 on the National Authority for Integrity, Prevention and Combating of Corruption)	official
Art. 21 of Law 46-19 lets anyone with reliable information report corruption to the Authority's president; reports must be written and signed. Arts. 22-24 set how files are closed, treated as urgent or studied, and Art. 22 requires the reporter to be notified within 15 days when a file is closed. Art. 39 gives reporters and complainants the protections available to victims, witnesses and experts under criminal procedure law, lets the Authority conceal their identity and penalises false reports made in bad faith.
Banking
AML record retention	Retention period 10 years	—	—	source
Art. 7 of Law 43-05 requires transaction records to be kept for ten years from the date of execution and identity records for ten years from account closure or the end of the relationship. Records needed to reconstruct transactions and the results of analyses are also kept.
Suspicious transaction reporting	Deadline Immediately (« immédiatement », Art. 9)	—	—	source
Art. 9 of Law 43-05 requires covered entities to file a declaration immediately when a transaction is suspected of being linked to money laundering or terrorism offences. Art. 10 requires it in writing (orally in urgent cases, with written confirmation), Art. 11 extends it to executed transactions, and Art. 17 lets the unit oppose a transaction for four working days.
Insurance
Insurance sector AML record retention	Retention period 10 years	ACAPS	Circulaire n° AS/02/19 du 25 septembre 2019 relative aux obligations de vigilance et de veille interne incombant aux entreprises d'assurances et de réassurance et aux intermédiaires d'assurances (Circular AS/02/19 on due diligence and internal monitoring duties of insurers, reinsurers and intermediaries)	official
Art. 35 of Circular AS/02/19 requires transaction records and due diligence documents to be kept for ten years from contract expiry or the end of the relationship, and Art. 36 requires analysis results to be kept for ten years from their creation.
Insurance sector AML vigilance system and responsible officer	Ongoing	ACAPS	Circulaire n° AS/02/19 du 25 septembre 2019 relative aux obligations de vigilance et de veille interne incombant aux entreprises d'assurances et de réassurance et aux intermédiaires d'assurances (Circular AS/02/19 on due diligence and internal monitoring duties of insurers, reinsurers and intermediaries)	official
Arts. 2-4 of Circular AS/02/19 require insurers, reinsurers and intermediaries to run a permanent due diligence and internal monitoring system, documented in a board-approved manual. Art. 9 requires a senior responsible officer who centralises unusual transactions, reports to the board and liaises with the financial intelligence unit; Art. 40 requires an AML officer for groups.
Insurance sector suspicious transaction reporting	Deadline Without delay (« sans délai », Art. 24)	ACAPS	Circulaire n° AS/02/19 du 25 septembre 2019 relative aux obligations de vigilance et de veille interne incombant aux entreprises d'assurances et de réassurance et aux intermédiaires d'assurances (Circular AS/02/19 on due diligence and internal monitoring duties of insurers, reinsurers and intermediaries)	official
Art. 24 of Circular AS/02/19 requires the firm to refuse or end the relationship and file a suspicion report without delay when identity cannot be established or is fictitious. Art. 32 requires an immediate report where deferring due diligence steps to avoid tipping off.
No obligations match these filters.