The anti-money laundering framework for financial institutions in France encompasses the key components of the country's regulations aimed at combating money laundering and financing of terrorism (AML/CFT). This framework includes the laws and regulations established for responsible parties, ensuring compliance with international initiatives.
History In France, the anti-money laundering framework is based on Ordinance 2009-104 of January 30, 2009, which is codified in Articles L. 561-1 and subsequent articles of the French Monetary and Financial Code.
The fourth directive on combating money laundering and the financing of terrorism (AML-CFT), initiated on February 5, 2013, was adopted by committees of the European Parliament on January 27, 2015. This directive introduced several legal innovations, including the establishment of national databases. It was transposed into domestic law by Member States by June 26, 2017, which marked its entry into force in France.
The fifth European AML-CFT directive (Directive (EU) No 2018/843 of May 30, 2018) took effect in July 2018.
In addition to the European legislative framework, the regulatory requirements for governance and internal control related to AML/CFT were defined by the decree of January 6, 2021, which came into effect on March 1, 2021.
The Autorité de Contrôle Prudentiel et de Résolution (ACPR) oversees compliance with AML/CFT obligations, while a common supervisory framework by the European Union is anticipated to be implemented in 2023.
The liable parties The list of liable parties responsible for combating money laundering and terrorist financing is defined in Article L561-2 of the Monetary and Financial Code (hereinafter "CMF") and includes:
Banking establishments; Insurance companies and brokers; Provident institutions; Mutual insurance companies and unions, as well as reinsurance and capitalization entities; The Bank of France; The issuing institute of the overseas departments; The issuing institute for overseas territories; Investment firms (excluding portfolio management companies); Credit institutions headquartered in a state party to the European Economic Area (EEA). The General Regulation of the Financial Markets Authority (AMF) allows for the inclusion of institutions that are not based in the EEA; Investment firms headquartered in a state belonging to the EEA. The General Regulation of the Financial Markets Authority allows for the inclusion of establishments not based in the EEA; Corporate entities whose partners are jointly and severally held by credit institutions headquartered in a state that is part of the European Economic Area (EEA); Corporate entities headquartered in mainland France or overseas departments or in Saint-Barthélemy or Saint-Martin, whose main or sole purpose is the clearing of financial instruments. The General Regulation of the Financial Markets Authority allows for the inclusion of corporate entities not established in mainland France or overseas departments or Saint-Barthélemy or Saint-Martin; Market operators; Central depositories and managers of financial instrument settlement and delivery systems; Financial investment advisors; Intermediaries acting on behalf of third-party owners of financial securities; Portfolio management companies for investment services; Portfolio management companies and management companies for the marketing of units or shares of collective investment schemes, whether or not they manage them; Manual currency exchangers; Individuals or legal entities who, habitually, engage in transactions involving third-party real estate; Legal representatives and managers are responsible for casinos and associations, clubs, and companies organizing gambling, lotteries, bets, sports, or horse racing predictions; Individuals who habitually engage in the trade or organization of the sale of precious stones, precious materials, antiques, and works of art; Companies providing payment banking services, exempted from approval by the Prudential Supervisory Authority; Chartered accountants and employees authorized to practice the profession of chartered accountant; Lawyers at the Conseil d'État and the Court of Cassation, lawyers, avoués near the courts of appeal; Notaries; Bailiffs; Judicial administrators and judicial agents; Judicial auctioneers; Public auction companies for voluntary sale of goods; Individuals engaging in domiciliation activities.
Penalties incurred in case of non-compliance with regulations The fourth AML/CFT directive establishes obligations regarding customer due diligence, suspicious transaction reporting, data retention, and internal control provisions in the event of serious, repetitive, or systematic breaches by obligated entities:
For credit and financial institutions, a maximum financial penalty of at least 5 million euros or 10% of annual turnover is set for legal entities, and a maximum of at least 5 million euros for natural persons; The fourth directive does not limit the financial penalties to the directors of financial institutions; it also extends to individuals responsible for regulatory breaches, such as those in charge of the AML/CFT system or compliance.
The risk-based approach The Third Anti-Money Laundering Directive 2005/60/EC, adopted on October 26, 2005, was transposed into national law by Ordinance 2009-104 of January 30, 2009. This transposition marked a shift from a threshold-based approach to due diligence to a risk-based approach that considers the actual risk of money laundering.
This "risk-based approach" was advocated by banking professionals, particularly in the Anglo-Saxon context, to ensure that resources are concentrated where they are most needed. Under this framework, the principle of due diligence is adjusted to account for various money laundering and terrorist financing risks associated with the customer, the product, or the distribution method.
The due diligence obligations are specified in Articles L. 561-5 to -10-2 of the aforementioned ordinance and in Articles R. 561-5 and -6 of the decree dated September 2, 2009.
Professionals are required to implement their due diligence obligations regularly, adapting their practices according to this new risk-based approach. Consequently, there are three levels of due diligence, with varying intensities of procedures: simplified, standard, and enhanced.
Simplified due diligence The simplified due diligence level is justified by the presence of low risk in the business relationship, leading to a reduction in the obligations of the obligated party concerning certain categories of customers and transactions. When the risk of money laundering is assessed as low, due diligence can be performed in a simplified manner, both in terms of customer identification and transaction processing. This risk assessment can be based on various criteria, including the customer, the product, or its marketing method.
Article R561-15 of the CMF, derived from Decree No. 2009/1087 of September 2, 2009, specifies the conditions for applying these simplified control measures and outlines cases presenting a low risk of money laundering and terrorist financing. These cases include when the customer or the "beneficial owner" is:
A financial institution established in a Member State of the European Union; A listed company whose securities are admitted to trading on at least one regulated market in France or a State party to the agreement on the European Economic Area; A public authority, a public body.
Article R561-16 of the aforementioned text details the products for which these simplified due diligence measures will be applied, including:
Digital currency with a maximum capacity of the device of 250 euros in case of impossibility to recharge and 2,500 euros in the opposite case; Employee savings plans.
These exemptions require obligated entities to gather the necessary information to confirm that the customer meets the specified conditions.
In the insurance sector, simplified due diligence is also addressed in the decree of November 10, 2009 (JORF No. 0264 of November 14, 2009).
Normal due diligence This level of due diligence corresponds to a medium risk, which applies to the majority of customers. It necessitates the application of the following principles:
Identification of regular and occasional customers based on reliable documents; Assessment of the nature and purpose of the intended business relationship; Regular monitoring of the business relationship, including the updating of information; Identification of ultimate beneficial owners.
Enhanced due diligence When the risk of money laundering and terrorist financing presented by a customer, product, or transaction is assessed as high, obligated entities must enhance the intensity of the measures outlined in Articles L561-5 and L561-6.
The strengthened due diligence measures specified in Articles L561-10-1 and L561-10-2 of the CMF are particularly applicable in the following situations: Cross-border correspondent banking relationships or business relationships for the distribution of financial instruments with a financial institution located in a country outside the European Union or not party to the agreement on the European Economic Area (Article L561-10-1). In such cases, specific measures (as outlined in Article R561-21 of the CMF) must be adopted, including gathering information about the contracting entity's activities, reputation, and the quality of supervision it is subject to; Atypical operations that lack economic justification, have no legitimate purpose, are complex, or involve unusually high amounts (Article L561-10-2). In these instances, obligated entities must inquire about the origin of the funds, the destination of these sums, the purpose of the operation, and the identity of the beneficiary.
Beyond these specific provisions, institutions may establish their risk management policies and adjust their controls based on the nature of the risks they face.
As part of the checks conducted by the French Prudential Supervision and Resolution Authority (ACPR) of the Bank of France, entities must be prepared to justify the nature of the measures implemented within the framework of their risk-based approach.
This approach is operationalized through the adoption of a risk mapping process,L'article R561-38 du CMF states that the obligated entities "shall develop a classification of the risks of money laundering and terrorist financing presented by their activities, according to the degree of exposure to these risks, assessed based notably on the nature of the products or services offered, the conditions of the proposed transactions, the distribution channels used, as well as the characteristics of the customers." which relies on an analysis of business processes that is cross-referenced with an operational risks typology.
Customer knowledge Customer knowledge is a fundamental pillar of anti-money laundering efforts, as a thorough understanding of the customer base facilitates the detection of atypical transactions that may be linked to illicit activities and enables the reporting of suspicious activities. Customer knowledge primarily involves identification and verification (including identity, address, activity, etc.) through credible documentation, as well as gathering information related to the purpose and nature of the relationship, to determine the customer's risk profile.Raoul d’Estaintot, Revue Banque (in French). March 2009.
The ordinance imposes a duty of due diligence on entities specified in Article L.561-2 of the CMF, which consists of understanding the customer.