No settled rule on confidentiality yet; the framework is in draft or newly in force.
What Morocco actually says
Morocco is moving from prohibition toward a framework, and the direction is genuinely liberalising after years in which crypto activity sat outside the exchange control rules. The detail worth attention is not the licensing but the retention. The draft would require providers to keep transaction data for ten years, which is longer than most regimes in this section and creates a large standing pool of transaction-level records regardless of any suspicion. Issuance of fiat-indexed tokens would be reserved to approved banks. Decentralised finance is left out of scope entirely. As of mid-2026 the central bank reported progress but no firm date for submission to parliament, so none of this is law yet.
The instruments that matter
- Draft Bill 42.25
- prepared jointly by the finance ministry, the central bank and the markets authority and published in November 2025, aligned with FATF Recommendation 15
- Ten-year transaction data retention
- the draft would oblige crypto service providers to retain transaction data for a decade, the most privacy-consequential provision located in the text
- Stablecoin issuance reserved to banks
- only credit institutions approved by the central bank could issue tokens indexed to fiat currencies
- DeFi left outside
- the draft does not regulate decentralised finance, with on-ramps and off-ramps to be monitored separately
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- BahrainMiddle East & Africa · A listing test written against effects, not asset names
- EgyptMiddle East & Africa · Crypto barred, so data protection is the live constraint
- GhanaMiddle East & Africa · The regulator that put self-custody in writing
- IsraelMiddle East & Africa · Light on-chain, heavy on data protection
- KenyaMiddle East & Africa · The ban written into primary legislation, not a rulebook
- KuwaitMiddle East & Africa · A ban whose stated reason is anonymity itself
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.