PSP in Morocco: payment service provider, licence, costs and integration

A PSP — payment service provider — is the intermediary that lets a business collect payments from its customers online without becoming a player in the payment system itself. In Morocco, a PSP relies on a payment institution licensed by Bank Al-Maghrib: that licence is what authorises it to hold payment accounts and execute operations on merchants' behalf.

This page sets out the definitions, walks through the chain of an online payment, details what a licensed PSP does for a merchant, what it costs and how it is integrated — then says what ChariPay does on each of those points.

What is a PSP in Morocco?

Payment service provider: the definition

A payment service provider gives merchants the means to accept a payment — bank cards, and, depending on the provider, cash against a reference — and handles the operation through to the credit of the merchant's account. In Morocco, two neighbouring terms also circulate, and they are best kept apart: the payment gateway, which is the technical part (payment page, API, notifications), and the payment institution, which is the regulated entity holding the accounts.

The gateway is software; the payment institution is a status. A PSP can be both at once, or a gateway backed by a third-party institution. The question to ask is the same either way: which entity holds the licence, and does your service run through it?

The chain of an online payment

When a customer pays for an order on a payment page, five links follow one another in a matter of seconds:

1. 1The customer enters their card on a page hosted by the provider — or, if paying in cash, receives a reference to present at an agency.
2. 2The gateway encrypts the data, triggers 3-D Secure authentication with the customer's bank and forwards the authorisation request.
3. 3The card networks route the authorisation, then the settlement, between the customer's bank and the institution receiving the funds.
4. 4The payment institution receives the funds and books them to the merchant's payment account.
5. 5The merchant's account is credited; the merchant uses it under their provider's rules — payout to their bank, refunds, operations from the account.

Every link has its own delays and its own ways of failing: card declined, authentication abandoned, deposit never made. That is what the webhook is for: the result reaches you as a signed notification, never through the customer's return page.

The Bank Al-Maghrib licence and Law 103-12

Law 103-12 on credit institutions and similar bodies introduced the status of payment institution in Morocco: an entity distinct from banks, licensed by Bank Al-Maghrib to provide payment services and hold payment accounts. The licence brings ongoing supervision and obligations on safeguarding customer funds and on internal control. It is what separates a provider that holds your money from one that merely passes it through.

For a merchant, the licence answers three concrete questions: who supervises the provider, where your funds sit between collection and payout, and who is accountable if something goes wrong. This page describes the framework in outline; what it means for your own business is a question for your legal adviser or your accountant.

What a licensed PSP does for a merchant

A licensed PSP provides five services, in the order a payment passes through them.

Collect

Payment collection covers bank cards, with 3-D Secure authentication, and — at ChariPay — cash at an agency: the customer receives a reference, deposits the amount at an agency of the Chari network, and the merchant is notified as soon as the network confirms the deposit. Both methods land in the same account, the same statement, the same export.

Hold the payment account

The payment account is the heart of the service: a regulated account in the company's name, with its own RIB, to which every successful payment is booked. It is not a balance displayed in an interface; it is an account the merchant acts from. Two questions describe it: when a successful payment becomes available on it, and what the merchant can do from it without going through their bank.

Pay out

A payout moves funds from the payment account to the merchant's bank. The modes vary from one provider to the next — on demand, on a fixed date, or automatically once a settlement account is registered. Two points are worth checking in the contract: the delay between collection and the funds reaching the bank, and what each payout costs.

Refund

A refund must be possible without leaving the system: full or partial, from the portal or through the API — POST /v1/refunds, which answers 202 while the operation settles.

Notify

Every event that matters — a successful payment, and a failed payment if you asked for it — is pushed to the merchant's server by webhook. The notification is signed so that nobody can forge it, timestamped so that it cannot be replayed, and redelivered if the server does not answer.

What a PSP costs in Morocco

The cost structure, in general

A PSP contract is read line by line. The items found from one provider to the next:

• Activation fee — paid once, at account opening or at go-live.
• Commission per transaction — a percentage of the amount, sometimes with a fixed amount per operation on top.
• Subscription — a monthly or annual flat fee, regardless of volume.
• Refunds — sometimes charged, or with no return of the original commission.
• Payouts — a cost per transfer to your bank, or a delay that stands in for one.
• Security deposit or guarantee — a sum held back, in proportion to the risk of the business.
• Chargebacks and disputes — the fees attached to a dispute over a card transaction.

The right habit is not to compare a headline percentage, but to ask for the full cost of a typical month on your real volume: commissions, fixed fees, refunds, payouts.

ChariPay's cost structure

We do not publish a "from" commission: it is set, along with the security deposit, once your application has been reviewed. The details are on the Pricing page, and the sandbox lets you test the entire service before committing a single dirham.

How a PSP is integrated

Integrating a PSP happens in stages, and the first one needs no code at all.

Payment links

From the portal, the merchant creates a link for the amount wanted, single-use or multi-use, and shares it by e-mail or WhatsApp; the same link exists as a QR code and as a poster for a counter. The customer pays on a hosted page, by card with 3-D Secure or in cash at an agency.

Hosted checkout

When orders come from a website or an app, the merchant's back office creates a payment session (POST /v1/payment-sessions) with the amount in dirhams — creating a session takes no currency field — and redirects the customer to the checkout URL returned. Card details are entered on the hosted page, never on the merchant's servers.

The full API

The same REST contract exposes clients, products and orders, subscriptions with due dates and automatic reminders at D+1, D+3 and D+7, refunds, and transactions with their CSV export. Twelve modules, sixty-two endpoints, examples in curl, JavaScript, Python and PHP, a Postman collection, the OpenAPI file and a pack for coding assistants: it is all in the API documentation.

Two conventions apply to every create call: an Idempotency-Key header makes the call safe to repeat without duplicates, and an externalId — unique per environment — lets you find a resource again with your own identifier.

Webhooks

The result of a payment arrives through a webhook signed with HMAC-SHA256. Two headers accompany each delivery, X-CHARI-SIGNATURE and X-CHARI-TIMESTAMP, with a ±5-minute tolerance on the timestamp. If your server does not answer, delivery is retried at growing intervals — 1 min, 5 min, 30 min, 1 h, then every 6 h — up to sixteen attempts, roughly 72 hours, and any delivery can be replayed from the portal. The webhooks guide details the handling that avoids the classic mistakes.

From the sandbox to production

The sandbox is free, has no time limit, and opens without an appointment, in eight steps, from signing up at portal-psp.charipay.ma/register to the API key you create yourself. A single test card is all you need: 4918914107195005, CVV 123, 3-D Secure code 555.

The API address does not change: https://api-psp.charipay.ma in the sandbox as in production. The key is what selects the environment — chari_sk_test_… or chari_sk_live_…. Until production is enabled on your account, any production call returns a 403 with the code PRODUCTION_ACCESS_NOT_ENABLED: nothing can be collected by mistake. Go-live happens with the integration team, once your application has been reviewed and the activation fee paid — the sequence is in From the sandbox to production.

The eight questions to ask a PSP

Pricing comes last. Before it, eight questions separate a provider you put up with from a partner you keep:

1. 1Who holds the licence, and where does my money live?
2. 2Where do card details live?
3. 3What happens when a payment fails?
4. 4Is the webhook signed, and replayable?
5. 5How do you leave — can the data be exported?
6. 6Is the sandbox a real environment?
7. 7Who answers, and how fast?
8. 8Does collection cover your real customers, including those without a card?

Each question is developed in the guide to choosing a payment platform in Morocco. Put them to us as you would to anyone.

ChariPay as a PSP

ChariPay is Chari's payment gateway, operated by Chari Money, a payment institution licensed by Bank Al-Maghrib. Point by point:

Licence and security. It is Chari Money that holds your payment account, under the central bank's supervision. The platform is PCI DSS Level 1 certified — the most demanding level, audited every year — and data is processed under Law 09-08. The details are on the Security page.

The payment account. Your company has a payment account with a RIB in its name. Every successful payment is available there instantly. From that account: bank transfers (with a quote and, if you have enabled it, a one-time code; a new beneficiary is subject to a 24-hour security hold), bill payments, and mobile top-ups through the API. Payout to your bank is by transfer on demand, or automatically every night once a settlement account is configured.

Payment collection. Bank cards with 3-D Secure, and cash at an agency by reference, across the Chari network — ChariPay is the only payment gateway in Morocco that also collects cash at agencies. See Online payment in Morocco for what that changes when some of your customers have no card.

The tools. Payment links (sent directly, QR code, poster, single-use or multi-use), hosted checkout through payment sessions, subscriptions with due dates and reminders at D+1, D+3 and D+7, products and orders, full or partial refunds.

The portal. Four roles — owner, manager, cashier, accountant — multiple users, CSV exports and webhook replay.

The price. One fixed line only: the MAD 6,000 activation fee (VAT included), paid once at go-live. The commission and the security deposit are set once your application has been reviewed; the sandbox and refunds cost nothing.

Frequently asked questions

What is the difference between a PSP, a payment gateway and a payment institution?

The PSP is the provider you contract with. The gateway is its technical side — payment page, API, webhooks. The payment institution is the entity licensed by Bank Al-Maghrib that holds the payment accounts. At ChariPay, the gateway is ChariPay and the payment institution is Chari Money.

Does a merchant need its own licence to collect payments online?

As a rule, no: the licence is carried by the provider's payment institution, with which the merchant contracts. What is asked of you is an application — the review that precedes go-live. A regulated activity may carry obligations of its own: that is for your adviser to say.

How much does a PSP cost in Morocco?

It depends on each contract — see the items above. At ChariPay: a free sandbox, a MAD 6,000 activation fee (VAT included) paid once at go-live, a commission and a security deposit set once your application has been reviewed, and free refunds.

How long does integration take?

A payment link created from the portal needs neither code nor lead time. For the API, a developer opens their sandbox and makes a first call the same day; what follows depends on what you connect. Go-live follows the review of your application.

Does the ChariPay payment account replace my bank?

No, it complements it. It is a regulated payment account, with a RIB in your company's name, where your takings are available instantly. Your bank remains the destination for payouts — on demand or every night. There is no cash withdrawal: money leaves the account by transfer, bill payment or mobile top-up.

Can my customers without a card pay?

Yes, in cash at an agency: the customer receives a reference, deposits the amount at an agency of the Chari network, and you are notified as soon as the deposit is confirmed. The order ships already paid.

Can Stripe be used in Morocco?

To date, Stripe's official list of supported countries does not include Morocco, and no timetable has been announced publicly. The workarounds that circulate — setting up a company abroad, or collecting into a third party's account — have consequences to weigh with your adviser before you take any step: funds collected outside Morocco on a foreign entity, tax obligations in the country of incorporation, Moroccan exchange-control and VAT obligations when your customers are Moroccan, the risk of the account being closed, Moroccan cards that are not always accepted. A PSP licensed in Morocco collects in dirhams, into a Moroccan payment account — Stripe in Morocco takes each point in turn.

Do my customers' card details pass through my servers?

No, if you use payment links or the hosted checkout: the card is entered on the page hosted by ChariPay, within a PCI DSS Level 1 certified perimeter. Your server only handles session references and signed notifications.