Bank Al-Maghrib and national cybersecurity rules: assess your mobile banking app before and after every release.
Bank Al-Maghrib Directive n° 3/W/16 requires credit institutions to run a risk-based penetration testing programme every year, with systems open to the outside tested more than once a year and after any significant change. The domestic mobile payment rules require customer authentication before every transaction and a lock or a complementary check after repeated authentication failures. Law 05-20 and the DNSSI set the national cybersecurity baseline, and law 09-08 sets personal data duties. Ostorlab tests your app and the APIs behind it, behind login, on every release.
- Assesses the mobile app and the APIs it calls, on the build your customers download
- Tests login, one-time codes, transaction confirmation and session handling with your test accounts
- Lists the SDKs and native libraries in each release and maps them to known vulnerabilities
- Proves each finding with a replayable exploit or request and response evidence
- Who it applies to
- Credit institutions and payment institutions supervised by Bank Al-Maghrib, including banks and payment institutions that offer the domestic mobile payment scheme (m-wallet)
- Key dates
- Penetration testing directive of 10 June 2016; m-wallet texts of 12 November 2018; cybersecurity law of 25 July 2020; DNSSI V2 of 12 January 2023
- Focus
- Penetration testing, mobile payment security, cloud and third-party risk, and personal data protection
- Main reference
- Bank Al-Maghrib Directive n° 3/W/16 on penetration testing of information systems (French text)
The Moroccan texts behind your mobile channel
Bank Al-Maghrib sets the banking and payment rules, the DGSSI sets the national cybersecurity baseline, and the CNDP covers personal data. The dates below are for the texts cited on this page.
- 18 February 2009
Law 09-08 on personal data
Law 09-08, promulgated by Dahir n° 1-09-15, sets the rules for processing personal data in Morocco and creates the CNDP. Articles 23 and 24 require technical and organisational security measures, and articles 43 and 44 control transfers of data abroad.
- 10 June 2016
Penetration testing directive
Bank Al-Maghrib issues Directive n° 3/W/16, fixing the minimum rules to be observed by credit institutions for carrying out penetration tests on their information systems.
- 12 November 2018
Domestic mobile payment
Bank Al-Maghrib adopts Décision n° 392/W/2018 and Lettre circulaire n° LC/BKAM/2018/70 on domestic mobile payment, the m-wallet. The letter circular sets the minimum security rules, including authentication before transactions and a block or complementary check after repeated authentication failures.
- 25 July 2020
Law 05-20 on cybersecurity
Law 05-20 is promulgated by Dahir n° 1-20-69 and published in Bulletin Officiel n° 6906 of 6 August 2020. It requires entities and vital infrastructures to apply security policies, audit their information systems, classify sensitive systems and declare cybersecurity incidents.
- 15 July 2021
Decree n° 2-21-406
The decree implementing law 05-20 is published in Bulletin Officiel n° 7028 of 7 October 2021. It organises cybersecurity governance, designates the DGSSI as the national authority, and requires entities and vital infrastructures to classify their information systems and to have sensitive systems audited by DGSSI-qualified providers.
- 19 May 2022
Cloud outsourcing directive
Bank Al-Maghrib issues Directive n° 4/W/2022 on the minimum rules for cloud outsourcing by credit institutions, covering data classification, security measures and provider due diligence. The directive was issued after the CNDP opinion n° D-110-2021.
- 12 January 2023
DNSSI V2
The Head of Government approves the second version of the National Directive on the Security of Information Systems (DNSSI V2) by circular n° 02/2023. It updates the organisational and technical security measures for public entities and vital infrastructures, public and private.
The Moroccan rules, applied to your mobile app
For each rule: what the text says, what it means for a mobile banking app, how Ostorlab helps, and what stays with your team. Most texts are in French; titles and numbers are kept as published.
- Bank Al-Maghrib Directive n° 3/W/16, articles 1 to 3, 5 and 8 (French text)
Run a risk-based penetration test programme
What the text says
Directive n° 3/W/16 fixes the minimum rules. The institution must assess the security of its information system and make regular testing part of a global assessment of the effectiveness of its security controls, based on risk. It maps the risks of intrusion or cyberattack across its information systems, then draws up a test programme every year specifying the scope, nature, extent and frequency of tests for the whole information system, primary and backup. The programme is submitted for approval to the audit or risk committee, and the RSSI leads its execution.
Source:Bank Al-Maghrib Directive n° 3/W/16, articles 1 to 3, 5 and 8 (French text)
What it means for your mobile app
The app, the backend APIs and the accounts they protect are part of the information system, so they belong in the risk map and in the annual programme, with a frequency that reflects their criticality.
How Ostorlab helps
An AI-agent pentest tests the app and its APIs behind login, on the build you ship, with a working exploit you can replay for each AI-agent finding. Findings are rated critical, high, medium or low and tracked as tickets in the platform or in Jira and ServiceNow.
What stays with you
The risk map, the annual programme and its approval by the audit or risk committee, and the risk appetite behind the chosen frequency.
- Bank Al-Maghrib Directive n° 3/W/16, articles 4, 6 and 7 (French text)
Test internet-facing systems more than once a year
What the text says
Systems open to the outside must be subject to tests more than once a year. Tests are also required whenever a change in the information system could affect the overall exposure to information security or cyberattack risks. Bank Al-Maghrib can require an institution to carry out targeted tests, at a frequency and under the modalities it sets. The scope, nature, extent and frequency of tests must be adapted to the criticality of the systems, the results of the risk analysis, and the size and volume of activity of the institution.
Source:Bank Al-Maghrib Directive n° 3/W/16, articles 4, 6 and 7 (French text)
What it means for your mobile app
Your mobile app and its public APIs are systems open to the outside. A single yearly test is not enough for them, and every significant release should trigger testing.
How Ostorlab helps
Scans run from your CI/CD pipeline on every build, and store release monitoring covers the version customers download, so a change does not wait for the next annual cycle.
What stays with you
Deciding what counts as a significant change, and scheduling the tests so they do not disturb operations.
- Bank Al-Maghrib Directive n° 3/W/16, articles 9 and 10 (French text)
Test from outside and inside, without and with prior knowledge
What the text says
Tests must be carried out both from the internal network of the institution and from outside. The institution must define an approach and a methodology based on good practice and carry out at least two types of test: one without prior knowledge of the target information system, and one with prior knowledge of the target information system.
Source:Bank Al-Maghrib Directive n° 3/W/16, articles 9 and 10 (French text)
What it means for your mobile app
Blackbox testing shows what an attacker sees from the internet; greybox testing with credentials and documentation goes deeper into the authenticated flows of the app and its APIs.
How Ostorlab helps
Ostorlab tests the app from the outside and, with your test accounts, behind login. It intercepts traffic even with TLS pinning, then tests authorization, token misuse and abuse such as enumeration and replay, with request and response evidence.
What stays with you
The rules of engagement, the test charter, and deciding who receives which information before a test.
- Bank Al-Maghrib Directive n° 3/W/16, articles 11 to 15 (French text)
Qualify testers and control confidentiality and evidence
What the text says
The institution establishes a charter defining the framework of the tests and the rules for the internal and external teams that carry them out. For tests that require explicit and confidential information about the target systems, it gives priority to its internal teams. Internal testers must have the necessary expertise and certifications, be independent and have sufficient resources. Work by an external provider must be governed by an agreement defining the scope, the execution modalities and the provider's responsibility. The provider must have the necessary skills, respect strict confidentiality, work with integrity, destroy its records and those provided by the institution within a maximum of two months and provide formal proof, exploit identified vulnerabilities only with the prior explicit agreement of the institution and without harming the target, and comply with Moroccan law.
Source:Bank Al-Maghrib Directive n° 3/W/16, articles 11 to 15 (French text)
What it means for your mobile app
The rules cover the whole chain, including who may see credentials and personal data, and what happens to the test evidence afterwards.
How Ostorlab helps
Ostorlab is SOC 2 Type II audited. You control where scan data lives: choose a data residency region on the Enterprise plan, or run scans on-premises on infrastructure you control.
What stays with you
The test charter, the choice between internal and external teams, the provider contract, and the destruction attestation.
- Bank Al-Maghrib Directive n° 3/W/16, articles 16 to 18 (French text)
Report results to the board with a corrective plan
What the text says
Test results must be brought to the knowledge of the management body and the audit or risk committee, tracing at minimum the approach and scope of the tests and the risks covered, the definition and qualification of the tests performed and the means used, the vulnerabilities detected and their impact on the security of the information system, the assessment of the level of security against recognised standards, and the preventive and corrective actions needed. Where a system is outsourced to a provider, the institution must ensure that all the provisions of the directive are observed and taken into account in the contract.
Source:Bank Al-Maghrib Directive n° 3/W/16, articles 16 to 18 (French text)
What it means for your mobile app
Findings are not just a technical list. They have to be readable by the board, comparable to a standard, and carry an action plan.
How Ostorlab helps
Every AI-agent finding comes with a working exploit you can replay, and results can be grouped into tickets that carry the evidence, severity and status to closure. That gives you the material for the report and the corrective plan.
What stays with you
Writing the report, the board and committee process, and the corrective action plan.
- Lettre circulaire n° LC/BKAM/2018/70, article 5 (French text)
Authenticate every mobile payment transaction and lock after failures
What the text says
The letter circular sets the minimum security rules for m-wallet issuers and acquirers. Transactions can only be initiated after the prior customer authentication steps. Entering wrong authentication information several times must trigger a complementary authentication mechanism or a blocking of the m-wallet. The risk profile of customers and their transactions must be controlled and mastered to reduce fraud risk.
Source:Lettre circulaire n° LC/BKAM/2018/70, article 5 (French text)
What it means for your mobile app
For a mobile payment app this means server-side enforcement: authentication before every transaction, a lock or a step-up after repeated failures, and risk controls that do not depend on the app behaving.
How Ostorlab helps
Authenticated testing covers login, one-time codes, transaction confirmation, step-up flows, session handling and account lockout with your test accounts, together with the API calls behind them.
What stays with you
The authentication methods and thresholds, the lock and recovery process, and the fraud rules.
- Décision n° 392/W/2018, articles 13 to 15 (French text)
Protect mobile payment data and notify new products
What the text says
Institutions must put in place appropriate security measures to protect the confidentiality and integrity of m-wallet user data. They must declare all m-wallet fraud to Bank Al-Maghrib, under the modalities and conditions that Bank Al-Maghrib sets. Issuers must submit every new m-wallet product to Bank Al-Maghrib for opinion at least 15 days before its launch date, under the modalities that Bank Al-Maghrib sets.
Source:Décision n° 392/W/2018, articles 13 to 15 (French text)
What it means for your mobile app
Mobile payment data on the device and in transit is in scope, and a new or significantly changed payment feature has a regulatory gate before launch.
How Ostorlab helps
Ostorlab looks for tokens and personal data in local storage, caches, logs and screenshots, checks transport protections, and tests the APIs behind payment flows for broken authorization and token misuse.
What stays with you
Data classification, fraud reporting to Bank Al-Maghrib, and the product notification process.
- Bank Al-Maghrib Directive n° 4/W/2022, articles 5, 6, 8, 9 and 10 (French text)
Assess cloud and third-party interconnection risks
What the text says
Directive n° 4/W/2022 sets the minimum rules for cloud outsourcing. The institution defines a data management framework including data classification, eligible hosting locations, security measures and restrictions by class, and recovery processes after a data loss or breach. It conducts a risk analysis before outsourcing, covering risks such as loss of governance, chain subcontracting, failure to respect retention and destruction rules, ineffective access rights, international data transfers, and weaknesses in the interconnection between its systems and the provider's, such as missing encryption, authentication weaknesses, protocol incompatibility and API flaws. It checks the provider's certifications, security measures, tested continuity plans, incident transparency and cyber insurance, and keeps auditability and reversibility clauses.
Source:Bank Al-Maghrib Directive n° 4/W/2022, articles 5, 6, 8, 9 and 10 (French text)
What it means for your mobile app
Everything your app talks to outside the bank, including cloud services and third-party APIs, belongs in the classification and the risk analysis, with authentication and API weaknesses treated as named risks.
How Ostorlab helps
Ostorlab intercepts the app's traffic even with TLS pinning and tests the APIs it calls for broken authorization (BOLA, BFLA, IDOR), token misuse and replay. SCA fingerprints statically compiled libraries and maps third-party SDKs to known vulnerabilities.
What stays with you
The cloud strategy, data classification, provider due diligence and contracts, and exit plans.
- Loi n° 05-20 relative à la cybersécurité, articles 3 to 8, 11, 12, 19 and 20; Décret n° 2-21-406; DNSSI V2 approved by circular n° 02/2023 (French text)
Comply with law 05-20, the DNSSI and the sensitive system rules
What the text says
Law 05-20 requires entities and vital infrastructures to comply with the directives, rules and referentials of the national cybersecurity authority, to put in place a security policy for their information systems, to identify risks and take technical and organisational measures to manage them, and to have any information system offering digital services to third parties audited before it goes into operation and audited regularly. They must classify their information assets and systems by sensitivity, set authorisation procedures for access, designate an information systems security officer (RSSI), and put in place supervision and detection. Cybersecurity incidents must be declared to the national authority. Sensitive data must be hosted exclusively on the national territory, and any outsourcing of a sensitive information system must be covered by a contract under Moroccan law with commitments on information protection, auditability and reversibility. Every sensitive information system must be homologated before it is put into operation and, at the request of the national authority, audited by that authority or by audit providers qualified by it. The DNSSI V2, approved by circular n° 02/2023, sets the organisational and technical measures, with entities and vital infrastructures given six months to establish an implementation schedule.
What it means for your mobile app
A mobile banking app is a digital service and a channel into systems that can be designated sensitive. The audit before launch, the classification, the localisation of sensitive data and the supervision duties apply to it. If the bank's systems are designated as a vital infrastructure with sensitive systems, the mobile channel and its backends are in the perimeter.
How Ostorlab helps
Ostorlab provides security testing evidence before a release: AI-agent pentests of the app and its APIs, Mobile SAST on the binary, SCA on embedded components, and shielding checks for root, jailbreak, tampering and pinning, all runnable from your CI/CD or on-premises on infrastructure you control. Ostorlab is SOC 2 Type II audited, and it does not replace the audits that must be carried out by DGSSI-qualified providers.
What stays with you
The security policy, the risk analysis, the classification and its declaration, the RSSI, the homologation of sensitive systems, the choice of hosting locations, incident reporting to the DGSSI, and the audits by qualified providers.
- Loi n° 09-08, articles 12, 23, 24, 43 and 44 (French text)
Protect personal data under law 09-08
What the text says
Under law 09-08, the processing of personal data requires a prior declaration, and a prior authorisation when it concerns sensitive data, the use of data for purposes other than those for which they were collected, or genetic data. The controller must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access, including where the processing involves data transmission over a network, and must choose a subcontractor that offers sufficient guarantees and is bound by a written contract. Specific controls apply to sensitive and health data, including access control, media control, transmission control and logging. Personal data may only be transferred to a State that ensures a sufficient level of protection, or under the derogations of article 44, including the express and reasoned authorisation of the CNDP.
Source:Loi n° 09-08, articles 12, 23, 24, 43 and 44 (French text)
What it means for your mobile app
Customer data in the app, in logs and in the backend is personal data. The security measures, the subcontractor terms and any transfer abroad, including to a scanning platform, need to be covered.
How Ostorlab helps
Ostorlab looks for personal data in local storage, caches, logs and screenshots and checks how the app transmits it. On the Enterprise plan you can choose a data residency region or run scans on-premises, so you can align the processing with your CNDP position.
What stays with you
The legal bases, the declarations and prior authorisations, the processing records and the transfer requests to the CNDP.
Summary of public Bank Al-Maghrib, DGSSI and CNDP texts, checked on 27 September 2026. The Bank Al-Maghrib, DGSSI and CNDP texts are in French and the summaries on this page are ours. This page is not legal advice.
The Moroccan rules, control by control
The controls the texts point to, how Ostorlab tests them in your app and its APIs, and the evidence you can keep.
| Control | How Ostorlab helps | Evidence you keep |
|---|---|---|
| Annual test programme, approved by the audit or risk committeeDirective 3/W/16, arts 1 to 3 | AI-agent pentest of the app and its APIs, behind login, on the build you ship. Details | A working exploit you can replay for each AI-agent finding, and a coverage heatmap |
| Systems open to the outside tested more than once a yearDirective 3/W/16, art 6 | Mobile DAST in CI/CD on every build, and monitoring of store releases. Details | Scan results per build and per store release |
| Tests from inside and outside, without and with prior knowledgeDirective 3/W/16, arts 9 and 10 | External testing plus authenticated testing with your test accounts, including the APIs behind them. Details | Findings on authenticated flows, with reproduction steps |
| Findings reported with impact and a corrective planDirective 3/W/16, arts 17 and 18 | Findings rated critical to low, grouped into tickets in the platform or in Jira and ServiceNow, and retested after the fix. Details | Ticket history and retest result for each finding |
| Authentication before every m-wallet transactionLC/BKAM/2018/70, art 5 | Completes one-time codes and tests MFA enforcement and step-up flows with your test accounts. Details | Findings on the authentication flow, with request and response logs |
| Lock or complementary check after repeated failuresLC/BKAM/2018/70, art 5 | Tests account lockout, session invalidation and step-up behaviour. Details | Session and lockout findings, with reproduction steps |
| m-wallet data confidentiality and integrityDécision 392/W/2018, art 13 | Looks for tokens and personal data in storage, caches, logs and screenshots, and checks transport protections. Details | File system evidence showing what was written, where and when |
| Third-party connections, authentication weaknesses and API flawsDirective 4/W/2022, arts 8 and 9 | Intercepts traffic even with TLS pinning and tests the APIs for broken authorization, token misuse and replay. Details | Request and response evidence for each API finding |
| Audit before launch, classification and data localisationLaw 05-20, arts 4, 5 and 11 | Scans run from your CI/CD or on-premises, on infrastructure you control, with results tied to a release. Details | Scan results per build, with the data residency option documented |
| Personal data security and transfers abroadLaw 09-08, arts 23, 24 and 43 | Checks where personal data lands on the device and how it travels, and keeps scan data in your chosen region. Details | Findings on storage and transport, and the platform's SOC 2 Type II report |
Ostorlab tests controls in the app and its APIs. SOC monitoring, incident response and incident reporting to the DGSSI, the homologation of sensitive systems, the audits carried out by DGSSI-qualified providers, governance and physical security stay with your teams.
Moroccan rules to test in your mobile app
A practical list for security and payment teams, based on Bank Al-Maghrib Directive n° 3/W/16, the m-wallet texts and the national cybersecurity rules.
Risk map and programme
Put the app, its APIs and the payment flows in the information system risk map, with a frequency that matches their criticality.
Committee approval
Have the annual test programme approved by the audit or risk committee, and keep the record of the approval.
More than once a year
Test systems open to the outside more than once a year and after every significant change, not only in the annual cycle.
Blackbox and greybox
Combine external tests with authenticated tests from your test accounts, including the APIs behind them.
Test providers
Check the provider's skills, independence and confidentiality terms, the destruction of records after the test, and the written approval required before exploiting a vulnerability.
m-wallet flows
Verify authentication before every transaction, blocking or a complementary check after repeated failures, and the risk profile controls behind them.
New products and fraud
Plan the notification to Bank Al-Maghrib at least 15 days before a new m-wallet product, and the fraud reporting process.
Third parties and data
Cover cloud services, SDKs and APIs in the classification and risk analysis, and check where personal data goes, including transfers abroad.
A suggested list, not a Bank Al-Maghrib or DGSSI template. This is not legal advice.
The capabilities behind this page
Each one has its own page with the details.
- Mobile Agentic Deep ScanAI agents pentest the store build on every release, with a working exploit you can replay for each AI-agent finding.Learn more
- Authenticated testingTest login, one-time codes and step-up flows with your test accounts.Learn more
- API and backend testingIntercept app traffic even with TLS pinning, then test the APIs and backends behind accounts and payments.Learn more
- Mobile SASTBinary-based static analysis of APK, AAB and IPA files, with taint analysis across the app and its embedded SDKs.Learn more
- SCA and SBOMFind vulnerable dependencies, including statically compiled native libraries, and track their closure release after release.Learn more
- Mobile Shielding ScanTest root and jailbreak detection, anti-tampering and pinning at runtime, and see which protections held and which were bypassed.Learn more
- Bring your own AI keyRun AI-agent scans on your own AI provider key with a spend cap per scan, so usage follows your internal policies.Learn more
- On-premises scanningScan staging apps, APIs and repositories behind your firewall or VPN, on infrastructure you control.Learn more
Trusted by banks and fintechs, including
Sources
The official texts this page is based on, checked on 27 September 2026.
- Directive n° 3/W/16 du 10 juin 2016 fixant les règles minimales à observer par les établissements de crédit pour réaliser les tests d'intrusion des systèmes d'informationBank Al-Maghrib, 10 June 2016, French text. Risk mapping, the annual test programme, tests more than once a year for systems open to the outside, internal and external tests, rules for internal and external testers, and reporting to the audit or risk committee
- Décision n° 392/W/2018 relative au paiement mobile domestiqueBank Al-Maghrib, 12 November 2018, French text. Rules for the domestic mobile payment scheme (m-wallet), including data confidentiality and integrity (article 13), fraud reporting (article 14) and the 15-day notification for new products (article 15)
- Lettre circulaire n° LC/BKAM/2018/70 relative au paiement mobile domestiqueBank Al-Maghrib, 12 November 2018, French text. Technical and security rules for the m-wallet, including authentication before transactions, complementary authentication or blocking after repeated failures, and risk profile controls (article 5)
- Directive n° 4/W/2022 du 19 mai 2022 fixant les règles minimales en matière d'externalisation vers le cloud par les établissements de créditBank Al-Maghrib, 19 May 2022, French text, issued after CNDP opinion n° D-110-2021. Data classification, security measures, provider due diligence, auditability and reversibility, and interconnection risks including authentication weaknesses and API flaws
- Loi n° 05-20 relative à la cybersécuritéDahir n° 1-20-69 of 25 July 2020, Bulletin Officiel n° 6906 of 6 August 2020, French text published by ANRT. Security policy, audits before going into operation, classification, the RSSI, and national hosting for sensitive data
- Décret n° 2-21-406 du 4 hija 1442 (15 juillet 2021) pris pour l'application de la loi n° 05-20 relative à la cybersécuritéBulletin Officiel n° 7028 of 7 October 2021, French text published by ANRT. Cybersecurity governance, the DGSSI as national authority, the classification of information systems, the declaration of sensitive systems, and audits by qualified providers
- Directive Nationale de la Sécurité des Systèmes d'Information (DNSSI), version 2DGSSI, approved by circular n° 02/2023 of 12 January 2023, French text. Organisational and technical security measures for public entities and vital infrastructures, including secure development, security testing, vulnerability management, supplier relations and mobile device handling
- Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnelDahir n° 1-09-15 of 18 February 2009, French text published by the CNDP. Prior declaration and authorisation, security measures for personal data (articles 23 and 24), and transfers of data abroad (articles 43 and 44)
Frequently asked questions
Straight answers on coverage, setup, and how results reach your team.
Can't find your answer? Book a demo or contact us.
Assess your mobile banking app the way Bank Al-Maghrib describes it
Start with a free scan of your app from the store, or book a demo to run logged-in tests of your app and APIs with our team.