Cyber insurance in Morocco: handling the claim and defending coverage

A ransomware attack, a data leak or a funds transfer fraud cannot be handled like an ordinary claim: when it is notified, the attack is often still under way, and decisions made in the first hours can jeopardise coverage. The firm assists insured companies, insurers and reinsurers with the legal handling of these claims in Morocco and internationally.

Maître Abdelatif Laamrani has long represented the Moroccan national reinsurer and several international reinsurers in claims settlement and arbitration. He is the author of the study Cyber Risk and the Global Insurance and Reinsurance Markets.

Has your company just suffered a cyberattack? Reread the notification clause of your policy at once and inform your insurer. Preserve the evidence, and do not hire a provider or pay any ransom before checking the conditions of your contract. Contact the firm in the first hours.

The legal framework in Morocco

Moroccan law has no single text on cyber claims. Several regimes apply:

• Law No. 09-08: security obligation of the data controller, supervised by the CNDP. Unlike the GDPR, it contains no general duty to notify data breaches; its overhaul has been announced.
• Law No. 05-20 on cybersecurity: security and incident reporting obligations to the DGSSI for government bodies, public institutions and critical infrastructure.
• Criminal Code (Law No. 07-03): offences against automated data processing systems. Morocco is also a party to the Council of Europe Convention on Cybercrime.
• Law No. 17-99 on the Insurance Code: risks located in Morocco must be placed with licensed undertakings.
• Law No. 43-05 and foreign exchange regulations: these frame the question of any ransom payment, together with international sanctions regimes.
• Law No. 95-17: arbitration and conventional mediation, useful for insurance and reinsurance disputes.

The first hours: a discipline to maintain

Cyber insurance is as much a service as an indemnity: the insurer organises and funds the incident response through its approved providers. Two consequences follow. Notification must be immediate, as delay may lead to forfeiture or reduced coverage depending on the applicable law. And costs incurred before notification, or without the insurer’s consent, may not be covered.

The technical investigation then drives the whole file: the scope of affected data determines notifications, the date of first intrusion bears on coverage, and the attack vector on a provider’s liability. We organise this response from a legal standpoint and ensure consistency between the insurer, the authorities and third parties.

By type of attack

• Ransomware: choosing between restoration and payment, the insurer’s prior consent, sanctions checks, full traceability.
• Data breach: identifying the data and persons affected, country by country, notifications, handling of claims.
• Funds transfer fraud and social engineering: prompt recall request to the banks, judicial freezing of accounts, complaint. Coverage is often capped by a sublimit and verification conditions.
• Business interruption: quantifying loss of income, the indemnity period, dependent coverage where the incident originates with a provider.

Should you file a criminal complaint?

Moroccan law does not make a complaint a legal condition of indemnification, but the policy may require one. A complaint, addressed to the King’s Prosecutor, dates the incident, enables international cooperation and prepares recovery actions; it also has drawbacks, such as disclosing sensitive technical documents. The decision is made case by case.

In France, by contrast, Article L. 12-10-1 of the Insurance Code makes indemnification conditional on a complaint filed within 72 hours. A group present in both countries must therefore reason under each applicable law.

Defending coverage

During the crisis, the insurer investigates coverage and often issues a reservation of rights. Disputes most often concern prior knowledge of the incident, inaccurate security representations, sublimits, the calculation of business interruption losses, costs incurred outside approved providers, and the war exclusion.

That exclusion has gained particular weight since the NotPetya cases (Merck, Mondelez) and Lloyd’s requirements on state-backed cyberattacks, in force since March 2023 (Bulletin Y5381). Moroccan law does not expressly recognise the claims-made clause, which creates an interpretation risk where a local policy is governed by that law. We act before the courts and in arbitration.

International programmes, reinsurance and Lloyd’s

International programmes covering Morocco often rely on a local policy issued by a Moroccan insurer and reinsured with the programme’s lead insurer or the London market (fronting). We assist insurers, reinsurers and foreign coordinating firms on three decisive questions for Morocco: must the incident be notified, may data be transferred for the investigation, and may payment be made.

Defence and recovery

In defence, we act before the authorities, against claims by affected persons and in dealings with clients and partners. In recovery, the subrogated insurer or the victim may act against the defaulting provider, subject to limitation of liability clauses, join criminal proceedings as a civil party and seek seizure of identified assets. The insured may sometimes act against its broker for breach of the duty to advise.

To go further: our full study.

Frequently asked questions

What should you do right after a cyberattack in Morocco?

Reread the policy’s notification clause and inform the insurer without delay, preserve the evidence, and do not hire a provider or make any payment before checking the contract’s conditions. Costs incurred without the insurer’s consent may not be covered.

Must a data breach be notified to the CNDP?

Law No. 09-08 imposes a security obligation but contains no general breach notification duty comparable to the GDPR. Other rules may apply: Law No. 05-20 for the entities it covers, the GDPR or another foreign law depending on the persons concerned, and the clauses of your contracts.

Is a criminal complaint required to be indemnified?

Not under Moroccan law, which has no equivalent of Article L. 12-10-1 of the French Insurance Code. The policy may nevertheless require one, particularly for fraud and extortion coverage.

Does cyber insurance cover the ransom?

It depends on the policy and the applicable law. In Morocco, a payment runs up against foreign exchange regulations, Law No. 43-05 and the international sanctions regimes to which foreign reinsurers are exposed. Nothing should be paid without prior legal analysis and the insurer’s consent.

My insurer denies coverage: what can I do?

The first step is to analyse the ground relied on: security representations, an exclusion, a sublimit, late notification or unauthorised costs. Depending on the policy, the dispute is then resolved in court, by mediation or by arbitration.

What is a breach coach?

A breach coach is the crisis coordination lawyer appointed in the first hours to direct the legal response to the incident: instructing investigators, characterising the incident, notifications, complaint, dealings with the insurer. This role differs from coverage counsel, who deals with the extent of coverage.

Do you act for foreign insurers or reinsurers?

Yes. Admitted to the Casablanca, Paris and Montreal Bars, the firm can handle the Moroccan side of an international claim, alongside the insurer, the reinsurer or the coordinating firm.