CIVIL LAW AND AUTOMATED CREDIT RISK ASSESSMENT LAW IN MOROCCO

1. Introduction

Automated credit risk assessment refers to the use of artificial intelligence (AI), machine-learning algorithms, statistical models, credit-scoring systems and automated decision-making technologies by banks, financial institutions and credit-information agencies to evaluate the financial reliability of individuals and businesses.

In Morocco, automated credit assessment is increasingly relevant to:

Consumer loans and personal financing.

Mortgage and housing finance.

SME and commercial lending.

Digital banking and fintech services.

Credit-card applications.

Buy-now-pay-later services.

Microfinance and mobile lending.

Creditworthiness assessment through alternative data.

Automated credit assessment creates important civil-law questions concerning contractual fairness, personal-data protection, negligence, discrimination, confidentiality, accuracy of financial information and liability for wrongful credit decisions.

Morocco does not have a single comprehensive statute specifically regulating AI-based credit scoring. Instead, the applicable legal framework is derived principally from:

Law No. 09-08 on the protection of personal data.

Law No. 31-08 on consumer protection.

Law No. 103-12 on credit institutions and similar bodies.

The Moroccan Code of Obligations and Contracts.

Banking confidentiality and regulatory requirements.

Applicable rules and supervision of Bank Al-Maghrib and the CNDP.

Central legal principle: A Moroccan financial institution cannot avoid its legal responsibilities merely because a credit decision was generated by an automated algorithm or supplied by an external credit-scoring company.

2. Legal Framework Governing Automated Credit Risk Assessment in Morocco

A. Law No. 09-08: Personal Data Protection

Law No. 09-08, promulgated by Dahir No. 1-09-15 of 18 February 2009, is one of the most important laws governing automated credit assessment.

It regulates the processing of personal information relating to identifiable individuals.

Credit-scoring systems commonly process:

Income and employment information.

Existing debts and repayment histories.

Bank-account information.

Previous defaults.

Financial transactions.

Borrowing patterns.

Personal identification information.

Information obtained from credit-information databases.

Article 1: Personal data and automated processing

The law recognises personal data and processing operations performed through automated or non-automated means.

Consequently, AI-based credit scoring falls within the general scope of the legislation when it processes identifiable individuals' information.

Article 3: Principles governing processing

Personal data processing must respect requirements concerning fairness, lawfulness, specified purposes, relevance and proportionality.

A bank should therefore avoid collecting excessive or irrelevant personal information simply because its algorithm can process it.

Article 5: Right to information

Individuals must receive appropriate information about the collection and intended use of their personal information.

For credit assessment, this is relevant to explaining:

The identity of the data controller.

The purpose of credit scoring.

The categories of information collected.

The recipients of the information.

Relevant rights of access and rectification.

Article 7: Right of access

This is particularly important for automated credit decisions.

An individual can obtain information about the processing of their personal data, including:

Whether their information is being processed.

The purposes of processing.

Categories of data involved.

Recipients of the information.

Available information concerning the origin of the data.

The logic underlying automated processing concerning them.

Article 8: Right to rectification

Individuals can request correction, updating, deletion or blocking of personal information processed unlawfully, including information that is incomplete or inaccurate.

The law provides a ten-day period for the controller to make the required rectification.

For example, if an AI credit-scoring system incorrectly records an individual as having defaulted on a previous loan, the individual may seek correction.

Article 9: Right to object

Individuals may object to processing on legitimate grounds, subject to the statutory exceptions, including processing required by law.

Article 11: Automated individual decisions

Particularly important provision

Article 11 establishes an important safeguard against decisions based exclusively on automated profiling.

It provides that a decision producing legal effects concerning an individual cannot be taken solely on the basis of automated processing intended to evaluate aspects of that individual's personality or profile.

However, it recognises exceptions, including certain contractual decisions where the individual has been given an opportunity to present observations.

This provision is especially relevant when a bank automatically refuses a loan because of an AI-generated credit score.

The legal question becomes whether the bank has provided meaningful human consideration and an opportunity for the applicant to express their position.

Articles 12 onwards: Prior formalities and authorisation

Depending on the processing activity, the responsible organisation may need to complete a prior declaration or obtain CNDP authorisation.

The applicable requirements must be examined for the particular credit database, sensitive information and data-sharing arrangements.

Articles 23–26: Security and confidentiality

These provisions address security safeguards, processing under the authority of the data controller and professional secrecy.

Banks and credit-scoring providers must ensure that personal financial information is appropriately protected.

B. Law No. 31-08: Consumer Protection

Law No. 31-08 provides important safeguards in consumer credit transactions.

Its objectives include protecting consumers against unfair commercial practices and strengthening transparency in contractual relationships.

Relevant provisions include:

The precise applicable provision depends on the type of credit and transaction.

For automated credit assessment, the principal implications are:

Consumers must receive legally required information.

Credit agreements must comply with applicable disclosure requirements.

Financial institutions must respect mandatory contractual formalities.

Consumers must not be misled about credit terms.

Automated systems must not be used to circumvent consumer-protection obligations.

A bank cannot justify an unlawful contractual practice merely by claiming that its AI system recommended the transaction.

C. Law No. 103-12: Banking and Credit Institutions

Law No. 103-12 regulates Moroccan credit institutions and similar financial organisations.

It establishes the institutional framework for regulated banking activities and the supervision of financial institutions.

Its relevance to automated credit assessment includes:

Risk-management systems.

Internal banking controls.

Credit-management procedures.

Prudential supervision.

Banking confidentiality.

Governance and accountability.

Appropriate management of financial risks.

Bank Al-Maghrib has an important supervisory role.

A financial institution using automated underwriting must ensure that its credit-risk systems are compatible with applicable banking requirements.

D. Moroccan Code of Obligations and Contracts

The Code of Obligations and Contracts (DOC) provides the civil-law foundation for contractual liability.

Article 230 – Binding force of contracts

Validly concluded contractual obligations bind the parties.

A bank must respect the obligations contained in a valid credit agreement.

Article 231 – Good faith

Every undertaking must be performed in good faith.

This principle is particularly relevant to automated credit assessment because financial institutions should not manipulate credit information, conceal material contractual information or rely knowingly on defective scoring processes.

Article 232 – Gross negligence and fraud

A person cannot contractually exclude liability in advance for gross negligence or fraud.

Article 233 – Liability for representatives and persons employed

A debtor may be responsible for the acts and faults of representatives and persons used in performing contractual obligations.

This can be relevant where a bank delegates data processing or credit assessment to an external service provider, depending on the contractual and legal circumstances.

Articles 263–264 – Contractual damages

These provisions concern compensation for non-performance and resulting loss.

They may provide a basis for a civil claim where unlawful conduct in a contractual relationship causes legally recoverable damage.

Civil-law significance: A bank's use of an AI system does not automatically transfer its contractual responsibilities to the algorithm developer.

3. Legal Nature of Automated Credit Risk Assessment

Automated credit risk assessment involves several distinct legal activities.

A. Automated credit scoring

A scoring system calculates an individual's creditworthiness using financial information.

For example:

Income: 30%.

Existing indebtedness: 25%.

Repayment history: 25%.

Employment stability: 10%.

Other permitted financial indicators: 10%.

These percentages are merely illustrative, not prescribed by Moroccan law.

A problem arises when the system relies on inaccurate, outdated or irrelevant information.

B. Predictive credit assessment

AI systems may predict the probability that a borrower will default.

They may analyse historical repayment patterns, transaction data and financial behaviour.

The legal problem is whether the underlying data is accurate, relevant, lawfully obtained and processed for a legitimate purpose.

C. Automated loan rejection

A bank may automatically reject an application because the applicant falls below a predetermined creditworthiness threshold.

Article 11 of Law No. 09-08 becomes particularly important where the decision is exclusively automated and legally or significantly affects the individual.

D. Alternative-data credit assessment

Fintech companies may use additional information, including:

Digital transaction histories.

Mobile-payment activity.

Commercial transaction records.

Business cash-flow information.

Other behavioural indicators.

The use of such information must comply with Moroccan personal-data protection requirements.

E. Third-party credit scoring

Banks may obtain creditworthiness assessments from external credit-information agencies.

This raises questions concerning:

Responsibility for inaccurate information.

Lawful disclosure of financial data.

Allocation of contractual responsibilities.

Access and rectification rights.

Security and confidentiality.

4. Civil Liability Arising from Automated Credit Assessment

Moroccan civil law may recognise several categories of liability depending on the circumstances.

A. Liability for inaccurate credit information

Suppose a credit-information agency incorrectly records a borrower as having defaulted.

A bank subsequently rejects the individual's mortgage application.

Potential legal issues include:

Accuracy of the underlying information.

Failure to correct inaccurate records.

Unlawful processing of personal information.

Breach of contractual obligations.

Recoverable financial or non-financial damage.

The affected individual may invoke Law No. 09-08 and applicable civil remedies.

B. Liability for defective algorithms

A financial institution may use an inadequately tested credit-scoring model.

For example, the model systematically treats applicants with irregular employment histories as financially unreliable, even where their actual repayment records demonstrate otherwise.

Possible issues include:

Negligent system design.

Defective data selection.

Inadequate validation.

Failure to monitor model performance.

Failure to correct known errors.

The legal outcome depends on proof of fault, applicable obligations, causation and damage.

C. Liability for discriminatory credit assessment

Automated systems may indirectly produce discriminatory results.

For example, an algorithm may use geographical or behavioural variables that disproportionately disadvantage particular groups.

A distinction must be made between legitimate risk assessment and unjustified discriminatory treatment.

The bank should be able to demonstrate that its criteria are relevant to creditworthiness and consistent with applicable law.

D. Liability for privacy violations

Credit-scoring companies may collect information without satisfying applicable legal requirements.

Potential violations include:

Processing information for incompatible purposes.

Unlawful disclosure.

Excessive data collection.

Inadequate security.

Failure to provide access.

Failure to correct inaccurate records.

E. Liability for inadequate human review

A financial institution may rely completely on an automated rejection without allowing an applicant to provide relevant explanations.

This creates a potential Article 11 issue.

A meaningful human review should involve genuine consideration rather than merely approving the algorithm's output.

5. At Least Six Important Case Laws

Important jurisdictional qualification: There is limited readily verifiable published Moroccan judicial jurisprudence specifically concerning AI-based credit-scoring decisions. The following decisions are therefore comparative foreign precedents. They are not Moroccan judgments and do not bind Moroccan courts. Their principles can nevertheless assist in interpreting issues involving personal data, creditworthiness, contractual fairness and civil liability under Moroccan law.

Case 1. SCHUFA Holding AG (Scoring)

Highly relevant

Court: Court of Justice of the European Union.

Citation: Case C-634/21, judgment of 7 December 2023.

Facts:

A German credit-information agency generated an automated creditworthiness score based on personal information.

Banks relied heavily on the score when deciding whether to grant credit.

The dispute concerned whether generating the score itself constituted automated individual decision-making.

Decision:

The CJEU held that automated establishment of a probability value concerning an individual's ability to meet future payment commitments may constitute automated individual decision-making where a third party relies strongly on that score when establishing, implementing or terminating a contractual relationship.

Legal principle:

Credit scoring cannot necessarily escape automated-decision safeguards simply because the scoring company does not formally make the final lending decision.

Application to Morocco:

This judgment is particularly relevant to Article 11 of Law No. 09-08.

A Moroccan bank should not assume that outsourcing credit scoring removes the legal significance of the automated assessment.

Case 2. CK v Dun & Bradstreet Austria GmbH

Court: Court of Justice of the European Union.

Citation: Case C-203/22, judgment of 27 February 2025.

Facts:

A telecommunications operator refused to conclude a contract with a customer based on an automated creditworthiness assessment performed by Dun & Bradstreet Austria.

The customer sought meaningful information about the logic behind the automated assessment.

The dispute concerned transparency, access to information and commercial confidentiality.

Decision:

The CJEU held that meaningful information about automated decision-making must explain the procedure and principles actually applied to the individual's personal data.

The explanation must enable the individual to understand and challenge the decision.

The court also addressed the balancing of trade secrets and data-subject rights.

Legal principle:

A business cannot automatically refuse to explain an algorithmic decision merely by invoking commercial confidentiality.

Application to Morocco:

Article 7 of Law No. 09-08 expressly recognises access to information about the logic underlying automated processing.

This case provides particularly useful comparative guidance for individuals challenging unexplained credit scores.

Case 3. Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) and Federación de Comercio Electrónico y Marketing Directo (FECEMD)

Court: Court of Justice of the European Union.

Citation: Joined Cases C-468/10 and C-469/10, judgment of 24 November 2011.

Facts:

The dispute concerned the processing of personal information and the conditions under which personal data could be processed without the individual's consent.

It involved the relationship between data protection, legitimate interests and the processing of information.

Decision:

The CJEU examined the balance between legitimate interests in processing personal data and the rights and freedoms of the individuals concerned.

Legal principle:

The processing of personal information requires a legally justified basis and appropriate balancing of competing interests.

Application to Morocco:

The judgment is relevant to credit-information databases that collect and process financial information.

Moroccan institutions must identify an applicable legal basis under Law No. 09-08 rather than assuming that all financial information can be freely processed.

Case 4. Cortez v Trans Union LLC

Court: United States Court of Appeals for the Third Circuit.

Citation: 617 F.3d 688 (3d Cir. 2010).

Facts:

The case involved inaccurate information in a consumer credit report, including information associated with a different individual.

The inaccurate reporting created serious consequences for the affected consumer.

Decision:

The court considered the obligations of credit-reporting agencies concerning the accuracy of consumer information and the consequences of inadequate investigation.

Legal principle:

Credit-reporting agencies must take appropriate steps to ensure the accuracy of information they provide.

Application to Morocco:

This decision is relevant to Articles 7 and 8 of Law No. 09-08.

Where an automated system relies on inaccurate financial information, the individual may seek access to the underlying data and correction of the inaccurate record.

Case 5. Safeco Insurance Co. of America v Burr

Court: Supreme Court of the United States.

Citation: 551 U.S. 47 (2007).

Facts:

The case concerned credit-related insurance pricing and alleged violations of the Fair Credit Reporting Act.

The dispute examined whether the defendants' interpretation of their statutory obligations amounted to a willful violation.

Decision:

The Supreme Court examined the statutory standard for willful non-compliance and distinguished objectively reasonable interpretations from reckless disregard of statutory requirements.

Legal principle:

Credit-related organisations must comply with statutory obligations governing the use of consumer credit information.

Application to Morocco:

The case provides comparative guidance concerning the importance of legal compliance in financial-information processing.

A Moroccan institution should establish procedures ensuring that credit information is obtained, used and communicated lawfully.

Case 6. Ramirez v TransUnion LLC

Court: Supreme Court of the United States.

Citation: 594 U.S. 413 (2021).

Facts:

TransUnion maintained credit files containing inaccurate information identifying certain individuals as potential matches to persons on a terrorist watchlist.

The information was communicated to third parties in certain cases.

The affected individuals alleged violations of federal credit-reporting legislation.

Decision:

The Supreme Court considered the requirements for establishing concrete injury for federal standing purposes.

It distinguished individuals whose inaccurate information had been disseminated from those whose information had not been disseminated.

Legal principle:

The communication of inaccurate personal financial information can create significant legal consequences, although the availability of judicial relief depends on the applicable legal requirements.

Application to Morocco:

The decision is relevant to the potential consequences of disseminating inaccurate credit assessments to banks and other financial institutions.

It also illustrates why credit-information providers should maintain reliable verification and correction procedures.

6. Additional Comparative Case Law

Two further decisions offer useful guidance.

A. Oliver v Navy Federal Credit Union

Court: United States Court of Appeals for the Fourth Circuit.

Citation: No. 24-1656, 9 February 2026.

The case concerned allegations that a semi-automated mortgage underwriting process produced discriminatory outcomes against minority applicants.

Its relevance lies in the examination of alleged discriminatory effects associated with algorithmic credit underwriting.

It is important not to treat the allegations as a final judicial finding that discrimination occurred.

B. CFPB v Townstone Financial, Inc.

Court: United States Court of Appeals for the Seventh Circuit.

Citation: No. 23-1654, 11 July 2024.

The case concerned the scope of the Equal Credit Opportunity Act and whether conduct discouraging prospective applicants from applying for credit could fall within its protections.

The Seventh Circuit reversed the district court's ruling and recognised that the statute could reach certain discouragement practices involving prospective applicants.

Its relevance is the broader principle that unfairness in lending may arise before a formal credit application is completed.

7. Legal Problems Associated with AI-Based Credit Assessment in Morocco

8. Responsibility of Banks, Fintech Companies and Credit-Scoring Providers

Different organisations may participate in an automated lending decision.

Their responsibilities should be examined separately.

A. Banks

Banks should:

Ensure the lawful use of credit information.

Maintain appropriate internal controls.

Review the reliability of automated assessments.

Respect data-protection requirements.

Protect customer confidentiality.

Comply with applicable consumer-credit rules.

B. Credit-information agencies

These organisations should:

Maintain accurate information.

Correct defective records.

Respect lawful processing requirements.

Provide relevant information to data subjects.

Maintain appropriate security controls.

C. AI developers and technology providers

Their potential liability depends on their contractual role and applicable legal obligations.

Relevant issues include:

Defective software.

Negligent model development.

Incorrect data integration.

Failure to maintain agreed security.

Failure to disclose known technical defects.

D. Fintech lending platforms

Fintech platforms should ensure that their automated lending operations comply with applicable financial, consumer-protection and data-protection requirements.

The outsourcing of an automated assessment does not automatically remove the responsibilities of the organisation making or implementing the lending decision.

9. Practical Hypothetical Case Study

Automated mortgage rejection based on inaccurate AI scoring

Facts

A Moroccan citizen applies for a mortgage from a commercial bank.

The bank uses an AI-based credit assessment system supplied by an external technology provider.

The system assigns the applicant a low credit score because its database incorrectly records a previous loan default.

The applicant provides evidence that the previous loan was fully repaid.

Despite this evidence, the bank refuses to reconsider the application and relies exclusively on the automated score.

The applicant subsequently discovers that the same inaccurate information has been transmitted to other financial institutions.

Legal issues

Whether the processing of inaccurate personal information violates Law No. 09-08.

Whether the applicant can demand access to the underlying credit information.

Whether the applicant can demand rectification.

Whether Article 11 restricts the exclusively automated rejection.

Whether the bank has breached applicable contractual or statutory obligations.

Whether the applicant can obtain compensation for proven damage.

Applicable legal provisions

Law 09-08, Article 7: Access to information.

Law 09-08, Article 8: Rectification.

Law 09-08, Article 11: Automated decision-making.

Law 09-08, Articles 23–26: Security and confidentiality.

Law 31-08: Applicable consumer-credit protections.

DOC, Article 231: Good-faith performance.

DOC, Articles 263–264: Damages for contractual non-performance.

Possible legal remedies

The applicant may:

Request access to the personal information used in the assessment.

Request correction of the inaccurate default record.

Request information about the automated processing logic.

Complain to the CNDP where appropriate.

Raise the matter with the relevant banking institution and, where appropriate, Bank Al-Maghrib.

Pursue civil proceedings if the legal requirements for liability and compensation are established.

Potential outcome: The inaccurate information may need to be corrected, and the automated assessment reconsidered. Compensation would depend on proof of an actionable legal wrong, causation and damage. The bank is not necessarily obliged to grant the mortgage simply because the scoring error is corrected.

10. Recommended Legal and Regulatory Safeguards for Morocco

Morocco could strengthen its approach to automated credit risk assessment through the following measures.

A. Human intervention

Financial institutions should establish meaningful review mechanisms for significant adverse credit decisions.

B. Explainability

Borrowers should receive meaningful explanations of relevant scoring factors and errors affecting their applications.

C. Data minimisation

Credit providers should avoid processing unnecessary personal information.

D. Algorithmic accountability

Banks should maintain documentation identifying:

The source of training data.

Relevant scoring variables.

Model-validation procedures.

Error rates.

Human-review arrangements.

Procedures for correcting inaccurate information.

E. Protection of vulnerable consumers

Automated assessments should be monitored for unjustified exclusion of individuals with limited credit histories, irregular employment or non-traditional income sources.

11. Critical Legal Analysis

The central challenge for Moroccan civil law is balancing three competing interests.

First: Financial institutions' freedom to assess credit risk.

Banks must be able to evaluate repayment capacity and manage financial exposure.

Second: Individual rights and contractual fairness.

Borrowers must not be subjected to unlawful data processing, inaccurate credit reporting or legally impermissible automated decisions.

Third: Financial innovation.

AI and predictive analytics can improve lending efficiency, reduce administrative costs and expand access to financial services.

However, technological innovation cannot displace statutory obligations.

An effective legal approach should therefore distinguish between:

The right of a bank to refuse credit on legitimate financial grounds.

The right of an individual to challenge inaccurate personal information.

The statutory restrictions on exclusively automated decisions.

The right to seek compensation where actionable civil liability is established.

A particularly important distinction is that Article 11 of Law No. 09-08 does not establish an unconditional right to receive a loan or prohibit every form of automated credit scoring. Its application depends on the nature of the processing, the effects of the decision and the statutory exceptions.

12. Conclusion

Civil law and automated credit risk assessment in Morocco involve the interaction of personal-data protection, banking regulation, consumer protection and contractual liability.

Law No. 09-08 is particularly significant because Articles 7, 8 and 11 provide important safeguards concerning access, rectification and automated decision-making.

Law No. 31-08 protects consumers in relevant credit transactions, while Law No. 103-12 establishes the regulatory framework for credit institutions.

The Code of Obligations and Contracts provides the foundation for good-faith contractual performance and compensation for legally established losses.

The comparative decisions in SCHUFA, Dun & Bradstreet, ASNEF, Cortez, Safeco and Ramirez demonstrate important principles concerning automated scoring, transparency, accuracy and accountability.

Ultimately, Morocco's legal framework should ensure that automated credit assessment remains a legitimate financial-risk management tool rather than becoming an instrument of arbitrary exclusion, unlawful profiling or unaccountable financial decision-making.

The fundamental principle is that technological automation does not eliminate legal responsibility.

13. Key Legal Authorities and Cases for Examination

Overall assessment: Moroccan law already provides a meaningful foundation for challenging unlawful automated credit assessment. Its principal limitation is the absence of a comprehensive, credit-specific statutory regime addressing AI model explainability, algorithmic discrimination, independent auditing and detailed human-review procedures.

Research note: The comparative cases above are foreign authorities, not binding Moroccan precedents. Their relevance is persuasive and analytical rather than precedential.