Essential sector obligations by country. This watch serves as a first risk map: each point must be confirmed before launch, fundraising or expansion.
FinTech priority: legally qualify the service before selling. Payments, e-money, aggregation, scoring, credit, wallets or marketplaces do not carry the same obligations.
🇲🇦 Morocco
High riskLicense & authorization
Check whether the model falls under payment services, banking activity, credit, crowdfunding, or is simply B2B software.
References: Bank Al-Maghrib, Banking Law No. 103-12, Law No. 15-18 on crowdfunding.
High riskPersonal data
Declaration or authorization from the CNDP depending on processing, legal basis, transfers and sensitive data.
References: Law No. 09-08, Decree No. 2-09-165, CNDP.
To documentKYC / AML
Implement customer identification, screening, data retention and suspicious activity reporting procedures where the activity is regulated.
References: Law No. 43-05 as amended, UTRF.
🇨🇮 Côte d'Ivoire
High riskPayments / e-money
For wallets, payments, collections or e-money issuance: check the applicable BCEAO regime and whether a license, banking partnership or payment institution status is required.
References: BCEAO, Instruction No. 008-05-2015, Instruction No. 001-01-2024 on payment services in the UMOA.
To documentData protection
Declaration, authorization or ARTCI oversight depending on the nature of processing, transfers, processors and sensitive data.
References: Law No. 2013-450 of June 19, 2013, ARTCI.
To documentKYC / AML
Set up internal procedures, identification, monitoring, retention and suspicious transaction reporting where the activity is regulated.
References: UEMOA AML/CFT framework, CENTIF Côte d'Ivoire.
🇸🇳 Senegal
High riskPayments / e-money
Same UMOA logic: assess whether the service requires a BCEAO license, an authorization, or a partnership with a licensed player.
References: BCEAO, Instruction No. 008-05-2015, Instruction No. 001-01-2024.
To documentPersonal data
Prior declaration to the CDP for relevant processing, oversight of transfers and security measures.
References: Law No. 2008-12 of January 25, 2008, CDP Senegal.
To documentKYC / AML
Formalize KYC, retention, internal alerts and reporting where the financial activity is regulated.
References: UEMOA AML/CFT framework, CENTIF Senegal.
🇹🇳 Tunisia
High riskPayments / digital finance
Check whether the activity qualifies as a payment institution, a financial service, credit, a wallet, or is simply a technology activity.
References: Central Bank of Tunisia, texts on payment institutions.
To documentPersonal data
Declaration or authorization from the INPDP depending on processing, sensitive data, transfers and outsourcing.
References: Organic Law No. 2004-63, INPDP.
To documentForeign exchange / cross-border flows
Anticipate foreign exchange restrictions and international billing or payment rules.
References: Central Bank of Tunisia, foreign exchange regulations.
HealthTech priority: distinguish between health information, teleconsultation, medical devices, health data management and intermediation with professionals.
🇲🇦 Morocco
High riskTelemedicine
Check the applicable framework where consultation, diagnosis, medical guidance or intervention by health professionals is involved.
References: Ministry of Health, Order of Physicians, Moroccan health framework. High riskHealth data
Sensitive data: consent, enhanced security, access, hosting and transfers must be governed.
References: Law No. 09-08, CNDP.
🇨🇮 Côte d'Ivoire
High riskHealth services
Identify whether the service requires authorization, a partnership with a healthcare institution, or validation by licensed professionals.
References: Ministry of Health, Professional Orders, Law No. 2013-450. To documentLiability
Separate general information, decision support and medical acts requiring a professional.
References: medical professional rules and civil liability.
🇸🇳 Senegal
High riskHealth data
CDP declaration, security, consent, retention and patient access must be governed.
References: Law No. 2008-12, CDP Senegal. To documentHealth professionals
Check the registration, liability and insurance of the professionals involved.
References: Ministry of Health, Professional Orders.
🇹🇳 Tunisia
High riskSensitive data
INPDP authorization to assess for health data, international transfers and hosting.
References: Organic Law No. 2004-63, INPDP. To documentMedical acts
Govern practitioners' involvement, medical confidentiality and professional insurance.
References: Ministry of Health, Professional Orders.
AgriTech priority: identify whether the solution touches inputs, seeds, producer data, agricultural financing, IoT or food distribution.
🇲🇦 Morocco
To documentAgricultural inputs / products
Authorization or health control may apply depending on seeds, fertilizers, pesticides, food products or certification.
References: ONSSA, Ministry of Agriculture.
🇨🇮 Côte d'Ivoire
To documentAgricultural chain
Check registration, phytosanitary authorizations, producer contracts and protection of collected data.
References: Ministry of Agriculture, ARTCI for personal data.
🇸🇳 Senegal
To documentProducers / data
Govern producer data collection, intermediation contracts, quality and payment.
References: Ministry of Agriculture, Law No. 2008-12.
🇹🇳 Tunisia
To documentAgri / FoodTech
Health control, traceability, data transfers and innovation subsidies to check.
References: Ministry of Agriculture, INPDP.
LogisticsTech priority: separate management software, freight forwarder, delivery platform, actual carrier and driver relationships.
🇲🇦 Morocco
To documentTransport
A license or authorization may apply for actual transport, intermediation, fleet operations or freight transport.
References: Ministry of Transport, road transport regulations.
🇨🇮 Côte d'Ivoire
To documentDelivery platform
Driver/courier contracts, insurance, goods liability and transport compliance to structure.
References: Ministry of Transport, Labor Code, ARTCI for data.
🇸🇳 Senegal
To documentUrban transport
Local authorization to check depending on urban transport, delivery, ride-hailing or freight logistics.
References: Ministry of Transport, CETUD depending on activity.
🇹🇳 Tunisia
To documentTransport / insurance
Transport authorization, carrier liability, insurance and partner contracts to check.
References: Ministry of Transport, insurance regulations.
EdTech priority: distinguish between open educational content, vocational training, certification, recognized diplomas and collection of minors'/learners' data.
🇲🇦 Morocco
To documentCertified training
Authorization or declaration to check for vocational training, certification or diplomas.
References: Ministry of Education, OFPPT/ANAPEC as applicable, Law No. 09-08.
🇨🇮 Côte d'Ivoire
To documentDiplomas / certifications
Authorization may be required for diploma issuance, regulated training or institutional partnerships.
References: Ministry of Education / Higher Education, Law No. 2013-450.
🇸🇳 Senegal
To documentVocational training
Registration, authorization or certification to check for training organizations.
References: Ministry of Vocational Training, ONFP, Law No. 2008-12.
🇹🇳 Tunisia
To documentE-learning
Authorization to check for distance learning, certification or recognized diplomas.
References: Ministry of Education, INPDP.
B2B SaaS priority: even without a sector license, the real risks are data, tax, SLAs, outsourcing, reversibility and cross-border payments.
🇲🇦 Morocco
To documentData & Cloud
Set up a DPA, records, transfers, security, processors and data localization when the client is sensitive.
References: Law No. 09-08, CNDP. To structureSaaS contracts
SLA, liability limitation, suspension, reversibility, data ownership and support.
References: general law of obligations, B2B contractual practices.
🇨🇮 Côte d'Ivoire
To documentPersonal data
Clarify controller/processor roles, DPA, transfers, security and incident notification.
References: Law No. 2013-450, ARTCI. To structureBilling / tax
Check VAT, potential withholdings, cross-border invoicing and proof of service.
References: local tax code to check with a tax advisor.
🇸🇳 Senegal
To documentData Processing Agreement
Formalize processing, client instructions, processors, security and transfers outside Senegal.
References: Law No. 2008-12, CDP Senegal. To structureCustomer contracts
Provide for payment, availability, termination, reversibility and exclusion of indirect liability.
References: OHADA law / local law of obligations depending on the contract.
🇹🇳 Tunisia
To documentInternational transfers
Transfers outside Tunisia must be assessed and governed, particularly for cloud and external support.
References: Organic Law No. 2004-63, INPDP. To documentForeign exchange
Cross-border SaaS flows, subscriptions and foreign-currency payments may require a foreign exchange review.
References: Tunisian foreign exchange regulations, BCT.