Banking · Payments · Markets · Morocco
Banking systems that hold under pressure.
From Casablanca, we design and deliver the critical systems of banks, payment institutions and capital-market firms in Morocco. We know what Bank Al-Maghrib expects before we draw the architecture.
Our domains
From core banking to critical infrastructure
Core banking & modernisation
Domain-by-domain core migration (accounts, credit, payments), progressive API enablement, real-time synchronisation — without stopping the bank.
Payments & cards
Fault-tolerant payment platforms, switch and CMI integration, mobile payments, PCI-DSS compliance. Latency measured in milliseconds.
Bank Al-Maghrib & DORA compliance
IT risk management, business continuity, outsourcing and cloud framed by Bank Al-Maghrib directives — and DORA for subsidiaries of European groups.
Capital markets
OMS, real-time risk, reconciliation, market data. Traceable pipelines that satisfy AMMC requirements and auditors.
Resilient infrastructure
Multi-site, tested disaster recovery, contractually defined RTO and RPO. Rehearsed failovers, not a DR plan sleeping in a binder.
AI for banking
Fraud detection, KYC, scoring, back-office agents — deployed with governance, auditability and compliance with law 09-08.
Regulatory framework
The regulatory framework we design in from day one
A bank in Morocco does not choose its architecture alone: the regulator, data protection and national cybersecurity set the boundaries. We treat them as architecture requirements.
- Bank Al-Maghrib
- Directives on information security, business continuity and outsourcing, including cloud; law 103-12 for credit and payment institutions.
- AMMC
- Operation traceability and integrity for brokerage firms, asset managers and market infrastructures.
- Law 09-08 & CNDP
- Protection of customers' personal data, including authorisation of data transfers outside Morocco.
- Law 05-20 & DGSSI
- Cybersecurity obligations for critical infrastructure operators, which include systemic financial institutions.
- DORA, PCI-DSS
- DORA for subsidiaries of European groups; PCI-DSS for anything that touches card data.
Related case studies
Core banking migration to domain-driven microservices
Bounded-context-by-bounded-context decomposition of a monolithic core — accounts, credit, payments, compliance — migrated in continuous production.
Read the case studyBanking & PaymentsHigh-availability payment architecture for a banking institution
Legacy payment stack replaced with a fault-tolerant, PCI-DSS compliant platform — sub-80ms latency, go-live with no maintenance window.
Read the case studyFintech · RegulatoryPayment institution creation — from regulatory dossier to go-live
Full-scope support: regulatory filing, technical architecture, implementation, and supervised launch. Now live and processing transactions under licence.
Read the case studyFinance · TradingCI/CD pipeline for a regulated trading infrastructure
Full build → SAST/DAST → deploy automation with integrated audit traceability. Release cycles moved from monthly to weekly.
Read the case studyServices involved
- Enterprise ArchitectureReference architectures, microservices migration, and event-driven design for systems that have to keep running.Discover
- DevSecOpsSecure CI/CD, SAST/DAST, and DORA / SOC 2 readiness — so you ship faster and still pass the audit.Discover
- Agentic AI & LLMAutonomous agents and LLM systems in regulated production: governed, auditable, and integrated with your real systems.Discover
FAQ
Frequently asked questions
Can a core banking system be migrated without a maintenance window?
Yes, if you migrate by domain rather than in a big bang. We extract domains one at a time (accounts, credit, payments), with transient dual-write and an anticorruption layer towards the legacy. Each cutover is rehearsed and reversible. It looks longer on paper than a one-shot migration, but the bank never stops — and the risk is split into steps management can steer.
Can a Moroccan bank host data in the cloud?
Yes, within the framework Bank Al-Maghrib sets for outsourcing and law 09-08 sets for personal data. In practice that means a risk analysis, controlled data location, contractual audit and reversibility clauses, and CNDP authorisation if personal data leaves Morocco. We design the architecture so these requirements can be demonstrated, not just declared.
Do you work with subsidiaries of European groups subject to DORA?
Yes. A Moroccan subsidiary of a European group often has to satisfy both Bank Al-Maghrib and its parent's DORA requirements: ICT third-party register, resilience testing, incident management. We align both frameworks in a single architecture and a single body of documentation, so there are not two versions of the truth to maintain.
How does an engagement with Coda Solutions start?
With a 30-minute first conversation with a senior engineer, not a salesperson. If the need is confirmed, we scope it — often through an architecture diagnostic — then propose an engagement model: fixed scope, embedded team or architecture advisory. You know who will work on your project before you sign.