France: Banking Regulation Comparative Guide

1 Legal framework

1.1 Which legislative and regulatory provisions govern the banking sector in your jurisdiction?

As France is an EU member state, the regulatory framework is in many instances based on EU regulations and directives. The EU Capital Requirements Regulation (575/2013) is particularly important. It sets out the rules for calculating capital requirements, reporting and general obligations for liquidity requirements. Further, the Capital Requirements Directive IV (2013/36/EU) (CRD IV) sets out stronger prudential requirements for banks, requiring them to:

• keep sufficient liquidity and capital reserves; and
• avoid insufficient capital reserves and insufficient short and long-term liquidity.

Additionally, the European Union has actively contributed to developing the Basel Committee on Banking Supervision standards at the Bank for International Settlements on capital, liquidity and leverage. These aim to ensure that major European banking specificities and issues are appropriately addressed. In response to Basel III, the European Union carried out a major overhaul of the existing regulatory framework, which came into effect on 1 January 2014. The rules introduced in the European Union through the CRD IV package therefore respect the balance and ambition of the Basel III framework.

Articles L511-1 and following of the Financial and Monetary Code (FMC) govern the banking sector.

Articles L612-1 and following of the FMC govern the Autorité de contrôle prudential et de résolution (ACPR).

Articles L613-20-1 and following of the FMC govern credit institutions specifically.

The Order of 4 December 2017 governs the approval, changes in status and withdrawal of authorisation of credit institutions.

1.2 Which bilateral and multilateral instruments on banking have effect in your jurisdiction? How is regulatory cooperation and consolidated supervision assured?

The EU Single Supervisory Mechanism (SSM) set out in EU Regulation 1024/2013 was set up as the first pillar of the European banking union, alongside the Single Resolution Mechanism and the European Deposit Insurance Scheme. The three pillars rest on the foundation of a single rulebook, which applies to all EU countries. The European banking supervision mechanism aims to contribute to the safety and soundness of credit institutions and to the stability of the EU financial system by ensuring that banking supervision across the European Union is of a high standard and is consistently applied to all banks.

While retaining ultimate responsibility, the European Central Bank (ECB) carries out its supervisory tasks within the SSM, comprising the ECB and national competent authorities (NCAs) – in France, the Autorité de contrôle prudentiel et de résolution (ACPR). This structure provides for strong and consistent supervision of all relevant entities across the euro area, while making the best use of the local and specific expertise of the national supervisor. Within the SSM – composed of the ECB and NCAs – the ECB carries out its supervisory tasks. The ECB is responsible for the effective and consistent functioning of the SSM, with a view to carrying out effective banking supervision and contributing to the safety and integrity of the banking system and the stability of the financial system.

1.3 Which bodies are responsible for enforcing the applicable laws and regulations? What powers (including sanctions) do they have?

French banks are supervised under the SSM by the ECB and ACPR, or both, and by the Banque de France. The responsibilities of both the ECB and the ACPR depend on the allocation of competencies set out in the SSM. The ECB is competent to supervise all French credit institutions with respect to licensing and assessment of notifications of acquisitions and disposals of qualifying holdings in such credit institutions. Additionally, the ECB is competent for the supervision of credit institutions that are deemed ‘significant', where:

• a credit institution has a total asset value of more than €30 billion;
• total assets exceed €5 billion and the ratio of total assets to French gross domestic product exceeds 20%;
• the ACPR and the ECB mutually decide that the credit institution should be deemed significant;
• the total value of its assets exceeds €5 billion and the ratio between its assets or liabilities in more than one participating member state and its total assets and liabilities exceeds 20%; or
• a credit institution has requested or received financial assistance directly from the European Financial Stability Facility or the European Stability Mechanism (ESM).

As of 2 October 2021, the ECB directly supervises 113 ‘significant' institutions and banking groups in the European Union (including 11 French institutions and banking groups); and supervises member states' regulatory authorities, which directly supervise less significant institutions and banking groups.

Within the framework of the ESM, the ECB can take binding decisions on supervised institutions, such as:

• determination of the importance of the institution;
• determination of capital requirements;
• assessment of the good repute and competence of managers;
• validation of approvals or repurchases of capital instruments; and
• enforcement of measures or sanctions.

Sanctions are intended to penalise the failures of supervised banks. They act as a deterrent for the banks concerned and for the banking sector as a whole. The ECB may impose financial penalties on major banks that violate directly applicable EU law or ECB decisions and regulations.

In the case of violations of national law implementing EU directives or violations by individuals, or where a non-pecuniary sanction is to be imposed, the ECB may require the relevant NCA to initiate the appropriate procedures. The NCA conducts these procedures and decides on the resulting sanctions in accordance with the applicable national law. The ECB can impose financial penalties on banks for non-compliance with EU prudential requirements.

The ECB may impose sanctions of up to:

• 10% of the total annual turnover generated by a bank in the previous financial year; or
• twice the gains or losses avoided by the infringement, where these can be determined.

The ECB will ensure that sanctions are effective, proportionate and dissuasive. In determining the level of such sanctions, the ECB will take into account all material circumstances relating to the infringement and assess its seriousness in light of its impact and the fault of the bank. The ECB also takes into account any aggravating or mitigating circumstances (eg, unwillingness to cooperate with the ECB in the exercise of its investigative powers or the bank's own initiative to take remedial action).

The ECB's independent investigation unit is responsible for conducting investigations into alleged breaches by major banks supervised by the ECB of directly applicable EU law and ECB supervisory decisions or regulations.

The Independent Investigation Unit may exercise the powers conferred on the ECB by the ESM Regulation (requesting documents or explanations, examining books and records, and conducting interviews and on-site inspections). It may also request information internally and from the NCAs; and may issue instructions to the NCAs to use their investigative powers under national law.

As a result of its investigations, the Independent Investigation Unit may initiate sanction proceedings by sending a statement of objections to the supervised bank concerned. The supervised bank will be given the opportunity to comment on the facts and objections raised by the investigation unit and on the proposed amount of the fine.

If, on the basis of its initial analysis of the facts, the evidence gathered and the written documents submitted by the bank, the Independent Investigation Unit considers that an administrative sanction should be imposed, it will submit a proposal for a complete draft decision to the Prudential Supervisory Board.

The Prudential Supervisory Board – which includes a chairman and a vice-chairman, a representative of each NCA and four representatives of the ECB – plans the supervisory tasks of the ESM and prepares decisions. These decisions are then adopted by the governing council.

The credit institutions concerned may refer to the Administrative Board of Review to request a review of a decision concerning them, prior to the adoption of the final version of that decision. They naturally retain their right to appeal to the Court of Justice of the European Union.

Whether or not ECB decisions imposing sanctions have been challenged before the Administrative Review Commission, they are published on the ECB's banking supervision website.

ECB decisions imposing sanctions are published on the ECB's banking supervision website. In exceptional cases, however, the publication of sanctions may be made anonymous or postponed.

The ACPR takes an active part in the work of direct supervision, at several levels:

• It is in charge of the direct supervision of smaller institutions, under the indirect control of the ECB;
• It continues to provide the bulk of the joint supervisory teams for large French institutions;
• It is involved in the definition and implementation of common procedures and is the main point of entry for French institutions on many subjects;
• It is involved, like the other NCAs, in structuring work and decisions – particularly in terms of methodology and supervisory approach – alongside the ECB's horizontal divisions; and
• Its representative sits on the supervisory board and the governing council, the ESM's decision-making bodies.

The ACPR is thus actively involved in the supervision of the largest European banks.

The ACPR also retains exclusive jurisdiction over certain supervisory tasks that remain outside the scope of the CRD IV Directive (2013/36/EU), such as:

• customer protection;
• the fight against money laundering and terrorist financing; and
• the implementation of the law on the separation of banking activities.

The ACPR has three missions:

• Preserve the stability of the financial system: According to Article L612-1 of the FMC, the ACPR is responsible for ensuring the stability of the financial system. This involves the following responsibilities, among others:
• • issuing the necessary approvals and authorisations to banking and insurance institutions operating in France. Directive 2014/59/EC, incorporated in Article R613-14 of the FMC, provides that a decision submitting a person to the jurisdiction of the ACPR to collective proceedings may be taken only with the ACPR's consent;
  • conducting ongoing surveillance of the financial situation and operating conditions of the legal entities under its supervision and, more specifically, monitoring compliance with solvency and liquidity requirements;
  • ensuring that the entities under its supervision comply with the applicable rules, including by enforcing sanctions; and
  • developing and implementing measures for the prevention and resolution of banking crises, in order to preserve financial stability, ensure the continuity of the activities, services and operations of institutions whose failure would have a systemic effect – that is, serious consequences for the economy, and to protect depositors and avoid or limit as much as possible the need for public support.
• Protecting the customers of banking and insurance institutions: The ACPR ensures that the companies under its supervision comply with all rules designed to protect customers. It also checks the procedures and means implemented by organisations to ensure compliance.
• Representing French supervision abroad: The ACPR is responsible for representing French supervision in international and European insurance and banking bodies, in cooperation with the Banque de France and the relevant government departments. As such, the ACPR contributes to the achievement of financial stability objectives in Europe and to the harmonisation of national and European supervisory practices.

Chaired by the governor of the Banque de France, to which it is attached, the ACPR has three decision-making bodies:

• Supervisory Board: The full college deals with general supervision issues common to the banking and insurance sectors. It analyses the risks of the two sectors in light of the economic situation. It is responsible for determining the principles of organisation, operation and budget, as well as the internal regulations of the ACPR. Two sub-colleges are foreseen – one for the banking sector, the other for insurance – each composed of eight members. The restricted formation of the supervisory board deals with individual issues likely to have a significant effect on the two sectors or on financial stability as a whole.
• Resolution Board: The resolution college, set up by Law 2013-672 and chaired by the governor of the Banque de France, is composed of six members. The college must oversee the development and implementation of measures to prevent and resolve banking crises.
• Enforcement Committee: The Enforcement Committee punishes various breaches of the legal and regulatory provisions applicable to institutions subject to ACPR supervision. It is independent of the two aforementioned ACPR boards which are in charge of prosecution functions.

The initiation of disciplinary proceedings – which is the sole responsibility of the ACPR's Supervisory Board or Resolution Board – may occur in three cases:

• in light of the conclusions of reports drawn up following on-site inspections decided by the secretary general of the ACPR;
• in light of the findings of an off-site inspection by the ACPR's departments; and
• at the request of the ECB, where the alleged offences do not fall within the ECB's power to impose sanctions. When the ECB refers a matter to the ACPR, the Supervisory Board must initiate proceedings.

When the competent panel of the board decides to initiate disciplinary proceedings, its chairman will notify the persons concerned of the grievances and, at the same time, refer the matter to the Enforcement Committee by sending it notification of the grievances (Article L612-38 of the FMC).

The chairman of the Enforcement Committee appoints a rapporteur from among the members of the committee, whose duties are similar to those of an investigating judge.

During this pre-hearing investigation phase, the rapporteur ensures that the disciplinary proceedings are conducted in an adversarial manner between the parties:

• on the one hand, the board – the prosecuting authority, which intervenes through the representative it has appointed; and
• on the other hand, the accused person(s), assisted, where appropriate, by counsel (Article L612-38 of the FMC).

The penalties incurred by persons subject to the supervision of the ACPR are:

• a warning;
• a reprimand;
• a ban on carrying out certain operations for a maximum period of 10 years;
• temporary suspension of managers for a maximum period of 10 years;
• the compulsory resignation of managers;
• partial or total withdrawal of approval or authorisation; or
• removal from the list of approved persons.

Instead of, or in addition to, these sanctions, a financial penalty of up to €100 million may be imposed (Articles L612-39 and L612-41 of the FMC). With respect to the fight against money laundering and terrorist financing, assets and unpaid life insurance contracts can be frozen; and an alternative ceiling of 10% of annual net sales is provided for most categories of reporting entities (Article L561-36-1, IV of the FMC). A fine of €5 million may also be imposed on the effective managers and persons who have direct and personal responsibility for the implementation of the anti-money laundering/counter-terrorist financing system.

In prudential matters, for credit institutions and financial companies, the maximum penalty is set at:

• 10% of the annual net turnover; or
• if it can be determined, twice the amount of the benefit derived from the breach; and
• €5 million for natural persons who are effective managers (Article L612-40 of the FMC).

In terms of financial stability, the Banque de France has a dual responsibility of protection and supervision:

• It is in charge of strengthening regulation and risk prevention, as well as ensuring the security of savers' deposits; and
• Together with the ACPR, it:
• • supervises financial sector companies (777 banking institutions, 827 insurance companies and mutual insurers);
  • ensures the proper functioning of payment systems and market infrastructure; and
  • regularly assesses the risks and vulnerabilities of the financial system.

The ACPR is an administrative authority; and the FMC establishes its independence for the exercise of its missions and its financial autonomy. In its operations, the ACPR is backed by the Banque de France, which provides it with resources – particularly human and IT resources.

1.4 What are the current priorities of regulators and how does the regulator engage with the banking sector?

According to Article L612-1, IV of the FMC, in order to carry out its missions, the ACPR has, with respect to the persons under its supervision:

• the power to carry out inspections;
• the power to take administrative enforcement measures; and
• the power to impose sanctions.

This power of sanction is exercised against persons and for acts falling within the scope of its control at the date of commission of the failure or infringement. It may also make public any information it deems necessary for the performance of its duties, without being bound by the professional secrecy mentioned in Article L612-17 of the FMC. With respect to credit institutions, financial holding companies and mixed financial holding companies, the ACPR must exercise its powers of authorisation and prudential supervision as provided for in the FMC without prejudice to the powers conferred on the ECB by EU Regulation 1024/2013.

For the implementation of the Single Supervisory Mechanism established by the abovementioned regulation, the ACPR is the competent national authority for France. In this capacity, it assists the ECB in carrying out the prudential supervision tasks entrusted to it by this regulation.

2 Form and structure

2.1 What types of banks are typically found in your jurisdiction?

There are a multitude of credit institutions subject to different licensing requirements and legal regimes. Article L511-9 of the Financial and Monetary Code (FMC) specifies that: "credit institutions are authorized as banks (banques), mutual or cooperative banks (banques mutualistes ou cooperatives), municipal credit unions (caisses de crédit municipal), financial companies (sociétés financières) or specialized financial institutions (institutions financières spécialisées)." Savings and provident institutions (caisses d'épargne et de prévoyance) may be added to this list.

Banks: Banks have the particularity of being able to carry out all banking operations (Article L511-9 of the FMC). As previously stated, this ‘universal' banking status allows banks to:

• receive funds from the public;
• carry out credit operations; and
• provide or manage means of payment.
  

These banks may be public or private. Most of them are ‘network' banks, which have a national or local network of branches; but they may also be head office banks, which have no branches other than their head office. Moreover, while some banks have a truly generalist vocation, there are still many ‘specialised' banks. For example, some investment banks continue to specialise in financial operations involving shareholdings or in financial engineering. They are likely to play an important role in mergers and acquisitions.

Mutual and cooperative banks: Mutual banks have a general competence. Indeed, Article L511-9 of the FMC expressly provides that mutual and cooperative banks are authorised to receive funds from the public at sight or with a term of less than two years. Furthermore, they may "carry out all banking operations in compliance with the limitations resulting from the legislative and regulatory texts that govern them". Originally conceived to fulfil social functions, these banks have gradually moved away from their primary vocation, without losing their specificity. Today, their activity is similar to that of other banks. The main mutual or cooperative networks are the banques populaires, the Crédit Mutuel, the Crédit Agricole, the Crédit Maritime Mutuel and the sociétés coopératives de banque.

La Poste: Under Article L518-25 of the FMC:

in the fields of banking, finance and insurance, La Poste offers products and services to the greatest number of people, in particular the Livret A. To this end ..., La Poste shall create, under the conditions defined by the applicable legislation, any subsidiary with the status of credit institution, investment company or insurance company and shall directly or indirectly take any equity interest in such institutions or companies. It may enter into any agreement with such institutions or undertakings with a view to offering, in their name and on their behalf and in compliance with the rules of competition, any service contributing to the achievement of their purpose

This refers, in particular, to any service relating to banking and related operations and investment services and their related services. This article broadens the scope of La Poste's activities. However, these activities can only be carried out by subsidiaries of La Poste that have a common law status with regard to banking regulations. Taking note of this new provision, La Poste has spun off its financial services.

La Banque Postale is a public limited company with a management board and supervisory board, with bank status, and is a wholly owned subsidiary of La Poste. This new institution will be able to use La Poste's staff and the post office network for its commercial activity under service agreements.

Caisses d'épargne et de prévoyance: The organisation and status of the organisations that make up the caisses d'epargne et de prévoyance network are now the result of Act 99-532 on savings and financial security. Under the terms of Article L512-85 of the FMC, the network fulfils missions of general interest. Its purpose is to promote and collect savings and to develop provident savings, especially to meet collective and family needs. In addition, these organisations have a mission to contribute to the protection of popular savings and to the collection of funds for the financing of social housing.

At the head of the caisses d'épargne et de prévoyance network is the caisse nationale des caisses d'épargne et de prévoyance (the national institution), which is the central body of the network. It is a public limited company with a board of directors and a supervisory board, in which the caisses d'épargne et de prévoyance together hold at least an absolute majority of the capital and voting rights. Its various functions are set out in Article L512-95 of the FMC. In particular, it is responsible for:

• representing the caisses d'epargne et de prévoyance network in order to assert its rights and interests;
• drawing up the standard articles of association for caisses d'épargne et de prévoyance and local caisses d'épargne;
• carrying out all financial transactions useful for the development and refinancing of the network; and
• ensuring that the caisses d'épargne carry out the public interest missions that they must fulfill.

The caisses d'épargne et de prévoyance are at the heart of the network. These are regional credit institutions which, since the enactment of Law 99-532 on savings and financial security, have been subject to cooperative status. These funds are managed by a board of directors, under the supervision of a supervisory board, which is called the orientation and supervisory board (Article L512-90 of the FMC). This board is composed of 17 members, including:

• employee representatives;
• members elected by local authorities; and
• members elected by the general meeting of members.

The share capital of the caisses d'épargne et de prévoyance is held entirely by the local caisses d'épargne.

The local caisses d'épargne were created by the aforementioned 1999 law. Their status is defined in Articles L512-92 and L512-93 of the FMC. They are cooperative companies that contribute to the development of the policies of the caisses d'épargne et de prévoyance to which they are affiliated. However, local caisses d'épargne are not authorised to carry out banking transactions.

Caisses de crédit municipal: The caisses de crédit municipal are public credit institutions whose main mission is to grant loans against guarantees on tangible assets. They also have a monopoly on this activity. The regulations applicable to them are currently set out in Articles L514-1 and following of the FMC.

The caisses de crédit municipal may also:

• carry out all transactions with credit institutions;
• receive funds from natural or legal persons;
• provide these persons with means of payment; and
• carry out related transactions with them within the meaning of Article L311-2 of the FMC.

In addition, when granting loans to individuals, caisses de crédit municipal are not subject to consumer law.

Sociétés financières: Finance companies are specialised credit institutions. They have limited capacity since, under the terms of Article L515-1 of the FMC, they "may not receive funds from the public at sight or with a term of less than two years, unless they are authorized to do so on an ancillary basis in accordance with the conditions defined by the Minister in charge of the economy". Thus, the financing of their activity can only be ensured through their own capital or through loans from other credit institutions. For this reason in particular, they are often subsidiaries of banking groups. Among the financial companies that carry out financial transactions resulting from an authorisation are, for example, credit sales financing institutions, leasing companies and factoring companies. Finance companies authorised to carry out banking operations resulting from legislative and regulatory provisions include mutual guarantee companies and overseas credit companies. The FMC devotes a set of provisions to three essential categories of financial companies:

• equipment and real estate leasing companies;
• mutual guarantee companies; and
• land finance companies.

Institutions financières spécialisées: Specialised financial institutions constitute a residual category. This term covers credit institutions to which the state has entrusted a permanent mission of public interest (Article L516-1 of the FMC). These institutions have a limited capacity, since they cannot carry out banking operations other than those related to their mission, except on an accessory basis. Article L516-2 of the FMC adds that these specialised credit institutions may not receive funds from the public at sight or with a term of less than two years, "unless they are authorised to do so on an ancillary basis in accordance with the conditions defined by the minister in charge of the economy". They therefore raise funds either by issuing bonds and long-term loans or by borrowing on the interbank market.

The financial institutions were most often created by the state, even if they often take the form of limited companies. Among the specialised financial institutions, mention may be made of:

• the Banque de développement des PME;
• the Caisse française de développement;
• the Caisse de garantie du logement social;
• the Crédit foncier de France;
• Dexia; and
• the regional development companies.

2.2 How are these banks typically structured?

The law does not impose a specific corporate form. It is intended to govern credit institutions with a wide variety of legal statuses: commercial companies, civil companies, cooperatives and public institutions.

However, Article L511-10 of the FMC leaves it up to the Autorité de contrôle prudential et de résolution (ACPR) to verify that the form of the company is consistent with the activity of a credit institution.

Unless otherwise provided, the Commercial Code applies to credit institutions incorporated as commercial companies.

Banking operations include:

• the receipt of funds repayable from the public;
• credit transactions; and
• payment banking services (Article L311-1 of the FMC).

Concerning the cooperative company specifically, it adopts one of the forms of company established either by the Civil Code or by the Commercial Code. Most credit cooperatives do not fit exclusively into one of the civil or commercial company forms. They are governed by autonomous provisions, sui generis articles of association. There is therefore a variety of articles of associations for cooperative banks and a great deal of room for statutory provisions in order to retain the most appropriate operating rules.

The adoption of the status of cooperative bank leads to the application of cooperative principles. Article 3 of the Law of 10 September 1947, states that "the cooperatives cannot admit third parties who are not members to benefit from their services". Also, cooperatives are governed by a democratic management symbolised by the formula ‘one man, one vote'. Finally, cooperatives have a non-lucrative goal which must induce a limitation of the distribution of profits to the members. These principles are sometimes abused in credit cooperatives, which are generally authorised to receive deposits from any person other than the members (Articles L512-2 and L512-55 of the FMC). Similarly, derogations from the cooperative principle of ‘one man, one vote' are also noted (Articles L512-5 and L512-89 of the FMC).

The cooperative and mutual banks are thus subject to an embryo of common regulation, which stems mainly from the specific rules that must be respected in order to carry out banking activities, as well as from their cooperative form. However, the main part remains specific to each type of cooperative or mutual bank.

2.3 Are there any restrictions on foreign ownership of banks?

Financial relations between France and foreign countries are free. As an exception, in a limited number of sectors related to national defence or likely to jeopardise public order and activities that are essential to guaranteeing the country's interests, Article L151-3 of the FMC requires prior authorisation for foreign investments.

If a company wishes to acquire, increase or reduce a holding in a credit institution, finance company, investment firm, payment institution or electronic money institution, it must submit an application for prior authorisation to the ACPR in the following cases:

• acquisition of effective power of control over the management of the institution; and
• acquisition of one-third, one-fifth or one-tenth of the voting rights in the institution.

For other changes in the shareholding of a company subject to ACPR supervision, the regulations only provide for a declaration to the ACPR. In certain cases, however, the college has the power to re-examine the situation of the supervised company.

In the case of a change in the shareholding of a credit institution, the request for prior authorisation is examined by the ACPR and then forwarded to the European Central Bank for a final decision within the framework of the Single Supervisory Mechanism.

Prior authorisation is required in the event of the acquisition or extension of a direct or indirect shareholding by a person acting alone or in concert with other persons with a view to acquiring effective control or acquiring one-third, one-fifth or one-tenth of the voting rights.

In the event of a direct or indirect reduction or transfer of shareholding by a person acting alone or in concert with other persons resulting in the loss of effective control or of one-third, one-fifth or one-tenth of the voting rights, only a declaration is required for credit institutions.

In the case of changes in the rules for calculating voting rights, only a declaration is required.

In the case of changes in the amount of capital of companies with fixed capital, only a declaration is required, except in the case of a reduction in equity capital, in which case an authorisation is required.

Request for prior authorisation: As a shareholder or future shareholder, you must:

• contact the Secretariat of the Authorisations Department (contactautorisations@acpr.banque-france.fr) in order to present your project and to examine the provisional timetable for its implementation (see below); and
• complete the corresponding application form together with all supporting documents, ensuring that all requests for information required by the EU Commission Delegated Regulation (2017/1946) are submitted using the appropriate sections of the form or by means of annexes to be added to the form, and submit it to the ACPR's Authorisations portal.

The criteria are as follows, in application of Articles L511-12-1, L511-51, R511-3-1 and R511-3-2 of the FMC:

• reputation of the candidate purchaser;
• reputation and experience/competence of any person who, as a result of the proposed acquisition, will effectively manage the business or hold a corporate office in the management body responsible for supervising the effective management of the reporting institution;
• reputation and experience/competence of the heads of key functions (internal control, risk management, compliance) of credit institutions, finance companies and investment firms;
• financial soundness of the proposed acquirer, taking into account in particular the type of activities carried out and envisaged within the reporting institution targeted by the proposed acquisition;
• the ability of the reporting institution to meet and continue to meet prudential requirements – in particular, whether the group to which it will belong has a structure that allows for effective supervision, effective exchange of information between competent authorities and determination of the division of responsibilities between competent authorities if necessary; and
• whether there are reasonable grounds to suspect that money laundering or terrorist financing is being or has been committed or attempted in connection with the proposed acquisition, or that the proposed acquisition could increase the risk thereof.

Declaration: As a shareholder, immediately after completion of the transaction (except in the case where prior notification is required), you must communicate to the Authorisations Department, via the ACPR's Authorisations portal, a document which indicates the exact terms of the transaction carried out. In the event of a loss of control or sale of a qualifying holding in a credit institution, finance company or investment firm, the ACPR will verify that this transaction does not impact the authorisation granted to the institution concerned.

2.4 Can banks with a foreign headquarters operate in your jurisdiction on the basis of their foreign licence?

Banks that are headquartered and licensed in the European Economic Area (EAA) can conduct regulated banking business in France without a French banking licence under the EU notification procedure, through a branch or on a cross-border basis.

Other foreign banks can either:

• conduct banking business in France through a branch (which is, however, subject to the full licensing requirements); or
• apply to the ACPR for an exemption from the licensing requirements to provide cross-border services, provided that the bank is effectively supervised in its home country under internationally recognised standards.

3 Authorisation

3.1 What licences are required to provide banking services in your jurisdiction? What activities do they cover?

If one wishes to carry out banking activities (granting loans and collecting repayable funds from the public), one must submit an application for authorisation as a credit institution to the Autorité de contrôle prudential et de résolution (ACPR), which will notify the European Central Bank (ECB).

If one also wishes to provide investment services, one must apply for authorisation as a credit institution providing investment services. Depending on the investment services envisaged, the Autorité des marchés financiers will be asked to send its observations to the ACPR or to approve the programme of activities.

In case of illegal practice of the profession of banker, the perpetrator may face civil, criminal and disciplinary sanctions.

According to Article L571-3 of the Financial and Monetary Code (FMC), anyone who fails to comply with one of the prohibitions set forth in Article L511-5 of the FMC is punishable by three years' imprisonment and a fine of €375,000. Legal entities may be fined up to five times the amount provided for natural persons guilty of the same offence.

Paragraph 2 of Article L571-3 provides that the court may order the posting or dissemination of the decision pronounced under the conditions provided for in Article 131-35 of the Penal Code. Concerning legal entities, Article L571-1 of the FMC indicates that they are also subject to the additional penalties provided for in Article 131-39 of the Penal Code.

Non-compliance with the banking monopoly may give rise to an intervention by the ACPR. In addition to the supervisor's power to impose sanctions, Article L613-24 of the FMC provides that: "when a company ... violates one of the prohibitions defined in article L511-5 ..., the Autorité de contrôle prudentiel et de résolution may, under the conditions provided for in article L612-35, appoint a liquidator to whom all the powers of administration, management and representation of the legal person are transferred."

3.2 What requirements must be satisfied to obtain a licence?

In order to issue an authorisation to a credit institution, the ACPR and the ECB verify the following elements:

• the adequacy of the legal form to the contemplated activity;
• the minimum paid-up capital;
• the programme of activity and technical and financial means implemented;
• its organisation;
• the identity and quality of the capital contributors and, if necessary, of their guarantors, and the amount of their participation;
• the central administration, located in the same national territory as the registered office;
• the effective management of the activity by at least two persons whose knowledge, experience, competence and availability are established, individually and collectively, and who are of good repute for their function;
• the social body whose members have the knowledge, experience and competence, assessed individually and collectively, as well as the availability and good repute necessary for their function;
• the persons in charge of key functions meeting the requirements of good repute, knowledge, experience and skills; and
• assets that exceed its liabilities by an amount at least equal to the minimum capital requirement.

For banks, mutual or cooperative banks, savings and provident institutions, the paid-up capital or the endowment paid in must be at least €5 million. This minimum requirement is reduced to:

• €2.2 million for:
• • municipal credit banks, provided that they have undertaken in their articles of association not to collect funds from the public and to limit their assistance to the granting of loans against tangible collateral and credit to natural persons; and
  • finance companies, other than those referred to below;
• €1.1 million for:
• • municipal credit banks that limit their activity to loans against guarantee on tangible assets;
  • financial companies whose authorisation is limited to the exercise of guarantee operations; and
  • financial companies whose banking operations are limited to the exercise of cashless exchange operations, including a credit operation; and
• €1 million for electronic money institutions, as defined in Article 2 of Regulation 2002-13. The value of electronic money units incorporated in an instrument issued by these institutions may not exceed €150 at any time.

The ACPR may limit the approval it grants to the performance of certain operations defined by the corporate purpose of the applicant (Article L511-10 of the FMC). It may refuse to grant approval if the exercise of the applicant's supervisory functions is likely to be hindered by:

• the existence of direct or indirect capital or control links between the company and other natural or legal persons; or
• the existence of legislative or regulatory provisions of a state that is not a party to the Agreement on the European Economic Area and to which one or more of these persons belong (Article L511-10 of the FMC).

3.3 What is the procedure for obtaining a licence? How long does this typically take?

Prior to the start of activities, you must:

• contact the Secretariat of the Authorisation Department (contactautorisations@acpr.banque-france.fr) to present the project and examine the provisional timetable for its implementation; and
• fill in and submit the application form for the requested approval in the portal (https://acpr-autorisations.banque-france.fr/), together with all supporting documents:
• • credit institution not providing investment services (https://acpr.banque-france.fr/sites/default/files/form_agrement_ec_non_psi_2019.docx); and
  • credit institution providing investment services (https://acpr.banque-france.fr/sites/default/files/form_agrement_ec_psi_2019.docx)

After receiving your application, the Authorisation Department will proceed with its examination. Authorisation as a credit institution is granted by the ECB on the basis of a draft decision transmitted by the ACPR. This authorisation decision must be taken within six months of receipt of a complete application. If the application is incomplete, additional information may be requested and the review period extended. The total period allowed to the ECB is 12 months from the receipt of the initial application.

4 Regulatory capital and liquidity

4.1 How are banks typically funded in your jurisdiction?

Mutual and cooperative banks and local savings and provident institutions as defined in question 2.1 refinance themselves with the head institutions. The latter are financed on the market (eg, bond issues, listed market)

With regard to deposit banks specifically, they are financed through deposits made by depositors and on the markets.

Finance companies and specialised finance companies finance themselves on the markets.

4.2 What minimum capital requirements apply to banks in your jurisdiction?

The Capital Requirements Regulations (CRR) I and II, which are directly applicable in all EU member states, lay down prudential requirements for capital, liquidity and credit risk for investment firms and credit institutions. The regulations require banks to have set aside enough capital to cover unexpected losses and keep themselves solvent in a crisis. As a main principle, the amount of capital required depends on the risk attached to the assets of a particular bank.

The CRRs provide for risk-weighted assets. This concept means that safer assets are attributed a lower allocation of capital, while riskier assets are given a higher risk weight. In other words, the riskier the assets, the more capital the bank must set aside.

The capital is assigned certain grades according to its quality and risk:

• Tier 1 capital is considered to be going concern capital. The going concern capital allows a bank to continue its activities and keeps it solvent. The highest quality of Tier 1 capital is called common equity tier 1 capital.
• Tier 2 capital is considered to be gone concern capital. The gone concern capital allows an institution to repay depositors and senior creditors if a bank becomes insolvent.

The total amount of capital that banks and investment firms must hold should be equal to at least 8% of their risk-weighted assets. The share that must be of the highest quality capital – common equity tier 1 – should make up 4.5% of the risk-weighted assets.

Credit institutions must hold sufficient liquid assets to cover net liquidity outflows under gravely stressed conditions over a period of 30 days. The liquidity coverage ratio – unencumbered high-quality assets against net cash outflows over a 30-day stress period – must be equal to 100%. The minimum amount of liquid assets that a bank must hold should be equal to 25% of outflows.

Leverage is the relationship between a bank's capital base and its total assets. A bank's assets are ‘leveraged' when they exceed its capital base. The regulation aims to reduce excessive leverage, because it may have a negative effect on banks' solvency. Banks must avoid excessive leverage and disclose their leverage ratio (which is a bank's tier 1 capital divided by its average total consolidated assets). The ratio is an indication of how well the bank is prepared to meet its long-term financial obligations.

In addition to the mandatory amount of 4.5% of common equity tier 1 capital requirement set out in CRR I and II, all banks must hold a capital conservation buffer and a countercyclical capital buffer, to ensure that they accumulate a sufficient capital base in prosperous times to enable them to absorb losses in the event of a crisis (Articles L631-2-1, L511-41-1 A and L533-2-1 of the FMC). More specifically, the following requirements apply:

• A bank must hold a capital conservation buffer of the highest quality of its capital (common equity tier 1 capital) equal to 2.5% of its total risk exposure. The purpose of the buffer is to conserve the bank's capital. If the bank does not comply with this buffer, it will have to limit or stop payments of dividends or bonuses.
• The countercyclical capital buffer is a prudential tool introduced by the Basel III Agreement to counteract the effects of the economic cycle on banks' lending activity. It requires a bank to have an additional amount of capital (common equity tier 1) in good times, when credit growth is strong; so that when the economic cycle turns, and economic activity slows down or even contracts, this buffer can be released to allow the bank to keep lending to the real economy. If a bank breaches this requirement, the same rules as in the case of the capital conservation buffer apply.
• The systemic risk buffer is one of the macroprudential measures that the High Council for Financial Stability (HCFS) can adopt to prevent risks to financial stability and consists of a strengthening of the capital requirements of banking institutions. The HCFS has the right to require banks to hold a systemic risk buffer of common equity tier 1 capital. The requirement may be applied to the entire financial sector or its separate parts. The aim is to prevent and mitigate long-term non-cyclical systemic or macro-prudential risks which may have serious negative consequences for the real economy. The setting of buffer rates of between 3% and 5% requires the notification of:
• • the European Commission;
  • the European Banking Authority; and
  • the European Systemic Risk Board.

Buffer rates above 5% must be authorised by the European Commission.

• The global systemically important institutions buffer is mandatory for banks that are identified by the relevant authority as ‘global systemically important institutions' (G-SIIs), to compensate for the higher risk they pose to the global financial system and for potential impact of their failure. The systemic importance of a bank is determined according to global systemically important financial institution criteria agreed by the G-20. The criteria include the bank's size, cross-border activities and interconnectedness. The S-GII mandatory surcharge ranges between 1% and 3.5% of common equity tier 1 capital of risk-weighted assets, depending on the systemic importance of the institution.
• The Capital Requirements Directive provides for a buffer to include domestically important institutions as well as institutions of EU importance. For ‘other systemically important institutions', a notification and justification procedure as well as an upper limit to the size of the buffer (2% of risk-weighted assets) are determined according to a set of criteria defined in the directive.

4.3 What legal reserve requirements apply to banks in your jurisdiction?

The European Central Bank (ECB) requires French credit institutions to hold compulsory deposits on accounts with the Banque de France. These are called ‘minimum' or ‘required' reserves, and the amount to be held by each institution is determined by its reserve base.

In order to determine an institution's reserve requirement, the reserve base is multiplied by the reserve ratio. The ECB applies a uniform positive reserve ratio to most of the balance-sheet items included in the reserve base. This reserve ratio was set at 2% at the start of Stage 3 of European Economic and Monetary Union and was lowered to 1% from 18 January 2012. The reserve requirement for each individual institution is calculated by applying the reserve ratio to the reserve base. Institutions must deduct a uniform lump-sum allowance of €100,000 from their reserve requirement. This allowance is designed to reduce the administrative costs arising from managing very small reserve requirements.

In order to meet their reserve requirements, French credit institutions must hold balances on their current accounts with the Banque de France. This means that compliance with minimum reserve requirements is determined on the basis of the average daily balances on the counterparties' reserve accounts over one reserve maintenance period. Data on the amount of required minimum reserves and their fulfilment is published in the statistical section of the Monthly Report of the Banque de France.

5 Supervision of banking groups

5.1 What requirements apply with regard to the supervision of banking groups in your jurisdiction?

The European Central Bank (ECB) and the Autorité de contrôle prudential et de résolution (ACPR) supervise banking groups as well as individual institutions. A group generally falls under the jurisdiction of the ECB or ACPR if:

• the parent undertaking is a credit institution incorporated in France; or
• the parent undertaking is a financial holding company or a mixed financial holding company, and:
• • both the holding company and the bank subsidiary are incorporated in France; or
  • the holding company is incorporated in another EU member state and the French subsidiary is subject to consolidated supervision in accordance with the EU Capital Requirements Directive IV.

Requirements: The most important requirement is that the minimum regulatory capital standards also be maintained at group level. For this purpose, the regulatory capital and risk-weighted assets of individual institutions and group members are consolidated. Although each institution in a group may be sufficiently capitalised, consolidation of group capital may produce a regulatory capital gap – in particular, if the group includes entities that are not subject to the same capital adequacy rules as banks on a solo basis, but that incur risks that must be covered by the own funds of the consolidated group.

The credit institution at the top of the group or, in the case of a group headed by a financial holding company or a mixed financial holding company, the largest subsidiary credit institution in the group is generally responsible to the supervisory authority for ensuring that the group has sufficient regulatory capital.

Similar rules apply to financial conglomerates. These groups include financial institutions and insurance companies.

5.2 How are systemically important banks supervised in your jurisdiction?

France is part of the Single Supervisory Mechanism established in all EU member states. Its purpose is to centralise the prudential supervision of banks. In particular, the ECB:

• directly supervises 113 institutions and banking groups in the European Union that are considered significant; and
• supervises member states' regulatory authorities that directly supervise less significant institutions and banking groups.

In France, day-to-day supervision is conducted by joint supervisory teams, which comprise staff from both the ACPR and the ECB. The ACPR continues to conduct the direct supervision of less significant institutions, subject to the oversight of the ECB. The ECB can also take on the direct supervision of less significant institutions if this is necessary to ensure the consistent application of high supervisory standards. The ECB is also involved in the supervision of cross-border institutions and groups, as either a home supervisor or a host supervisor in colleges of supervisors. Moreover, the ECB participates in the supplementary supervision of financial conglomerates in relation to the credit institutions included in a conglomerate and assumes the responsibilities of the coordinator referred to in the Financial Conglomerates Directive.

5.3 What is the role of the central bank?

The French national central bank is the Banque de France. In banking supervision, the Banque de France works in close cooperation with the ACPR and the ECB. Because of its role in the EU System of Central Banks, the EU system and its participation in the EU payment system TARGET2, it has genuine access to large amounts of data relating to banks.

With regard to monetary strategy, the Banque de France plays a crucial role, as its teams of economists and market operators help to prepare and implement the decisions of the ECB's Governing Council.

As guardian of the currency, the Banque de France is charged with delivering price stability and maintaining public confidence in cash.

With regard to financial stability, the Banque de France plays a dual role of protection and supervision:

• It is responsible for strengthening regulations and monitoring risks, and ensuring the safety of savers' deposits; and
• In conjunction with the ACPR, it:
• • oversees the financial sector (777 banks and 827 insurance companies and mutual institutions);
  • ensures the smooth operation of payment systems and market infrastructure; and
  • regularly assesses the risks and weaknesses in the financial system.

Its economic services are targeted at households and businesses:

• It provides practical services to people in severe financial difficulty. In 2015 it handled and resolved some 237,000 cases of household over-indebtedness and ensured that 69,000 people were given access to basic banking services.
• For small and medium-sized enterprises, its services include company ratings, credit mediation and support for very small enterprises.
• The bank also compiles national and regional surveys of economic conditions that are widely sought after by business leaders.

6 Activities

6.1 What specific regulations apply to the following banking activities in your jurisdiction: (a) Mortgage lending? (b) Consumer credit? (c) Investment services? and (d) Payment services and e-money?

(a) Mortgage lending?

The European Mortgage Credit Directive (MCD) regulates mortgage lending in the European Union. The MCD was to be transposed by 21 March 2016. It was transposed by Ordinance 2016-351 on consumer credit agreements relating to immovable property for residential use, which was ratified by Law 2017-203 and transposed into the Consumer Code (Articles L313-1 and following – formerly Article L321-1 – of the consumer code). It is specified by two decrees, also incorporated into the code (Decree 2016-607 of 13 May 2016; Decree 2016-622 of 19 May 2016; Articles R313-1, D313-20, D314-22 and following of the Commercial Code).

To ensure the protection of consumers raising real estate loans, numerous requirements have been set out across different pieces of legislation – in particular, the Civil Code. More specifically, mortgages are governed by Articles 2385 and following of the Civil Code.

(b) Consumer credit?

Directive 2008/48/EC mainly covers the following areas:

• consumer information;
• the right to early repayment of credit;
• the regulation of the activities of consumer credit intermediaries; and
• the protection of the borrower in the event of:
• • assignment of the credit agreement by the creditor; or
  • an agreement between the seller and the creditor.

Law 2010-737 reforming consumer credit, known as the ‘Lagarde Law', transposed Directive 2008/48/EC into French law. The rules are inserted in the Consumer Code (Articles L312-1 to L312-94 and L314-1 to L314-5 of the Consumer Code).

There are six types of consumer credits:

• Affected credit: Credit often offered at the point of sale. It is managed by a bank or a credit institution.
• Personal loan: A loan granted by a bank or credit institution.
• Revolving credit or permanent credit: Credit granted by a retailer or mail order company, a credit institution specialised in consumer credit or a bank.
• Rental with purchase option (lease option agreements or leasing): A loan granted by a commercial brand, a credit institution or a bank.
• Personal microcredit: A loan granted by a social support network that acts as an intermediary with an approved bank: a local authority, a job centre, a municipal social action centre or a social association.
• State-guaranteed student loan: A loan granted by a banking establishment such as a société générale, banque populaire, crédit mutuel or caisse d'epargne.

(c) Investment services?

The provision of investment services is based on three concepts:

• the products concerned;
• the services provided; and
• the providers.

It is prohibited for anyone other than the following to provide investment services to third parties on a regular basis:

• an investment service provider;
• a provider operating in France under the freedom to provide services or the freedom of establishment; or
• an authorised third-country company (Article L531-10 of the Financial and Monetary Code (FMC)).

Failure to comply with this requirement is punishable by law.

Products: Financial instruments include financial securities and financial contracts (Article L211-1 of the FMC). ‘Financial securities' include:

• equity securities issued by public limited companies;
• debt securities, excluding commercial paper and savings bonds; and
• units or shares of collective investment schemes (eg, undertakings for collective investment in transferable securities and alternative investment funds mentioned in Article L214-24, II of the FMC.

With respect to foreign financial instruments, all equivalent instruments or rights representing a financial investment in an entity issued on the basis of foreign law are assimilated to financial securities (Article L211-41 of the FMC).

‘Financial contracts' or ‘financial futures' are those included in a list established by decree (Article D211-1 A of the FMC) – that is, futures contracts (options, futures, swaps) relating to:

• financial instruments;
• currencies;
• interest rates;
• yields;
• financial indices;
• commodities;
• credit risk transfers;
• climatic variables;
• freight rates;
• emissions permits; and
• inflation rates or other official economic statistics.

Services provided: Investment services relate to financial instruments and include (Article L321-1 of the FMC), under the Second Markets in Financial Instruments Directive (MiFID 2):

• the receipt and transmission of orders on behalf of third parties;
• the execution of orders on behalf of third parties;
• trading on own account;
• portfolio management on behalf of third parties;
• investment advice;
• underwriting;
• guaranteed investment;
• unsecured placement;
• the operation of a multilateral trading facility;
• the operation of an organised trading system (created by Order 2016-827 to transpose MiFID 2); and
• services rendered to the state and the Banque de France in connection with policies for managing money, exchange rates or public debt.

The following activities (Article L321-2 of the FMC) are qualified as related (or ‘ancillary') services within the meaning of Annex I, Section B of Directive 2014/65/EU:

• the custody or administration of financial instruments and ancillary services such as the keeping of corresponding cash accounts or the management of financial guarantees;
• the granting of credit or loans to an investor to enable it to carry out a transaction involving a financial instrument or units of greenhouse gas emission allowances, and in which the company granting the credit or loan is involved;
• the provision of advice to companies on capital structure, industrial strategy and related matters, as well as services concerning mergers and takeovers;
• investment research and financial analysis or any other form of general recommendation concerning transactions in financial instruments or units of greenhouse gas emission allowances;
• services related to underwriting;
• foreign exchange services, where these are linked to the provision of investment services. Excluded, therefore, is manual foreign exchange, which is a banking business and not a financial business;
• services and activities similar to investment services or related services relating to the underlying element of financial futures instruments; and
• credit rating services (Article L321-2 of the FMC).

MiFID 2 expanded the ancillary services of credit or loan granting, investment research and financial analysis to greenhouse gas emission allowances. These ancillary services are not eligible for the European passport.

Providers: Investment service providers (ISPs) were divided into two broad categories in the investment services Directive (directive sur les services d'investissement or DSI) and MiFID 1: investment firms and credit institutions incorporated under French law that have received authorisation to provide investment services. ISPs include investment firms, as well as credit institutions and portfolio management companies, provided that they are authorised to provide investment services (Articles L531-1 and L531-2 of the FMC).

ISPs from another EU member state are authorised to provide investment services in France under the mutual recognition of authorisations procedure.

Investment service providers pay fees to the Autorité des marchés financiers.

(d) Payment services and e-money?

A company that wishes to provide payment services within the meaning of Article L314-1 of the FMC must apply to the Autorité de contrôle prudential et de résolution (ACPR) for authorisation as a payment institution. Registration as an account information service provider is required if the only payment service provided is the account information service.

‘Payment services' essentially comprise:

• services enabling cash to be deposited into or withdrawn from a payment account and the transactions required to manage such accounts;
• the execution of payment transactions associated with a payment account (card payments, credit transfers and direct debits);
• the transmission of funds;
• payment initiation and account information services; and
• the issuance of means of payment and/or the acquisition of payment orders.

In addition to payment services, payment institutions may provide related services as defined in the applicable regulations.

Before licensing a payment institution, the ACPR will check the following:

• the suitability of the legal form for the proposed activity;
• sufficient initial capital and the level of prudential capital with respect to capital requirements,
• the programme of operations and technical and financial resources;
• the identity and status of direct and indirect capital contributors, and where applicable, of their guarantors;
• the central administration, located in the same national territory as the registered office;
• sound governance arrangements, including a clear organisational structure with a well-defined, transparent and consistent division of responsibilities;
• the propriety, knowledge, experience and fitness of the persons effectively running the undertaking or placed in charge of the payment services activity in the case of hybrid institutions (institutions pursuing other commercial activities);
• effective risk detection, management and control procedures and an appropriate internal control system, including sound administrative and accounting procedures and appropriate arrangements to prevent money laundering and terrorist financing;
• the protection of user funds;
• professional indemnity insurance; and
• the resources implemented to ensure the security of means of payment and general organisation to ensure security, oversight of orderly operation and fraud prevention.

If it is expected that the payment volumes handled by the institution will not exceed a monthly average of €3 million and the company does not plan to provide the service of fund transmission, it is possible to apply to the ACPR for a simplified payment institution licence (Article L522-11-1 of the FMC).

In this case, the prudential requirements are adjusted – notably in terms of initial capital, capital requirements and internal control (restricted to control of key service providers). This category of institution is not eligible for a European passport.

A company that wishes to issue, manage and provide electronic money within the meaning of Article L315-1 of the FMC in the normal course of its business must submit an application for an electronic money institution licence to the ACPR.

In addition to issuing, managing and providing electronic money, electronic money institutions may provide payment services and services related to electronic money or payment services as defined by the applicable regulations.

Before licensing an electronic money institution, the ACPR will check the following:

• the suitability of the legal form for the proposed activity;
• sufficient initial capital and the level of prudential capital with respect to capital requirements;
• the programme of operations and the technical and financial resources;
• a description of the distribution network;
• the identity and status of direct and indirect capital contributors and, where applicable, of their guarantors;
• the central administration located in the same national territory as the registered office;
• sound governance arrangements, including a clear organisational structure with a well-defined, transparent and consistent division of responsibilities;
• the propriety, knowledge, experience and fitness of the persons effectively running the undertaking or the persons placed in charge of the electronic money activity in the case of hybrid institutions (institutions pursuing other commercial activities);
• effective risk detection, management and control procedures and an appropriate internal control system, including sound administrative and accounting procedures and appropriate arrangements to prevent money laundering and terrorist financing;
• protection of user funds; and
• resources implemented to ensure the security of means of payment and general organisation to ensure security, oversight of orderly operation and fraud prevention.

If it is expected that the volume of electronic money in circulation will not exceed a monthly average of €5 million, it is possible to apply to the ACPR to be licensed as a simplified electronic money institution (Article L526-19 of the FMC). In this case, the prudential requirements are adjusted – notably in terms of initial capital, capital requirements and internal control (restricted to control of key service providers). The units of electronic money incorporated in the electronic money instruments issued by the institution may not exceed €250 and the institution is not eligible for the European passport.

7 Reporting, organisational requirements, governance and risk management

7.1 What key reporting and disclosure requirements apply to banks in your jurisdiction?

Articles L232-1 and L232-6 of the Commercial Code apply to all credit institutions and investment companies under the conditions set by the Accounting Regulations Committee after obtaining the opinion of the Banking and Financial Regulations Committee.

More specifically, credit institutions whose balance-sheet total exceeds €450 million must publish their individual annual financial statements (balance sheet, off-balance sheet statement, income statement and notes) in the Bulletin des annonces légales obligatoires within 45 days of approval of these financial statements by the competent body.

The consolidating company prepares a report on the management of the group which describes:

• the situation of all companies included in the group;
• the foreseeable development of this group; and
• the important events which have occurred since the end of the financial year.

This report also contains information on market risks on a consolidated basis.

The published consolidated financial statements are certified by the statutory auditors of the consolidating company in accordance with the conditions provided for by Law 66-537– in particular, Article 228 as amended by Law of 3 January 1985.

Credit institutions must publish their consolidated financial statements, certified by the statutory auditors, by no later than 15 June of the year following the end of the fiscal year, under the same conditions as those provided for individual annual financial statements.

Credit institutions and finance companies must publish in the appendix to their annual financial statements information on their establishments and activities in non-cooperative states or territories within the meaning of Article 238-0 A of the General Tax Code. Credit institutions, financial holding companies and mixed financial holding companies must publish once a year – in an appendix to their annual financial statements or, as the case may be, to their consolidated annual financial statements, or in their management report – information on their establishments and activities, included in the scope of consolidation defined in Articles L233-16 and following of the Commercial Code, in each state or territory.

The following information must be published for each state or territory:

• name of the establishments, nature of activity and geographical location;
• net banking income and turnover;
• number of employees in full-time equivalent;
• profit or loss before tax;
• amount of income tax payable by the subsidiaries, distinguishing between current and deferred taxes; and
• public subsidies received.

The Autorité de contrôle prudential et de résolution (ACPR) ensures compliance with these disclosure requirements.

The information must be made available to the public for a period of five years. The statutory auditors will certify the fairness of this information and its consistency with the financial statements.

Banks and credit institutions must report all sums or transactions involving sums which they know, suspect or have good reason to suspect are derived from an offence punishable by a prison sentence of more than one year or are involved in the financing of terrorist activities.

Once they have completed their analysis of their clients' situation based on information that they must keep up to date, professionals in the banking sector must examine each suspicious transaction before sending a report to TRACFIN, if necessary.

7.2 What key organisational and governance requirements apply to banks in your jurisdiction?

The Capital Requirements Directive IV (CRD IV) stipulates guidelines for corporate governance principles for institutions in accordance with Article 3. Furthermore, Recital 54 of the CRD IV sets out specific principles. The effective implementation of these corporate governance principles requires the assistance of legal, regulatory and institutional frameworks. Such guidelines tend to guide the actions of the senior leadership of a diverse range of banks in a number of countries with varying legal and regulatory systems. However, there are significant differences in the legislative and regulatory frameworks across countries, which may restrict the application of certain principles or provisions therein.

The entry into force of CRD IV significantly strengthened the requirements regarding the role and composition of the supervisory body (ie, the board of directors, the supervisory board or another body with similar functions), and gave the supervisor the task of verifying the proper implementation of these rules.

In addition to the tasks entrusted to it by the Commercial Code, the supervisory body has been given specific tasks by the texts applicable to the banking sector. Thus, the supervisory body plays an eminent role in:

• risk control;
• compliance;
• internal auditing; and
• matters of appointment and remuneration.

The largest entities must also set up specialised committees emanating from the supervisory body, to which they report:

• a risk committee;
• a compensation committee;
• an appointments committee; and
• an audit committee.

By way of illustration, the supervisory body now bears ultimate responsibility for the effectiveness of the risk management system by setting the company's risk appetite and general risk tolerance limits in line with the company's overall risk profile, through approval of the company's main risk management strategies and policies. In this respect, it must approve the company's:

• written policies;
• internal risk assessment report; or
• where applicable, the application for an internal model.

The profile of each member of the supervisory body must meet certain criteria set out in the regulations concerning:

• good repute;
• skills;
• experience;
• knowledge;
• availability;
• conflict of interests; and
• honesty, integrity and independence of mind.

In addition to the individual analysis, the supervisory body must justify its competence and experience from a collective point of view in order to properly fulfil its tasks. This enables it to have the necessary perspective and distance to monitor management and make informed decisions within its competence.

To help ensure that the interests of all internal and external stakeholders are taken into account, and that independent judgement is exercised when there is an actual or potential conflict of interest, the management body in its oversight function should not be composed of members who are not independent.

The board should not be composed of too many members, to allow collegiality to be expressed in the most effective way.

CRD IV requires that institutions in the banking sector be effectively managed by at least two persons. The persons who effectively run a regulated institution must have the broadest powers.

Most legal forms used by regulated entities provide for functions that allow for the appointment of at least two effective managers. For example, public limited companies with a board of directors may appoint deputy general managers in addition to the general manager. For those with a supervisory board, all members of the management board are effective managers as members of the collegial body in charge of executive management. The texts or doctrine (see ACPR Position 2014-P-07 on the designation of effective managers within the meaning of Articles L511-13 and 4 of Article L532-2 of the Financial and Monetary Code (FMC)) recall or specify, for each of the corporate forms used, the functions that fall within the scope of the effective management of regulated entities. The texts also allow for the designation of a senior manager (generally a deputy general manager) as effective manager. The competent body must then grant the latter the necessary powers: the executive must have a sufficiently broad view of the business and risks, and must be able to take over entirely from the other effective manager.

Another key principle of the regulations is the separation of the functions of the chairman of the management body in its supervisory capacity from those of the chief executive officer.

The banking regulations give the supervisor the possibility to oppose the appointment of executive directors, or their continuation in office, if it finds that they do not, or that they no longer, comply with the criteria set out in the texts, which are basically the same as those mentioned above for directors. The expected level of compliance with these various criteria, excluding good repute, is adjusted in accordance with the principle of proportionality.

7.3 What key risk management requirements apply to banks in your jurisdiction?

CRD IV requires member states to ensure that material institutions establish a risk committee. This committee advises the management body on aspects concerning the institution's overall risk strategy and overall risk appetite, both current and future. It assists the management body – the latter nevertheless continuing to exercise overall responsibility for risk (Article 76(3) of Directive 2013/36/EU).

These provisions were transposed into domestic law in Comité de la Réglementation Bancaire et Financière Regulation 93-05 on the control of large exposures.

In addition, the FMC requires credit institutions of a significant size to set up a risk committee (Article L511-89). This concerns institutions with a balance-sheet total exceeding €5 billion.

In addition to the steering, monitoring and risk management functions entrusted to the supervisory body, as mentioned above, CRD IV has identified critical functions relating to the risk management and control framework that must be performed by key individuals who are thus subject to specific expectations.

The European Banking Authority and European Securities and Markets Authority guidance identifies key position holders with significant influence on the management of the institution. These include, in particular:

• the heads of internal control and the financial director, when they are not members of the management body; and
• the heads of key functions identified by the institutions on the basis of a risk-based approach.

In France, the Order of 3 November 2014 on internal control in companies in the banking, payment and investment services sector defines four key function managers in particular – the heads of:

• permanent control;
• periodic control;
• compliance; and
• risk management.

Each of these key functions has a single manager, who reports directly to the general manager, the management board or the operational manager of the organisation, as the case may be. In particular, the heads of the key functions must:

• be able to communicate with all members of the organisation or the group;
• be able to access all information necessary for the performance of their duties; and
• have the independence required to produce quality work, free of conflicts of interest.

The French regulatory framework does not provide for an assessment by the ACPR of the suitability of the holders of key positions at each appointment or renewal, contrary to what is recommended by the guidelines. However, the ACPR assesses the heads of internal control:

• upon approval;
• in the event of a change of control; and
• as part of its ongoing supervision of supervised institutions.

It can thus oppose the continuation of the mandate of the holders of key positions.

In addition, in the area of risk management, the use of outsourcing – including for essential services – has increased in recent years in the context of the growing digitalisation of financial services. In some cases, outsourcing is even an intrinsic part of the institutions' business model due to the many potential advantages, which include:

• cost reduction;
• flexibility; and
• access to or use of new technologies (fintechs).

However, excessive use of outsourcing creates additional risks for institutions in the event of difficulties with the service provider. On the banking side, the use of outsourcing has recently been more closely regulated by European regulations – in particular, through the publication of recommendations on outsourcing to cloud service providers (EBA/REC/2017/03) and the updating of the guidelines on this subject (EBA/GL/2019/02).

The supervised institutions must thus carry out a risk assessment prior to the conclusion of an outsourcing agreement and monitor it ex post, taking into account the critical or important nature of the outsourced function. The institution must therefore retain the necessary resources internally to meet these requirements. The outsourcing of critical or important functions must also be thoroughly monitored by the supervisor. To this end, the register of all outsourced functions may be transmitted to the ACPR upon request; and plans to outsource critical or important functions must be communicated each year as part of the internal control report.

Finally, the Order of 3 November 2014 on internal control of companies in the banking, payment services and investment services sector subject to ACPR supervision requires the latter to outsource services that substantially participate in banking, payment or investment services exclusively to entities that are themselves authorised to provide these services.

7.4 What are the requirements for internal and external audit in your jurisdiction?

According to Article L511-55 of the FMC, credit institutions and finance companies must have a sound governance system including, in particular:

• a clear organisation ensuring a well-defined, transparent and consistent division of responsibilities;
• effective procedures for detecting, managing, monitoring and reporting the risks to which they are or may be exposed;
• an adequate internal control system;
• sound administrative and accounting procedures;
• remuneration policies and practices that allow and promote sound and effective risk management; and
• where applicable, a preventive recovery plan.

The personnel performing control functions are independent of the operating units they control and have the resources necessary to perform their duties.

The aforementioned governance system is adapted to the nature, scale and complexity of the risks inherent in the business model and activities of the credit institution or finance company.

According to Article L511-56 of the FMC, the internal control system referred to above should include the essential or important operational functions or other tasks entrusted to third parties.

Finally, when supervision is exercised based on the consolidated financial situation, financial or mixed groups as well as groups comprising at least one finance company, must adopt adequate internal control procedures for the production of information and intelligence relevant to the exercise of such supervision.

Credit institutions and finance companies that are part of a mixed group must implement adequate risk management processes and internal control mechanisms – including sound accounting and reporting procedures – in order to properly detect, measure, monitor and control transactions with their parent mixed holding company and its subsidiaries (Article L511-57 of the FMC).

8 Senior management

8.1 What requirements apply with regard to the management structure of banks in your jurisdiction?

A form must be filled out. This form is to be used in case of appointment or renewal of the members of the management board, general managers, deputy general managers and all persons who effectively manage the activity of a reporting institution within the meaning of Articles L511-13, L532-2, L522-6 and L526-9 of the Financial and Monetary Code (FMC).

To be considered complete, the file must include:

• a dated and signed copy of the form, which is available on the website of the Autorité de contrôle prudential et de résolution (ACPR) (http://acpr.banque-france.fr/agrements-et-autorisations/procedures-secteur-banque/tous-les-formulaires.html);
• a copy or scanned version of a valid identification document of the effective manager;
• the effective manager's CV in French, updated, dated and signed by the executive director, indicating in particular:
• • the training courses followed;
  • the diplomas obtained; and
  • for each of the functions exercised during the last 10 years in France or abroad (including the mandates of director or member of the supervisory board), the name or corporate name of the employer or the company concerned, the responsibilities actually exercised and, for the executive functions, the results obtained in terms of development of the activity and profitability (eg, number of employees, turnover);
• a certified copy of the document appointing the effective director (an extract of the minutes of the corporate body that made the appointment);
• in the event that the executive director is not a legal representative, a copy of an extract of the deliberations of the corporate body that has delegated to him or her the powers necessary for the effective management of the establishment;
• for effective managers who have not been resident in France for at least three years, a certificate in lieu of a criminal record extract, issued by the competent authority of the country where the declarant resides or previously resided, and including the designation of the signing authority and the country concerned; and
• a declaration of non-conviction relating to Article L500-1 of the FMC.

8.2 How are directors and senior executives appointed and removed? What selection criteria apply in this regard?

Please see questions 7.2 and 8.1.

8.3 What are the legal duties of bank directors and senior executives?

Decree 2014-1357, issued pursuant to the Act of 26 July 2013 on the separation and regulation of banking activities, which came into force on 1 January 2015, specifies the procedures for the control exercised by the ACPR on the good repute and competence of the managers of credit institutions.

It stipulates that investment firm executives (ie, members of the board of directors, supervisory board and management board) must have the necessary knowledge, skills and experience in financial markets, applicable regulations, internal control, risk management and accounting and financial reporting. They must also demonstrate honesty, integrity and independence of mind in making management decisions, in order to ensure the effective supervision and monitoring of such decisions.

In addition, this decree determines:

• the deadlines within which credit institutions must request an opinion on the appointment or renewal of their managers from the ACPR;
• the deadlines for the ACPR to give its opinion on the proposal for the appointment or renewal of senior management;
• the deadlines for notifying the ACPR of the appointment or reappointment of directors;
• the procedures for checking the competence of managers and for drawing up the training plan; and
• the criteria for assessing the collective competence of the collegiate bodies (ie, the board of directors, supervisory board and management board).

8.4 How is executive compensation in the banking sector regulated in your jurisdiction?

Directive 2010/76/EC imposes various obligations on credit institutions to adopt remuneration policies that are consistent with effective and prudent risk management. This is to avoid excessive risk taking resulting from inappropriate remuneration. The aim is to encourage decision making that takes into account the long-term interests of the credit institution or investment firm. The framework and supervision of remuneration policies in Directive 2013/36/EU pursue these objectives.

The FMC requires credit institutions of significant size to set up a remuneration committee (Articles L511-89 and L511-102). This concerns institutions whose balance-sheet total exceeds €5 billion (Order dated 3 November 2014). Pursuant to Order 2020-1635 on various provisions for adapting legislation to EU law on financial matters, which transposed the rules stemming from EU Directive 2019/878 on remuneration:

• the rules on remuneration policy are now an element taken into account in the granting of authorisation (Article L511-10 of the FMC); and
• the rules on variable remuneration and remuneration in groups and gender-neutral remuneration policies have been tightened.

The variable part of the total remuneration may not exceed the amount of the fixed part of the remuneration (Article L511-78 of the FMC).

9 Change of control and transfers of banking business

9.1 How are the assets and liabilities of banks typically transferred in your jurisdiction?

In principle, the general law applicable to assignments of claims applies.

Nevertheless, it is important to check that the transfer of assets does not jeopardise the legal obligations regarding margins, cushions and equity capital.

Furthermore, any transfer of assets or liabilities that would affect the bank's business could also call into question the grant of the licence by the ACPR. In this regard, it is important to ensure upstream that this is not the case in the event of the transfer of a particular asset or liability.

9.2 What requirements must be met in the event of a change of control?

Please see question 2.3.

10 Consumer protection

10.1 What requirements must banks comply with to protect consumers in your jurisdiction?

Article L612-1 of the Financial and Monetary Code (FMC) gives the Autorité de contrôle prudential et de résolution (ACPR) the task of ensuring:

• "the preservation of the stability of the financial system and the protection of the customers, policyholders, members and beneficiaries of the persons subject to its supervision"; and
• that these same persons comply with "the rules intended to ensure customer protection", and "the adequacy of the means and procedures that they implement for this purpose".

It is the purpose of the customer protection rules and the duty of each professional to reduce this information asymmetry so that each customer can be offered products adapted to his or her needs and expectations, and can make an informed decision to buy or subscribe. This is crucial for public confidence in the financial sector.

The role of the ACPR is to promote fair behaviour and commercial practices among professionals:

• taking into account the interests of clients;
• limiting the risks to them; and
• preventing the risk of conflicts of interest to the detriment of clients.

A few principles can be identified in terms of good commercial conduct and customer protection:

• The first is to ensure that the client is properly informed and that the explanations given to him or her are fair, including on costs and risks. This implies paying particular attention to the training of sales staff, both on products and on customer protection rules.
• The second is that this is a question not only of managing the compliance risk of the professional, but also of ensuring that the interests of the client are taken into account in all circumstances. From this point of view, the corporate culture promoted by management, product governance and monitoring, and conflict of interest prevention policy all play key roles.

The issue of customer protection and good commercial practices must be taken into consideration throughout the commercial process: from the design of products and commercial tools – including digital interfaces – through the choice of partners to marketing practices, execution of the contract and complaints handling.

The ACPR monitors market practices, including advertising, products and services, and marketing methods. This monitoring is based on information collected from the public and professionals as part of the reporting requirements or thematic questionnaires. It also includes information exchanged in the framework of cooperation with other national or international institutions. This monitoring and analysis activity enables it to identify and anticipate trends and risks in the market, and to organise control priorities.

The ACPR carries out on-site or documentary inspections of the commercial practices of banking and insurance institutions, their intermediaries and intermediaries in the field of participatory finance. Whenever necessary in light of its findings, the ACPR asks professionals to correct their practices.

The ACPR guides market practices through its supervisory activities and communications. When it identifies general problems, it may publish recommendations of good practice for professionals or press releases for the general public.

10.2 How are deposits protected in your jurisdiction?

In accordance with European requirements, a deposit guarantee fund now provides protection for depositors.

Pursuant to EU Directive 94/19/EC, which required member states to adopt a deposit guarantee scheme, Law 94-679 established the principle of the obligation for credit institutions to join a deposit guarantee fund (Article L312-4), the purpose of which is to compensate depositors in the event of the unavailability of their deposits and other repayable funds.

The deposit guarantee fund is governed by:

• the Act of 25 June 1999 on savings and financial security and several regulations of the Banking and Financial Regulation Committee;
• more recently, Act 2013-672 of 26 July 2013 on the separation and regulation of banking activities; and
• Orders 2014-158 of 20 February 2014 and 2015-1024 of 20 August 2015 containing various provisions for adapting legislation to EU law in the financial field.

It became a deposit guarantee and resolution fund in 2013, intended to protect savers; but it does not intervene on behalf of institutional depositors (eg, other banks, insurance companies, undertakings for collective investment in transferable securities).

Coverage is capped at €100,000 per depositor with the same institution, which is much higher than the minimum originally set by the directive (€20,000). The fund compensates at the request of the ACPR, either preventively or in the event of collective proceedings against the credit institution, which will inevitably be struck off; the fund is then subrogated to the rights of the creditor in its recourse against the defaulting institution (Articles L312-4 to L312-18).

Furthermore, specific rules apply to specific loans. Examples are outlined below.

The Directive of 23 April 2008 governs consumer credit agreements. Among the key measures of the directive are those relating to information, and more specifically to pre-contractual information. Article 5 stipulates that several elements must be communicated to consumers, both in ads and prior to the loan offer. The directive introduced a standardised information sheet at European level. This must be drawn up on paper or another durable medium. The information it must contain is set out in Annex II of the directive. This concerns, among other things:

• the identity of the lender; and
• the main characteristics of the loan, such as:
• • its nature, duration and amount; and
  • the conditions for its repayment.

With regard to the cost of the credit, the annual percentage rate must be specified; and the information must also cover the cost of ancillary services such as insurance.

This information obligation is accompanied by a duty to explain. The lender must provide the minimum explanations necessary for the consumer to understand his or her commitments in order to ensure that he or she can make an informed decision.

The lender must also assess the creditworthiness of the borrower. In order to do this, the directive provides for access to national databases by lenders in EU member states.

The directive also provides for a minimum withdrawal period of 14 days. However, Article 14 leaves open the possibility of reducing this period if:

• national law requires that no funds may be paid to the borrower during this period; and
• the borrower expressly requests this.

Finally, the directive also intervenes in the case of early repayment. If the right to early repayment is not called into question, the directive limits the compensation due to the lender in this case (Article 16). For fixed-rate loans, this compensation may not exceed 1% of the amount of credit subject to early repayment if the period between early repayment and the termination of the credit agreement provided for in the latter exceeds one year. If the period does not exceed one year, the indemnity may not exceed 0.5% of the amount of credit subject to early repayment. On the other hand, no indemnity can be requested by the lender if the loan is at a variable rate. Moreover, in case of early repayment, the borrower is entitled to a reduction in the total cost of credit.

Directive 2014/17/EU regulates credit agreements for consumers relating to immovable property for residential use. According to Article 3 of this directive, it is intended to apply to two types of loans. First, it concerns loans secured by a mortgage or comparable guarantee. Second, it relates to loans for "the acquisition or maintenance of property rights in respect of land or an existing building to be constructed".

Unlike the directive on credit for movable property, this directive also regulates the providers of this type of credit.

As with the 2008 directive, the role of information is widely emphasised, in terms of both advertising and pre-contractual information. Requirements in this regard include:

• the standardised information sheet;
• the same rules on transparency and information on the cost of credit;
• the duty to advise; and
• the obligation to assess the debtor's solvency (Article 18).

In France, a 10-day cooling-off period is granted by law before taking out a loan when buying a property. If the loan offer is accepted before then, the contract is void.

Article L313-34 of the Consumer Code states that "the sending of the offer obliges the lender to maintain the conditions indicated for a minimum period of thirty days from its receipt by the borrower"; and further that "the borrower and the guarantors may only accept the offer ten days after they have received it. Acceptance shall be given by letter, the postal operator's stamp being taken as proof, or by any other means agreed between the parties that would make the date of acceptance by the borrower certain".

It is therefore only after this 10-day cooling-off period that a borrower can accept an offer from a lender – the offer should be accepted between the 10-day cooling-off period and the 30 day-period during which the lender's offer is valid. No payment of funds may be made before the end of the cooling-off period (Article L313-35 of the Consumer Code).

"The offer is always accepted subject to the resolutive condition that the contract for which the loan is requested is not concluded within four months of its acceptance. The parties may agree on a longer period" (Article L313-36 of the Consumer Code). This is the withdrawal period – not to be confused with the 10-day cooling-off period mentioned above.

11 Data security and cybersecurity

11.1 What is the applicable data protection regime in your jurisdiction and what specific implications does this have for banks?

The applicable data protection regime for banks is based on:

• the Financial and Monetary Code (FMC);
• the General Data Protection Regulation (GDPR); and
• Law 78-17 relating to information technology, files and freedoms.

The GDPR stipulates in concrete terms how the collection, selection, archiving and processing of personal data are to be carried out. In addition, bank secrecy aspects apply.

11.2 What is the applicable cybersecurity regime in your jurisdiction and what specific implications does this have for banks?

The applicable data protection regime is the EU Cybersecurity Act and the GDPR – especially Sections 32 and 33 of the GDPR. However, there are also special regulations for the banking sector, such as:

• Section 25a(1), number 5 of the Banking Act, which requires an appropriate contingency plan for IT systems;
• the minimum requirements for the security of internet payments of the Federal Financial Supervisory Authority; and
• the banking supervisory requirements for IT supervision (see question 7.3).

12 Financial crime and banking secrecy

12.1 What provisions govern money laundering and other forms of financial crime in your jurisdiction and what specific implications do these have for banks?

‘Money laundering' refers to processes that make funds of criminal origin legal. The European Union's action is therefore part of an international framework and follows the recommendations of the Financial Action Task Force (FATF). The French anti-money laundering system imposes on credit institutions:

• due diligence obligations; and
• an obligation to report and transmit information.

Under the due diligence obligations, credit institutions must implement measures of varying degrees of importance, depending on the risk. Thus, in the case of standard due diligence, it is necessary to identify the customer, the beneficial owner and the planned transaction before entering into a relationship. If this is not possible, it is impossible for the credit institution to enter into a business relationship. Moreover, during the business relationship, vigilance must be maintained – in particular, by keeping knowledge of the customer up to date. This vigilance may be reinforced in certain situations where additional measures must be put in place – for example, when dealing with politically exposed persons (PEPs).

EU Directive 2015/849 concerns the prevention of the use of the financial system for the purpose of money laundering or terrorist financing, and amends EU Regulation 648/2012. This was intended, among other things, to bring European law into line with the FATF recommendations adopted in February 2012. Finally, the various terrorist attacks on the European territory in recent years led to the passage of the Fifth Anti-money Laundering Directive (2018/843) on 30 May 2018, which was supplemented by Delegated Regulation 2019/758 on 31 January 2019.

This directive makes numerous contributions towards the establishment of means for the transmission and consultation of information, so that exchanges are more transparent –particularly with regard to the persons involved in the transactions. The requirement for parties subject to due diligence obligations to consult the register of beneficial owners of legal persons, established by the Fourth Anti-money Laundering Directive, has been supplemented by the obligation to hold proof of registration or an extract from the register as soon as the relationship is entered into.

In order to clarify the notion of a PEP, each member state must publish a list of functions that fall within its scope – the objective being to create a common list at European level.

In addition, virtual currency platforms are governed by the anti-money laundering provisions. These specify the enhanced due diligence measures and those to be implemented when a relationship is established at a distance or with a so-called ‘high-risk' third country.

In addition, mechanisms for exchanging information between the competent authorities of each member state have been put in place. In France, a specific department has been set up within TRACFIN to respond to requests made in this regard.

The Order of 1 December 2016 transposes the legislative part of the Fifth EU Anti-money Laundering Directive to the anti-money laundering/counter-terrorist financing (AML/CFT) obligations of the financial sector. It is expected that other regulatory instruments that supplement this order will complete the transposition. The following articles govern money laundering and other forms of financial crime

• Articles L561-2 and following of the Financial and Monetary Code (FMC);
• Articles R561-1 and following of the FMC;
• the Order of 2 September 2009 implementing Article R561-12 of the FMC and specifying the information required about the customer and the business relationship for the purpose of assessing AML/CFT risks;
• the list of equivalent third countries set out in Article L561-9 of the FMC (Order of 27 July 2011); and
• the Order of 12 February 2010 implementing the second paragraph of Article 238-0 A of the General Tax Code on non-cooperative countries with regard to transparency and the exchange of information on tax matters, as amended by the Orders of 14 April 2011, 4 April 2012 and 8 April 2016.

12.2 Does banking secrecy apply in your jurisdiction?

Professional secrecy is governed by Article L511-33 of the FMC and concerns the disclosure of confidential information. This notion includes precise and quantified information. More generally, it refers to information that is only in the banker's possession. General information – for example, on the financial situation of a company, the civil status of a client or a client's management policy – is not covered by professional secrecy. Where the information is known and has been disclosed in the press, the banker commits no fault in disclosing it.

There are certain exceptions to the protection of banking secrecy. One such exception applies to files setting up an information system relating to payment and repayment incidents of loans to individuals. This information is regularly transmitted to the Banque de France by banking institutions. Although the use of these files constitutes an undeniable violation of banking secrecy, the purpose of this information is to protect credit.

In addition, Article L511-33, paragraph 2 of the FMC states that professional secrecy may not be invoked against the Autorité de contrôle prudential et de résolution, the Banque de France or the judicial authority acting in the context of criminal proceedings. On the other hand, banking secrecy remains enforceable in the context of other proceedings – in particular, civil or commercial proceedings – with the exception of receivership proceedings, in which case secrecy is not enforceable against the official receiver.

Similarly, bank secrecy cannot be invoked against the tax authorities.

13 Competition

13.1 What specific challenges or concerns does the banking sector present from a competition perspective? Are there any pro-competition measures that are targeted specifically at banks?

The European Central Bank (ECB) can prohibit the acquisition of a qualifying holding in a French credit institution if any of the following conditions are met:

• The prospective acquirer is considered unsuitable to be a major shareholder in a financial institution;
• The institution would no longer be able to comply with its regulatory obligations;
• The institution would become a subsidiary of a foreign institution whose regulator does not cooperate with the Autorité de contrôle prudential et de résolution (ACPR) or the ECB;
• The future management would be unreliable;
• There are reasonable grounds to suspect that money laundering or terrorist financing is being conducted through the institution or the acquisition would the risk of this; or
• The prospective investor cannot provide financial support to the institution when needed.

During their review of a notification, the ACPR and the ECB will investigate the ultimate purchaser(s), as well as any intermediate holding companies and their management. Further, the ACPR and the ECB will require evidence of the source of funds used for the acquisition in order to combat money laundering. Compliance with these regulatory requirements generally involves long-term planning and careful preparation.

Non-financial organisations are not prevented from acquiring and owning banks in France.

Similarly, French banks are generally allowed to acquire minority or controlling investments in other banks and non-financial organisations.

14 Recovery, resolution and liquidation

14.1 What options are available where banks are failing in your jurisdiction?

The Bank Recovery and Resolution Directive (2014/59/EU) (BRRD) establishes a European framework for the recovery and resolution of credit institutions and investment firms.

It was transposed into French law by Ordinance 2015-1024 and supplements the framework created by Law 2013-672 on the separation and regulation of banking activities. The latter had already put in place some elements of the BRRD by introducing a French bank resolution scheme and entrusting its implementation to the Autorité de contrôle prudential et de résolution (ACPR,) which set up a resolution college.

In addition, the Single Resolution Mechanism (SRM) – the second pillar of the Banking Union – was defined in 2014 under EU Regulation 806/2014, which established uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms within the framework of an SRM and a Single Resolution Fund (SRF). In 2014 the European Commission, the European Parliament and the EU member states reached agreement on an SRM for all EU member states whose currency is the euro, including the establishment of an SRF of up to €55 billion, to be raised from 2016 to 2023 through contributions by EU banks.

Under the SRM, responsibilities for resolution are split between:

• the Single Resolution Board (SRB), located in Brussels, and
• the national resolution authorities of participating member states.

The SRB is responsible for:

• credit institutions that are considered significant and those directly supervised by the European Central Bank (ECB);
• cross-border groups; and
• investment firms that are subsidiaries of a credit institution falling within the SRB's remit.

The ACPR has exclusive responsibility for certain entities:

• credit institutions considered less significant (not supervised by the ECB);
• nearly all investment firms;
• branches of third-country banks; and
• the banking systems in Monaco and in the French overseas territories.

With regard to these entities, the ACPR is charged with the following duties:

• preparing resolution plans;
• assessing the resolvability of an entity;
• taking decisions aimed at reducing or removing obstacles to the implementation of resolution measures;
• determining whether an entity is failing or likely to fail; and
• implementing resolution measures.

International cooperation between resolution authorities in the Eurozone is organised within the SRM. The SRB has concluded bilateral resolution cooperation arrangements with certain non-EU resolution authorities, which provide a basis for the exchange of information and cooperation in resolution planning and in the implementation of resolution measures.

There are four reasons why a bank may be declared failing or likely to fail:

• It no longer fulfils the requirements for authorisation by the supervisor;
• It has more liabilities than assets;
• It is unable to pay its debts as they fall due; or
• It requires extraordinary financial public support.

At the time of declaring a bank as failing or likely to fail, one of the above conditions must be met or be likely to be met.

Once declared failing or likely to fail, the bank will be taken over by the SRB – the resolution authority for significant banks under European banking supervision, as well as for cross-border less significant banks. The SRB will decide:

• whether there is a public interest in the bank's resolution (if not, the bank will be liquidated); and
• which resolution measures should apply.

The key objectives in resolution are:

• preserving the systemically important part of the bank's business (the part whose failure could trigger a financial crisis);
• protecting depositors;
• ensuring that critical functions continue to operate; and
• preventing market disruption.

The ECB, which directly supervises around 120 significant banks, closely cooperates with the SRB throughout the resolution process.

Step 1 – recovery and resolution planning: Planning is an essential component of the effective resolution of banks that are declared to be failing or likely to fail.

Every year, banks must prepare recovery plans, which are assessed by their supervisor (the ECB in the case of significant banks). Recovery plans specify possible scenarios that could arise should a bank get into financial difficulty and set out actions which the bank could take to continue operating, thus preventing a failure. A bank in financial difficulty could, for example, raise additional capital, reduce planned lending or sell assets.

The resolution plan is a type of ‘living will' that sets out how a bank will wind down its operations should it be decided that it is no longer viable. The purpose is to:

• determine the bank's critical functions;
• identify and address any impediments to its resolvability; and
• prepare for its possible resolution.

The resolution authority is responsible for preparing the resolution plan for each bank based on information received from the bank and from the supervisor, which is also consulted in the process.

Step 2 – bank enters resolution: Following a decision that a bank is failing or likely to fail, the SRB will assess whether there are alternative private sector measures which could be taken to prevent its failure within a reasonable timeframe, and whether it is in the public interest for resolution to proceed (rather than the bank being liquidated under normal insolvency proceedings). In other words, the SRB evaluates whether the bank's failure could, for example, cause financial instability or disruptions in the market. If the SRB determines that there are no feasible alternative private sector measures and that the public interest is best served through resolution, it can adopt a resolution scheme.

A number of different resolution tools are available to the SRB:

• Parts of the bank can be sold;
• Parts of the bank can be transferred to a temporary structure (a ‘bridge bank'), to ensure that banking services to customers are maintained;
• Certain assets and liabilities can be transferred to a ‘bad; bank; and
• The bank's liabilities can be cancelled or reduced through a bail-in procedure.

14.2 What insolvency and liquidation regime applies to banks in your jurisdiction?

According to Article L613-31-2 of the Financial and Monetary Code (FMC), recovery measures will be taken in France or in any other member state by the administrative or judicial authorities in order to preserve or restore the financial situation of a credit institution or an investment firm.

When taken in France, these measures are as follows:

• temporarily limiting or prohibiting the exercise of certain operations or activities by the relevant institution or firm, including the acceptance of premiums or deposits;
• prohibiting the institution or firm from carrying out certain operations and imposing any other limitations on its activities;
• imposing measures for the prevention and management of banking crises under Articles L613-34 to L613-34-9;
• imposing measures relating to the implementation of the deposit guarantee and resolution fund under Articles L613-64 to L613-64-2; and
• undertaking the safeguard or legal redress procedures mentioned in Book VI of the Commercial Code.

Liquidation measures are collective procedures opened and controlled in France, or in any other member state, by the administrative or judicial authorities, with the aim of realising assets under the supervision of these authorities.

Where they are taken in France, these measures are those covered by Title IV of Book VI of the Commercial Code.

The commencement of compulsory liquidation proceedings against a credit institution, an investment firm or a finance company will result, depending on the case, in:

• the filing of an application for withdrawal of authorisation with the ECB; or
• its removal from the list of investment firms or finance companies (Article L613-31-4 of the FMC).

15 Trends and predictions

15.1 How would you describe the current banking landscape and prevailing trends in your jurisdiction? Are any new developments anticipated in the next 12 months, including any proposed legislative reforms?

The European Parliament passed a legislative package for amendments to the Capital Requirements Regulation (CRR) and the Capital Requirements Directive IV (CRD IV), as well as the Directive on Bank Recovery and Resolution (2014/59/EU) (BRRD) and the Single Resolution Mechanism, in April 2019. The legislation package aims to eliminate certain weaknesses identified in the banking regulation system, while taking into account the role that banks play in the economy. It includes measures agreed by the Basel Committee on Banking Supervision (BCBS) and the Financial Stability Board.

The amendments include a binding advantage ratio of 3% for all institutions that fall within the scope of the CRD IV, with adjustments being possible under specific circumstances. A requirement for stable funding based on the ratio of an institution's stable funding to the requisite stable funding over a one-year period (net stable funding ratio) is introduced, in order to prevent institutions from relying on excessive amounts of short-term wholesale funding to finance long-term activities. This requirement will become effective from 28 June 2021. The rules for calculating the capital requirements for market risk, which are applicable to trading book positions, will be amended as from 28 June 2023 to reflect more accurately the actual risk to which banks are exposed. However, to allow for a more proportionate solution, there are derogations for banks with small trading books and a simplified standardised approach for medium-sized banks. Furthermore, the European Commission's implementing power is replaced by a delegated power, enabling it to:

• exempt entities from the CRD where certain conditions are fulfilled; and
• decide on whether such institutions fall within the scope of the CRD or CRR, again once these criteria are no longer fulfilled.

To improve the effectiveness of resolution and to protect public funds, global systemically important banks must now hold sufficient amounts of capital and other instruments that absorb losses in case of a resolution (total loss-absorbing capacity). Moreover, the package provides for an EU harmonised approach to a bank creditor's insolvency ranking. To this end, a new statutory category of unsecured debt that ranks just below the most senior debt and other senior liabilities is introduced. BRRD II also includes a moratorium tool that enables the suspension of certain contractual obligations for a short period. Several changes are intended to enhance proportionality (ie, small institutions will be subject to less frequent and less extensive reporting and disclosure requirements).

The Group of Governors and Heads of Supervision – the steering committee of the BCBS – decided on 27 March 2020 to extend the implementation timetable of the Basel III finalisation package. This should free up additional operational capacity for banks during the COVID-19 crisis. It was important that banks and supervisors focus their resources on providing critical banking services to the real economy and stabilising the financial system. The Basel Committee postponed the date by which Basel Committee on Banking Supervision members must fully implement the Basel III standards of December by one year to 1 January 2023. The transition periods for the output floor now apply until 1 January 2028 instead of 1 January 2027. The new implementation date for the Market Risk Framework and Pillar 3 disclosure requirements is 1 January 2023.

15.2 Does your jurisdiction regulate cryptocurrencies? Are there any legislative developments with respect to cryptocurrencies or fintech in general?

Virtual money is a currency with a different unit of account from currency or scriptural money. It is created by a private institution and is stored on an electronic tool. Unlike electronic money, virtual money does not have the same unit as currency. It has its own unit, so one unit of virtual money is worth so many units of currency at a time. It was initially used as a means of payment in special markets, such as online video games; and then developed autonomously in order to be traded against legal tender, such as Bitcoin.

The lack of regulation and the development of virtual money outside the mainstream for this new form of currency are not without their concerns and dangers. One of these is the difficulty of tracing virtual currency and the difficulties in fighting money laundering and financing of terrorism. This is why the Fifth Anti-money Laundering Directive requires that institutions offering virtual currencies be subject to due diligence rules, particularly regarding the identification of persons. The European Central Bank has emphasised the absence of regulation, since as virtual currency is not an official currency, it is not subject to the Second Payment Services Directive. The Court of Justice of the European Union seems more tempered in viewing virtual currency as a means of payment and referring to both ‘traditional' and ‘virtual' currencies, which would suggest that it is a type of currency (CJEU, 5th Ch, 22 October 2015, Hedqvist, aff C-264/14, Europe 2015).

The issues surrounding these new forms of money and the development of technological tools undoubtedly augur a significant evolution of European regulation.

In France, crypto-assets do not yet benefit from a real legal framework. However, the PACTE Law, enacted on 22 May 2019, introduced a new regulatory framework aimed at:

• token transactions, which the Autorité des marchés financiers defines as "a fundraising operation by which a company with a need for financing issues tokens, to which investors subscribe mainly with crypto-currencies";
• digital asset service providers; and
• certain investment funds.

In particular, it defined ‘tokens' in Article L552-2 of the Financial and Monetary Code as "any intangible asset representing, in digital form, one or more rights that can be issued, registered, retained or transferred by means of a shared electronic recording device that makes it possible to identify, directly or indirectly, the owner of the asset".

The new regime introduced by the PACTE Law is optional and therefore does not appear to be a constraint for issuers of tokens that do not wish to implement it. Consequently, this new legislation can only be analysed as an opportunity to attract new players willing to comply with it for more legal certainty, and not as a protection for current holders of crypto-assets in France.

16 Tips and traps

16.1 What are your top tips for banking entities operating in your jurisdiction and what potential issues would you highlight?

We recommend paying particular attention to the following aspects:

• In the case of cross-border mergers, check whether the previously non-critical sized bank becomes critically important;
• In case of transfer or purchase of assets, check that the banking monopoly is respected;
• Check that the total effective rate is mentioned and calculated in accordance with the applicable law; and
• Pay particular attention to security interests in financing restructurings.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.