Complete 2026 AML/CFT Guide: Anti-Money Laundering Obligations for Businesses in Morocco

Obliged persons are determined by Article 2 of Law No. 43-05, as worded following, in particular, Law No. 12-18. The framework primarily covers financial activities: credit institutions, similar bodies, payment institutions, finance companies, insurance and reinsurance undertakings, insurance intermediaries, capital market participants, investment undertakings, and entities carrying out funds transfers. Their size is not decisive. A small agency belonging to a transfer network is still required to identify its clients, monitor transactions, and escalate suspicions.

Certain non-financial professions are also concerned because of the transactions they carry out. These include notaries, adouls, chartered accountants, licensed accountants, real estate agents and intermediaries, dealers in precious metals or stones, casino operators, and professionals involved in trading high-value goods under the conditions established by law or regulations. A very small business carrying out a covered activity does not benefit from a general exemption. It may adapt its organization to its staffing level, but it may not dispense with client identification, retention of supporting documents, or reporting of a suspicion.

Lawyers are not subject to these obligations for all their activities. The regime covers the situations specified by law, particularly when they participate, on behalf of a client, in certain financial, real estate, corporate, or funds management transactions. Information received to assess a client’s legal position, conduct the client’s defense, or represent the client in proceedings benefits from the protections associated with professional secrecy and defense rights. Classification therefore depends on the work actually performed, not merely on the description appearing on the fee invoice.

An ordinary commercial business that sells clothing or provides IT services is not automatically an obliged person within the meaning of Article 2. It nevertheless remains exposed to money laundering offenses under the Criminal Code if it knowingly accepts funds of criminal origin, conceals their source, or makes its structure available for an unlawful transaction. Similarly, a mixed activity must be analyzed on a branch-by-branch basis. A non-financial group owning a payment subsidiary, real estate agency, or asset management entity must apply the corresponding obligations to the entity and transactions concerned.

A suspicious transaction report is not an accusation and requires neither proof of the predicate offense nor certainty that money laundering has occurred. The obliged person reports when they know, suspect, or have reasonable grounds to suspect that funds are derived from an offense, are connected to money laundering, or may finance terrorism. Indicators may include an inconsistent price, a contribution disproportionate to income, a series of unjustified transfers, a nominee, an unexplained early repayment, or structuring intended to avoid controls. The amount alone does not determine whether suspicion exists.

The file is analyzed by the AML/CFT officer or authorized person, without creating a process so burdensome that it delays reporting. The report submitted to the ANRF specifies the identity of the persons concerned, the accounts or assets, the amounts, the dates, the sequence of events, and the objective reasons for the suspicion. Relevant contracts, KYC documents, statements, correspondence, and flow diagrams are attached using the secure channel and technical procedures established by the Authority. Goumruk is a customs platform and must not be presented as the general reporting portal for the ANRF.

As a rule, a suspicious transaction is not carried out before the report is submitted where it can be deferred without jeopardizing investigations. Where it has already been carried out because it was impossible to defer it or because the suspicion arose afterward, the report is submitted without delay. Article 17 of consolidated Law No. 43-05 governs the ANRF’s power to suspend a transaction for a limited statutory period, which may be extended by judicial decision under the conditions set out in the text. There is no general thirty-day period during which every reported transaction is automatically blocked.

The report and its consequences are confidential. Article 19 of Law No. 43-05 prohibits disclosing to the client or a third party that a report has been made, is being considered, or is under analysis. This is tipping-off. An employee may request additional supporting documents in a neutral manner but must never say that the client has been reported to the ANRF. Information may circulate internally only among persons who need it to fulfill their obligations, in compliance with the rules applicable to groups.

The law protects a report made in good faith and in the required form, even if subsequent analysis does not confirm the suspicion. This protection does not cover an intentionally false report, misuse of the procedure, or personal participation in the transaction. After submission, the business retains the file, responds to requests for additional information from the ANRF, and continues monitoring. It does not contact the client directly to ask the client to justify the report. If a suspension order, official request, or freezing measure is received, it must be executed immediately and documented in strict detail.

The penalties for the offence of money laundering must not be confused with those relating to an incomplete KYC file. Article 574-3 of the Criminal Code generally punishes a natural person found guilty of money laundering with two to five years’ imprisonment and a fine of 20,000 to 100,000 DH. The sometimes published figures of two to ten years and one million dirhams for basic money laundering do not correspond to the scale set out in this article. Attempts are punishable under the provisions of the Criminal Code, and several acts involving the same funds may be addressed in a single proceeding.

Article 574-4 of the Criminal Code provides for the doubling of penalties where money laundering is committed habitually, by using facilities provided by a professional activity, by an organised group or in the case of repeat offending. These circumstances directly concern managers or professionals who misuse their business, mandate or access to the financial system. Article 574-5 also provides for the confiscation of property, assets and income linked to the offence, subject to the rights of good-faith third parties, as well as additional penalties that may affect the activity or the publication of the decision.

For legal persons, Article 574-3 provides for a fine of 500,000 to 3,000,000 DH, without excluding the criminal liability of the managers or employees involved. Other consequences may be ordered under the conditions laid down in the Criminal Code, including confiscation, dissolution where the legal conditions are met, closure of an establishment or prohibition from carrying out certain activities. The company’s liability therefore does not protect a manager who gave instructions, approved a sham arrangement or deliberately disabled internal controls.

A preventive compliance breach may also trigger the penalties provided for by consolidated Law No. 43-05 and sector-specific regulations. Depending on the activity and seriousness of the breach, the supervisory authority may issue a warning or reprimand, impose a financial penalty, restrict an activity, order a suspension or propose the withdrawal of an authorisation. Repeated deficiencies, failure to remedy them after formal notice and obstruction of supervision generally increase exposure. Professional bodies may, for their part, initiate disciplinary proceedings against a notary, lawyer, chartered accountant or other regulated professional.

In the event of a criminal investigation, the Public Prosecutor’s Office directs investigations with the competent services. The ANRF analyses and supplements reports, then forwards to the prosecution service any intelligence whose nature may justify prosecution; it does not itself impose a criminal conviction. The competent criminal court depends on the legal classification, the location of the acts and the rules of criminal procedure. The entity must preserve the requested documents, comply with official requests and organise its defence without retrospectively altering files. Fabricating supporting evidence after an inspection may create an additional criminal issue.

There is no universal threshold of 100,000 DH below which all due diligence would be waived or above which a report would automatically be triggered. Applicable thresholds depend on the activity, transaction and sector-specific texts in force. They never replace the suspicion criterion: an 8,000 DH transaction may be reportable if it is split or inconsistent, whereas a larger, properly substantiated transaction is not automatically criminal. AML/CFT rules must also be distinguished from limits or tax consequences applicable to cash payments.

In real estate, the price stated in the deed must reflect the actual payments. A portion paid outside the deed, financing provided by a third party with no apparent connection, a rapid resale without economic justification or a company with no identifiable activity are serious red flags. The notary and real estate agent must not accept a statement such as “paid in cash” without understanding the flow of funds. Splitting a deposit among several people or across several days does not eliminate the overall transaction and may, on the contrary, heighten suspicion.

For a lawyer, the difficulty lies in separating protected legal defence and advice from transactional engagements falling within the scope of the law. Before handling funds, creating a structure, arranging a transfer or participating in a real estate transaction, the firm must classify the engagement and verify the applicable professional rules. Professional secrecy cannot be invoked generally to knowingly facilitate an unlawful transaction. Conversely, the reporting obligation must not be extended without a legal basis to information received solely to defend the client in proceedings.

Virtual assets require particular caution. Their inclusion in the AML/CFT framework and the possible designation of service providers as obliged entities do not mean that all crypto-asset transactions are freely authorised in Morocco. In 2026, the status of banking and exchange-control texts, as well as any specific regime that may have been adopted, must be checked before accepting or intermediating a transaction. Apparent anonymity, unhosted wallets, foreign platforms, repeated conversions and transfers to high-risk jurisdictions warrant enhanced analysis of the source of funds.

The costliest mistakes are often simple: an outdated KYC file, a beneficial owner copied without verification, a nominal compliance officer, premature destruction of records or disclosure of the report to the client. Another mistake is waiting for criminal proof before reporting. The obliged entity must document a reasonable suspicion, not conduct a police investigation. Conversely, an automated alert does not automatically constitute a report: it must be analysed promptly, supported by reasons and closed with a written record if the supporting documents reasonably allow it to be ruled out.