Choosing a PSP in Morocco: what to ask
Prices come last. Before them, eight questions separate a payment provider you endure from a partner you keep.
The natural reflex when comparing payment providers is to compare fees. That is the last step, not the first: a fee can be renegotiated; an architecture can't be fixed after the fact. Here are the questions to ask before signing. Ask them of us — and of anyone else.
1. Who holds the licence, and which one?
In Morocco, the payment-institution business is regulated by Bank Al-Maghrib. The question is not "are you serious?" but "which entity is licensed, and does your service run through it?". A provider that answers precisely — the entity, the status — is also telling you how your funds are segregated and who supervises them.
Our answer, for the record: ChariPay is operated by Chari Money, a payment institution licensed by Bank Al-Maghrib — and your balance lives on a payment account with a RIB in your company's name.
2. Where do card details live?
PCI DSS certification exists precisely for this question. Level 1 is the most demanding, audited every year. But the best architectural answer remains: "card numbers never touch our servers, nor yours". If your integration makes you handle a card number, your compliance scope just exploded — and the audit is yours to carry.
3. What happens when a payment fails?
Everyone handles successful payments well. The real test: ask to see a declined payment in the interface. Is the reason readable? Can the customer retry? Can you tell a declined card from an abandoned authentication? A provider that shows its failures cleanly also handles their consequences cleanly.
4. Is the webhook signed, and replayable?
Your order must ship only on the provider's notification — never on the customer's return page. Two technical requirements follow: the notification must be signed (otherwise anyone can make you ship), and replayable from the interface when your server was down. Skip either and you will pay for it in production incidents.
5. How do you leave?
The least asked question and the most revealing. Is your data — transactions, customers, history — fully exportable? Is the notice period reasonable? A provider confident in its service has no need to make leaving painful.
6. Is the sandbox a real environment?
A test environment must behave like production: same APIs, same webhooks, same statuses, realistic test data. Beware of the "sandbox" that is only documentation. The decisive test: can your team simulate a failed payment, a refund, a lost notification — before signing anything?
7. Who answers, and how fast?
The day a payout doesn't arrive, you don't want an anonymous form. Ask who answers — an account manager? an engineering team? — and through which channel. In Morocco, a phone number that picks up and a WhatsApp that replies are often worth more than a ticket portal.
8. Does it cover the way your customers actually pay?
Bank cards only cover part of the Moroccan customer base. Depending on your business, the real question is: how do your customers who pay in cash, or without a card, enter the same system — with the same books, the same reconciliation, the same export?
So, what about pricing?
With these eight answers in hand, compare prices — on your real volume, not on a displayed percentage. Ask for the full cost of a typical month: fees, fixed costs, refunds, payouts. And remember that the most expensive line of a payment contract is never the fee: it is the integration you redo after choosing the wrong partner.
Written by ChariPay Team.