1. Introduction

Artificial Intelligence (AI) anti-money laundering (AML) systems are increasingly important to the prevention, detection, and investigation of financial crime. In Morocco, their legal significance arises from the interaction between civil liability, banking and financial regulation, personal-data protection, contractual obligations, and criminal law.

Money laundering generally involves concealing or disguising the criminal origin of money or assets so that they appear legitimate. AI-based AML systems can help banks, payment institutions, financial intermediaries, and other regulated entities identify suspicious transactions by analysing transaction patterns, customer identities, beneficial ownership, account activity, and cross-border transfers.

The central legal question is not merely whether AI can detect suspicious activity. It is who is legally responsible when an AI system fails to detect money laundering, wrongly flags an innocent customer, freezes legitimate funds, or improperly processes personal data.

Morocco's legal framework must therefore be understood through several interconnected areas:

Civil liability for negligence, loss, and damage.

Banking supervision and anti-money laundering obligations.

Contractual duties owed to customers and business partners.

Personal-data protection and confidentiality.

Evidentiary standards and judicial review of automated decisions.

Cross-border financial compliance and international cooperation.

An important qualification: Morocco-specific reported judgments directly addressing AI-based AML systems are limited. The six cases discussed below are established comparative authorities relevant to the underlying legal principles; they should not be mistaken for six Moroccan judgments on AI and money laundering.

2. Legal framework governing AI and AML in Morocco

A. Law No. 43-05 on combating money laundering

Morocco's principal anti-money laundering statute is Law No. 43-05, as amended and supplemented, notably by Law No. 12-18 of 2021. It establishes the framework for identifying money laundering, imposing preventive obligations on regulated entities, and coordinating financial intelligence and supervisory activities.

ACAPS

+2

Key obligations relevant to AI systems include:

Customer identification and verification.

Understanding the purpose and nature of business relationships.

Risk-based customer due diligence.

Monitoring transactions for suspicious patterns.

Internal controls and compliance procedures.

Reporting suspicious transactions to the competent authority where legally required.

Identifying beneficial owners and examining higher-risk relationships.

AI may support these obligations, but purchasing or deploying an automated monitoring system does not itself establish compliance. The regulated institution remains responsible for ensuring that its procedures meet applicable legal requirements.

B. Law No. 09-08 on personal-data protection

Morocco's Law No. 09-08 governs the processing of personal data. Its relevance to AI-driven AML is substantial because these systems may analyse identity documents, bank transactions, customer relationships, geographic information, and behavioural patterns. The National Commission for the Control of Personal Data Protection (CNDP) is the relevant data-protection authority.

cndp.ma

+1

Financial institutions should assess:

Whether the collection and processing of data have a lawful basis.

Whether the information is relevant and proportionate to the AML purpose.

Whether records are accurate and corrected when necessary.

Whether applicable declaration or authorisation requirements are met.

Whether cross-border transfers and access by external technology providers comply with Moroccan law.

Whether customers' applicable information and data-protection rights are respected.

AML obligations may justify certain forms of data processing, but they do not automatically authorise unlimited surveillance or unrestricted reuse of customer data.

C. Banking supervision and financial intelligence

Morocco's AML system involves the National Financial Intelligence Authority (ANRF), Bank Al-Maghrib, and other competent supervisory authorities within their respective jurisdictions. Insurance and capital-market institutions may also be subject to sector-specific requirements.

ACAPS

+1

These institutions have different responsibilities. An AI vendor may supply software, a bank may operate it, and a public authority may receive or analyse suspicious-transaction reports. Legal responsibility must be assessed according to each party's duties, conduct, and role.

D. Is there a separate Moroccan AI-AML statute?

The framework described here is principally based on existing AML, banking, civil-liability, and data-protection law. The cited materials do not establish a comprehensive, dedicated Moroccan statute specifically regulating AI-based AML systems.

Consequently, AI governance should be understood as an application of existing legal duties to new technology, rather than as a claim that every AI-specific safeguard listed below is already expressly mandated by a standalone Moroccan AI law.

3. How AI-based AML systems operate

Stage 1 — Customer due diligence

The system checks identity information, customer profiles, beneficial ownership, and risk indicators. Errors in identity matching can cause innocent customers to be treated as suspicious.

Stage 2 — Transaction monitoring

Rules and machine-learning models analyse transfers, payment frequency, transaction networks, unusual account activity, and potential links to higher-risk entities.

Stage 3 — Alert generation and investigation

The system flags unusual activity for review. A trained compliance officer should examine the underlying evidence, investigate relevant circumstances, and decide on the appropriate lawful action.

Stage 4 — Reporting, records, and audit

The institution documents its investigation and makes any legally required report to the competent authority. Records of model versions, alerts, human decisions, and system changes help establish accountability.

The key distinction is between an unusual transaction, a suspicious transaction requiring investigation, and a proven money-laundering offence. These are not legally interchangeable. An algorithmic alert is a risk indicator, not proof of criminal conduct.

4. Civil liability arising from AI-AML failures

Moroccan civil-law principles are relevant when an AI system causes financial loss, reputational harm, or an unjustified restriction on a customer's property.

A. Failure to detect money laundering

Suppose a bank deploys an AI model that repeatedly fails to flag suspicious transactions because its training data or monitoring rules are defective.

Potential questions include:

Did the bank fail to implement legally required controls?

Was the system reasonably tested and monitored?

Were warnings ignored by compliance staff?

Did the failure cause a legally recoverable loss?

Did the conduct breach a regulatory obligation, a contractual duty, or a general duty of care?

A software defect alone does not automatically establish civil liability. The claimant must establish the applicable legal basis, causation, and damage, subject to any relevant statutory rules.

B. Wrongful customer flagging or account restrictions

An AI model may wrongly identify a customer as a money launderer because of a mistaken identity match, a misleading risk score, or an unusual but legitimate transaction.

Possible consequences include:

Delayed payments or access to funds.

Breach of contractual banking obligations.

Loss of business opportunities.

Reputational injury.

Improper disclosure or processing of personal data.

Liability depends on the institution's legal duties, the basis for the restriction, the facts known at the time, and the customer's provable loss. A temporary restriction required by law is not equivalent to an unjustified restriction.

C. Contractual liability of AI vendors

Contracts between financial institutions and technology providers should address system accuracy, security, maintenance, audit access, incident notification, data processing, and responsibility for defective performance.

An indemnity clause may allocate certain losses between the bank and its vendor. It cannot necessarily eliminate the bank's independent obligations to regulators or customers.

D. Data-protection liability

If an AML system processes inaccurate personal information, uses data beyond a lawful purpose, or transfers information unlawfully, the institution and other involved parties may face consequences under applicable data-protection rules.

The legal assessment should distinguish between the institution determining the purposes of processing, a provider processing data on its instructions, and any independent processing by another party.

E. Evidence and causation

Useful evidence in a dispute may include transaction records, alert histories, customer communications, model documentation, audit logs, access records, and expert reports.

Courts should assess the actual evidence and applicable rules of procedure. A high AI risk score should not automatically displace the need to prove the elements of a civil claim or criminal offence.

5. Six important case laws and their relevance

The following cases provide judicial principles that can help analyse banking security, AML reporting, automated risk assessment, privacy, and accountability. Only the first is a Moroccan Court of Cassation decision. The remaining authorities are comparative and do not bind Moroccan courts merely because they are relevant.

Case 1: Moroccan Court of Cassation, Commercial Chamber, Decision No. 372 of 27 July 2017

Subject: Banking security, fraudulent electronic transactions, and bank liability.

The dispute concerned the protection of a bank account against unauthorised access and fraudulent withdrawals. The reported decision addresses the bank's responsibility where the security of its information systems is inadequate.

Maathis

+1

Legal significance: Banks must take their contractual and legal responsibilities for protecting customers' funds and banking systems seriously. The allocation of responsibility depends on the facts, the applicable contractual duties, and the evidence of fault.

Application to AI-AML: If a bank deploys an inadequately secured AML system that exposes customer data, fails to preserve transaction records, or permits fraudulent activity through a preventable system weakness, the decision may provide a useful domestic analogy when assessing banking responsibility.

Limitation: This is a banking-security authority, not a judgment specifically concerning machine-learning models or AML algorithms.

Case 2: Jyske Bank Gibraltar Ltd v Administración del Estado — CJEU, Case C-212/11 (2013)

Subject: Cross-border banking and suspicious-transaction reporting.

The Court of Justice of the European Union examined the application of anti-money laundering reporting obligations to a financial institution operating across borders. It considered the relationship between reporting requirements, cross-border financial services, and legitimate public-interest objectives.

EUR-Lex

Legal significance: AML reporting obligations can serve important public interests, but their application must be analysed within the relevant legal framework, including the scope of national authority and cross-border obligations.

Application to Morocco: A Moroccan financial institution using an AI platform hosted abroad must distinguish between outsourcing technical processing and transferring legal responsibility. It should assess applicable reporting obligations, data-transfer rules, confidentiality, and regulatory cooperation.

Limitation: The judgment interprets EU law. It does not directly determine Moroccan reporting or outsourcing requirements.

Case 3: Michaud v. France — European Court of Human Rights, Application No. 12323/11 (2012)

Subject: AML reporting duties, professional confidentiality, and privacy.

The case concerned obligations imposed on lawyers to report certain suspicions of money laundering. The European Court of Human Rights examined the interaction between AML requirements, professional secrecy, and the right to respect for private life.

HUDOC

Legal significance: AML systems must be assessed in light of the legal safeguards applicable to the information being processed and the professional relationships involved.

Application to Morocco: Where an AI platform analyses data originating from lawyers, accountants, or other professionals, the institution must consider applicable confidentiality and reporting rules rather than assuming that every dataset can be freely processed or disclosed.

Limitation: The case does not establish a general exemption from AML reporting, nor does it directly regulate Moroccan professional secrecy.

Case 4: SCHUFA Holding (Scoring) — CJEU, Case C-634/21 (2023)

Subject: Automated scoring and individual decision-making.

The Court considered whether the automated creation of a probability score could constitute automated individual decision-making where a third party relied heavily on that score when making a decision affecting an individual.

EUR-Lex

+1

Legal significance: A decision-making process cannot necessarily escape automated-decision safeguards merely because the algorithm produces a score and another organisation formally makes the final decision.

Application to AI-AML: Suppose an AML system assigns a customer a high-risk score and the bank routinely freezes the customer's account whenever that score exceeds a threshold. The institution should assess whether the score is effectively determining the outcome, whether the decision is legally justified, and what review safeguards apply.

Limitation: The judgment concerns the EU General Data Protection Regulation (GDPR), particularly credit scoring. Its legal test is not automatically part of Moroccan law.

Case 5: CK v. Dun & Bradstreet Austria GmbH — CJEU, Case C-203/22 (2025)

Subject: Explanation of automated decisions and trade secrets.

In its judgment of 27 February 2025, the Court examined the right to meaningful information about the logic involved in automated personal-data processing. It held that an explanation must enable the affected individual to understand how personal data were used to reach the relevant result. Merely supplying a complex formula or algorithm is insufficient.

EUR-Lex

+1

Legal significance: Technical complexity and commercial confidentiality do not automatically justify withholding all meaningful information about an automated decision. The judgment also addresses the role of a competent supervisory authority or court in balancing competing interests.

Application to AI-AML: If a customer challenges a consequential decision based on an AML risk score, an institution should be able to document the relevant factors, the data used, and the human review undertaken. Any disclosure must also respect lawful confidentiality and restrictions on revealing suspicious-transaction reports.

Limitation: The judgment interprets the GDPR, not Morocco's Law No. 09-08. It is a comparative guide to transparency and accountability rather than a directly binding Moroccan rule.

Case 6: Ordre des barreaux francophones et germanophone and Others — CJEU, Case C-305/05 (2007)

Subject: AML obligations and professional legal confidentiality.

The Court examined anti-money laundering obligations imposed on lawyers and their compatibility with fundamental rights, particularly the protection of legal professional confidentiality. The judgment recognised the importance of safeguards associated with the specific legal activities and circumstances in question.

Legal significance: AML compliance must account for the legal status of the information, the professional role of the person holding it, and any applicable exceptions or protections.

Application to AI-AML: An AI vendor processing legal-client communications or professional records should not assume that every piece of information is available for unrestricted risk scoring. Data access, reporting, and disclosure should be governed by applicable law and carefully defined procedures.

Limitation: The case concerns EU law and professional legal secrecy. It is not a Moroccan AI or data-protection judgment.

6. Comparative lessons from the cases

These decisions should be used as comparative analytical tools. The Moroccan legal outcome will depend on the applicable domestic statutes, contractual terms, facts, and procedural rules.

7. Practical legal safeguards for AI-AML systems in Morocco

A financial institution seeking to reduce civil liability and improve AML compliance should adopt a documented governance framework.

A. Model accuracy and validation

The institution should test its system before deployment and periodically thereafter. Testing should assess false positives, missed suspicious transactions, data quality, model drift, and performance across relevant customer groups.

For example, if a model disproportionately flags customers because they frequently receive legitimate international remittances, the institution should investigate whether the model is confusing ordinary economic activity with criminal risk.

B. Human oversight

AI should assist compliance professionals rather than replace legally required judgment. Human reviewers should have sufficient training, authority, and access to supporting information to challenge an alert.

A review process should record:

Why the transaction was flagged.

What additional information was examined.

Whether the initial alert was confirmed or rejected.

What action was taken and by whom.

Whether the decision was reconsidered when new information emerged.

C. Data protection and confidentiality

Institutions should establish access controls, retention policies, security measures, and procedures for correcting inaccurate information. They should also assess the legality of data sharing with cloud providers and overseas service providers under Law No. 09-08 and applicable AML rules.

cndp.ma

+1

D. Auditability and evidence preservation

A defensible AI-AML programme should maintain appropriate records of model versions, changes to risk thresholds, alerts, investigation outcomes, access to customer information, and system incidents.

These records help demonstrate whether the institution acted reasonably and complied with its legal obligations. They also assist regulators, courts, and independent experts in determining the cause of a failure.

E. Vendor contracts and responsibility

Contracts with AI providers should address:

Software defects and system availability.

Security incidents and breach notification.

Data ownership, permitted processing, and deletion.

Audit and inspection rights.

Model updates and performance testing.

Cooperation with lawful regulatory requests.

Allocation of responsibility for losses and remedial action.

Contractual allocation does not automatically release a regulated financial institution from its own statutory obligations.

8. Illustrative legal scenarios

Scenario 1: AI misses suspicious transactions

A bank's model repeatedly ignores a pattern of suspicious transfers because its detection rules were inadequately tested.

Legal analysis: Investigators would examine the bank's AML controls, the foreseeability of the failure, the conduct of its compliance personnel, and any resulting damage. Regulatory sanctions and civil liability are separate questions.

Scenario 2: AI incorrectly flags an innocent customer

A legitimate business receives an unusually large payment, triggering an automated high-risk alert and a restriction on its account.

Legal analysis: The institution must assess the lawful basis and duration of the restriction, its contractual and statutory obligations, and the available review process. Whether compensation is due depends on the applicable law and proven facts.

Scenario 3: AML data is disclosed unlawfully

A cloud-based provider uses customer transaction data for an unrelated commercial purpose.

Legal analysis: The institution should investigate the provider's conduct, the lawful basis for processing, contractual safeguards, and applicable data-protection obligations. A service agreement does not by itself make an otherwise unlawful use of personal data lawful.

9. Challenges and future development

Morocco's AI-AML framework faces several practical challenges:

Explainability: Complex models can make it difficult for compliance officers to identify why an alert was generated.

False positives: Excessive alerts increase operational costs and may lead to unnecessary restrictions on legitimate customers.

Data fragmentation: Inconsistent identity records and incomplete beneficial-ownership information can weaken detection.

Cybersecurity: Centralised financial intelligence creates risks of unauthorised access, data theft, and manipulation.

Cross-border processing: International cloud services and data transfers raise questions of jurisdiction, confidentiality, and regulatory access.

Accountability: Responsibility may be divided among banks, software vendors, external investigators, and compliance officers.

Judicial scrutiny: Courts may need expert evidence to evaluate complex technical failures without treating an algorithmic score as conclusive proof.

Future reforms and supervisory guidance could clarify model validation, audit standards, human review, incident reporting, and the treatment of automated decisions. Such proposals should be distinguished from requirements already imposed by Moroccan law.

10. Conclusion

Civil law and AI-based anti-money laundering systems in Morocco intersect through banking liability, contractual responsibility, personal-data protection, regulatory compliance, and evidentiary rules.

Law No. 43-05, as amended, provides the central AML framework, while Law No. 09-08 governs relevant personal-data processing. AI can strengthen transaction monitoring and financial investigations, but it does not transfer the legal responsibility of regulated institutions to an algorithm or software provider.

The six cases discussed above offer complementary principles concerning banking security, suspicious-transaction reporting, confidentiality, automated scoring, transparency, and professional secrecy. Their comparative value must be assessed carefully because only the Moroccan banking-security decision is a domestic judgment.

The fundamental principle is that AI should support lawful, evidence-based financial monitoring—not replace legal accountability, reliable investigation, or judicial assessment.

Academic note: This is a general legal overview, not a substitute for advice based on the consolidated Moroccan legislation, current supervisory requirements, and the facts of a particular dispute