Checking out an IT provider rarely takes more than half a day of actual work, and almost nobody does it. The usual sequence is familiar: three proposals on the table, a committee comparing prices line by line, a presentation meeting where the sales director shows up with a friendly project manager, then a signature two weeks later. In between, nobody calls the clients listed as references, nobody pulls a trade register extract, and nobody asks who will actually write the code.
A buyer who has been burned once works differently. He asks for the RC number and the ICE the day the offer lands, looks at the incorporation date and the last filed accounts, calls two clients he picked himself without going through the salesperson, and reads the intellectual property and exit clauses before discussing the discount. To vet IT provider Morocco candidates is not an act of suspicion. It is the same diligence you already apply to a machinery supplier or a freight forwarder.
The list below is the one I run through when a Moroccan SME asks for an opinion on a proposal before signing. It goes from the fastest check to the most demanding one.
A reference deck proves nothing until you pick up the phone
A logo on a slide can cover very different realities: a project delivered end to end, a three-day advisory assignment, subcontracted work done on behalf of another agency, or a project belonging to an employee who left two years ago. None of that is dishonest in itself. The difference matters when you are handing over your invoicing or your customer database.
So ask, for three references at most: the year, the exact scope delivered, the role played (full delivery ownership or team reinforcement), and the name of someone who will take a call. An established provider always has two or three clients willing to talk. If the answer is that the entire portfolio is confidential, that holds for one large bank, rarely for everyone.
Online reviews of IT companies in Morocco add almost nothing at this stage. Volume is low, part of the feedback comes from job applicants or former employees, and a 400,000 MAD B2B project never ends with a star rating on a listing page. Use them to spot a negative pattern that repeats, not to decide.
RC, ICE and a real address: what a shell structure reveals
Legal information about a Moroccan company is public, and this is the quickest part of the job. Ask for the trade register number, the ICE, the legal form and the share capital, then cross-check against what the commercial court registry and the OMPIC company information service can confirm. The modèle 7 certificate issued by the registry shows the registration date, the stated business purpose, the directors and any charges registered over the business.
Nothing dramatic comes out of that file, but it exposes gaps: a company registered eight months ago claiming ten years of experience, a business purpose centred on trading while you are being sold software development, a manager who is not the person due to sign the contract, a 10,000 MAD capital facing a 600,000 MAD commitment. None of these is disqualifying on its own. Each deserves an explanation.
Two more documents complete the picture, and no serious provider takes offence at the request: the tax clearance certificate and the CNSS certificate. Both are standard in public tenders and in many private consultations. Go and look at the address too. A domiciliation service is not a red flag for a three-person consultancy; it is more of one for a company advertising twenty-five staff and a support centre.
The questions salespeople hope you never ask their clients
The reference call is the only moment in the process where you get information nobody prepared for you. Make the call yourself, by phone rather than email, and allow twenty minutes. The useful questions are not about overall satisfaction, which everyone answers politely, but about the points of friction.
- Was the go-live date announced at the start actually met, and by how many weeks did it slip?
- What fell out of scope along the way, and how were the change requests priced?
- Who was the technical lead, is that person still with the company, and were they swapped mid-project?
- At the first production incident, how long before a human answered, not an automated ticket acknowledgement?
- At the end of the project, did you get the code, the credentials and the documentation without having to negotiate?
- Would you sign again, and what would you negotiate differently?
That last question is the most productive of all. Almost every client says yes, and almost every client adds a concrete reservation in the very next sentence. The reservation is what you came for, because it describes the provider’s structural weakness, the one you will meet in turn.
How many people will really work on your project
The proposal describes a team. The contract almost never commits to names. Between the pre-sales meeting where a senior architect explains his approach and the third sprint where a junior picks up the ticket, there is usually no clause protecting you.
Ask for the named composition of the assigned team, with each person’s allocation rate and a designated backup if someone leaves. Ask in writing whether part of the work is subcontracted, to whom, and from where. A Casablanca provider handing the back end to a partner team is not a problem in itself. Not saying so before signature is.
The simplest signal is the ratio between declared headcount and number of live projects. A six-person outfit proudly announcing seven parallel engagements is telling you, without meaning to, how much time yours will get. The shape of the risk also depends on the model you choose, and the comparison between a freelancer, an IT company and a consultancy helps you know where to concentrate the checks.
The financial health of a partner who must last two years
An application maintenance contract, or a project phased over eighteen months, ties you to your provider’s economic survival. Moroccan companies file their annual accounts with the commercial court registry. Filings are often late or incomplete among small firms, but a complete absence across several consecutive years is information in itself.
What deserves attention, if you can see the accounts: equity that has turned negative, a share of revenue concentrated on a single client, headcount doubling with no capital increase or visible financing behind it. Freelancers in the local market, for their part, answer readily when you ask whether a given company pays at sixty days or at a hundred and fifty.
A price far below the other offers is a financial indicator too, not just a commercial one. Either the proposed team is more junior than advertised, or the scope was misunderstood, or the provider needs cash now and will recover the gap through change requests later. All three show up when you compare line by line, an exercise covered in how to read an IT quote before signing.
Reversibility and CNDP subcontracting: the two clauses worth a second reading
Two articles decide what happens on the day the relationship ends, and they are rarely the ones reviewed in committee. The reversibility clause must state what you get back (a complete source code export, technical documentation, credentials and administrator accounts, data extracted in a usable format), within what deadline after termination, and at what daily rate handover support is billed. With no rate written in, the exit invoice gets negotiated at the worst possible moment.
Intellectual property deserves an explicit sentence: rights transferred on full payment, open source components listed with their licences, and clear treatment of the generic building blocks the provider reuses across clients. You can accept a usage licence on an internal framework, provided you know about it beforehand and not during a migration.
On personal data, your provider acts as a processor under Law 09-08. The contract should name its own subcontractors, state where data is hosted, require your prior agreement for any transfer outside Morocco, and organise deletion or return at the end of the engagement. Filing formalities and transfer conditions change over time, so check the current obligations on the CNDP website rather than trusting the provider’s standard annex. If you have ever gone through a breakup, you know that the exit is prepared before the entry.
The five-call test to vet IT provider Morocco shortlists
Everything above fits into ten working days and about half a day of your own time, provided you run it as a sequence rather than a list of good intentions.
- Call 1, to the salesperson. RC, ICE, modèle 7 certificate, tax and CNSS certificates, named team composition, list of subcontractors. Documents should arrive within forty-eight hours.
- Calls 2 and 3, to two clients you pick from the reference list, not the ones offered spontaneously. Twenty minutes each, using the friction questions above.
- Call 4, to the technical lead, alone. Thirty minutes with no salesperson in the room, about your own environment: your ERP, your data flows, your technical debt. You will know quickly whether he has handled this kind of context or is discovering it.
- Call 5, to your legal counsel, contract in hand, on four points only: reversibility, intellectual property, late delivery penalties, personal data annex.
A solid provider goes through this sequence without friction, sometimes with relief, because it separates him from the less serious offers. The one who spends three weeks failing to send a CNSS certificate is already showing you how an urgent ticket will be handled in month fourteen. One limit is worth naming: this exercise checks the provider, not your own preparation. If the requirement is vague, the best company in the country will deliver something other than what you expected, and a properly written specification remains the prerequisite.
Frequently asked questions
How do you obtain a Moroccan company’s trade register information?
Register information is public. The modèle 7 certificate is issued by the commercial court registry of the company’s registered office, and OMPIC runs an online company information service for a small fee. The fastest route is still to ask the provider directly: a refusal, or an unusual delay, is already an answer.
What if a provider refuses to give references?
Confidentiality is a fair argument for one or two sensitive clients, not for an entire portfolio. Offer an alternative: a call with a client whose name will appear in none of your documents, or a demonstration of a delivered project with that client on the line. If nothing is possible, ask yourself what exactly you are buying.
Are online reviews enough to judge a Moroccan IT company?
No. The volume is too small to be representative, a share of the comments comes from job applicants, and B2B decision-makers almost never publish a review after a project. Two properly conducted reference calls carry more information than fifty online ratings.
Should you ask for professional liability insurance?
Ask for the certificate, especially if the provider will work on a production system or handle customer data. It shows that cover exists and what the ceiling is. Check that the period covers the contract duration and that the insured activity actually matches IT services.
Arrowlancer’s digital transformation consulting covers precisely this moment: reviewing a proposal you have received, checking out a shortlisted provider, negotiating reversibility and CNDP compliance clauses before signature, whether the project then goes to us or to someone else. The detail of those engagements sits on the services page. If a proposal is on your desk right now, write to us through the contact form with the scope and the amount at stake.