Morocco: technology regulation at a glance

Framework: Draft Bill 42.25 (avant-projet de loi n° 42-25) on crypto-assets, published November 2025 for public consultation; joint oversight by Bank Al-Maghrib and AMMC. Current operative restriction: 2017 joint warning by Bank Al-Maghrib, Office des Changes, AMMC, and ACAPS declaring crypto use unauthorized under Morocco's foreign-exchange regime.

Morocco operated under a de facto restriction on crypto since a 2017 joint regulatory warning that cryptocurrency use was unauthorized under its foreign-exchange rules, with the Office des Changes conducting enforcement actions against holders in 2025. In November 2025 the Ministry of Economy and Finance published Draft Bill 42.25, a comprehensive MiCA-inspired framework jointly prepared with Bank Al-Maghrib and the AMMC, establishing licensing for crypto-asset service providers (CASPs), dual-authority oversight, and investor protections. As of May 2026 the bill remains in parliamentary review; no licences have yet been issued and crypto is still not recognized as legal tender or a payment method.

Framework: Draft Digital X.0 Framework Law (2025, under government review); Maroc Digital 2030 national strategy (Ministry of Digital Transition and Administrative Reform); CNDP oversight under Law 09-08 on personal data protection

Morocco has no enacted AI-specific legislation as of May 2026. A draft Digital X.0 Framework Law, unveiled in late 2025 and under review by the General Secretariat of the Government ahead of expected parliamentary consideration in 2026, would embed AI governance, data governance, digital identity, and interoperability requirements into a single legal instrument. In parallel, the Maroc Digital 2030 national strategy (launched September 2024) sets the strategic direction, and the data protection authority CNDP has initiated a deliberation on AI and personal data processing under existing Law 09-08.

Framework: Law No. 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data (promulgated by Dahir 1-09-15); Implementing Decree No. 2-09-165 of 21 May 2009; supervised by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)

Morocco has a comprehensive, standalone personal data protection law, Law 09-08, in force since 2009, modelled on the pre-GDPR EU Data Protection Directive 95/46/EC. The CNDP is the independent supervisory authority responsible for registration, authorisation, investigation, and enforcement. Morocco has not yet received an EU adequacy decision under the GDPR, though its application has been pending since 2009 and alignment efforts continue.

Framework: Law No. 103-12 on credit institutions and similar bodies (Dahir No. 1-14-193 of Dec. 24, 2014) and Bank Al-Maghrib (BAM) implementing circulars; BAM is the sole licensing/supervisory authority for payment institutions and e-money

Morocco operates a clear, in-force licensing regime for digital payments. Under Law 103-12, 'établissements de paiement' (payment institutions) and electronic-money issuance are defined activities requiring prior approval (agrément) from the Governor of Bank Al-Maghrib, with a minimum capital of MAD 3 million. The regime is actively used, BAM granted its first payment-institution license in October 2025 and published a formal fintech licensing-pathway guide in December 2025, though open banking remains unregulated and BNPL has no dedicated framework.

Framework: Law No. 02-03 (Dahir No. 1-03-196 of 16 Ramadan 1424 / 11 November 2003) on the entry and residence of foreigners in Morocco, supplemented by Implementing Decree No. 2-09-607 of 1 April 2010; administered by the General Directorate of National Security (DGSN)

Morocco has no dedicated digital nomad or remote-work visa as of mid-2026. Many nationalities (EU, US, UK and others) may enter visa-free for up to 90 days, after which remote workers who wish to stay long-term must apply for a carte de séjour (residence permit) under an available category such as independent professional or self-employed, in accordance with Law 02-03. No formal golden-visa or citizenship-by-investment programme exists, though discretionary investment-linked residency is available.

Framework: Law No. 88.13 (Press Code, 2016), Penal Code provisions for online speech, Law No. 07-03 on cybercrime, Budapest Convention on Cybercrime (ratified 2018); HACA (Haute Autorité de la Communication Audiovisuelle) as audiovisual regulator; DSA-inspired platform regulation draft law under preparation (2025)

Morocco regulates online content through a patchwork of existing instruments, the 2016 Press Code, Penal Code, and cybercrime statutes, rather than a single comprehensive online-safety law. Platforms currently face no dedicated liability regime for user-generated content. The government is finalising a draft law to expand HACA's mandate over digital platforms, modelled on the EU Digital Services Act, but as of mid-2026 this legislation has not been enacted.

Framework: Law No. 05-20 on Cybersecurity (2020), implemented by Decree 2-21-406 (2021), enforced by the General Directorate of Information Systems Security (DGSSI) under the Ministry of National Defence

Morocco enacted a comprehensive cybersecurity law (Law 05-20) in 2020 that establishes mandatory organisational and technical security obligations for public administrations, local authorities, public institutions, and private critical-infrastructure operators managing sensitive information systems. The DGSSI is the designated national cybersecurity authority responsible for oversight, incident management, and issuing binding security directives. The framework has been progressively strengthened through a 2023 incident-management framework, a 2024 cloud-services decree (No. 2-24-921), and a National Cybersecurity Strategy extending to 2030.

Framework: Law 03-22 (Investment Charter, December 2022); Law No. 5-96 on commercial companies as amended (SARL/SA); OMPIC and Regional Investment Centers (CRIs) under Law No. 47-18 as amended by Law No. 22-24

Morocco permits 100% foreign ownership in most sectors under the 2022 Investment Charter (Law 03-22), with company registration centralized through Regional Investment Centers (CRIs) acting as one-stop shops. A SARL can be formed with a nominal MAD 1 minimum capital and registered in roughly 3-7 business days, though the process still requires notarization, multiple administrative filings, and mandatory legal-notice publication. Certain sectors, fisheries (capped at 49% foreign stake), audiovisual/media, and agriculture, retain ownership restrictions.