· Jurisdiction Briefing

Morocco after the grey list: the FIU, the supervisors and the offshore holding circular

On 24 February 2023 the FATF announced that Morocco was no longer subject to its increased monitoring process, the list often called the "grey list". The FATF said Morocco had met its action-plan commitments on the deficiencies identified in February 2021:…

Illustration for “Morocco: what a country does after it leaves the grey list”

On 24 February 2023 the FATF announced that Morocco was no longer subject to its increased monitoring process, the list often called the “grey list”. The FATF said Morocco had met its action-plan commitments on the deficiencies identified in February 2021: international cooperation, AML/CFT supervision, beneficial ownership transparency of legal persons, the capacity of the FIU, money-laundering investigations and confiscation, and targeted financial sanctions. It added that Morocco should continue to work with MENAFATF to sustain those improvements. Morocco is not among the jurisdictions on the FATF’s list of 19 June 2026.

Leaving the list is a change of status, not the end of the work. Here is what the official documents show since then.

The FIU’s cross-border work in 2024

The Autorité Nationale du Renseignement Financier (ANRF) is Morocco’s financial intelligence unit. Its 2024 annual report gives these figures for exchanges with foreign FIUs:

  • Requests received: 69 from counterpart FIUs, against 70 in 2023. European FIUs sent 40 of them, a 58% share.
  • Spontaneous communications received: 37, up from 30 in 2023 (an increase of 23.33%).
  • Requests sent: 56, to 18 counterpart FIUs, against 49 in 2023. European FIUs received 75% of them.

The report also describes the ANRF as an active member of the Egmont Group.

The picture is mixed rather than a surge. Incoming requests held steady; what grew was the information the ANRF received unprompted and the requests it sent out itself.

Offshore holding companies: Circular No. 2/2026

On 10 August 2026 the Office des Changes announced the publication of Circular No. 2/2026 on the vigilance and internal monitoring obligations of offshore holding companies. The circular is issued under Law No. 43-05 on money laundering, as amended, and Law No. 58-90 on offshore financial centres. It falls within the supervision and control of offshore holding companies entrusted to the Office des Changes.

According to the Office des Changes’ press release, the circular:

  • takes a risk-based approach, with a vigilance system suited to each company’s size, activity and risk level;
  • covers identifying and knowing customers and beneficial owners, and checking the origin and destination of funds;
  • sets obligations to monitor transactions, with enhanced vigilance for unusual, complex or high-risk ones;
  • provides for each offshore holding company to designate a compliance officer responsible for implementing and controlling the vigilance system.

On timing: the announcement came about three and a half years after the grey-list exit, and three months after Morocco hosted the 42nd MENAFATF Plenary in Rabat (11–13 May 2026).

Who supervises what

The March 2025 joint guide sets out the AML/CFT roles of the ANRF, the CNASNU, Bank Al-Maghrib, the AMMC and ACAPS. The Office des Changes and CNDP rows come from those bodies’ own documents.

BodyAML/CFT-relevant role, per the documents
ANRFNational FIU. Coordinates the authorities’ AML/CFT action; receives and analyses suspicious transaction reports; sets the general and strategic AML/CFT orientations within government policy; exchanges financial intelligence with foreign FIUs
CNASNUThe national commission applying UN Security Council sanctions on terrorism, proliferation and their financing. Freezes, immediately and without prior notice, the assets of those named on the lists annexed to the resolutions; enters persons and entities on the local sanctions list and reviews it periodically
Bank Al-MaghribSupervisor for credit institutions, “assimilated bodies” (including payment institutions, microfinance associations and offshore banks) and financial conglomerates
AMMCSupervisor for capital-market participants, including fund management companies, brokerage firms, financial investment advisers, crowdfunding companies and securities account keepers
ACAPSOversees AML/CFT compliance by insurance and reinsurance companies and insurance intermediaries
Office des ChangesRegulates and controls foreign-exchange operations; ensures compliance with Law 43-05 by the entities under its control; supervises offshore holding companies
CNDPMorocco’s personal data protection body. Can investigate whether processing complies with Law 09-08; its checks can lead to administrative, pecuniary or criminal sanctions

The joint guide had five authors. It was produced by Bank Al-Maghrib jointly with the ANRF, the CNASNU, the AMMC and ACAPS. It describes itself as part of efforts to raise public awareness of money-laundering and terrorist-financing risks, and it presents the international standards, Morocco’s national framework and the missions of the key authorities. Treat it as an orientation map: the guide itself lists issuing regulatory texts among the missions of Bank Al-Maghrib, the AMMC and ACAPS, so the detailed requirements are in each supervisor’s own texts.

Three things worth doing this week

  1. If you have Moroccan offshore holding companies in your book, get Circular No. 2/2026 itself from the Office des Changes and check that each company has designated its compliance officer. Read the circular for commencement and any transitional provisions; the press release is a summary.
  2. Map every Moroccan entity to its supervisor. Banks, payment institutions and microfinance associations go to Bank Al-Maghrib; capital-market firms to the AMMC; insurers and insurance intermediaries to ACAPS; offshore holding companies to the Office des Changes. Then read that supervisor’s texts, not only the guide.
  3. Add Law 09-08 to your KYC data review. The CNDP handles controllers’ declarations and authorisation requests, and explains the rules for transferring personal data abroad. If your group KYC programme was written for another jurisdiction, check how it handles both.

SonarPulse in this jurisdiction: Logiciel de filtrage LBC/FT pour le Maroc (in French)

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu