Regulatory risk is reputation risk with a letterhead. A supervisory finding, a public sanction, a consultation paper — each is a signal that journalists, NGOs and AI engines will read and replay. We monitor twelve Moroccan regulators whose 2026 priorities will shape the reputation landscape for the companies they supervise. This is the map, and what to watch in each.
The 12 regulators
BAM — the centre of gravity
Bank Al-Maghrib is the single most reputation-consequential regulator in Morocco. Its 2026 supervisory programme names AML, instant-payments resilience and climate-related financial risk as the three heightened-scrutiny pillars. For supervised banks, the translation is direct: an AML finding now reaches the public domain faster, the instant-payments programme increases the operational-incident surface, and climate-risk disclosure intersects with the AMMC ESG framework to create a double-reporting obligation.
AMMC — ESG enforcement year
The AMMC's 2024 ESG framework moves from guidance to enforcement in the 2026 reporting cycle. The signal to watch is the regulator's treatment of 'weakly substantiated' sustainability claims — our greenwashing-risk index flagged 38% of listed non-financial ESG statements in 2025. Companies whose 2026 disclosures repeat 2025 claim language without quantified baselines are the most exposed.
ANRT — 5G and quality of service
The ANRT's 5G rollout conditions, finalised in late 2025, set coverage and quality-of-service obligations that will define telecoms reputation through 2026. The regulator has shown willingness to publish QoS penalties publicly — a reputational, not just financial, consequence. For Maroc Telecom, Orange Maroc and Inwi, the monitoring priority is the gap between marketed coverage and measured QoS by region.
CNDP — the data-protection acceleration
The CNDP's 2026 work programme signals alignment with GDPR on cross-border transfers and consent management. For any Moroccan company processing EU personal data — most of the financial and telecoms sector — the gap analysis between Loi 09-08 and the forthcoming amendments is a Q1 2026 priority. Data-protection incidents are among the fastest-moving reputation crises; the CNDP's enhanced public-communication posture means incidents will be named.
ONSSA and ANAC — safety and trust
ONSSA's import-control and traceability programme and ANAC's safety-oversight follow-ups are lower-frequency but high-severity reputation triggers. A food-safety recall or an aviation safety finding travels faster than any financial sanction. The monitoring discipline here is early-warning: tracking regulator consultation papers and inspection programmes before they become enforcement actions.
The reputation lens on regulation
Every regulator on this list produces two kinds of signal: a compliance signal (what the company must do) and a reputation signal (what the public will infer). Most Moroccan companies monitor the first and under-monitor the second. The reputation signal lives in the consultation papers, the public statements, the penalty notices, and the subsequent media and AI-engine citation.
“We read every BAM circular. We did not read the Hespress story that quoted the circular until it was already shaping customer calls.”— Compliance officer, mid-sized Moroccan bank (anonymised)
A monitoring discipline for 2026
- Map every regulator with jurisdiction over your entity, and assign a named internal owner.
- Track consultation papers, not just enforceable texts — they are the leading indicator.
- Monitor media and AI-engine citation of regulatory actions within 24 hours of publication.
- Pre-draft holding statements for the top three regulatory scenarios per regulator.
- Reconcile double-reporting obligations (e.g. BAM/AMMC climate) against a single internal data spine.
Harch Atelier's Regulatory Risk Radar monitors the twelve regulators above, with a 24-hour alert on consultation papers, enforcement actions, and the media and AI-engine citation that follows.