# Morocco

> Morocco (Bank Al-Maghrib · AMMC · Office des Changes): Liberalising in direction, with a ten-year retention sting. Region: Middle East & Africa. Regime still forming: No settled rule on confidentiality yet; the framework is in draft or newly in force.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Jurisdiction
- Region: Middle East & Africa
- Subject: Liberalising in direction, with a ten-year retention sting
- Authority: Bank Al-Maghrib · AMMC · Office des Changes
- Stance on on-chain confidentiality: Regime still forming. No settled rule on confidentiality yet; the framework is in draft or newly in force.
- Tags: Bill 42.25, draft not adopted, ten-year retention, bank-only stablecoins
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/jur-morocco

## What it actually says

Morocco is moving from prohibition toward a framework, and the direction is genuinely liberalising after years in which crypto activity sat outside the exchange control rules. The detail worth attention is not the licensing but the retention. The draft would require providers to keep transaction data for ten years, which is longer than most regimes in this section and creates a large standing pool of transaction-level records regardless of any suspicion. Issuance of fiat-indexed tokens would be reserved to approved banks. Decentralised finance is left out of scope entirely. As of mid-2026 the central bank reported progress but no firm date for submission to parliament, so none of this is law yet.

## The instruments that matter

- **Draft Bill 42.25**: prepared jointly by the finance ministry, the central bank and the markets authority and published in November 2025, aligned with FATF Recommendation 15
- **Ten-year transaction data retention**: the draft would oblige crypto service providers to retain transaction data for a decade, the most privacy-consequential provision located in the text
- **Stablecoin issuance reserved to banks**: only credit institutions approved by the central bank could issue tokens indexed to fiat currencies
- **DeFi left outside**: the draft does not regulate decentralised finance, with on-ramps and off-ramps to be monitored separately

## Sources

- [Analysis of Bill 42.25](https://www.lexisma.info/?p=12230)

## Related entries

- [Bahrain](https://www.sodalabs.xyz/privacy-hub/regulation/jur-bahrain): A listing test written against effects, not asset names
- [Egypt](https://www.sodalabs.xyz/privacy-hub/regulation/jur-egypt): Crypto barred, so data protection is the live constraint
- [Ghana](https://www.sodalabs.xyz/privacy-hub/regulation/jur-ghana): The regulator that put self-custody in writing
- [Israel](https://www.sodalabs.xyz/privacy-hub/regulation/jur-israel): Light on-chain, heavy on data protection
- [Kenya](https://www.sodalabs.xyz/privacy-hub/regulation/jur-kenya): The ban written into primary legislation, not a rulebook
- [Kuwait](https://www.sodalabs.xyz/privacy-hub/regulation/jur-kuwait): A ban whose stated reason is anonymity itself