What is the legal framework for AML in France (cadre juridique)?
Tracfin receives suspicion reports and supervises nobody. Older guides call it France's principal AML authority, but article L561-23 of the CMF sets it up as the national financial intelligence unit, and article L561-36 hands the supervision of firms to the ACPR, the AMF, the professional bodies and others.
The French framework for anti money laundering (AML) has three layers. The CMF sets the preventive duties in articles L561-1 onwards and the asset freezing rules in L562-1 onwards. The Criminal Code defines the offense, blanchiment de capitaux (in everyday French, blanchiment d'argent), in articles 324-1 to 324-9. French texts call the whole field LCB-FT, lutte contre le blanchiment de capitaux et le financement du terrorisme, which English texts write as AML/CFT or AML/CTF.
The L articles are statute. The R and D articles are decrees, regulation in the strict sense, and most euro thresholds live there. Together they transpose the EU directives that carry the FATF Recommendations. Loi 2025-532 of 13 June 2025 extended the presumption of illicit origin in article 324-1-1 to crypto asset transactions made anonymous.
Short lived shell companies are one target Tracfin names for 2025. Its 2025 activity report counts more than 8,000 companies reported to commercial court registries, and 80 percent of them were struck off.
Which authorities regulate AML in France (autorités de régulation)?
| Authority | Role in AML (November 2026) | Who it covers |
|---|---|---|
| ACPR (Autorité de contrôle prudentiel et de résolution) | AML supervisor; its Sanctions Committee imposes reprimands and fines | Banks, insurers, payment and electronic money institutions, money changers |
| AMF (Autorité des marchés financiers) | AML supervisor for the financial markets; authorizes crypto asset service providers under MiCA | Investment firms, asset management companies, CASPs |
| Tracfin | Financial intelligence unit (L561-23): receives déclarations de soupçon and systematic communications (COSI) | No firm; it supervises nobody |
| DGCCRF and the National Sanctions Commission | Inspection, then sanctions (L561-38, L561-40), where no dedicated supervisor exists | Real estate agents, domiciliation companies, dealers in goods |
| Customs (administration des douanes) | AML supervisor (L561-36, 12°) | Art and antiques dealers, dealers in precious metals and stones, auction houses |
| Professional orders and chambers | Supervise their members | Notaries, lawyers, accountants, auditors |
| Treasury Directorate General (DG Trésor) | Administers national asset freezes | Every person and firm |
The ACPR, the prudential supervision and resolution authority attached to the Banque de France, covers banking and insurance. Its Sanctions Committee publishes each decision with the breaches it upheld, which makes those decisions the plainest record of what French inspectors test. The AMF is the financial markets authority, and since MiCA it also authorizes crypto firms.
Tracfin's agents are authorized by the economy minister (L561-23). It can hold a reported transaction that has not yet run for 10 working days, a period the president of the Paris judicial court can extend (L561-24), and it passes its findings to judicial and administrative authorities. The DGCCRF, the directorate general for competition, consumer affairs and fraud control, inspects the non financial sectors that have no dedicated supervisor, and the National Sanctions Commission rules on what it finds.
Picture an illustrative Paris payment institution. The ACPR inspects its controls. Its declarant files suspicion reports with Tracfin, and DG Trésor administers any national freeze it has to apply.
Who must comply with AML rules in France, sector by sector?
Article L561-2 of the CMF lists the obliged entities (assujettis) and carries the sector specific AML requirements, in its version in force since 5 August 2026 after Loi 2026-725 of 3 August 2026.
- Financial sector. Credit institutions, payment and electronic money institutions and their agents, insurers, investment firms, asset management companies, money changers and crowdfunding providers, under the ACPR or the AMF.
- Crypto asset service providers. Authorized by the AMF under MiCA. The number of suspicion reports from crypto asset service providers rose 58 percent to 4,850 in 2025.
- Legal and accounting professions. Notaries, bailiffs, judicial administrators, accountants, auditors, and lawyers for named transactions. Lawyers report through the president of their bar (bâtonnier), not straight to Tracfin, unless they act as fiduciary (L561-17).
- Dealers and agents. Art and antiques dealers, dealers in precious metals and stones and auction houses at €10,000 or more; jewelers above €10,000; letting agents once the monthly rent reaches €10,000; real estate agents; casinos and gaming operators; domiciliation companies.
- Sports agents. Obliged since 2010, and still silent: Tracfin's 2025 report says they sent no suspicion report that year, despite awareness work with DG Trésor.
The financial sector sent 93 percent of the reports Tracfin received in 2025, and the whole non financial sector sent 20,014.
What are the AML requirements in France (obligations LCB-FT)?
Twelve LCB-FT duties follow, each with its CMF article as in force on 3 November 2026. The right hand column shows where complead, formerly Sanction Scanner, keeps the evidence for each duty when an ACPR inspector asks.
| Obligation | Legal basis (in force, November 2026) | What a program must do | How complead does it |
|---|---|---|---|
| Risk classification and procedures | CMF L561-4-1, L561-32 | Classify money laundering and terrorist financing risks by product, customer, channel and country; write the procedures and internal controls that answer them; name a senior person responsible. | Rules carry a version history with who changed what, when and why, and can be scoped per product, segment or jurisdiction. |
| Customer due diligence | CMF L561-5, R561-5 onwards, R561-10 | Identify and verify the customer and its beneficial owner before the relationship (verification may finish while it is set up where the risk seems low and waiting would interrupt normal business); occasional customers above €15,000, on lower cash, manual exchange and casino lines, and on every money remittance (transmission de fonds) whatever the amount. | One engine runs onboarding, screening and monitoring, and the customer ends up with one risk score across all three. |
| Beneficial owners | CMF L561-2-2, R561-1 onwards; register L561-46 onwards; discrepancies L561-47-1 | Identify each individual holding more than 25 percent of capital or votes, or control by other means; check the beneficial owner register and report discrepancies to the registry clerk. | KYB and UBO verification traces owners and controlling entities up the chain until natural persons are reached, with no fixed depth cap; a layer that cannot be resolved is reported as such. |
| Politically exposed persons | CMF L561-10, R561-18, R561-20-2 | Find out whether the customer or its beneficial owner is a PEP or a PEP's relative or close associate; a member of the executive body, or a person it authorizes, approves the relationship, and the firm establishes the source of wealth and of funds. | PEP lists sit inside the screening coverage, with their own fuzzy matching threshold; the reviewer decides the next step. |
| Enhanced due diligence | CMF L561-10 to L561-10-3 | Enhanced measures for high risk, EU high risk third countries, correspondent relationships and transactions that are particularly complex, unusually large, or without apparent economic justification or lawful object. | A rule scoped to a jurisdiction raises the customer's score; the alert shows which rule fired and which signals matched. |
| Suspicious transaction report (déclaration de soupçon) | CMF L561-15, L561-16, L561-18; R561-23, R561-24 | Report to Tracfin sums suspected to come from an offense punishable by more than one year in prison or linked to terrorist financing, and tax fraud where a decree criterion is met; report before execution, or inform Tracfin without delay after it where postponing was impossible, could hinder an investigation or the suspicion arose later; never disclose the report; name a declarant and a correspondent for Tracfin. | Agents gather the case evidence, write the narrative and keep a work log, and case management carries reporting support; the declarant decides and files with Tracfin. |
| Systematic communications (COSI) | CMF L561-15-1, R561-31-1, R561-31-2 | Banks, payment and electronic money institutions send Tracfin cash deposits or withdrawals on a customer account above €10,000 in a calendar month, and money remittances funded in cash or electronic money above €1,000 per operation or €2,000 a month, within 30 days of the month's end. | The €10,000 calendar month cash line can be written as a no code rule and backtested in a 30, 60 or 90 day window first. |
| Asset freezing | CMF L562-1 onwards; EU sanctions regulations | Screen against EU and national freeze measures; freeze without delay and inform DG Trésor. | Each screening search keeps a record of the user, the search terms, the time and the outcome, empty results as well. |
| Ongoing monitoring (vigilance constante) | CMF L561-6 | Watch the relationship and check transactions against up to date knowledge of the customer. | Monitoring per name starts and stops through API triggers, so names that are no longer relevant stop being screened. |
| Transfers of funds and the crypto travel rule | Regulation (EU) 2023/1113 | Payer and payee data travel with transfers of funds and crypto asset transfers in scope (Article 2 excludes, among others, card payments for goods or services and person to person crypto transfers with no provider); above €1,000 to or from a self hosted address, the CASP checks whether the client owns or controls it. | Transaction screening checks both parties to a transfer, payer and payee, through the API while it is being processed. |
| Record keeping (conservation des documents) | CMF L561-12 | Keep identification documents and transaction records for five years after the account closes, the relationship ends or the transaction is executed. | The search audit trail is the screening part of the file; documents and transaction records stay in the firm's own systems. |
| Training | CMF L561-34, D561-38-1-1 | Train staff on hiring and regularly afterwards on the law and the firm's procedures. | Training stays with the firm; every alert lists the rule behind it and the matching signals, so trainers work from real cases. |
How do CDD, EDD, record keeping and suspicious transaction reporting work in France?
Customer due diligence (vigilance à l'égard de la clientèle) means identifying and verifying the customer and its beneficial owner before the relationship starts (L561-5 allows a later verification in the low risk case the table gives), and knowing what the relationship is for. KYC requirements in France are this row under its English name. Enhanced due diligence (vigilance renforcée) adds checks for PEPs, high risk third countries and unusually complex transactions. Record keeping (conservation des documents) runs five years. The suspicious transaction report (déclaration de soupçon) goes to Tracfin, and the firm holds the transaction until it has reported, except in the three L561-16 cases listed in the table's report row.
Banque Delubac's 2025 sanction shows the gap inspectors look for: accounts closed for LCB-FT reasons without the bank systematically checking whether enhanced review or a report to Tracfin was due.
Which euro thresholds apply in 2026?
The lines come from R561-10 (Décret 2024-1205, in force since 25 December 2024) and from the COSI and cash payment articles. A business relationship needs due diligence at any amount.
- €15,000. Occasional customers (CMF R561-10).
- €10,000. Occasional transactions in cash or electronic money (R561-10); cash deposits or withdrawals in a calendar month, which trigger a COSI (R561-31-2).
- €2,000. Casinos and gaming clubs, per session (R561-10); cash funded remittances in a month (R561-31-1).
- €1,000. Manual currency exchange (change manuel), with no floor when the customer is not physically present (R561-10); one cash funded remittance (R561-31-1); the most a resident may pay a professional in cash (D112-3, €3,000 in electronic money, €10,000 for a non resident individual paying personal expenses).
- No threshold. Money remittances (transmission de fonds), safe deposit box rentals and any operation the firm suspects (R561-10).
How does France apply a risk based approach to AML?
France applies a risk based approach (RBA): the firm classifies its own risks, then sizes its checks to them.
- A written risk classification. Article L561-4-1 asks for one by product, customer, channel and country; every later check refers back to it.
- Simplified measures where risk is low. A lighter file is allowed only when the classification supports it.
- Enhanced measures where risk is high. PEPs, high risk third countries, correspondent relationships and unusually complex transactions (L561-10 to L561-10-3) need more than the standard file.
- Owner checks against the register. Since 3 May 2025 register access turns on a legitimate interest (intérêt légitime, L561-46-2); Décret 2026-310 amended the register's declaration and access articles from 26 April 2026. The firm still checks each ultimate beneficial owner it records against the register entry.
- Monitoring sized to the profile. Constant vigilance (L561-6) compares each transaction with what the firm knows of the customer, so the risk rating decides how closely transactions are watched.
The BRED decision shows step 5 failing: the bank's customer base held incomplete income and turnover data, which left its monitoring scenarios less to compare each transaction with.
Which penalties apply to AML non-compliance in France?
| Offense or breach | Basis | Maximum (in force, November 2026) |
|---|---|---|
| Breach of AML duties by a bank, insurer, payment or electronic money institution | CMF L561-36-1, version of 1 July 2026 | Fine up to the higher of €100 million or 10% of total turnover (€5 million for money changers), with disciplinary measures |
| Breach by a professional under the National Sanctions Commission | CMF L561-40 | Fine up to €5 million |
| Laundering | Criminal Code art. 324-1 and 324-3 | 5 years in prison and €375,000; the fine can rise to half the value laundered |
| Aggravated laundering (habitual, professional or organized group) | Criminal Code art. 324-2 | 10 years in prison and €750,000 |
| Disclosing a report to Tracfin | CMF L574-1 | €22,500 fine |
| Breach of a cash payment limit | CMF L112-7 | Fine up to 5% of the sums paid |
The ACPR's ceiling sits in article L561-36-1 in the version that took effect on 1 July 2026 under Ordonnance 2024-936. In each ACPR decision below, the Sanctions Committee paired the fine with a reprimand (blâme), and it publishes such decisions under the firm's name for five years.
Penalties for non-compliance come from two directions. The disciplinary side punishes the firm's controls. The criminal side goes after the money itself, through prosecutors and courts.
Famous money laundering cases in France
| Firm | Date | Penalty | What was found |
|---|---|---|---|
| UBS AG | 23 Sep 2025 | €730m fine, plus €105m damages to the state | Guilty plea (CRPC) approved in Paris for illegal solicitation and aggravated laundering of tax fraud, after 14 years of proceedings |
| BRED Banque Populaire | 27 Jun 2024 | Reprimand and €2.5m | Accounts left out of automated monitoring, badly set scenarios, thin reasons for closing alerts, missed reports |
| Banque Delubac | 19 Jun 2025 | Reprimand and €600,000 | Monitoring blind spots, slow alert handling, gaps in enhanced checks, internal control and asset freezing |
| Banque Chaabi du Maroc | 7 Nov 2025 | Reprimand and €250,000 | Second ACPR sanction for the bank, after a decision of 2 December 2013 |
The UBS resolution ranks among the biggest AML fines in history. The ACPR amounts are smaller, but each decision names the control that failed.
How do screening and monitoring apply to AML compliance in France?
An ACPR on site inspection reads the firm's own records: which names were screened against which lists, which alert fired and who closed it. complead, formerly Sanction Scanner, is an AI native platform for AML, KYC and fraud. Records of that kind are what it keeps.
In the BRED decision the Sanctions Committee punished weak monitoring scenarios and thin reasons for closing alerts, yet held that the rules at the time of the inspection set no clear duty to filter adverse media automatically. On asset freezing it is stricter: in the Delubac decision it repeated that an effective freeze system is an obligation of result.
Client screening and ongoing monitoring sets fuzzy matching thresholds per list type and per individual list, so a sanctions list can run at a lower threshold, and catch looser spellings, than a watchlist. Sanction Scanner, the screening product, is part of complead. Every name scan is logged, the empty ones too, and monitoring of a PEP or any other name starts and stops through API triggers. Behind each scan lie 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
Asset freezing has no threshold, so a stale list feed is the risk. Pick a name the EU added in the last month. If your own system misses it and the free sanctions check against the EU consolidated list finds it, your feed is behind.
Transaction monitoring runs on a rules engine where the COSI cash line becomes a rule built without code. Agents close the routine cases and attach the evidence, the narrative and the work log to each; the declarant or the analyst decides, and the record shows who.
What changed in French AML in 2025 and 2026, and what comes next?
Recent developments, by date:
- 25 December 2024. The current R561-10 due diligence lines took effect (Décret 2024-1205).
- 30 December 2024. MiCA and the EU transfer of funds regulation, Regulation (EU) 2023/1113, began to apply.
- 3 May 2025. Access to the beneficial owner register narrowed to a legitimate interest.
- 15 June 2025. Loi 2025-532 took effect, extending the laundering presumption to anonymized crypto asset transactions.
- 26 April 2026. Décret 2026-310 amended the register rules, among them the access articles R561-57 to R561-58-7.
- 1 July 2026. The PSAN transition ended, as the AMF reminded firms on 5 February 2026; only firms authorized under MiCA, after the MiCA compliance steps, may serve clients in France.
- 5 August 2026. Loi 2026-725 amended the L561-2 list.
- 8 September 2026. Tracfin's 2025 report: 278,484 suspicion reports, up 32 percent, and its first use of the right to oppose to seize crypto asset funds.
What comes next:
- 10 July 2027. The AML Regulation, Regulation (EU) 2024/1624, applies and caps cash payments at €10,000 across the EU; member states may keep lower limits, so France's €1,000 line stays. AMLD6 (Directive (EU) 2024/1640, not the criminal law 6AMLD of 2018) is due in French law by then, apart from articles due in 2026 and 2029.
- 2028. AMLA begins direct supervision of up to 40 entities.
| Rule | France today (CMF, November 2026) | From 10 July 2027 |
|---|---|---|
| Source of the duties | CMF articles transposing the EU directives | AMLR applies directly in every member state |
| Cash payments | €1,000 for a resident paying a professional (D112-3) | EU cap of €10,000; the lower French line stays |
| Supervision | ACPR, AMF, DGCCRF and professional orders | The same, plus AMLA direct supervision of up to 40 entities from 2028 |
| Crypto asset firms | AMF authorization under MiCA; travel rule since 30 December 2024 | MiCA and the travel rule stay; AMLR duties apply to CASPs as obliged entities |
| Beneficial owner register | Access on a legitimate interest since 3 May 2025 | AMLD6 access rules (Articles 11 to 13 and 15), due in national law by 10 July 2026 |
Which AMLR article takes over each CMF duty on 10 July 2027 is the question a French file has to answer next. The EU AMLR customer due diligence form starts that mapping at the onboarding file.
Download the France AML PDF (2026 edition)
Nothing on this page sits behind the form. The 16 page PDF is for the compliance file: a 14 point checklist that gives the CMF article for each check, a customer risk factor template for France, and a decision record for suspicions the team reviewed and left unreported, with the reason.
