Why CMI remains central for Moroccan e-commerce
The Centre Monétique Interbancaire was founded in 2004 by nine Moroccan banks, which are its shareholders. The country's major banks — Attijariwafa Bank, CIH, Bank of Africa, BCP, Saham Bank (formerly Société Générale Maroc), Crédit Agricole du Maroc, BMCI and others — issue Visa and Mastercard cards accepted on this network. CMI was long the near-sole acquirer of card payments in Morocco; that is no longer the case. Through decision no. 152/D/2024 of 31 October 2024, the Conseil de la concurrence (Competition Council) made its commitments binding: since November 2024, CMI no longer signs new merchant contracts; since May 2025, approved payment institutions and bank subsidiaries market acquiring services; CMI becomes a technical processing platform open to these acquirers.
An e-commerce site that only accepts PayPal or an international card effectively excludes the vast majority of Moroccan buyers: their bank cards go through the CMI network, and a payment in foreign currency generates conversion fees at their expense. The common objection — "PayPal is enough" — ignores that PayPal adoption remains low among Moroccan individuals, and that exchange fees on each purchase are a real barrier to purchase, particularly for low-value baskets. CMI processes transactions in Moroccan dirhams (MAD), directly from the buyer's bank account, without conversion and without friction.
What CMI concretely brings to your merchant client
- National card acceptance — all Visa and Mastercard cards issued by Moroccan member banks of the CMI network are accepted by right.
- Transactions in dirhams — no friction from exchange rates, for either the buyer or the merchant who receives payment directly in MAD.
- 3D Secure included — the buyer validates their payment with a security code sent by their bank, reducing fraud and placing liability with the issuing bank in case of dispute.
- Settlement in dirhams — the net amount of sales is credited to the merchant's bank account within the delay set by its acquiring contract.
- International card acceptance — Visa and Mastercard cards issued abroad go through the same integration; other networks depend on the contract signed with the acquirer.
- Online merchant portal — transaction monitoring dashboard, commission statements and transaction history, provided by the acquirer.
- Production support — support reachable for incidents, with contact details set out in the acquiring contract.
- Payment page in the buyer's language — Arabic, French or English, chosen by the merchant site at redirect time.
Merchant membership conditions: what the acquirer requires
Merchant membership is no longer obtained from CMI: since November 2024, it no longer signs new merchant contracts. The merchant opens a professional account at a Moroccan bank, then submits an e-commerce merchant membership application to an approved acquirer — a payment institution or a bank subsidiary dedicated to acquiring — which its bank may introduce.
Two profiles are accepted: legal entities (incorporated companies) and self-employed individuals engaged in commercial activity. The documents required vary by status, but the principle is the same in both cases: demonstrating the legal existence of the activity and the signatory's authority.
One prerequisite is often underestimated: the site must be online and fully functional at the time of application. The acquirer reviews the site before validating membership. A site under construction or served over plain HTTP will be rejected.
CMI merchant membership file — required documents
Company bylaws and signatory powers (legal entities)
Provide up-to-date constitutive bylaws, minutes of the legal representative's appointment, and — if the signatory is not the manager — an explicit power of attorney. Individuals provide the registration documents of their activity instead.
Commercial registration
Recent extract from the Moroccan commercial register. For an SARL or SA, the commercial court extract is sufficient. The declared activity must match what is exercised on the site.
Business licence (taxe professionnelle)
Current professional tax notice. This document is required by the acquirer to confirm the Moroccan tax presence of the activity.
Specimen cheque
A crossed cheque from the professional bank account to which settlements will be paid. This account must be held at a Moroccan bank.
Identity document of the signing officer
Valid National Identity Card (CIN) or passport of the legal representative or delegated signatory.
E-commerce site URL
The full address of the site, publicly accessible over HTTPS. The acquirer reviews the site before validation: the payment page must be reachable, the SSL certificate valid, and legal notices present.
Technical prerequisites: what CMI requires of the host
CMI gateway integration imposes server-side constraints that hosting must satisfy before a single line of payment code is written. These prerequisites are not recommendations: a site that does not meet them will be refused at membership or will see its transactions fail in production.
HTTPS mandatory across the entire site. CMI requires a valid and active SSL certificate on the merchant's domain. Payment pages but also notification pages (callbacks) must be served exclusively over HTTPS. A self-signed or expired certificate results in immediate failure at membership validation.
Notification URL (callback) reachable from outside. The CMI server sends an HTTP POST notification to the callback URL sent with the transaction to confirm each transaction. This URL must be reachable from CMI servers at all times, without IP filtering on the firewall side, and must respond within a reasonable time. A hosting environment behind a private network without inbound NAT rules, or a server with port 443 filtered, blocks these notifications and leaves orders in a "pending" state on the merchant side.
Stable DNS resolution. The domain name of the site and callback URL must resolve correctly and consistently. Incomplete DNS propagation at launch or a hosting change without a transition period can cause notification failures.
3D Secure support. The 3D Secure protocol (Visa Secure / Mastercard Identity Check) is enabled by default on the CMI network. The buyer is redirected to the ACS (Access Control Server) page of their bank, which sends them a validation code. Hosting must allow these redirects and must not block the user agents or IP addresses of CMI servers in application security rules.
Check the SSL chain before submitting the file
The acquirer inspects the SSL certificate of the site at the time of membership. A certificate that is valid in a browser may be incomplete on the server side: if the intermediate authority chain is not sent by the server (missing bundle), some automated verifiers flag it as invalid. Before submitting the file, test the URL with an online tool such as Qualys SSL Labs: a grade of A or A+ indicates a complete chain and an up-to-date protocol (TLS 1.2 minimum, TLS 1.3 preferred). A hosting plan that includes the SSL certificate and activates it by default avoids this manual verification step.
CMI integration protocols: hosted payment page and 3D Secure
CMI offers two main integration protocols for e-commerce sites.
The hosted payment page (3D_PAY_HOSTING mode) is the standard integration method. The merchant redirects the buyer to the payment page hosted by CMI (CMI-hosted card data entry page), which exempts the merchant site from directly handling card data and simplifies PCI-DSS compliance. Transaction parameters (amount, currency, order reference, return URL, callback URL) are passed in an HTML form signed with a shared key. The CMI server validates the signature, displays the payment page, then notifies the merchant via POST to its callback URL.
3D Secure is enabled by default on CMI transactions. During payment, the buyer is redirected to the ACS (Access Control Server) page of their bank, which sends them a validation code. This mechanism transfers fraud liability to the issuing bank once authentication succeeds — a direct operational benefit for the merchant in case of dispute.
In both cases, the callback URL must be absolute, in HTTPS, and reachable from the public internet. Avoid bare IP URLs and non-standard ports: serve the callback on a domain name, over HTTPS on port 443.
Exchange fees avoided: the case of the Moroccan dirham
Dirham billing is a point often overlooked in e-commerce specifications. When a Moroccan buyer pays on a site billing in euros or dollars, their bank applies an exchange rate and may add a conversion commission. This surcharge, which varies with the bank and card type, is visible on the buyer's bank statement and constitutes a real psychological barrier to purchase, particularly for low-value baskets.
CMI transactions are denominated in Moroccan dirhams (MAD). The buyer sees the exact amount of their order in dirhams, with no conversion surprise. The merchant is settled in dirhams in their Moroccan professional account. Neither party bears conversion costs.
For agencies managing clients whose audience is predominantly Moroccan, this is a direct commercial argument: a CMI integration in the checkout funnel improves conversion on this audience, without any modification to the site content.
The role of hosting in CMI integration
The three technical prerequisites of CMI — active HTTPS, publicly reachable callback URL, stable DNS resolution — are directly conditioned by the choice of hosting provider.
A hosting plan that includes the SSL certificate (automatic issuance and renewal via Let's Encrypt or an equivalent authority) avoids the main cause of membership failure: an expired certificate or an incomplete chain. Activating HTTPS from the moment the site goes live, before even submitting the merchant file, is the sequence that avoids back-and-forth with the bank.
Dirham billing on the hosting side is a complementary advantage for agencies managing multiple Moroccan clients: paying for infrastructure in MAD, receiving invoices in MAD with Moroccan VAT, and integrating a CMI gateway into delivered sites form a coherent package from the client accounting perspective. An agency that hosts its e-commerce clients on a plan including SSL, HTTPS and dirham billing brings together the three conditions required at membership on a single provider.
Comparison: PayPal, international card and CMI for a Moroccan buyer
Scroll the table
| Criterion | PayPal / International card | CMI integration |
|---|---|---|
| Moroccan bank cards accepted | Partial — depends on international activation | Yes — all cards from CMI member banks |
| Transaction currency | EUR, USD or other — conversion required | Moroccan dirham (MAD), no conversion |
| Exchange fees for buyer | Varies by bank and card | None |
| 3D Secure | Variable depending on network | Enabled by default on all transactions |
| Merchant onboarding file | Online, no Moroccan headquarters required | Via an approved acquirer in Morocco — Moroccan bank account required |
| Merchant settlement | Variable delay, in foreign currency | In Moroccan dirhams, per the acquiring contract |
| Hosting prerequisites | None specific | HTTPS mandatory, HTTPS callback publicly reachable |
| Moroccan tax compatibility | Foreign VAT possible | Transaction in MAD, invoices in MAD, Moroccan VAT applicable |
Troubleshooting: common errors during CMI integration
Five problems recur systematically when putting a CMI integration into production. Here they are with their exact message or symptom and their resolution.
Error 1 — Callback not received / order stuck in "pending".
Symptom: the CMI payment page displays, the buyer validates their payment, but the order remains pending on the merchant side. Cause: the callback URL is not reachable from CMI servers — firewall, iptables rule blocking inbound connections on port 443, or hosting behind a private network. Resolution: verify that port 443 is open inbound and that the callback URL responds to a curl from an external IP.
Error 2 — "Incorrect signature" or "Invalid hash".
Symptom: the CMI page returns a signature error. Cause: the shared key (store key) entered in the integration form does not match the one configured in the merchant portal, or the parameters are encoded differently (URL encoding, field casing). Resolution: re-check the key in the merchant portal, ensure the field order in the string to sign exactly matches the CMI documentation.
Error 3 — SSL certificate rejected at membership.
Symptom: the membership file is returned with the note "unsecured site" or "invalid certificate". Cause: self-signed certificate, incomplete authority chain, or domain partially served over HTTP. Resolution: test with SSL Labs before submitting, ensure all pages (including the callback) respond over HTTPS with a certificate signed by a recognised authority.
Error 4 — 3D Secure redirect fails or loops.
Symptom: the buyer is redirected to their bank page, but the return to the merchant site results in a 404 error or blank page. Cause: the return URL (okUrl / failUrl) points to a non-existent path after deployment, or the server blocks POST redirects. Resolution: verify the return URLs in the CMI configuration and ensure they are active on the production hosting.
Error 5 — Duplicate amount on merchant statement.
Symptom: the same order appears twice in the CMI statement. Cause: the callback was called twice (server-side timeout → CMI retry) and the application logic has no idempotency on the order reference. Resolution: check the order reference (oid) on callback receipt and only validate the order if it is not already marked as paid.
Going further: compliance and infrastructure for your Moroccan business
CMI integration is just one aspect of a Moroccan e-commerce site's compliance. Moroccan VAT (20% on digital services) applies when the provider is based in Morocco and the service is rendered to a Moroccan client — a point developed in the article Moroccan VAT and web hosting. Personal data collected during the payment process is subject to Law 09-08 and CNDP recommendations, particularly if hosted outside Morocco — see CNDP compliance and hosting outside Morocco.
For agencies registering .ma domain names for their clients, the registrar's ANRT accreditation is a prerequisite: a .ma domain registered through a non-accredited registrar is not valid. The article Megalogi, ANRT-accredited registrar details this point.
All of these constraints — CMI, VAT, CNDP, ANRT — form the regulatory framework of a Moroccan e-commerce project. Managing them with a single hosting provider that bills in dirhams, includes SSL, and is itself anchored in the Moroccan legal framework simplifies project management for the agency and its client.
