PSP in Morocco: payment service provider, license, costs and integration

A PSP in Morocco — a payment service provider — is the company that lets a merchant collect payments from customers by card, in cash against a reference or through a payment link, and receive the money in an account in its own name, without becoming a player in the payment system itself. In Morocco, that service rests on a payment institution or a bank licensed by Bank Al-Maghrib: it is the institution's license, not the software, that turns a provider into a regulated counterpart. This page defines the PSP, shows how to check a license at the source, sets out what a PSP costs and how one is integrated — then says what ChariPay does on each point.

What is a PSP in Morocco?

PSP, in 40 words

A PSP, or payment service provider, lets a business accept payments — card, cash, payment link, hosted payment page — and receive the proceeds in an account in its own name. In Morocco, these services fall to an institution licensed by Bank Al-Maghrib.

In practice, the PSP supplies the hosted payment page, the API your website calls, the notifications that tell you each outcome, the account the money lands in, and the tools to track it, refund it and pay it out to your bank. You will also come across "payment provider", "payment platform" or "payment solution": the vocabulary shifts, the underlying question does not — who holds your money, and under whose supervision.

A PSP is not a bank, and the difference is more than a matter of words. Under Law 103-12, only banks may take demand deposits from the public (Article 12). It lists payment institutions among the bodies treated as equivalent to credit institutions (Article 11), and Bank Al-Maghrib describes them as non-bank institutions authorized to hold payment accounts and to offer the payment services attached to them. The law defines a payment account as an account held in the name of a payment service user and used solely for payment operations (Article 16). A payment institution is therefore not there to lend to you or to keep your savings: your bank keeps that role, and the PSP sits alongside it for payment collection.

PSP or payment gateway: the difference

The two terms are used interchangeably; they do not mean the same thing. The payment gateway is the technical layer: the page where the customer enters a card, the API your site calls, the webhooks that notify you. The payment institution is a regulated status: the licensed entity that holds the accounts and executes the operations. The PSP, finally, is the provider you sign with — it can be both at once, or a gateway backed by a third-party institution. Software is never licensed as such; the entity operating it is. How the technical side works, the selection criteria and real code are all on the payment gateway in Morocco page.

When a customer pays for an order, five links follow one another:

1. 1The customer enters their card on a page hosted by the provider — or, when paying in cash, receives a reference to present at an agency.
2. 2The gateway encrypts the data, triggers 3-D Secure authentication with the customer's bank and forwards the authorization request.
3. 3The card networks route the authorization, then the settlement, between the customer's bank and the institution receiving the funds.
4. 4The payment institution receives the funds and books them to the merchant's payment account.
5. 5The merchant is notified by a signed webhook and uses the money under the provider's rules.

The framework has moved recently. Through its decision No. 152/D/2024 of October 31, 2024, Morocco's Competition Council (Conseil de la concurrence) made binding a set of commitments designed to open up the card acquiring market, and it monitors their implementation. Its communiqué of May 19, 2025 states that payment institutions and bank subsidiaries dedicated to acquiring, when duly authorized, may operate on that market from May 1, 2025. The practical consequence: new players are entering the acquiring market, and the question "who holds the license?" matters all the more when you choose a PSP.

What a licensed PSP does for a merchant

A licensed PSP provides five services, in the order a payment passes through them.

1. 1Collect. Accept cards — Visa, Mastercard, Maroc Pay — with 3-D Secure authentication and, at ChariPay, cash at an agency: the customer receives a reference, deposits the amount at an agency of the largest cash payment network in Morocco — Damane Cash, Chaabi Cash, Tasshilat, Barid Cash and the Chari network — and you are notified as soon as the network confirms the deposit.
2. 2Hold the payment account. Every successful payment is booked to a regulated payment account in your company's name, with its own RIB. It is not a balance displayed in an interface; it is an account you act from.
3. 3Pay out. Move funds to your bank — on demand, on a fixed date or automatically, depending on the provider. Two points are worth checking in the contract: the delay between collection and the funds reaching your bank, and what each payout costs.
4. 4Refund. Full or partial, without leaving the system: from the portal or through the API.
5. 5Notify. Push every event that matters to your server by webhook — signed so nobody can forge it, timestamped so nobody can replay it, redelivered if your server does not answer.

Two questions then separate one provider from another: when does a successful payment become available in your account, and what can you do with that money without going through your bank? At ChariPay, the answer to the first is "instantly"; to the second, instant bank transfers, bill payments, telecom top-ups through the API, and payouts to your bank, instantly on demand or every night.

Those answers are easier to check than to read about. ChariPay's test mode is free, has no time limit and needs no prior approval: Start in test mode. Here is what happens after the click:

1. 1You fill in three fields: your name, your work email, your company.
2. 2You receive an activation link by email and choose your password.
3. 3From the portal, you create your own test key.
4. 4You make your first test payment with the test card: 4918 9141 0719 5005, CVV 123, 3-D Secure code 555, any future expiry date.

Verification of your business (KYB) only gates the move to production: to test, there is nothing to wait for and nothing to pay.

How to check that a provider is licensed by Bank Al-Maghrib

"Licensed" is the word you read most often on payment websites, and the only one you can check yourself, at the source. The check is worth it, because it answers three concrete questions: who supervises your provider, where your money sits between collection and payout, and who is accountable if something goes wrong.

What the law says. Law 103-12 on credit institutions and similar bodies sets three rules that matter to a merchant. Before operating, a payment institution must have been licensed by the Governor (wali) of Bank Al-Maghrib, after consulting the credit institutions committee, and the licensing decision is published in the Official Bulletin (Article 34). Anyone not licensed as a credit institution or as a payment institution is prohibited from carrying out, as a regular occupation, the payment services the law lists, subject to the exceptions it provides (Article 18). And the funds recorded in payment accounts must be deposited in a global, separate, individualized account with a credit institution authorized to take demand deposits, and clearly identified and ring-fenced in the payment institution's books (Article 17). This page describes the framework in outline and is not legal advice; what it means for your own business is for your legal adviser or your accountant to say.

Where to look. The reference is Bank Al-Maghrib, and Bank Al-Maghrib alone. Its Structure of the banking system page (in French) states that at the end of 2024, 93 credit institutions and similar bodies were licensed in Morocco, 18 of them payment institutions (page consulted on October 2, 2026). The same page offers a downloadable list of credit institutions and similar bodies, drawn up as of December 31, 2019: for a more recent license, the law provides that Bank Al-Maghrib keeps the list of licensed institutions up to date and publishes its changes in the Official Bulletin (Article 48), where each licensing decision also appears. We do not reproduce any name here: a copied list goes stale, and the official publication is what counts.

The check, in five steps.

1. 1Ask for the exact name of the licensed entity. Not the brand, not the app: the legal name of the institution that holds the accounts, and the category it is licensed under.
2. 2Find that name in Bank Al-Maghrib's publications. The central bank's list and the Official Bulletin are the two sources that count; a mention on the provider's own website does not replace them.
3. 3Check that your contract and your funds run through that entity. Your customers' money should land in a payment account opened in your company's name, with a RIB, held by the licensed institution — not in a third party's account, nor with a company based outside Morocco.
4. 4Ask for the PCI DSS certification level. Level 1 is the most demanding; ask for the document that attests it and its renewal date.
5. 5Ask how personal data is handled. In Morocco, the framework is Law 09-08: where the data is hosted, who can access it, how it is masked in logs.

Three signals should stop you: a provider that calls itself licensed without naming the entity that is; a gateway presented as licensed in its own right, when software never is; funds collected through a foreign company or into a third party's account. The question comes up in particular with Stripe, whose list of available countries does not include Morocco: what that implies is set out in Stripe in Morocco.

For ChariPay, the answers fit in a few lines. The licensed entity is Chari Money, a payment institution licensed by Bank Al-Maghrib, which holds your payment account in your company's name, with a RIB and a PDF certificate. The platform is PCI DSS Level 1 certified, with the certification renewed every year, and data is processed under Law 09-08. The full setup — dual validation, a chained audit log, strong authentication — is described on the Security and compliance page. As with any provider, that name — Chari Money — is the one to look up in the official sources cited above.

What a PSP costs in Morocco

A PSP contract is read line by line. These are the items you find from one provider to the next:

• Activation fee — paid once, at account opening or at go-live.
• Commission per transaction — a percentage of the amount, sometimes with a fixed amount per operation on top.
• Subscription — a monthly or annual flat fee, regardless of volume.
• Refunds — sometimes charged, or with no return of the original commission.
• Payouts — a cost per transfer to your bank, or a delay that stands in for one.
• Security deposit — a sum held back, in proportion to the risk of the business.
• Chargebacks and disputes — the fees attached to a dispute over a card transaction.

The right habit is not to compare a headline percentage, but to ask for the full cost of a typical month on your real volume. Take your sales for an ordinary month, apply the commission and any fixed fee, add the subscription, the cost of your payouts and of your refunds, then divide the total by what you actually collected: that effective rate is what you compare, not the percentage in the brochure. Look at the exit as well — what happens to your data and your deposit the day you switch providers.

At ChariPay, the published pricing fits in one table:

We do not publish a "from" commission: it is set, along with the security deposit, once your application has been reviewed, according to your products, payment methods and volumes. Nothing is charged before production, and the sandbox lets you put the entire service to the test before committing a single dirham. The details are on the Pricing page.

How a PSP is integrated

Integrating a PSP happens in stages, and the first one needs no code at all.

No code: payment links. From the portal, you create a link for the amount you want, single-use or multi-use, and share it by email or WhatsApp; the same link exists as a QR code and as a PDF poster for a counter. The customer pays on a hosted page, by card with 3-D Secure or, for a single-use link, in cash at an agency. This is the stage for Instagram sales, deposits and one-off invoices: see payment links.

With a website: hosted checkout. When orders come from a website or an app, your back office creates a payment session with the amount in dirhams, then redirects the customer to the checkout URL returned. Card details are entered on the hosted page, never on your servers, and the outcome reaches you by webhook. The online payments page walks through the flow; the call looks like this:

curl -X POST 'https://api-psp.charipay.ma/v1/payment-sessions' \
  -H 'X-CHARI-PAY-API-KEY: chari_sk_test_...' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: order-2026-0421-session' \
  -d '{
    "amount": 250.00,
    "orderId": "ORD-2026-0421",
    "externalId": "order-2026-0421",
    "config": {
      "customer": {
        "email": "amine.bennani@example.com",
        "firstName": "Amine",
        "lastName": "Bennani",
        "phone": "+212600000000"
      },
      "urls": {
        "accept": "https://your-store.example.com/payment/success",
        "decline": "https://your-store.example.com/payment/failure"
      }
    }
  }'

The 201 response carries the sessionId, the checkoutUrl to redirect the customer to and the session's expiresAt. The customer and order in the example are fictitious.

The whole contract: the API. The same REST contract exposes clients, products and orders, subscriptions with a payment link e-mailed at each due date, refunds, and transactions with their CSV export. Twelve modules, fifty-seven endpoints, examples in curl, JavaScript, Python and PHP, a Postman collection and the OpenAPI file: it is all public in the API documentation. Two conventions apply to every create call: the Idempotency-Key header makes the call safe to repeat without duplicates, and the externalId, unique per environment, finds a resource again with your own identifier. The payment API in Morocco guide walks through the full integration, call by call.

Webhooks. The outcome of a payment arrives through a webhook signed with HMAC-SHA256, with the X-CHARI-SIGNATURE and X-CHARI-TIMESTAMP headers and a ±5-minute tolerance on the timestamp. If your server does not answer, delivery is retried at growing intervals — 1 min, 5 min, 30 min, 1 h, then every 6 h — up to sixteen attempts over roughly 72 hours, and any delivery can be replayed from the portal. Deduplicate on Chari-Event-Id: delivery is guaranteed at least once, not exactly once.

From the sandbox to production. The API address does not change: https://api-psp.charipay.ma in the sandbox as in production, and the key is what selects the environment — chari_sk_test_… or chari_sk_live_…. Until production is enabled on your account, a call with a live key returns a 403 with the code PRODUCTION_ACCESS_NOT_ENABLED: nothing can be collected by mistake. Go-live follows the KYB check and the review of your application, then payment of the activation fee; on the day, you change the key and the webhook secret, nothing else. The checklist is in From the sandbox to production.

The eight questions to ask a PSP

Pricing comes last. Before it, eight questions separate a provider you put up with from a partner you keep, and each one has a recognizable good answer.

Each question is developed, criterion by criterion, in the guide to choosing a payment platform in Morocco. Put them to us as you would to anyone: our answers follow, and test mode lets you check them one by one.

ChariPay as a PSP

ChariPay is the Moroccan payment platform of the Chari ecosystem, operated by Chari Money, a payment institution licensed by Bank Al-Maghrib. Point by point:

License and security. Chari Money holds your payment account, under Bank Al-Maghrib's supervision. The platform is PCI DSS Level 1 certified, renewed every year; data is processed under Law 09-08; every sensitive action requires re-authentication and leaves a trace in a cryptographically chained audit log.

The payment account. Your company has a payment account with a RIB in its name and a PDF certificate. Every successful payment is available there instantly. From that account: instant transfers to any Moroccan bank account, with a fee quote and, if you have enabled it, a one-time code — a security hold applies after a new beneficiary is added —, bill payments, and telecom top-ups through the API. Payout to your bank is by instant transfer on demand, or automatically every night once a settlement account is configured.

Payment collection. Cards with 3-D Secure, and cash at an agency by reference, at any Damane Cash, Chaabi Cash, Tasshilat, Barid Cash or Chari agency: ChariPay is the only payment gateway in Morocco that also collects cash at agencies. What that changes when some of your customers have no card is explained in the guide to online payment in Morocco.

The tools. Payment links (sent directly, QR code, poster, single-use or multi-use), hosted checkout through payment sessions, subscriptions with a payment link e-mailed at each due date, products and orders, full or partial refunds.

The portal. Four roles — owner, manager, cashier, accountant —, multiple users, CSV exports and webhook replay. The portal is available in French and English.

The price. One fixed line only: the activation fee, MAD 6,000 (VAT included), paid once at go-live. The commission and the security deposit are set once your application has been reviewed; the sandbox and refunds cost nothing.

The shortest way to check all of this is to try it: create your test account, then collect your first dummy payment with the test card and watch it land in the test payment account.

Frequently asked questions

What is the difference between a PSP, a payment gateway and a payment institution?

The PSP is the provider you contract with. The gateway is its technical side — payment page, API, webhooks. The payment institution is the entity licensed by Bank Al-Maghrib that holds the payment accounts and executes the operations. A single player can combine all three roles. At ChariPay, the platform is ChariPay and the licensed payment institution is Chari Money.

Is a PSP a bank?

No. A bank takes deposits from the public and grants loans; a payment institution provides payment services and holds payment accounts, which are reserved for payment operations. The ChariPay payment account therefore complements your bank rather than replacing it: the money you collect is available there instantly, and your bank remains the destination of your payouts, on demand or every night.

How do I know whether a PSP is licensed?

Ask the provider for the exact name of the licensed institution that holds the accounts, then find that name in Bank Al-Maghrib's publications: its page on the structure of the banking system and the Official Bulletin, where licensing decisions appear. Then check that your funds land in a payment account in your company's name, held by that institution, and ask for the PCI DSS certification level.

Which payment institutions are licensed in Morocco?

The list that counts is Bank Al-Maghrib's: we do not copy it, because a copied list goes stale. According to the central bank's page on the structure of the banking system, consulted on October 2, 2026, Morocco had 18 licensed payment institutions at the end of 2024. More recent licenses and changes to the list are published in the Official Bulletin.

Does a merchant need its own license to collect payments online?

As a rule, no: the license is carried by the provider's payment institution, which the merchant contracts with. What is asked of you is a business verification file (KYB) — identity documents, trade register — before go-live. A business that is itself regulated may carry obligations of its own: that is for your adviser to say.

How much does a PSP cost in Morocco?

It depends on each contract: activation, commission, any subscription, security deposit, and the cost of payouts and refunds. Compare the full cost of a typical month rather than a headline percentage. At ChariPay: a free sandbox, a MAD 6,000 activation fee (VAT included) paid once at go-live, a commission and a security deposit set once your application has been reviewed, and free refunds.

How long does it take to integrate a PSP?

The first stage needs neither code nor waiting: a payment link is created from the portal. For the API, test mode opens as soon as you sign up, with no approval to wait for, and your developer works on the same contract as in production; how long it takes then depends on what you connect. Go-live follows the review of your application and payment of the activation fee.

Can my customers without a card pay?

Yes, in cash at an agency: the customer chooses cash on the page of a single-use payment link, receives a reference, deposits the amount at a partner agency, and you are notified as soon as the network confirms the deposit. The amount is then available in your payment account, and the order ships already paid, with no courier collecting cash and no cash drawer to reconcile.

Can Stripe be used in Morocco?

As of October 2, 2026, Morocco is not on the list of countries where Stripe is available, published at stripe.com/global. The workarounds that circulate — a company abroad, a third party's account — mean your funds are collected outside Morocco, through a foreign entity, with tax and exchange-control consequences to review with your adviser. The Stripe in Morocco article takes each point in turn.

Do my customers' card details pass through my servers?

No, if you use payment links or the hosted checkout: the card is entered on the page hosted by ChariPay, within a PCI DSS Level 1 certified perimeter, and card numbers are never written to a database. Your server only handles session references and signed notifications, which lightens your own compliance scope — to be confirmed with your adviser or your acquirer.

Next step

The surest way to judge a PSP is to try it: Start in test mode — free of charge, with no time limit and no approval to wait for. If you are still comparing, read the guide to choosing a payment platform in Morocco, and the Pricing page for the full grid.

Sources

• Bank Al-Maghrib — Structure of the banking system (figures at the end of 2024, in French) — read on 2026-10-02
• Bank Al-Maghrib — Law No. 103-12 on credit institutions and similar bodies, consolidated version as of March 31, 2022 (PDF, in French), Articles 11, 12, 16, 17, 18, 34 and 48 — read on 2026-10-02
• Bank Al-Maghrib — Operating conditions (licensing), in French — read on 2026-10-02
• Bank Al-Maghrib — Payment systems and means (payment institutions), in French — read on 2026-10-02
• Competition Council — communiqué of May 19, 2025 (decision No. 152/D/2024), in French — read on 2026-10-02
• Stripe — Global availability — read on 2026-10-02