The verdict in three sentences
In Morocco, accepting cards online almost always goes through the CMI (Centre Monétique Interbancaire), and certification rarely fails for technical reasons: it is the legal pages, the terms of sale, price display and consistency between the site and the contract that get a file rejected. A clean integration costs MAD 15,000 to 40,000 excl. VAT (about EUR 1,400 to 3,700), the commission sits between 1.5 and 3% per transaction depending on the volume negotiated with the bank, and certification takes 3 to 6 weeks when the file is complete. Preparing the site as if the auditor were visiting it page by page halves the risk of a second rejection.
The certification steps, in order
The process starts at the bank, not with the developer. The company's bank (Attijariwafa bank, BMCE Bank of Africa, Banque Populaire, CIH, Société Générale Maroc...) opens the online payment application, then the CMI provides test environment access and the integration kit. The site is then audited before going live.
| Step | Party | Timeline (2026 order of magnitude) | Deliverable |
|---|---|---|---|
| E-commerce merchant application | Company's bank | 1 to 2 weeks | Merchant contract, pricing terms |
| Test credentials received | CMI | 3 to 7 days | Credentials, hash key, documentation |
| Gateway integration and testing | Web provider | 1 to 3 weeks | Payment, return, server callback, failure cases |
| Required pages prepared | Company and provider | 3 to 5 days | Legal notice, terms, delivery, returns, privacy |
| CMI audit and acceptance | CMI | 1 to 2 weeks | Compliance report or list of fixes |
| Fixes and resubmission | Provider | 3 to 10 days per round | Corrected site |
| Go-live | CMI and bank | 2 to 5 days | Production credentials |
The traps that get a file rejected
Observed rejections follow the same patterns. The first is missing or incomplete legal notice: company name, legal form, registered address, RC, ICE, IF, patente number, contact phone and email must be visible. The second concerns the terms of sale: they must state payment terms, delivery times, return and refund policy, and governing law. The third is currency: prices must be shown in dirhams, including VAT for consumers, with the excl. VAT mention clear for trade customers.
On the technical side, the auditor checks that the order is only confirmed on receipt of the signed server callback (not on the browser return alone), that the hash is correct, that Visa, Mastercard and CMI logos appear on the payment page, and that privacy (law 09-08, CNDP declaration) is covered. Finally, invoices must meet DGI requirements: ICE of the seller and of the business customer, continuous numbering, itemised VAT.
| Common trap | Consequence | Fix cost (2026 order of magnitude) |
|---|---|---|
| ICE, RC or IF missing from the legal notice | Immediate rejection | A few hours, MAD 500 to 1,500 |
| Terms without return or refund policy | Rejection | MAD 2,000 to 6,000 with a lawyer |
| Order confirmed on browser return | Technical rejection and fraud risk | MAD 3,000 to 8,000 of development |
| Prices in euros or without VAT included | Correction request | MAD 1,000 to 3,000 |
| Site in maintenance or empty catalogue on audit day | 1 to 2 week delay | Lost time |
| Invoices without customer ICE or continuous numbering | Tax non-compliance | MAD 2,000 to 6,000 |
| No CNDP declaration or privacy policy | Correction request | MAD 1,500 to 4,000 |
What CMI payments cost day to day
Beyond integration (MAD 15,000 to 40,000 excl. VAT depending on the platform and number of cases to handle), expect onboarding fees that vary by bank, a commission of 1.5 to 3% per transaction (often decreasing above MAD 500,000 a month) and settlement in 2 to 5 working days. In B2B, where baskets often exceed MAD 20,000, many suppliers combine CMI cards for small baskets with bank transfer or cheque on invoice for large amounts, which keeps the commission bill down.
Mini case study
Illustrative scenario: Karim, sales director of a professional catering equipment supplier in Casablanca, had his certification rejected twice: missing ICE, then orders confirmed on browser return. Each rejection cost 3 weeks of delay.
- Planned online sales: MAD 180,000 excl. VAT a month.
- Cumulative delay over two rejections and fixes: about 6 weeks, or MAD 270,000 of online sales postponed, part of it lost.
- Final fixes: MAD 9,000 (server callback, legal notice, revised terms).
- Commission negotiated at 2%: MAD 3,600 a month on MAD 180,000.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
With a file prepared from day one, the extra MAD 9,000 would have been absorbed in the initial project, and the store would have been collecting payments from week six instead of week twelve.
FAQ
Is CMI mandatory to accept cards in Morocco?
For Moroccan cards in dirhams, CMI through your bank remains the near-unavoidable route. Alternatives (PayZone, some bank gateways) exist, but they also rely on local acquiring, with comparable commissions of 1.5 to 3%.
How long does certification take?
Allow 3 to 6 weeks from receiving test credentials to go-live if the file is complete. Each rejection usually adds 1 to 3 weeks.
Can we collect in euros?
CMI acquiring is in dirhams. To sell to foreign customers in euros you need a second international provider, with commissions of 2.5 to 3.5% and applicable foreign exchange rules.
Is a specific platform required?
No: WooCommerce, PrestaShop, Magento and custom builds can all be certified. Off-the-shelf modules are cheaper, but MAD 15,000 to 40,000 excl. VAT of development handles B2B cases such as partial payments or customer accounts better.
Are cards suitable for large B2B baskets?
Above MAD 50,000, buyers' card limits often block payment. Offer cards up to a threshold, then bank transfer on a DGI-compliant invoice, which also reduces the commission paid.
Let's scope your project. Tell us your bank, platform and volumes: we will prepare the CMI integration, required pages and certification file for go-live in 3 to 6 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.