Executive Summary
- The Moroccan supplier can pursue a technical software model for these merchants if its functions remain supporting services. It should prepare mandate records and collection files, while merchants and their PSPs retain the relevant payment decisions. Direct settlement alone cannot establish the technical-service exclusion. (Directive (EU) 2015/2366, art. 3(j); Code monétaire et financier, art. L. 314-1 III 7°.)
- Each merchant should be the named scheme creditor for the first release. Its name and creditor identifier must match the mandate and collection message, and the collection account must belong to it. EPC rules also recognise an organisation collecting for another creditor, but that arrangement requires accurate collector identification and a separate legal assessment. (EPC132-17, Clarification Paper v5.1, §§2.3–2.4.)
- A French creditor identifier has a conditional non-resident route. The applicant needs the required French economic activity and qualifying French account, and must apply through its bank. An identifier establishes neither payment authorisation nor bank acceptance of a pooled product. (Banque de France, ICS allocation FAQ; EPC262-08, Creditor Identifier Overview v12.0, §8.1.7.)
- Core can serve consumers and businesses; B2B requires an eligible non-consumer payer and participating banks. Core carries an eight-week authorised-payment refund exposure. B2B removes that scheme refund but preserves applicable unauthorised-payment remedies, subject to lawful business-contract variations. (EPC Core and B2B Rulebooks 2025 v1.2, §§2.2, 4.3–4.4; Code monétaire et financier, arts. L. 133-2, L. 133-18 and L. 133-24–L. 133-25-2.)
- A merchant's insolvency does not undo a valid Core refund. The creditor PSP bears the recovery risk if it cannot debit its creditor. The supplier should accept responsibility for its own service failures without inadvertently guaranteeing every merchant's default. (EPC Core Rulebook 2025 v1.2, §4.6.4, PT-04.18 and PT-04.26.)
- The supplier's own software fees are Moroccan service-export receipts. The ordinary rule requires full repatriation within 90 days of performing the service. Merchant customer receipts require their own legal treatment and cannot be treated as the supplier's export turnover. (Office des Changes, Instruction générale des opérations de change 2026, arts. 95–98.)
- Processing payer information in Morocco requires an EU transfer basis and compliance with Moroccan data law. Hosting in the EU does not resolve the transfer question if the separate Moroccan supplier can access personal data. Mandate evidence must remain available after suspension or exit. (Regulation (EU) 2016/679, arts. 28, 32 and 44–46; Moroccan Law No. 09-08, arts. 2, 12, 23–25 and 43–44.)
Each merchant should control its collection relationship
The first release should preserve the merchant's direct relationship with its PSP. The merchant sells the subscription or business service and remains entitled to its price. The payer gives that merchant a mandate authorising collections from the specified account. The merchant's PSP provides the collection service, while the payer's PSP debits the payer's account. The Casablanca company supplies the records and files needed for those steps. The European Payments Council (EPC) defines these scheme roles through private contractual rules, which operate alongside the applicable payment legislation. (EPC Core Rulebook 2025 v1.2, §§3.1–3.2 and 4.1.)
Four roles must remain distinguishable. The trade creditor owns the underlying claim. The scheme creditor receives the mandate and presents collections in the identity specified by that mandate. A technical submitter prepares or transmits data under defined authority. The regulated PSP provides the payment service. The recommended design makes the merchant the trade creditor and scheme creditor; it does not give the software supplier either role merely because it generates the file. (EPC Core Rulebook 2025 v1.2, §§3.1–3.2; EPC132-17 v5.1, §2.3.)
The contract chain should reflect that allocation. Each merchant needs a customer contract and the payer's mandate, plus a separate collection agreement with its PSP. The payer keeps its account agreement with its own PSP. The merchant also signs a software agreement with the Moroccan supplier. That agreement should authorise only the specified data processing and file preparation, with a separate software invoice. The supplier should have no authority to redirect settlement, spend merchant receipts or promise payment execution as its own service. These are recommended limits on the proposed service, derived from the technical exclusion's functional requirements. (Code monétaire et financier, art. L. 314-1 III 7°.)
For the first release, the merchant should approve collection amounts and dates through its PSP's accepted process. The PSP should retain acceptance and execution controls. If the software later transmits files automatically, the agreement must specify whose instruction it carries and which changes require fresh approval. A recurring schedule can be an instruction, but unrestricted authority to create debts, alter beneficiaries or order refunds changes the classification question. (Directive (EU) 2015/2366, arts. 3(j), 4(13) and 4(15).)
The worked payment arrangement uses euros and EU-located PSPs. Regulation 260/2012 applies to the qualifying intra-EU transactions even though the software supplier is Moroccan. The supplier's location does not make it a SEPA participant. The EPC country list excludes Morocco, while the French merchants obtain their collection services through participants in the relevant scheme. Scheme geography does not determine every participant's regulatory permission or customer acceptance. (Regulation (EU) No. 260/2012, art. 1; EPC409-09 v8.0, §2; EPC Core Rulebook 2025 v1.2, §§2.2 and 5.4.)
The creditor identifier must match the collecting party
Each merchant should use its own creditor identifier in the initial model. In France this is the identifiant créancier SEPA, or ICS. Together with the unique mandate reference, it identifies the creditor and particular mandate. The supplier should record the identifier as merchant data and check it against the PSP's accepted onboarding record. Banque de France instructs creditor banks to check that the issuer owns the identifier and does not already hold another one. (Banque de France, Référentiel des identifiants créanciers SEPA, sections on obtaining an ICS and bank precautions.)
The application goes through the creditor's bank. Banque de France's detailed FAQ requires economic activity in France or its overseas territories and an account there with a bank authorised to operate there. The EPC's French national entry includes resident and non-resident entities satisfying the requirements, without an existing SEPA creditor identifier. Moroccan incorporation alone therefore neither establishes nor defeats eligibility. The supplier should not obtain a collector identifier for a release that merely prepares merchants' files. (Banque de France, ICS allocation FAQ; EPC262-08 v12.0, §8.1.7.)
An ICS persists when the same creditor changes bank or uses several banks. That continuity supports merchant portability, but it does not authorise another legal entity to borrow the identifier. Nor does the business-code element create a separate creditor for every unrelated merchant. A genuine collector arrangement must consistently identify the collector in the mandate, collection message and credited account. (Banque de France, Référentiel des identifiants créanciers SEPA; EPC Core Rulebook 2025 v1.2, §4.8.15; EPC132-17 v5.1, §2.3.)
The French issuance conditions must also be distinguished from payer-account requirements. A merchant using direct debit cannot require a payer's reachable EU account to be in a particular Member State. The product should therefore avoid a French-IBAN-only payer field merely because its merchants use French identifiers. (Regulation (EU) No. 260/2012, art. 9(2).)
Submission powers determine the software boundary
The proposed file-preparation service has a defensible technical route, provided its actual functions remain limited. PSD2 excludes technical services supporting payment services where the supplier never possesses the transferred funds. The exclusion expressly leaves payment initiation and account information services within the regulated assessment. France implements that distinction in Article L. 314-1 III 7° of the Code monétaire et financier. The supplier must satisfy the supporting-service condition as well as the absence-of-possession condition. (Directive (EU) 2015/2366, art. 3(j); Code monétaire et financier, art. L. 314-1 III 7°.)
The strongest objection concerns independent initiation powers. PSD2 defines a payment initiation service by reference to a payment service user's request concerning an account at another PSP. A payment service user can be a payee. The European Commission's answer published as EBA Q&A 2021_6256 explains that PSD2 neither excludes payees' use of such services nor guarantees them the payer's equivalent access right. This nonbinding interpretation matters because creditor initiation alone cannot settle the supplier's status. (Directive (EU) 2015/2366, art. 4(10), (15); EBA Q&A 2021_6256, final answer, 28 June 2024.)
Preparing a merchant's file is not automatically an independent payment initiation service. Equally, a supplier cannot claim the technical exclusion merely because a licensed partner sends the final bank message. The assessment must examine its contractual undertaking, credentials, account access and discretion over instructions. The initial product should leave approval and release in the merchant's PSP process. Independent submission, refund authority or account-information access should require a fresh assessment before activation. (Directive (EU) 2015/2366, arts. 3(j) and 4(15)–(16).)
A commercial-agency label does not resolve this issue. The relevant exclusion requires authority to negotiate or conclude the underlying sale for the payer alone or payee alone. The company has invoicing and billing functions, without authority to negotiate or conclude merchants' subscription contracts. Its collection appointment therefore cannot establish that exclusion. ACPR's published collection guidance applies the same distinction. (Directive (EU) 2015/2366, art. 3(b); Code monétaire et financier, art. L. 314-1 III 3°; ACPR, J'encaisse des fonds et les reverse à une tierce personne.)
The pooled proposal requires a separate authorised collection design
The partner's proposal should not enter the technical release unchanged. Receiving multiple merchants' proceeds into an account controlled by the supplier, then allocating and paying them onward, changes the service. ACPR treats own-name collection of amounts owed to third parties as requiring classification under the actual payment services performed. Depending on the account and execution arrangements, payment execution or money remittance can arise. Its guidance expressly distinguishes direct debit from its generic acquiring example. (Code monétaire et financier, art. L. 314-1 II; ACPR, J'encaisse des fonds et les reverse à une tierce personne.)
The strongest argument for central collection comes from the scheme itself. EPC guidance permits an organisation to collect on another's behalf. The collector is then the scheme creditor; the underlying merchant can appear as the creditor reference party. The collector's name and identifier must match the mandate and collection; the collection must specify the collector's own account. This permits a coherent scheme arrangement, but supplies no payment authorisation, transfer of the trade debt or insolvency protection. (EPC132-17 v5.1, §§2.3–2.4.)
The commercial alternative should therefore place any regulated collection service with an authorised provider. The documents must identify who accepts the payment obligation, whose receipt discharges the customer's debt, and who owes each merchant its proceeds. The provider must accept the actual merchant population and retain effective control over funds and payouts. If the supplier instead wants to provide those services itself, it needs the appropriate permission route before launch. A payment-services agent route also requires a valid principal, permitted scope and registration; a technical contract cannot replace those conditions. (Code monétaire et financier, arts. L. 521-2, L. 522-6, L. 522-13 and L. 523-1.)
Where the collector is a payment institution, Article L. 522-17 requires the applicable protection of payment-user funds. The statutory options include segregation and qualifying insurance or a comparable guarantee. Under the segregation route, qualifying funds retained beyond the statutory next-business-day point require the prescribed protected placement. An ordinary account called a pool does not acquire those protections through its label. The bank or institution's actual account documents must establish the applicable arrangement. (Code monétaire et financier, art. L. 522-17; Directive (EU) 2015/2366, art. 10.)
Statutory safeguarding addresses failure of the payment institution. A merchant reserve addresses the PSP's recovery exposure under its merchant contract. Neither cancels the payer's refund rights or guarantees that the merchant will deliver its service. A central collector should maintain separate merchant ledgers, but ledger accuracy alone cannot establish proprietary rights or protection from creditors. The proposed pooled model must resolve those matters before anyone substitutes one identifier for the merchants' own identifiers. (Code monétaire et financier, art. L. 522-17; EPC Core Rulebook 2025 v1.2, §4.6.4, PT-04.18.)
Core and B2B require separate payer journeys
One software product can support Core and B2B, but it must maintain separate eligibility and mandate processes. Core accommodates consumers and non-consumers. B2B requires a non-consumer whom the applicable national law permits to opt out of authorised-payment refunds. A business email address or a merchant's preferred refund policy cannot turn a consumer transaction into B2B. Where the payer does not qualify, the product must use an available consumer-compatible route. (EPC Core Rulebook 2025 v1.2, §2.2; EPC B2B Rulebook 2025 v1.2, §§2.2, 2.7 and 5.8.)
B2B also requires bank support. Before the first debit, the debtor PSP must obtain confirmation of the mandate data; later collections must be checked against the recorded information. Core does not ordinarily require the debtor PSP to receive and validate the signed mandate before collecting. The EU reachability obligation for direct debits applies to schemes available to consumers, so it cannot establish universal B2B availability. The merchant's PSP and the business payer's bank must each support the selected B2B service and account. (EPC B2B Rulebook 2025 v1.2, §4.1, PT-01.04–PT-01.05 and §5.8; Regulation (EU) No. 260/2012, art. 3(2)–(3).)
For the French domestic variant, the creditor and payer PSPs are established in France. The French payer-law rules apply to that variant; other EU account relationships require the applicable national implementation and contractual terms. A French merchant's location alone does not determine its foreign payer's rights. (Code monétaire et financier, art. L. 133-1 II.)
An authorised Core debit can be refunded on request within eight weeks after the payer's account is debited. The creditor cannot defeat that scheme right merely by producing a valid mandate or proving delivery. French Article L. 133-25-1 separately provides an unconditional refund for the euro direct debits within its scope, subject to Article L. 133-25-2. The general rule for an unexpectedly large authorised payment is therefore not the complete Core answer. (EPC Core Rulebook 2025 v1.2, §4.3.4; Code monétaire et financier, arts. L. 133-25 and L. 133-25-1.)
The statutory exception in Article L. 133-25-2 requires an agreement with the payer's PSP, direct consent to that PSP and the specified advance information. Where applicable, that information must precede the due date by at least four weeks. Those conditions cannot be presumed from an ordinary merchant mandate. They also do not rewrite the selected Core scheme's refund obligations. For the proposed Core service, the merchant should budget for the eight-week refund exposure. (Code monétaire et financier, art. L. 133-25-2; EPC Core Rulebook 2025 v1.2, §4.6.4.)
For eligible business users, French law permits contractual derogation from specified payment protections, including authorised-payment refund provisions. B2B uses that distinction and has no ordinary scheme refund process for authorised debits. The relevant payer's agreement with its PSP must implement the permitted allocation. A clause in the merchant's sales terms or the supplier's software contract cannot substitute for it. The payer retains whatever claims arise from defective supply under the underlying contract. (Code monétaire et financier, art. L. 133-2; EPC B2B Rulebook 2025 v1.2, §§4.4 and 5.8.)
Unauthorised debits require separate treatment in either product. French law ordinarily requires notification without delay and within thirteen months after debit, unless the PSP failed to provide the required transaction information. Eligible non-consumers can agree another notification period. Article L. 133-18 requires prompt reimbursement of a qualifying unauthorised payment; it is absent from Article L. 133-2's derogation list. A B2B label therefore cannot justify a blanket statement that no refund or challenge is possible. (Code monétaire et financier, arts. L. 133-2, L. 133-18 and L. 133-24.)
Electronic mandates need provable consent
The merchant must obtain a valid mandate before collecting. The record must identify the creditor, its identifier, the payer and the account, and include the required mandate reference, consent and signature information. The required scheme wording and data differ between Core and B2B. If the unique mandate reference is unavailable at signing, the creditor must communicate it before the first initiation. A generic software subscription acceptance should not be used as a substitute for the actual payment mandate. (EPC Core Rulebook 2025 v1.2, §4.1, §4.6.1 and DS-01; EPC B2B Rulebook 2025 v1.2, §4.1 and DS-01.)
French law accepts electronic evidence subject to identification and integrity requirements. An electronic signature must reliably identify the signatory and link that person to the act. A qualified electronic signature benefits from the specified reliability presumption and handwritten-signature equivalence. That does not make a qualified signature compulsory for every mandate, nor make every checkbox conclusive evidence. The merchant and PSP should accept a defined process whose evidence can be reproduced. (Code civil, arts. 1366–1367; Décret No. 2017-1416, art. 1; Regulation (EU) No. 910/2014, art. 25(1)–(2).)
The evidence package should preserve the exact mandate text shown, creditor details, signer identity and authority, signature method, time of consent and later changes. The software should connect each collection to that version of the mandate and the merchant's instruction. These records address the evidential risk under Article L. 133-23: a payment instrument's recorded use does not necessarily prove authorisation. Eligible business contracts can vary that article, so the B2B evidence process must match the actual bank agreement. (Code monétaire et financier, arts. L. 133-2 and L. 133-23.)
Strong customer authentication and civil validity are separate questions. The Commission's nonbinding EBA answers treat payee-initiated direct debits without payer interaction as outside the transaction-authentication requirement. They distinguish remote mandate setup involving a PSP, which can require strong authentication, from a mandate given directly to the payee without the payer PSP's direct involvement. The company should agree the applicable setup process with the PSP and retain usable evidence of consent. The EPC's optional bank-validated e-Mandate service is a particular scheme option; it is not the name for every electronic signature. (Directive (EU) 2015/2366, art. 97; EBA Q&As 2018_4359 and 2019_4664, final answers; EPC B2B Rulebook 2025 v1.2, Annex VII.)
Notice and cancellation must remain effective throughout the mandate
The creditor should send the collection amount and due date through the agreed notice channel. EPC's default is at least fourteen calendar days before the due date, unless creditor and payer agree another period. An invoice or a schedule of recurring collections can perform that function if it supplies the required information. The software should preserve the agreed period and evidence of dispatch through that channel. It must distinguish creating an invoice from sending the required notice. (EPC132-17 v5.1, §2.6.)
The product must distinguish cancelling one debit from withdrawing authority for future collections. Under the French statutory default, the payer may revoke a direct debit by the end of the business day preceding the agreed debit date. Non-consumer agreements can alter specified rules, and later revocation depends on the statutory agreement conditions. The supplier should record the affected payment or mandate, stop the corresponding future submissions and alert the merchant and PSP. Cancelling the payment authority does not itself resolve whether the underlying subscription debt remains payable. (Code monétaire et financier, arts. L. 133-2, L. 133-7 and L. 133-8; Banque de France, Foire aux questions le prélèvement SEPA.)
Mandate changes require an agreed amendment and retained evidence. Changes relevant to the PSPs must accompany the next collection through the scheme's amendment process. A change of creditor needs separate legal treatment: the governing law determines whether existing authority survives or a new mandate is required. A simple change of reference party has a different scheme effect. The software should never treat an account migration, creditor transfer and name correction as interchangeable events. (EPC Core Rulebook 2025 v1.2, §4.6.2; EPC132-17 v5.1, §§2.4 and 2.10.)
After thirty-six months without a presented collection, the creditor must cancel the dormant mandate before collecting again under a new one. The relevant last presentation includes a collection later rejected, returned or refunded. The merchant must monitor that period rather than assume its banks will do so. Record retention continues for the mandate's life and the applicable period after cancellation, including the relevant unauthorised-payment exposure. Thirteen months is not a universal maximum deletion date. (EPC Core Rulebook 2025 v1.2, §§4.1–4.2, PT-01.03 and PT-03.02.)
Returns and refunds require different operating rules
The product should report the actual payment event and its initiator. A reject occurs before settlement. A return follows settlement and originates through the debtor PSP. Where the creditor PSP offers the reversal facility, the creditor or its PSP can reverse an erroneous collection in full after settlement. A refund responds to the payer's claim. Treating all four as card chargebacks would obscure different deadlines and powers. (EPC Core and B2B Rulebooks 2025 v1.2, §4.4.)
Core returns must settle within five Inter-PSP Business Days after original settlement; B2B returns have three. Reversals instead run from settlement through five Inter-PSP Business Days after the original due date. Those anchors can differ. The merchant's submission cut-off is also a separate contractual deadline. The supplier should use the PSP's calendar and acknowledgements, rather than calculate every deadline from an invoice date. (EPC Core and B2B Rulebooks 2025 v1.2, §4.3.4.)
For an authorised French refund claim within the applicable eight-week period, the statutory response period is ten working days. An unauthorised-payment claim has a different rule: immediate reimbursement, no later than the end of the following business day after awareness or notification, subject to the statutory payer-fraud exception. The PSP must have reasonable grounds for that suspicion and report it in writing to Banque de France. Scheme investigation and recovery between PSPs cannot extend that payer-facing deadline. (Code monétaire et financier, arts. L. 133-18, L. 133-24 and L. 133-25 III.)
Retries should follow the reason for failure and continuing authority. A cancellation, closed account or missing mandate cannot be solved by repeatedly resending the same instruction. The merchant should decide any permitted re-presentation through its PSP process. The software should reconcile a reversal with any refund already made, preserve the original transaction reference and prevent duplicate repayment. These controls address the distinct scheme exception processes; they create no general permission to retry every failed debit. (EPC132-17 v5.1, §§2.11–2.15; EPC Core Rulebook 2025 v1.2, §4.4.)
Merchant insolvency leaves a defined refund exposure
If the merchant becomes insolvent after collections, valid Core refunds still move through the banks. The creditor PSP refunds the debtor PSP and seeks recovery from its creditor. EPC's procedure expressly allocates the unpaid amount to the creditor PSP's credit risk if it cannot debit the creditor. It cannot return that loss to the debtor PSP merely because its merchant has failed. Mandate evidence also cannot defeat an otherwise valid eight-week authorised Core refund. (EPC Core Rulebook 2025 v1.2, §4.6.4, PT-04.18 and PT-04.26.)
The merchant's contract with its PSP should specify any reserve, permitted debits, recalculation, review and release after termination. The cited public rulebook provisions do not prescribe a universal reserve percentage or guarantee full recovery. The PSP should assess collection value, refund exposure and the merchant's delivery obligations when negotiating those terms. The software supplier should receive the reporting needed to reconcile reserves without obtaining authority to use them. (EPC Core Rulebook 2025 v1.2, §§5.7–5.8 and PT-04.18.)
French insolvency rules can limit contractual recovery. Article L. 622-7 prohibits payment of pre-opening claims, subject to statutory exceptions including set-off of connected claims. Reserve enforcement therefore depends on the account and security arrangements, claim timing and applicable proceeding. A clause allowing any balance to be debited cannot by itself establish that the debit survives insolvency. The PSP must assess its actual reserve and recovery rights, including which funds belong to whom. (Code de commerce, arts. L. 622-7 and L. 631-14.)
The supplier's liability should follow its own role and failures. If French law governs its agreement, breach of its obligations can attract contractual damages under Articles 1103 and 1231-1. The parties should allocate losses caused by defective files, unauthorised changes or failure to preserve agreed evidence. The merchant should remain responsible for its debt claims, instructions and mandate procurement. Any indemnity must address causation, defence of claims and amounts already recovered. A guarantee of every merchant's refund shortfall would add a separate commercial exposure to this software business; it should never enter through an undefined platform indemnity. (Code civil, arts. 1103 and 1231-1; EPC Core Rulebook 2025 v1.2, §§5.7–5.8.)
The failure procedure should stop new unsupported collections and preserve the archive. It should identify the administrator or liquidator, alert the PSP and maintain the evidence access needed for refunds. French law restricts termination of ongoing contracts solely because insolvency proceedings open. An automatic insolvency termination or blanket suspension clause would therefore be unsafe. Operational restrictions must address actual invalid instructions, security failures or other lawful grounds while respecting continuation rules. (Code de commerce, arts. L. 622-13, L. 631-14 and L. 641-11-1.)
Moroccan operations must remain within the software service
The Moroccan assessment must examine what the Casablanca team actually does. Law No. 103-12 regulates fund transfers and specified payment execution. Article 16 includes direct debits on payment-account funds and execution through remote communication where the operator acts solely as intermediary between payer and supplier. Article 18 prohibits habitual performance of the reserved activities without the required status, subject to its exceptions. The statute does not supply a general exemption equivalent to PSD2's technical-service wording. An EU exclusion cannot replace this local analysis. (Moroccan Law No. 103-12, arts. 15–18.)
The recommended first release leaves payment execution with the merchants' EU PSPs. The supplier prepares records and draft collection files and earns its own software fee. On that defined allocation, its work supports the merchant without undertaking the listed execution or transfer activity. The contrary case becomes stronger if Moroccan staff can operate payment accounts, execute debit instructions or distribute receipts as their own service. Those functions require a separate Bank Al-Maghrib permission assessment before implementation. (Moroccan Law No. 103-12, arts. 1, 16, 18 and 34.)
Article 17 requires protected treatment of funds in payment accounts operated by payment institutions, including a separate global account and distinct records. It does not authorise an ordinary software company to create its own merchant pool. A regulated Moroccan collection activity would need the applicable approval, payment-service rules and exchange arrangements. The initial product should avoid relying on a foreign partner's permission to cover an independently performed Moroccan payment service. (Moroccan Law No. 103-12, arts. 15–18 and 34.)
Software fees must follow Morocco's export rules
The separate software fee falls within the service-export analysis when a Moroccan resident supplies a non-resident for remuneration. IGOC 2026 requires a service contract and the prescribed settlement route. Article 97 ordinarily requires repatriation of the full service-export receipts within ninety days after performing the services. The clock is tied to performance, rather than automatically starting on the invoice date or the foreign PSP's payout date. Recurring billing records should therefore identify the service periods to which each fee relates. (Office des Changes, IGOC 2026, arts. 95–97 and 11.)
The supplier should receive its own fees through its Moroccan bank under the documented export arrangement. Repatriated foreign currency is subject to the surrender rules, with permitted retention in an eligible foreign-currency or convertible-dirham account in Morocco. For an ordinary exporter, Article 229 permits credits within the seventy per cent limit on repatriated export proceeds. Higher or special allowances require their own eligibility; a technology company should not assume them from its software business description. (Office des Changes, IGOC 2026, arts. 22, 98 and 229.)
An exporter account in Morocco does not itself permit an unrestricted foreign collection account. Nor does the ordinary export allowance cover receipts belonging to French merchants. The supplier should keep its software invoices, bank credits and reconciliation separate from the merchants' customer money. Netting its fees out of a merchant pool changes the receipt and settlement facts and requires a new exchange-law analysis alongside the payment-service assessment. Article 99 allows specified foreign deductions under its conditions; it supplies no general permission to deduct merchant refunds or reserves. (Office des Changes, IGOC 2026, arts. 1, 11, 20, 95–99 and 229.)
If the insolvent French merchant also fails to pay the supplier's software invoice, Article 97 addresses that export debt. The exporter must pursue recovery by appropriate means and keep the Office des Changes informed where non-recovery arises from insolvency or a dispute. That duty concerns the supplier's own receivable. It should not be confused with the EU banks' responsibility for refunding the merchant's customers. (Office des Changes, IGOC 2026, art. 97.)
Processing in Morocco requires EU and Moroccan safeguards
For the proposed mandate service, the French merchant will ordinarily determine the purposes of customer billing and act as controller. The Moroccan supplier processes the records on its documented instructions. The PSP's separate payment and legal-compliance purposes require their own role allocation. The supplier can also be a controller for its own software billing; that does not authorise reuse of payer information for unrelated purposes. Roles must follow actual decisions over processing. (Regulation (EU) 2016/679, arts. 4(7)–(8), 5–6 and 28.)
The merchant needs an Article 28 processing agreement covering instructions, confidentiality, subprocessors, security, assistance, audits and return or deletion of data. Access should be restricted by merchant and staff function. The service should protect records in transit and storage, log privileged access and maintain recoverable copies. The supplier must notify its controller of a personal-data breach without undue delay; the controller separately assesses its own notification duties. These controls must also preserve usable mandate evidence through an incident. (Regulation (EU) 2016/679, arts. 28, 32 and 33.)
Morocco has no European Commission adequacy decision. Making EU personal data available to the separate Moroccan provider therefore needs an applicable Chapter V transfer basis. Remote access from Morocco can amount to a transfer even if the servers remain in the EU. The company should map support access, backups and onward recipients before choosing a mechanism. EU hosting alone cannot establish that no transfer occurs. (Regulation (EU) 2016/679, arts. 44–46; European Commission, Adequacy decisions; EDPB Guidelines 05/2021 v2.0.)
The 2021 standard contractual clauses can provide the transfer instrument where their scope conditions are met. Module Two addresses controller-to-processor transfers; Module Three addresses the appropriate processor chain. Article 1(1) limits this decision's transfer clauses to relevant importer processing that is not already directly subject to the GDPR. The parties must therefore assess the supplier's territorial status before choosing this instrument; an EU business customer alone does not settle that question. (Commission Implementing Decision (EU) 2021/914, art. 1 and Annex; Regulation (EU) 2016/679, art. 3.)
Clause 14 requires a documented assessment of the transfer circumstances and destination laws and practices, with any necessary supplementary protection. Public-authority requests also require the clause 15 process. If appropriate safeguards cannot be maintained, the clauses require suspension of affected transfers. Signing a template or adding transfer consent to a payment mandate cannot replace those steps. The debit authorisation and the lawful processing of personal data serve different purposes. (Commission Implementing Decision (EU) 2021/914, Annex, clauses 14–15; Regulation (EU) 2016/679, arts. 6 and 44–46.)
Moroccan Law No. 09-08 applies separately to processing within its territorial scope. It also covers a foreign controller using processing means in Morocco, apart from the statutory transit exception. That controller must notify CNDP of a Moroccan representative. The parties must identify the responsible controller and complete the required declaration or authorisation. The authorisation categories include processing national identity-card numbers; ordinary billing software should not collect those numbers merely to strengthen a mandate file. Processor confidentiality and security obligations also need contractual implementation. (Moroccan Law No. 09-08, arts. 2(2)(b), 2(3), 12, 14–15, 23 and 25–26.)
An incoming EU transfer and a later transfer out of Morocco require distinct checks. Articles 43–44 govern the Moroccan outward transfer. France appears on the CNDP's designated list, but that does not dispense with the applicable processing and transfer formalities. For a destination without sufficient protection, Article 44 permits a transfer based on express consent, its specified necessity grounds, an applicable international agreement, or express, reasoned CNDP authorisation based on sufficient safeguards. The return of records, foreign backups and access by another overseas provider must each follow the appropriate route. EU contractual safeguards do not substitute for those Moroccan requirements. (Moroccan Law No. 09-08, arts. 43–44; CNDP Deliberation No. 236-2015, art. 1.)
The contracts must preserve evidence and support a lawful exit
The software agreement should give each merchant continuing access to its mandate archive and collection history. The export must include original evidence, amendments, cancellations, consent versions, notices and transaction links in an agreed usable format. Suspension of new collections should preserve the limited access needed for claims and reconciliation. Retention must reconcile applicable evidence duties with storage limitation; neither immediate destruction on exit nor indefinite retention of every record is justified. (EPC Core Rulebook 2025 v1.2, §4.1 and PT-03.02; Regulation (EU) 2016/679, arts. 5(1)(e) and 28(3)(g).)
A change of PSP can preserve the same merchant's identifier, but the receiving provider must accept the mandate records and migration process. A change of creditor is a different legal event and may require fresh mandates. The exit agreement should allocate pending refunds, reserve releases, evidence requests and cooperation after the last collection. It should also restrict reuse of exported personal data to the permitted purposes. Portability is a contractual delivery obligation, subject to the continuing validity of the mandates. (Banque de France, Référentiel des identifiants créanciers SEPA; EPC132-17 v5.1, §2.4; Regulation (EU) 2016/679, art. 28.)
If a PSP within DORA's scope contracts with the supplier for ICT services supporting its operations, DORA can add contractual requirements. The parties must address the services, locations, data access and return, incident assistance and termination. Contracts supporting critical or important functions need the relevant subcontracting, audit and exit provisions. The financial entity retains responsibility for compliance. A merchant's software purchase alone does not establish that this PSP outsourcing arrangement exists. (Regulation (EU) 2022/2554, arts. 28 and 30.)
The agreement between merchant and supplier should select governing law and dispute arrangements expressly. The mandate must be governed by the law of a SEPA country under the scheme. Contractual choice cannot remove applicable mandatory payment or data rules. When a merchant directs consumer services into another country, Rome I's consumer conditions can preserve that consumer's mandatory home-law protection. The French worked implementation therefore does not justify copying French payer terms unchanged across every EU market. Expansion should identify payer location, PSP jurisdiction and the relevant consumer or professional status before activating the country. (Regulation (EC) No. 593/2008, arts. 3, 6 and 9; EPC Core and B2B Rulebooks 2025 v1.2, §3.5.)
Bank acceptance must precede the first collection
The first merchant and its PSP should approve one documented collection journey before production. The record should identify the creditor, issued identifier, settlement account, selected scheme and exact supplier permissions. It should include an accepted mandate form, evidence method, notice process, file format and submission cut-off. Core and B2B acceptance must be established separately. A PSP's presence in the EPC register establishes participation, rather than acceptance of this merchant or its Moroccan software provider. (EPC Core Rulebook 2025 v1.2, §§5.4 and 5.7–5.8; EPC B2B Rulebook 2025 v1.2, §§5.7–5.9.)
The merchant's refund and reserve terms should be agreed before it relies on collected cash. The supplier should demonstrate duplicate prevention, cancellation, rejected-file correction, evidence export and separation of merchant access. The parties should also test the merchant-insolvency procedure: new instructions stop where legally required, records remain retrievable and refund requests reach the responsible PSP. Licentium's payment-processor selection guide provides a wider procurement checklist for reserve, reporting and exit terms. These acceptance tests do not replace the legal classification of the service.
The release decision should require the Moroccan fee-receipt arrangement and applicable data formalities alongside the PSP agreement. If the partner insists that the supplier use its own shared creditor identity, control a pool or guarantee all merchant losses, the parties must reopen the structure before enabling that feature. A separately authorised collector can be assessed on its own contracts and controls. The proposed software release should proceed only with the narrower powers, direct merchant receipts and funded refund allocation described in the agreed implementation. (Code monétaire et financier, arts. L. 314-1 and L. 521-2; Moroccan Law No. 103-12, arts. 16–18; Office des Changes, IGOC 2026, arts. 95–98.)