CNSS is setting up two subsidiaries to separately manage its polyclinics and digital operations, taking two activities that have become increasingly difficult to handle within its existing structure.
The board approved the move on Thursday, September 3, at a meeting chaired by Economy and Finance Minister Nadia Fettah.
One of the companies will take charge of the CNSS polyclinics, a network that has struggled for years with losses, aging equipment, and low activity.
Its structural deficit was still estimated at around MAD 250 million a year in 2024.
The numbers have since started moving in the other direction.
Revenue from the polyclinics rose from around MAD 430 million in 2021 to nearly MAD 700 million in 2025 as CNSS rolled out a restructuring program. The deficit also narrowed.
But the management question remained.
CNSS currently manages mandatory health insurance, or AMO, while also providing healthcare through its own polyclinics.
Putting the clinics under a separate company would further separate the two functions and give the medical network its own management structure.
Investment has been another problem.
The Economic, Social and Environmental Council (CESE) had previously pointed to a gradual decline in funding for CNSS medical units, slowing or freezing parts of the network’s development.
The new company will take over a network still facing the need to replace ageing equipment and increase investment while competing with private healthcare providers.
Digital arm follows 2025 breach
The second subsidiary will be responsible for accelerating CNSS’s digital transformation.
Its creation comes a year after a cyberattack exposed weaknesses in the systems holding data on insured workers, employers and other social protection beneficiaries.
CNSS said in April 2025 that its IT system had been targeted by attacks designed to bypass its security measures and confirmed that data had been leaked.
At the time, it said the origin and extent of the attack were still being investigated.
Several media outlets subsequently reported that information involving nearly two million employees had been affected.
The National Commission for the Control of Personal Data Protection (CNDP) also warned about risks arising from the use of personal information contained in the leak.
The new digital subsidiary will now handle CNSS’s push to expand digital services as the Caisse continues to manage large volumes of personal and employer data.
