Regulation, enforcement and litigation activities have, again, been prolific this year at the French Financial Market Authority (hereinafter “AMF”), the Prudential and Resolution Control Authority (hereinafter “ACPR”), the Commission Nationale de l’Informatique et des Libertés (hereinafter “CNIL”, French authority overseeing, among others, data processing issues).
The fight against money laundering and terrorist financing: a central priority for Regulators
Regulators in the banking and financial sectors have made anti-money laundering and combating the financing of terrorism (hereinafter “AML/CFT”) a central priority.
In this respect, the ACPR’s Sanctions Committee issued six decisions in 2023, primarily addressed breaches related to AML/CFT and asset freeze. The Sanctions Committee has notably clarified the obligations regarding enhanced scrutiny and the reporting of suspicious activity to Tracfin to prevent frequent misinterpretations.
This Committee issued several noteworthy decisions against banking institutions and insurance companies which were sanctioned for significant. breaches of their AML/CFT obligations. These sanctions included high fines and reprimands, highlighting shortcomings in the systems for monitoring and analyzing transactions, as well as in updating customer knowledge and detecting politically exposed persons (hereinafter “PEPs”). Interestingly, the Committee took into account the remedial actions already undertaken by the entities concerned in each decision.
“The AML/CFT is a recurring and important area of supervision for the AMF”
In 2023, the AMF was also active regarding AML/CFT, and took steps towards the harmonization of supervision practices at a European level, under the impulse of the European Banking Authority (EBA). In addition, the AMF, the ACPR, TRACFIN and the General Directorate of Public Finances (DGFIP) increased their efforts in AML/CFT as well as tax evasion and fraud by implementing the 2022 agreements. The AMF is also committed in the OECD’s assessment on the implementation of the Common Reporting Standard for automatic exchange of tax information, aimed at combating tax evasion, with reports expected by 2025.
In 2023, the AMF also conducted numerous inspections on the AML/CFT framework of asset management companies. These inspections revealed deficiencies in existing procedures, particularly regarding the classification of clients, due diligence, the use of intermediaries and the identification of PEPs and asset freezes. The AMF also found that the internal controls of asset management companies generally needed to be strengthened in AML/CFT matters and reminded that “the AML/CFT is a recurring and important area of supervision for the AMF, which will continue to mobilize its inspection teams and could ultimately lead to sanctions on this issue”.
Moreover, TRACFIN, the French financial intelligence unit responsible for combating concealed financial circuits and AML-CFT, published its “Review 2023 – AML/CFT: activity of reporting professions” on 11 April 2024. The report notes an increase in the transmission of suspicious transaction reports, the financial sector remaining the most abundant source of reports.
To learn more on the issue: Activities of the Financial Markets Authority
Creation of the Anti-Money Laundering Agency or AMLA, an authority dedicated to AML/CFT
In addition, the main new development within the European Union is the creation of an authority dedicated to AML/CFT, the Anti-Money Laundering Agency or AMLA, which will be based in in Frankfurt, Germany and will start its activities in the course of 2025.
This authority was conceived as an EU body with legal personality and capacity. Its mission is to ensure AML/CFT within the EU by implementing its supervisory powers and by contributing to the convergence of supervision across the internal market as well as enhancing cooperation between national financial intelligence units and supervisory authorities.
To learn more on the issue: Overview of the future European authority to combat money-laundering
Data protection is also at the heart of the authorities’ concerns
The Council of Europe recently published guidelines aiming at harmonizing the protection of personal data with AML/CFT requirements. These guidelines underline the importance of respecting the fundamental principles of data protection, particularly the GDPR, in the implementation of AML/CFT obligations, which provide for several situations of personal data processing, primarily based on public interest, defining detailed obligations for data controllers. This extends to the processing of personal data by government authorities that are legally responsible for AML/CFT and have specific powers in this area, but also by private entities for the same public interest purposes and for their own commercial interests.
Furthermore, on 10 May 2023, the Criminal Section of the Cour de Cassation issued five rulings concerning the compliance with European Union law, of French provisions relating to the collection and retention of connection data by AMF investigators. These rulings follow the decisions of the Court of Justice of the European Union (CJEU) of 20 September 2022, whereby it ruled on the legality of these practices in France. The Cour de Cassation ruled that EU law permits the widespread and undifferentiated retention of data due to serious and present threats to national security and access to such data to solve serious criminal offences. The Cour de Cassation also ruled that the AMF may, from the outset of an administrative investigation on potential market abuse, request the rapid preservation of connection data, subject to two criteria: seriousness and necessity, which are assessed on a case-by-case basis.
Cooperation between the CNIL and the French Competition Authority
Additionally, on 12 December 2023, the CNIL and the French Competition Authority reaffirmed their common desire to strike a balance between the protection of consumers’ personal data and the free play of competition, after noting an “intersection” between competition analysis on the one hand and the protection of consumers’ personal data on the other. The two authorities affirmed their commitment to continuing their cooperation and joint discussions in order to guarantee the interests of both consumers and economic players at stake, in particular by offering the latter greater legal certainty with regard to their obligations. In practice, their cooperation takes the form of both formal cooperation (i.e., referrals for opinions) and consultative or litigation framework. Informally, they may also consult each other as part of exploratory exchanges of views on a given topic or for the purpose of undertaking joint studies on subjects of mutual interest.
To learn more on the issue:
