The Market in Morocco

Morocco has an established and growing IT outsourcing market, underpinned by several structural advantages. Its geographical proximity to Europe enables providers based in Morocco to serve European customers within broadly compatible working hours, and supports Morocco’s position as a nearshore delivery location. The availability of multilingual talent, particularly in French, Arabic, English and Spanish, facilitates the provision of services to customers operating across European, African, Middle Eastern and North American markets.

The market also benefits from comparatively competitive operating costs, an established telecommunications environment and a developed outsourcing ecosystem comprising local providers, international technology groups and specialised service centres. These factors have enabled Morocco to build capabilities in infrastructure management, software development, application maintenance, technical support and other managed IT services.

The Ministry of Industry identifies infrastructure management, software development and software maintenance as the principal activities historically undertaken within Morocco’s IT outsourcing sector.

Public Policy

Public policy continues to support the sector’s expansion and gradual movement towards higher-value services. The Digital Morocco 2030 strategy seeks to:

• develop Information Technology Outsourcing and Engineering Services Outsourcing;
• attract higher-value projects;
• strengthen technology training;
• support the upskilling and reskilling of professionals;
• attract international technology companies; and
• promote the export of digital services by Moroccan businesses.

It also provides for employment and training incentives, subject to the applicable eligibility requirements.

The broader Moroccan outsourcing sector has consequently attained a significant scale. According to the Ministry of Digital Transition and Administrative Reform, Morocco is the second-largest outsourcing destination in Africa and is ranked 28th in the 2023 Kearney Global Services Location Index. The Ministry also reports that more than 1,200 companies operate in the sector, which accounted for approximately 150,000 stable jobs in 2024 and generated more than MAD27 billion in service-export revenue in 2025. These figures relate to the outsourcing sector as a whole and not exclusively to IT outsourcing.

Market Focuses

Morocco’s IT outsourcing market remains strongly oriented towards nearshore service delivery, particularly for European customers, while progressively developing capabilities in cloud services, cybersecurity, engineering and other higher-value digital activities. However, conventional infrastructure, application development, maintenance and technical support services continue to represent an important part of the market.

Historically, Moroccan IT outsourcing has focused on infrastructure management, software development and software maintenance. These remain important activities, together with technical support, application management, web hosting and other managed IT services.

Market Development

The main market development is an expansion towards services with greater technical and economic value. Against this background, the services being developed within the Moroccan market include:

• software and application development;
• application testing, maintenance and support;
• IT infrastructure management;
• cloud implementation, migration and managed-cloud services;
• cybersecurity and security operations;
• enterprise-system implementation and support;
• data management and analytics;
• digital-platform development; and
• engineering and other knowledge-intensive technology services.

This development does not mean that traditional IT support and staff-based delivery models have disappeared; they continue to represent an important part of the market. Rather, customers and service providers are progressively supplementing them with managed-service and project-based arrangements covering more complex digital functions.

Morocco’s position as a nearshore location remains particularly important. Its geographical proximity to European markets and multilingual talent pool allow providers to support European customers within similar time zones. The government’s outsourcing and digital-export policy also seeks to expand Morocco’s presence in international markets and encourage Moroccan technology companies to export digital services.

Cloud Computing, Cybersecurity and AI

Cloud computing is also affecting the type and structure of IT outsourcing services. Customers increasingly use SaaS, IaaS and managed-cloud solutions rather than relying exclusively on customer-owned infrastructure. For regulated or sensitive environments, however, cloud adoption must be considered alongside cybersecurity, data location and supplier qualification requirements.

Cybersecurity has similarly become a more significant component of IT outsourcing. Customers increasingly focus on supplier security standards, access controls, incident management, business continuity, subcontractor risk and the location from which systems are administered. Law No 05-20 establishes cybersecurity requirements applicable to public entities, critical infrastructure and certain categories of operators.

The use of AI, machine learning and robotic process automation has not yet had a significant impact on the Moroccan IT outsourcing market. Certain providers are exploring such technologies, and the Digital Morocco 2030 strategy seeks to encourage AI-related skills and infrastructure, but their practical adoption remains relatively limited and conventional service delivery models continue to predominate.

Overall, the Moroccan IT outsourcing market is characterised by continued growth, a strong nearshore orientation towards European customers, continued reliance on established infrastructure and application services, and a gradual movement towards cloud, cybersecurity, engineering and other higher-value digital services.

BPO remains a major component of Morocco’s outsourcing sector. Historically, it has focused on English and French speaking customer service and call centre activities, but it increasingly includes back office administration, finance and accounting, human resources support, procurement, content moderation and sector-specific operational services.

The official description of Morocco’s offshoring sector classifies BPO activities into general administrative functions, customer relationship management and business-specific functions. The renewed offshoring strategy also encompasses customer relationship management, BPO, engineering services outsourcing, knowledge process outsourcing and ITO.

The principal trends are:

• movement away from voice-based services towards omnichannel customer support;
• growth in KPO and specialist back office work;
• closer integration between BPO providers and customers’ cloud platforms; and
• increased attention to personal data protection, international transfers and access controls.

AI, machine learning, chatbots and robotic process automation have not had a significant impact on the Moroccan outsourcing market. Although certain outsourcing providers are exploring these technologies, their adoption remains relatively limited, and traditional service delivery models continue to predominate.

However, these technologies are expected to develop progressively, particularly in customer support, process automation, data analysis and software development. Their adoption may raise contractual and regulatory issues relating to personal data protection, confidentiality, cybersecurity, intellectual property rights, accuracy and human oversight.

Blockchain, smart contracts, cryptocurrencies and NFTs also remain at an early stage of development in the Moroccan outsourcing market and have not materially affected the prevailing outsourcing models.

The most commonly outsourced services in Morocco include:

• helpdesk and technical support;
• IT infrastructure monitoring and maintenance;
• software development, testing and application maintenance;
• cloud implementation and managed services;
• cybersecurity monitoring and incident response support;
• finance, accounting and payroll administration;
• human resources administration;
• data entry, document processing and records management;
• customer contact and customer relationship management;
• procurement and supply chain support; and
• content moderation and digital marketing support.

The precise model varies by sector. Banks, insurers, telecommunications operators, public entities and critical infrastructure operators generally retain closer control over regulated or strategically sensitive information systems.

There is no general prohibition on outsourcing or technology transactions in Morocco. The parties are generally free to structure their arrangements contractually, subject to mandatory provisions of Moroccan law, including rules governing contracts, employment, competition, consumer protection, intellectual property, electronic transactions, personal data, cybersecurity and regulated sectors.

Restrictions are most likely to arise where the arrangement involves:

• personal data or international data transfers;
• sensitive information systems or sensitive data;
• a public entity or critical infrastructure;
• regulated financial, insurance or telecommunications activities;
• public sector procurement;
• cybersecurity services subject to qualification requirements; or
• digital trust services.

Financial Services

Banks, payment institutions, insurers and other regulated financial businesses must consider sector-specific rules concerning governance, internal control, professional secrecy, operational resilience, audit access, data security, continuity and regulatory supervision. Depending on the regulated entity and the materiality of the outsourced function, notification to or engagement with the relevant regulator may be required.

Outsourcing does not generally relieve a regulated entity of responsibility for the outsourced function. Contracts should therefore preserve regulatory and audit access, control over subcontracting, information security rights, continuity measures and an effective exit strategy.

Telecommunications and Digital Services

Telecommunications activities may require authorisation or licensing, and remain subject to the supervision of the National Telecommunications Regulatory Agency (Agence nationale de réglementation des télécommunications, or ANRT). Law No 05-20 also imposes cybersecurity requirements on specified operators, including:

• public telecommunications network operators;
• internet access providers;
• cybersecurity service providers;
• digital service providers; and
• internet platform providers.

Public Sector and Critical Infrastructure

Public entities and critical infrastructure are subject to enhanced cybersecurity requirements concerning sensitive information systems, risk management, incident reporting and, where applicable, the use of qualified cybersecurity or cloud providers. Certain cybersecurity services must be performed within Morocco, and additional Moroccan ownership and nationality requirements may apply to providers serving Class A sensitive information systems.

Personal data processing is governed mainly by Law No 09-08. Depending on the processing, the controller must generally file either a prior declaration or a request for prior authorisation with the National Data Protection Authority (Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel, or CNDP). Prior authorisation is required in specified cases, including for certain processing of sensitive data, national identification numbers, offences and convictions, genetic information and interconnected databases.

Outsourcing contracts involving personal data should address:

• processing only on documented instructions;
• confidentiality;
• appropriate technical and organisational safeguards;
• restrictions on further subcontracting;
• audit and information rights;
• assistance with data subject requests;
• retention and deletion;
• data location and remote access;
• incident management; and
• the return or destruction of personal data at exit.

Outsourcing contracts involving personal data should comply with the applicable standard contractual clauses.

Law No 09-08 regulates transfers of personal data outside Morocco, which require prior authorisation. Contractual safeguards or binding corporate rules must support a transfer to a jurisdiction that is not recognised as providing sufficient protection.

Uploading data to servers abroad, permitting access from abroad or using a foreign cloud provider constitutes an international transfer. Internal materials used in Moroccan cloud reviews likewise treat the offshore hosting of employee data as requiring prior CNDP transfer authorisation.

Law No 05-20 applies additional cybersecurity requirements to public entities, critical infrastructure and specified operators.

There is no mandatory standard form for private sector outsourcing contracts in Morocco. The usual model is a bilateral services agreement covering:

• the service description;
• service levels and key performance indicators;
• pricing and indexation;
• acceptance procedures;
• change of control, personnel and key-person requirements;
• data protection and cybersecurity;
• intellectual property rights;
• subcontracting;
• audit rights;
• business continuity and disaster recovery;
• liability and insurance;
• termination; and
• exit assistance.

For complex transactions, the documentation may consist of a framework agreement, statements of work, service level schedules, data processing terms, security requirements, and transition or transformation plans.

Public sector outsourcing may also be subject to public procurement documentation and mandatory administrative terms.

Alternative models in Morocco include:

• multi-sourcing, under which separate providers deliver infrastructure, applications, cloud, cybersecurity or BPO services;
• build-operate-transfer models;
• joint ventures;
• managed-services arrangements;
• prime-contractor and subcontractor structures;
• regional or global framework agreements implemented through local statements of work; and
• consortium structures, particularly for larger public or infrastructure projects.

Multi-sourcing is generally accompanied by customer-retained governance and co-operation obligations among suppliers. Joint ventures and captive structures may be used where the customer requires greater operational control, local capability development or compliance with localisation requirements.

Cloud computing, SaaS and IaaS have shifted outsourcing contracts away from bespoke asset transfer transactions towards subscription and managed-service models. Contracts now place greater emphasis on:

• availability and service credits;
• data location;
• remote access;
• security certification;
• portability and interoperability;
• data extraction at exit;
• resilience and disaster recovery; and
• regulatory audit rights.

Cloud contracts are often based on international provider terms, which may limit the customer’s ability to negotiate liability, audit and termination provisions.

Moroccan customers operating in regulated sectors normally require local addenda or negotiated enterprise terms.

Common customer protections include:

• service levels and service credits;
• audit, inspection and reporting rights;
• remediation plans and step-in rights;
• obligations concerning key personnel;
• controls over subcontracting and changes of control;
• intellectual property indemnities;
• confidentiality, data protection and cybersecurity undertakings;
• business continuity and disaster recovery commitments;
• transition and exit assistance; and
• financial security, insurance or parent company guarantees for material projects.

Remedies are typically limited to the withholding of disputed charges, service credits, damages, termination and indemnification.

Contractual remedies should be drafted clearly, particularly if service credits are intended to be the sole remedy for a particular failure.

The parties may terminate in accordance with the contract, including for:

• expiry of a fixed term;
• convenience, if expressly permitted and subject to a reasonable notice period;
• material breach not remedied within a cure period;
• repeated service level failure;
• prolonged force majeure;
• loss of a licence or regulatory qualification; or
• an unapproved change of control or subcontracting arrangement.

Upon termination, the customer’s rights include the entitlement to file a claim for damages and the rights that are provided for in the contract, such as:

• continued service during transition;
• the transfer of data in a usable format;
• the return or destruction of confidential information;
• the transfer or licensing of relevant intellectual property; and
• assistance in migrating to the customer or a replacement supplier.

Article 264 of the Code of Obligations and Contracts provides that recoverable damages comprise the effective loss suffered by the creditor and the gain of which the creditor has been deprived, provided that such loss is the direct consequence of the non-performance. The assessment is made by the court in light of the circumstances of each case, including whether the debtor’s conduct amounts to fault or fraud.

Direct and Indirect Loss

Moroccan law does not rely on the common law distinction between direct and indirect or consequential loss as separate, precisely defined categories. The relevant statutory test is whether the loss constitutes a direct consequence of the non-performance. Accordingly, contractual references to “direct”, “indirect” or “consequential” loss should be defined carefully; simply importing those expressions from an English law contract may create uncertainty as to their meaning and scope under Moroccan law.

As a matter of market practice, technology and outsourcing agreements frequently exclude indirect or consequential losses. However, the contract should preferably identify the specific heads of loss intended to be excluded rather than rely exclusively on those general expressions.

Loss of Profit, Goodwill, Business, etc

Loss of profit is not automatically irrecoverable or necessarily classified as indirect loss. Article 264 of the Code of Obligations and Contracts expressly recognises the gain of which the creditor has been deprived as a potentially recoverable head of damage, provided that the loss is established and results directly from the non-performance.

In practice, technology and outsourcing contracts commonly exclude or limit specific economic losses, such as:

• loss of profit or revenue;
• loss of turnover;
• loss of business or contracts;
• loss of anticipated savings;
• loss of business opportunities;
• loss of goodwill or reputation; and
• loss or corruption of data.

The effectiveness of such exclusions depends on their wording and on the mandatory limitations imposed by Moroccan law. Moroccan contracting practice includes clauses expressly excluding indirect or consequential loss and enumerating loss of profit, revenue, turnover, market share, goodwill and future business.

The parties may also agree in advance on the damages payable for total or partial non-performance or delay. However, under Article 264 of the Code of Obligations and Contracts, the court may reduce an agreed amount if it is excessive, increase it if it is manifestly insufficient, or reduce it to reflect the benefit obtained by the creditor from partial performance.

Losses Typically Not Subject to Limitation

The parties generally have considerable freedom to agree limitations and exclusions of liability. However, Article 232 of the Code of Obligations and Contracts provides that a party cannot stipulate in advance that it will not be liable for its gross negligence or misconduct, or for its fraud or wilful misconduct. A contractual limitation or exclusion purporting to cover such conduct may therefore be ineffective.

As a matter of market practice, liability caps and exclusions commonly do not apply, or are subject to separate higher caps, in respect of:

• fraud, wilful misconduct, or gross negligence or misconduct;
• death or personal injury;
• breach of confidentiality;
• infringement of intellectual property rights;
• breach of data protection or cybersecurity obligations; and
• liabilities expressly covered by an indemnity.

However, except for the aforementioned statutory restrictions, there is no universal mandatory list of uncapped liabilities applicable to technology or outsourcing contracts. Whether confidentiality, intellectual property, personal data or cybersecurity liabilities are uncapped is principally a matter of negotiation and contractual allocation.

Moroccan contracts are governed not only by their express wording but also by mandatory law, good faith, the consequences arising from the nature of the obligation, established usage and applicable custom. A supplier may therefore be required to perform in accordance with professional standards and the agreed purpose even where every operational detail is not expressly stated.

However, Moroccan law does not provide a specialised and comprehensive set of statutory implied terms exclusively for IT or outsourcing contracts. Matters such as service levels, compatibility, acceptance, data portability, security, documentation, remediation and exit support should be addressed expressly.

Mandatory consumer protections may apply where the customer is acting as a consumer, but most substantial outsourcing contracts are business-to-business arrangements.

Common contractual security requirements include:

• an information security management framework;
• role-based and least-privilege access;
• multi-factor authentication;
• encryption;
• vulnerability management and penetration testing;
• secure software development practices;
• physical access controls;
• back-up, redundancy and recovery testing;
• incident notification and co-operation obligations;
• audit rights and security attestations;
• data retention and secure deletion controls; and
• cyber-insurance requirements.

ISO 27001 and the NIST Cybersecurity Framework are frequently used as reference standards in international transactions, although their contractual application depends on the parties’ agreement.

Business continuity is commonly addressed through geographically separated back-ups, recovery time and recovery point objectives, crisis management procedures, alternative working arrangements and periodic continuity tests.

The most common mechanisms are:

• service-level agreements;
• key performance indicators;
• service credits;
• milestones and acceptance criteria;
• operational and management reporting;
• root-cause analysis;
• remediation or service improvement plans;
• customer satisfaction indicators;
• benchmarking;
• productivity and automation targets;
• gain-sharing arrangements;
• governance committees;
• escalation procedures;
• audit and inspection rights;
• continuous-improvement obligations;
• step-in rights; and
• termination rights for persistent or critical failure.

Customers generally seek to preserve termination and damages claims for serious, repeated or excluded breaches.

Cloud-based contracts usually differ in the following respects:

• services are standardised and shared rather than dedicated;
• charges may be based on subscription or consumption;
• data may be replicated across multiple locations;
• the supplier may resist broad audit and step-in rights;
• termination assistance may be limited;
• data extraction and deletion become critical; and
• customer dependency and switching risk are higher.

Moroccan customers should pay particular attention to data location, foreign access, data privacy formalities, encryption, portability, deletion evidence, subcontractor changes and continuity. Where sensitive systems or data of a public entity or critical infrastructure are involved, local hosting with a qualified provider is required.

Morocco does not have a detailed outsourcing-specific employee transfer regime equivalent in all respects to the UK TUPE regime. Accordingly, an outsourcing contract does not automatically mean that all affected employees transfer to the supplier. The transfer of employees is typically subject to the transfer of an undertaking or business.

Where consent is required, the documentation should preserve seniority, remuneration, accrued rights and other agreed benefits. Any dismissal must comply with the applicable substantive and procedural requirements.

Market practice is not to transfer employees for outsourcing unless justified through the transfer of an undertaking or a business.

There is no general rule requiring consultation merely because a commercial outsourcing contract is signed by a company.

Morocco continues to be positioned primarily as a nearshore location for European customers and as a regional service hub for Africa. Its principal advantages are geographical proximity, overlapping working hours and French, Arabic, English and Spanish language capabilities.

The market is moving towards hybrid delivery models combining:

• onshore customer-facing or regulated functions;
• nearshore delivery from Morocco;
• cloud-based shared platforms; and
• offshore specialist or follow-the-sun resources.

Security, operational resilience, geopolitical risk and data localisation requirements have strengthened interest in nearshore delivery for sensitive functions. Conversely, specialised skills and cost considerations continue to support multi-country sourcing.

Morocco’s official strategy seeks to move the sector towards higher-value digital, engineering, AI, cybersecurity and knowledge-based services while continuing to support traditional BPO.

Moroccan labour law does not yet contain a comprehensive, standalone statutory framework governing all aspects of remote working; general employment, health and safety, working-time, accident, confidentiality and data protection rules continue to apply.

A remote working arrangement should address:

• the employee’s normal work location;
• working hours and availability;
• time recording and overtime;
• equipment and maintenance;
• expense allocation;
• occupational health and safety;
• confidentiality and secure document handling;
• monitoring and privacy;
• remote access and authentication;
• the use of personal devices;
• incident reporting;
• cross-border working;
• the return of equipment; and
• circumstances in which attendance at the employer’s premises may be required.

Customers’ principal business concerns are:

• information security;
• supervision;
• service continuity;
• data leakage;
• access by unauthorised household members;
• employee productivity;
• segregation of duties; and
• compliance with data location or regulated sector requirements.

Customers commonly require approved locations, managed devices, VPN access, multi-factor authentication, restricted printing and downloading, clean-desk requirements and periodic security training.

Cross-border remote work may create additional immigration, tax, social security and permanent establishment issues. These must be reviewed according to the employee’s physical working location and the duration and nature of the arrangement.