Online payment platforms in Morocco: the 2026 guide to choosing one (criteria, pricing, integration)

To choose a payment gateway in Morocco, check these in order: the Bank Al-Maghrib-licensed payment institution that holds your funds, the moment a successful payment becomes usable, the payment methods covered — cards with 3-D Secure, but also customers without a card —, the sandbox and the webhooks, and only then the fee schedule. Then try before you sign. If you searched for the best payment gateway in Morocco hoping for a ranking, this guide gives you something more useful: the method to build your own, with eight questions, a grid to fill in, how to read a quote, and a checklist to print.

Gateway, platform, PSP, processor, payment institution: who does what

Providers use these words interchangeably, but one describes the software, another the company, a third the regulatory status. Knowing which applies to whom tells you which question to ask of whom — and who will answer you the day a payout goes missing.

A full offering often combines several of these roles. At ChariPay, the gateway is operated by Chari Money, a Bank Al-Maghrib-licensed payment institution, which also holds the payment account you collect into: one counterpart for the technology and for the money. How the technology works is covered on our page about the payment gateway in Morocco; the provider's regulatory role, on the one about the PSP in Morocco. This guide helps you compare, then choose.

Software is not licensed; the entity that runs it is: ask for its exact name, then match it against the official source. Bank Al-Maghrib publishes the structure of the banking system by category of institution: at the end of 2024, it counts 93 licensed credit institutions and similar bodies in Morocco, including 18 payment institutions. We do not copy any name here: only Bank Al-Maghrib's list counts.

An online payment gateway in Morocco, in 2026: what are we talking about?

An online payment gateway does four things: it shows your customer a page where they pay, has that payment authenticated — through 3-D Secure for cards —, notifies you of the outcome reliably, and makes the money available to you in an account before paying it out to your bank. Payment links, subscriptions, refunds and exports are built around those four functions. The landscape of payment methods, from cards to cash on delivery, is covered in our guide to online payment in Morocco.

In Morocco, holding funds on behalf of third parties is the business of a payment institution or a bank, under the supervision of Bank Al-Maghrib. That rule shapes the families of solutions you will come across.

Three families of solutions

The licensed payment institution, with its own gateway. An entity licensed by Bank Al-Maghrib holds a payment account in your name, with a RIB, and operates the gateway that collects into it: one counterpart for the technology and for the money. This is ChariPay's family: the payment gateway of the Chari ecosystem, operated by Chari Money.

Bank-backed solutions. The gateway is a technical module; the money is collected under an acquiring contract signed with your bank, then paid out on the bank's own cycle. Two counterparts, two contracts, and funds whose availability depends on the bank: that is not a flaw in itself, just an architecture worth knowing.

Foreign services not available locally. For Stripe, Morocco is not on the list of supported countries published on stripe.com/global, checked again on the day of this update. PayPal lists Morocco among its countries; the question is what that account lets you do when collecting from Moroccan customers in dirhams. Both cases are covered in Stripe in Morocco and PayPal in Morocco.

What changed in 2025

For years, card acquiring in Morocco — accepting card transactions on behalf of merchants — relied on a single acquirer. Three official texts, checked again on the day of this update, describe the shift:

• October 31, 2024. In its decision no. 152/D/2024, the Competition Council makes binding the commitments made to open up this market.
• May 1, 2025. According to the Council's communiqué of May 19, 2025, duly authorized payment institutions and bank subsidiaries dedicated to acquiring may operate on this market from that date; the transitional period ends on November 1, 2025.
• July 10, 2026. The joint communiqué of the Competition Council and Bank Al-Maghrib recalls that the decision required the former operator to transfer its entire portfolio of merchant contracts by January 31, 2026 for private contracts and by April 30, 2026 for public contracts. It notes the move from a single-acquirer model to a multi-acquirer architecture, with, in its own words, a broader range of offers and lower acquiring fees borne by merchants.

For you, the question "who accepts my card payments, and on behalf of which entity?" now has several answers: comparing has become possible. The details of this opening, text by text, are in card acquiring in Morocco.

The workarounds

Without direct access to foreign services, workarounds circulate: incorporating a company abroad, or going through a third party's account. The funds are then collected outside Morocco, by an entity with its own tax obligations, while yours remain — foreign-exchange regulation, and VAT as soon as your customers are Moroccan. Have any such route checked by your adviser; this guide sticks to what is available in Morocco, with funds in Morocco.

Try before you sign

A payment gateway is judged on evidence, not on a brochure: most of the questions below can be checked in a few tries, if the provider lets you try without paperwork or a meeting. If you are asked for a trade register extract or a sales call before you are shown a test key, write it down in the grid.

At ChariPay, this is the default path. Start in test mode takes you to the merchant portal: three fields — name, work email, company —, then an activation link received by email, choosing your password, creating your test key from the portal, and a first test payment with the test card. It is free, with no time limit and no approval to wait for; the verification of your business (KYB) only gates the move to production. Keep the tab open to check the questions below as you read.

The eight questions to ask before looking at pricing

Put these eight questions to every provider, in this order, and write down the answers: you will have your comparison before you open a single fee schedule. For ChariPay, we answer the same questions.

1. Who holds the license, and where does my money live?

The question is not "are you serious?" but "which entity is licensed, under what status, and does your service run through it?". Take it further: is my money in an account in my name, with a RIB, and at what point does a successful payment become available — not merely "processed"?

Our answer: Chari Money, a payment institution licensed by Bank Al-Maghrib, holds your payment account, with a RIB in your company's name and a PDF certificate; every successful payment is available there instantly. The payout to your bank is a separate operation, automatic every night once a settlement account is configured, or on demand. What a payment account in Morocco allows is covered separately.

2. Where do the card details live?

Level 1 of the PCI DSS certification is the most demanding, and the certification is renewed every year. The architectural answer to get: "on our hosted page, card numbers never go through your servers". If your integration has you handling a card number, you enter the compliance scope, and you are the one who will carry the audit.

Ask, too, about the framework for your customers' personal data: in Morocco, Law 09-08. The ChariPay platform is PCI DSS Level 1 certified and processes data within that framework; on the hosted checkout as on payment links, the card is entered on our pages, never on yours, and card numbers are never written to a database. The rest of the setup — chained audit log, dual validation, strong authentication — is described on the security and compliance page.

3. What happens when a payment fails?

Everyone collects successful payments well. Ask to see a declined payment in the interface: is the reason legible? Can the customer try again? Can you tell a declined card from an abandoned 3-D Secure authentication? And for a recurring payment, what happens when an installment stays unpaid?

At ChariPay, a payment session sends a payment.failed webhook in addition to the success webhook if you ask for it. For a subscription, each installment is a payment link emailed to your customer: as long as it is unpaid, they get a reminder every day with the same link, a declined card attempt is reported to you through subscription.payment_failed, and the link stays payable for 14 days. The real causes of a decline are set out in 3-D Secure: what makes a payment fail.

4. Is the webhook signed, and replayable?

Your order must ship only on the provider's notification, never on the return page, which the customer can close before it loads. That notification must be signed — otherwise anyone can make you ship — and replayable from the interface for the times your server was unavailable.

At ChariPay, every delivery is signed with HMAC-SHA256 — X-CHARI-SIGNATURE and X-CHARI-TIMESTAMP headers, timestamp checked to within ±5 minutes —, retries follow the schedule 1 min → 5 min → 30 min → 1 h → every 6 h, up to 16 attempts over roughly 72 hours, and any delivery can be replayed from the portal. Server-side handling is described in Getting your webhook integration right.

5. How do you leave?

The least asked question, and the most revealing: are your transactions, customers and history exportable in full, at any time, without asking permission, and is the notice period reasonable? Test it in the sandbox: export a full month and look at the columns — is your order reference there? are gross, fees and net shown separately?

At ChariPay, transactions export to CSV from the portal and through the API (GET /v1/transactions/export.csv, up to 10,000 rows per export, split by period beyond that), and your customers, links, sessions and subscriptions can be read through the API at any time.

6. Can you test without paperwork or a meeting?

A test environment must behave like production: same API, same webhooks, same statuses, dummy data. Be wary of the "sandbox" that is merely documentation, or that you have to request and then wait for. The decisive test: can your team simulate a successful payment, a failed payment, a refund, a lost notification, before signing or filing anything?

At ChariPay, the sandbox is free, with no time limit, and self-serve: your developer creates their own test key. A single test card is accepted there — 4918 9141 0719 5005, CVV 123, any future expiry date, 3-D Secure code 555 —, no real money moves, and webhooks are sent as usual.

7. Who answers, and how quickly?

The day a payout does not arrive, you do not want an anonymous form. Ask who answers — an account manager, a technical team? —, through which channel, and what you need to provide for an investigation to move fast.

At ChariPay, every API error response carries a correlation identifier to quote to support, and an operation's timeline (GET /v1/transactions/{operationId}/timeline) shows each step: you describe an incident with facts, not recollections. The team can be reached by phone, WhatsApp or email, and the integration team walks you through going live.

8. Does payment collection cover your real customers?

Cards cover only part of the Moroccan customer base, and many Moroccan cards are closed to online payments by default until their holder enables them with their bank. How do your customers who pay in cash enter the same system — same reconciliation, same export?

This is where ChariPay stands apart: it is the only payment gateway in Morocco that also collects cash at agencies. On the page of a single-use payment link, your customer can choose cash: they receive a reference and deposit the amount at a Damane Cash, Chaabi Cash, Tasshilat, Barid Cash or Chari agency; as soon as the network confirms the deposit, the link turns "Paid" and you are notified in the portal. For a store, that means one link per order, created through the API: our guide to e-commerce payments in Morocco compares this flow with cash on delivery, and the mechanism is described in Taking cash without a till — payment by reference.

The criteria table — and where ChariPay stands

Here are the eight questions turned into thirteen checkable criteria, as a grid to fill in for your current provider or any candidate. We fill in only our own column: no named comparison, because the figures circulating about providers can rarely be sourced.

For every row, ask for a demonstration, not a promise; a question with no written answer counts as "no". Start with the "testing without paperwork or a meeting" row: if it is genuinely open, you can verify half of the others yourself.

Which gateway for which profile

There is no best payment gateway in Morocco in the abstract, only the one that ticks the rows that matter for your business:

The table also tells you what not to pay for: a shop that sells through payment links does not need to fund a custom integration.

Pricing: how to read a fee schedule, and ours

A payment gateway's fee schedule reads in five lines. If one is missing, ask for it: silence is rarely free.

The five lines of a schedule

1. 1Activation. A one-off set-up fee: is it due at signature or at go-live, and what does it cover?
2. 2The commission. A percentage per transaction, sometimes topped up with a fixed amount: does it apply to successful payments only, does it vary by payment method, and does the figure include VAT?
3. 3The deposit. A security deposit against unpaid amounts and refunds: what amount, what method of calculation, what conditions for its return?
4. 4Payouts. Moving the money to your bank: automatic or on demand, how often, and at what price shown before each operation?
5. 5Refunds. Do they cost you anything? Is the original commission returned? Is a partial refund possible, from the interface or through the API?

A "starting from" price list often shows only one of these lines: insist on all five, in writing.

Our actual figures

• Sandbox: free, with no time limit and no commitment; after you go live, it remains your staging environment.
• Activation: MAD 6,000 (VAT included), paid once, at go-live — nothing before.
• Commission and deposit: a percentage per successful transaction and a deposit, both set after reviewing your application — according to your products, your payment methods and your volumes. We do not publish a "starting from" commission: the proposal reaches you with the numbers in it, before any commitment.
• Payouts and transfers: automatic payout every night once a settlement account is configured, or an instant transfer on demand from the portal; every transfer shows its fee quote before confirmation.
• Refunds: free, in full or in part, from the portal or through the API.

Included at no extra cost: the payment account with a RIB and certificate, the full portal, cash at agencies, users and their roles, signed webhooks, transaction tracking and support for going live. The up-to-date detail is on the ChariPay pricing page.

Working out the cost of a typical month

Once the five lines are filled in, run the numbers on your real volume — number of payments, average basket, share of refunds, number of payouts — rather than on a headline percentage: two providers with similar percentages can differ markedly. Add two lines that no schedule ever shows: the time during which your money cannot be used, and the cost of an integration you have to redo after picking the wrong partner.

Integration: without a developer, with a developer

The right question is not "how much does integration cost?" but "how many days of work, on our side, and by whom?". The two paths are not mutually exclusive: you can start with the first and add the second once volume justifies it.

Without a developer: the portal and payment links

From the portal, you create a payment link for the amount you want, you send it, and your customer pays on a hosted page — by card with 3-D Secure, or in cash at an agency if the link is single-use; the successful payment credits your payment account instantly. Without a line of code, the link covers:

• sending by email or WhatsApp, or sharing the URL through the channel of your choice;
• a QR code, and a PDF poster to print for a counter;
• single use, or multiple use for a fixed price or a membership fee;
• an expiry of your choice: 24 hours, 7 days, 30 days, never, or a specific date.

If you already sell through an online store, this path works too: the order comes in, you create the link, you mark the order paid. This path needs nothing installed; on WooCommerce, the ChariPay module is also available on GitHub, while there is no app for Shopify. The flow is detailed for collecting on Shopify and for collecting on WooCommerce.

With a developer: the API

For payment to live inside your own order funnel, your developer wires up the REST API. The effort is counted in working days on the merchant side, depending on your funnel and on how thorough your tests are; the sandbox lets you measure it before you sign. The landmarks that matter:

• A single base URL, https://api-psp.charipay.ma, in the sandbox as in production: the key selects the environment, chari_sk_test_… or chari_sk_live_…. Until production is activated on your account, a live key answers 403 with the code PRODUCTION_ACCESS_NOT_ENABLED.
• Hosted checkout through payment sessions: POST /v1/payment-sessions creates a card payment session with 3-D Secure, for the amount you want — in MAD, with no currency field —, you redirect your customer, and the result comes back through a webhook.
• Cash for an order: to offer it, create through the API a single-use payment link per order (POST /v1/payment-links, with paymentMethod: CASH if cash is the default method); as soon as the network confirms the deposit, the link turns "Paid", and your server reads its state with GET /v1/payment-links/{reference}.
• Idempotency: an Idempotency-Key header makes a network retry harmless, and an externalId that is unique per environment prevents duplicates: Never charge twice — idempotency explained.
• Refunds: POST /v1/refunds, full or partial, answers 202 while the refund executes.

Here is how to create a session, in the sandbox:

curl -X POST https://api-psp.charipay.ma/v1/payment-sessions \
  -H "X-CHARI-PAY-API-KEY: chari_sk_test_..." \
  -H "Idempotency-Key: order-2026-0001" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 250,
    "orderId": "ORD-2026-0001",
    "externalId": "order-2026-0001",
    "notifyOnFailure": true,
    "config": {
      "customer": {
        "firstName": "Amine",
        "lastName": "Bennani",
        "email": "amine@example.com",
        "phone": "+212600000000"
      },
      "urls": {
        "accept": "https://shop.example.com/thank-you",
        "decline": "https://shop.example.com/payment-failed",
        "notification": "https://shop.example.com/webhooks/charipay"
      }
    }
  }'

The 201 response contains the session identifier, the URL of the payment page to redirect your customer to, and its expiry date; the result arrives through a webhook, and the webhook is what counts. The documentation is public, no account needed: 12 modules, 57 endpoints, examples in four languages. The guide to the payment API in Morocco walks through the full integration; also read Protecting your API keys before creating a live key.

From sandbox to production

On the developer side, create your test account: the getting-started guide in the documentation walks through the eight steps up to the first API call with your test key. Once everything checks out, going live changes only the key and the webhook secret; the list to go through before switching over is in our article on moving from sandbox to production.

The final checklist, to print

Before signing with an online payment gateway in Morocco, tick:

• The entity licensed by Bank Al-Maghrib is named in the contract, and the service runs through it.
• My money is in an account in my name, with a RIB; I know when a successful payment becomes available, and how often and at what price it reaches my bank.
• The provider is PCI DSS Level 1 certified, no card number passes through my servers, and my customers' data is processed under Law 09-08.
• I have tested it myself, without paperwork or a meeting: a successful payment, a declined payment with a legible reason, a refund.
• Webhooks are signed, retried and replayable from the interface.
• I have exported a full month in the sandbox, and my accountant has opened the file.
• I know who answers, and through which channel, when a payout goes missing.
• My customers without a card can pay within the same system, with the same export.
• The fee schedule has its five lines, and I have worked out a typical month on my real volume.
• I know how I leave: full export, notice period, data.
• The reconciliation method is decided before the first payment is collected.

The last point is prepared with your accountant: the accounting-side checklist and reconciling your collections are written for exactly that.

Frequently asked questions

What is the best payment gateway in Morocco?

The one that ticks your criteria, not the one that calls itself the best. Check first the Bank Al-Maghrib-licensed entity that holds your funds, the moment a successful payment becomes available and the methods covered — cards with 3-D Secure and, if your customers need it, cash —, then the sandbox, the webhooks and the exports. To decide between two finalists, test both: the one you can try without paperwork or a meeting has already scored a point.

Platform, gateway or PSP: what is the difference?

The gateway is the technology: hosted payment page, API, notifications. The PSP, or payment service provider, is the company that sells you the service and runs it. The platform is the full offering, portal and account included. Finally, the payment institution is the status licensed by Bank Al-Maghrib that allows it to hold your funds. A single offering can combine these roles, as ChariPay does, operated by Chari Money.

How much does a payment gateway cost in Morocco?

Read the quote on five lines: activation, commission, deposit, payouts, refunds. At ChariPay, the sandbox is free with no time limit; activation costs MAD 6,000 (VAT included), paid once at go-live; the commission per successful transaction and the deposit are set after reviewing your application; and refunding a customer is free, in full or in part.

How long does integration take?

It depends on the path. A payment link created from the portal needs no integration at all: you try it in test mode, and it collects as soon as your account is live. An API integration — payment session, redirect, webhook — is counted in a developer's working days on the merchant side, depending on your order funnel and on how thorough your tests are. The sandbox lets you measure it before you sign.

Is 3-D Secure mandatory?

At ChariPay, every card payment goes through 3-D Secure authentication on the hosted page: the customer confirms with their bank, by code or in their banking app, and it is that bank that decides, transaction by transaction. Rather than trying to avoid it, work on the causes of failure — cards not enabled for online payments, abandonment during authentication —, set out in 3-D Secure: what makes a payment fail.

Can a payment gateway collect cash?

Yes, if it is built for it. With ChariPay, on the page of a single-use payment link, the customer chooses cash, receives a reference and deposits the amount at a partner agency. As soon as the network confirms the deposit, the link turns "Paid", you are notified in the portal, and the amount is available in your payment account at that instant.

Can you start without any commitment?

Yes. Test mode opens as soon as your account is activated: it is free, with no time limit, no credit card and no approval to wait for. You create your test key there, collect with the test card and receive real webhooks, without any real money moving. Nothing is due before going live, when the MAD 6,000 (VAT included) activation fee is paid once, and only once.

Which documents do you need to go live?

Going live follows the verification of your business (KYB): identity documents and the trade register extract, with dual human review. Then come the review of your application, the priced proposal — commission and deposit —, the payment of the activation fee, and finally activation, which creates your live key. On switch-over day, you change only the key and the webhook secret; your code stays the same.

Can Stripe or PayPal be used as payment gateways in Morocco?

Stripe, no: Morocco is not on the list of supported countries published on stripe.com/global and checked again on October 2, 2026. PayPal lists Morocco among its countries, but a PayPal account does not answer the same need as collecting locally in dirhams into an account in your name. Both cases are covered in detail in Stripe in Morocco and PayPal in Morocco.

When is the money available?

At ChariPay, instantly: every successful payment, by card or in cash at an agency, is available in your payment account, an account held by Chari Money with a RIB in your company's name. You can use it right away, for a transfer or a bill. The payout to your bank is a separate operation: automatic every night once a settlement account is configured, or by instant transfer on demand.

Next step

Try before you sign: Start in test mode is free, with no time limit and no approval to wait for, and lets you fill in the grid as you test. When production gets closer, check our published pricing and contact the integration team to prepare the switch-over.

Sources

• Competition Council of Morocco — communiqué of May 19, 2025 (decision no. 152/D/2024 of October 31, 2024) — read on 2026-10-02
• Competition Council and Bank Al-Maghrib — joint communiqué of July 10, 2026 — read on 2026-10-02
• Bank Al-Maghrib — Structure of the banking system (data at the end of 2024) — read on 2026-10-02
• Stripe — global availability — read on 2026-10-02
• PayPal — list of countries and regions (Morocco site) — read on 2026-10-02