AML & KYC in France: 2026 Update

AML & KYC in France is governed by a dense, multi-layered framework that combines EU directives, national legislation, and sector-specific guidance from several supervisory authorities. France';s anti-money laundering regime is among the strictest in the European Union, and recent regulatory updates have raised the bar further for financial institutions, professional service providers, and digital asset businesses. This guide explains who is subject to French AML and KYC rules, what those rules require in practice, how supervisors enforce them, and what changes are currently reshaping the landscape.

The cornerstone of the French AML framework is the Monetary and Financial Code (Code monétaire et financier), specifically Articles L. 561-1 through L. 561-50, which transpose successive EU Anti-Money Laundering Directives into national law. France has implemented the Fourth, Fifth, and Sixth EU AML Directives, each adding new categories of obliged entities and tightening due diligence requirements.

The Autorité de contrôle prudentiel et de résolution (ACPR) supervises banks, insurance companies, payment institutions, and electronic money institutions. The Autorité des marchés financiers (AMF) oversees investment firms, asset managers, and, increasingly, digital asset service providers (DASPs). The Conseil national des barreaux (CNB) and other professional bodies supervise lawyers, notaries, accountants, and real estate agents under the same statutory framework.

France is a founding member of the Financial Action Task Force (FATF), headquartered in Paris, and its domestic rules closely mirror FATF Recommendations. The country underwent its most recent FATF mutual evaluation in recent years, and the resulting action plan has driven several of the current reforms. Compliance with FATF standards is not merely aspirational in France - it is embedded in binding regulation and enforced through substantial penalties.

A non-obvious requirement is that French law extends AML obligations to a wide range of non-financial professions. Notaries, chartered accountants, statutory auditors, real estate agents, trust and company service providers, and even certain dealers in high-value goods must implement full KYC procedures, file suspicious transaction reports, and maintain records for at least five years.

The list of obliged entities under French law is broad and continues to expand. The core categories include:

• Credit institutions and payment service providers licensed by the ACPR.
• Investment firms, portfolio management companies, and financial advisers supervised by the AMF.
• Insurance undertakings and intermediaries.
• Digital asset service providers (prestataires de services sur actifs numériques, or PSANs) registered or licensed with the AMF.
• Notaries, lawyers, accountants, and auditors when they assist with financial or real estate transactions.
• Real estate agents, property developers, and luxury goods dealers above defined transaction thresholds.

Foreign businesses operating in France, even without a permanent establishment, may fall within the scope of these rules if they provide regulated services to French residents. A common mistake made by international firms is assuming that their home-country compliance programme satisfies French requirements. In practice, French supervisors expect a locally adapted programme that reflects French legal specifics, including French-language record-keeping and reporting to the national financial intelligence unit, Tracfin.

Tracfin (Traitement du renseignement et action contre les circuits financiers clandestins) is the French financial intelligence unit, operating under the Ministry of Economy and Finance. All obliged entities must file suspicious transaction reports (déclarations de soupçon) directly with Tracfin, using its secure online portal. Failure to report is a criminal offence, not merely an administrative infraction.

Customer due diligence (CDD) under French law follows a risk-based approach, as required by the Fifth EU AML Directive and codified in the Monetary and Financial Code. Obliged entities must identify and verify the identity of every customer before establishing a business relationship or executing an occasional transaction above applicable thresholds.

Standard CDD requires collecting the customer';s full name, date and place of birth, nationality, and residential address for natural persons. For legal entities, the obliged entity must identify the company, its registered address, its legal form, and - critically - its beneficial owners. Beneficial ownership is defined as any natural person holding, directly or indirectly, more than 25% of the capital or voting rights, or exercising effective control by other means.

France maintains a national beneficial ownership register (Registre des bénéficiaires effectifs, or RBE), held by the Registre du commerce et des sociétés (RCS). Obliged entities must cross-reference customer declarations against the RBE and document any discrepancies. A common mistake is treating the RBE as a definitive source rather than a starting point - French supervisors expect entities to conduct independent verification and flag inconsistencies to Tracfin where appropriate.

Enhanced due diligence (EDD) applies in higher-risk situations. These include transactions involving politically exposed persons (PEPs), customers or counterparties from high-risk third countries identified on the EU';s AML list, complex or unusually large transactions with no apparent economic rationale, and business relationships conducted entirely at a distance without face-to-face contact.

Simplified due diligence (SDD) is available in limited, prescribed circumstances - for example, for certain low-risk financial products or publicly listed companies subject to disclosure requirements. However, French supervisors have consistently cautioned against over-reliance on SDD, and the ACPR has issued enforcement actions against institutions that applied simplified measures without adequate risk justification.

In practice, founders and compliance officers should consider that French supervisors expect documented risk assessments for every customer segment, not just high-risk ones. The absence of written risk classification is itself a finding in ACPR inspections.

AML & KYC in France is not a one-time onboarding exercise. Obliged entities must monitor business relationships on a continuous basis, updating customer information when circumstances change and scrutinising transactions for patterns inconsistent with the customer';s known profile.

The Monetary and Financial Code requires obliged entities to retain all CDD documentation, transaction records, and correspondence for a minimum of five years from the end of the business relationship or the execution of the transaction. This retention obligation applies regardless of whether a suspicious transaction report was filed. Many entities underestimate the operational burden of maintaining searchable, auditable records across this timeframe, particularly when dealing with large volumes of occasional customers.

Suspicious transaction reporting to Tracfin is mandatory whenever an obliged entity knows, suspects, or has reasonable grounds to suspect that funds are the proceeds of a criminal offence or are connected to terrorist financing. The report must be filed before the transaction is executed where possible, or immediately afterwards if prior filing is impractical. Tipping off the customer about a filed report is a criminal offence under French law.

Internal controls are a distinct obligation. Obliged entities must appoint a senior manager responsible for AML compliance (the "responsable de la conformité LCB-FT"), establish written internal procedures, train all relevant staff at least annually, and conduct periodic independent audits of the AML programme. For larger institutions, the ACPR expects a dedicated compliance function with direct reporting lines to senior management.

If your organisation is building or reviewing its French AML programme, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Several significant developments have recently reshaped AML & KYC in France, and further changes are in progress.

The EU';s new AML package - comprising the AML Regulation (AMLR), the AML Directive 6 (AMLD6), and the regulation establishing the EU Anti-Money Laundering Authority (AMLA) - is being transposed and implemented across member states, including France. AMLA, which will be headquartered in Frankfurt, will take direct supervisory responsibility for the highest-risk financial institutions operating across the EU. French institutions in scope will face dual oversight from both AMLA and the ACPR, requiring alignment of compliance programmes with both French and EU-level expectations.

The AMLR introduces directly applicable rules on customer due diligence, beneficial ownership, and correspondent banking, removing the variation that previously existed between member states'; transpositions of directives. For French obliged entities, this means some existing national rules will be superseded by directly applicable EU law, while others will remain governed by French-specific provisions under AMLD6.

The French DASP regime has also evolved significantly. Digital asset service providers must register with the AMF and comply with full AML obligations under the Monetary and Financial Code. Recent AMF guidance has clarified expectations around blockchain analytics, travel rule compliance for crypto-asset transfers, and the treatment of unhosted wallets. Providers that registered under the earlier, lighter-touch regime are now expected to upgrade their compliance programmes to meet current standards.

The ACPR has increased the frequency and depth of AML inspections across all supervised sectors. Recent enforcement decisions have resulted in substantial financial penalties and, in some cases, public censure. The ACPR has been particularly focused on deficiencies in beneficial ownership verification, inadequate PEP screening, and gaps in transaction monitoring systems.

A practical scenario: a mid-sized French payment institution onboarded a corporate client without independently verifying the beneficial ownership chain beyond the first layer. The RBE showed a single shareholder, but the actual ultimate beneficial owner was a natural person two layers up. During an ACPR inspection, the gap was identified and resulted in a formal finding. The institution was required to remediate its entire corporate onboarding process and invest in enhanced verification tooling.

A second scenario: a foreign law firm advising French clients on real estate transactions assumed its home-country KYC procedures were sufficient. French supervisors found that the firm had not filed any suspicious transaction reports with Tracfin despite handling transactions that met the reporting threshold. The firm was required to appoint a dedicated AML compliance officer and implement a French-law-compliant reporting process.

Non-compliance with AML & KYC obligations in France carries serious consequences. The ACPR can impose administrative sanctions ranging from formal warnings and injunctions to financial penalties and withdrawal of authorisation. Penalties can reach several million euros for significant breaches, and the ACPR publishes enforcement decisions, creating reputational risk alongside financial exposure.

Criminal liability is a distinct risk. The Monetary and Financial Code and the Penal Code both provide for criminal sanctions for money laundering offences, failure to report suspicious transactions, and tipping off. Senior managers and compliance officers can face personal criminal liability, not just the institution.

The ACPR';s supervisory approach is increasingly risk-based and thematic. In recent inspection cycles, the authority has focused on the quality of risk assessments, the effectiveness of transaction monitoring, and the governance of AML programmes at board level. Institutions that treat AML compliance as a box-ticking exercise rather than a genuine risk management function are consistently identified in enforcement actions.

Many underestimate the importance of staff training documentation. The ACPR expects entities to demonstrate not only that training was conducted but that it was tailored to the specific risks faced by the institution and that its effectiveness was assessed. Generic annual e-learning modules are unlikely to satisfy an inspector looking for evidence of a genuine compliance culture.

Tracfin';s annual reports consistently show growth in the volume of suspicious transaction reports received, reflecting both increased awareness among obliged entities and more active supervisory pressure. Entities that file no reports over extended periods are likely to attract scrutiny, as supervisors may question whether the absence of reports reflects genuine low risk or inadequate monitoring.

What are the main differences between standard and enhanced due diligence in France?

Standard CDD applies to most business relationships and requires identity verification, beneficial ownership identification, and an understanding of the purpose of the relationship. Enhanced due diligence applies when the risk assessment identifies elevated risk - for example, with PEPs, customers from high-risk jurisdictions, or complex transactions. EDD requires additional verification steps, senior management approval for the relationship, and more frequent ongoing monitoring. French supervisors expect the decision to apply standard rather than enhanced measures to be documented and justified, not assumed by default.

How long does it typically take to build a compliant AML programme for a new French entity?

The timeline depends heavily on the entity type and complexity. A straightforward payment institution or investment firm can typically implement a basic compliant programme within two to four months, covering written procedures, risk assessments, staff training, and Tracfin reporting setup. More complex organisations - particularly those with cross-border operations or high-risk customer segments - should allow six months or more. The ACPR expects a compliant programme to be in place before the entity begins onboarding customers, not after.

Does a foreign company providing services to French clients need to comply with French AML rules?

The answer depends on the nature of the services and the regulatory perimeter. If the foreign company provides regulated financial services to French residents without a French licence, it may be operating illegally regardless of AML compliance. If it provides professional services - such as legal, accounting, or real estate advice - that fall within the scope of French AML obligations, it must comply with French rules for those activities, including filing suspicious transaction reports with Tracfin. Relying solely on home-country compliance is a common and potentially costly mistake.

France maintains one of the EU';s most demanding AML and KYC regimes, enforced by active supervisors with real appetite for sanctions. The ongoing implementation of the EU AML package will add further obligations and introduce direct EU-level oversight for the largest institutions. Businesses operating in France - whether domestic or foreign - must treat AML compliance as a continuous operational priority, not a one-time setup task.

VLO Law Firms advises international clients on AML & KYC matters in France. We can assist with compliance programme design, beneficial ownership analysis, Tracfin reporting procedures, and regulatory correspondence with the ACPR and AMF. To request a consultation, contact: info@vlolawfirm.com