AML/CFT 2026: French accountants' Tracfin filing duties and client due diligence

Updated 24 May 2026.

Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT, known in France as LCB-FT — lutte contre le blanchiment de capitaux et le financement du terrorisme) is no longer a back-office formality filed away in the permanent dossier. Since the adoption of the EU AMLR/AMLD6 package in May 2024 and the progressive tightening of French supervisory standards, a chartered accounting firm now occupies a critical position in France's national prevention architecture.

In practice this translates into heightened expectations from the Ordre des experts-comptables (the French professional regulator), from Tracfin (France's financial intelligence unit) and from the Commission nationale des sanctions (CNS). AML/CFT compliance within a firm is now audited at every Ordre inspection, and identified failings can result in heavy administrative sanctions — up to one million euros per breach, independent of any criminal exposure.

This article maps the obligations applicable in 2026: who is in scope, how to build the full due-diligence chain, when and how to file a Suspicious Activity Report (SAR) with Tracfin, and which watchpoints matter most for SME clients and directors.

The French legal foundation sits in articles L.561-1 to L.561-50 of the Code monétaire et financier (CMF), which originate from successive transpositions of EU anti-money-laundering directives, starting with ordinance 2009-104 of 30 January 2009 (3rd AML directive), followed by ordinances 2016-1635 (4th directive) and 2020-115 (5th directive). Layered on top:

• the internal rules (règlement général) of the Ordre des experts-comptables, translating the statutory obligations into professional duties;
• the AML/CFT professional standard for chartered accountants, revised in 2020 and again in 2023;
• the joint guidelines issued by the Ordre and Tracfin, updated at regular intervals;
• the EU Regulation (EU) 2024/1624 (AMLR) and Directive (EU) 2024/1640 (AMLD6), most provisions of which apply from 10 July 2027 — though they are already generating indirect compliance pressure in 2026 for firms updating their internal policies.

The arrêté of 6 January 2021 sets out the detailed methodology for risk classification, and the arrêté of 27 August 2020 specifies the internal-control requirements applicable to chartered accountants.

Why 2026 is a pivotal year#

On 9 June 2026, the European AML Authority (AMLA) is formally established in Frankfurt. Although direct AMLA supervision of a short list of roughly forty financial institutions will only begin in 2028, national regulators are already aligning their inspection methodologies. French accounting firms are directly affected: thematic Ordre inspections multiplied in 2024-2025, and Tracfin's published activity reports show a steady increase in reports filed by the accounting profession.

2.1 Identifying the client and the ultimate beneficial owner (RBE)#

Before any engagement, the firm must identify:

• the client itself (individual or legal entity);
• its ultimate beneficial owner (UBO / bénéficiaire effectif) under articles R.561-1 to R.561-3 CMF: any individual holding, directly or indirectly, more than 25 % of share capital or voting rights, or exercising control by any other means.

For French companies, UBO identification flows through the register of beneficial owners (RBE — registre des bénéficiaires effectifs), maintained by the commercial court registries and accessible to AML-obliged entities via data.inpi.fr. Following the CJEU ruling of 22 November 2022 (cases C-37/20 and C-601/20), broad public access to the RBE has been restricted — but accounting firms, as obliged entities, retain full access.

Minimum documents to collect:

2.2 Risk rating: low / standard / enhanced#

Article L.561-4-1 CMF requires a documented risk classification for every client, based on a reasoned analysis. Three levels apply:

• Low risk: established French entity, sector with limited exposure, ordinary transactions — simplified due diligence is permitted (article L.561-9).
• Standard risk: the default level.
• Enhanced risk: PEP involvement, FATF-monitored jurisdiction, atypical cross-border flows, sensitive sectors (crypto-assets, luxury real estate, cash-intensive businesses) — enhanced due diligence is mandatory (article L.561-10).

The classification must be updated whenever a material change occurs: capital restructuring, new director appointment, change of business activity, adverse press coverage, etc.

2.3 Record-keeping#

Identification documents and records of transactions must be kept for five years after the end of the business relationship (article L.561-12 CMF). In practice, firms store records on a durable, encrypted medium (encrypted document management system with timestamping), with access restricted to the designated AML officer and the firm's senior partners.

3.1 Criteria triggering the filing obligation#

The duty to file arises as soon as the firm holds a suspicion that the funds or operations at issue stem from an offence punishable by more than one year of imprisonment (article L.561-15 CMF). The patterns most frequently encountered by the accounting profession, as published in Tracfin's activity reports, include:

• complacency invoices, intra-group over-billing;
• shareholder current accounts (comptes courants d'associés) funded by unjustified cash deposits;
• unconvincing justification for capital contributions;
• atypical flows with high-risk jurisdictions;
• a mismatch between the declared business activity and the director's apparent lifestyle;
• an abrupt switch to recently-incorporated, opaque suppliers.

3.2 Filing procedure via Ermes#

The SAR is submitted through the Ermes online portal, available on the Tracfin website (https://www.economie.gouv.fr/tracfin). The firm must complete:

1. the filer's identity (firm name and named AML correspondent);
2. the full identification of the suspected client;
3. the transactions and amounts in question;
4. a factual, substantiated analysis of the suspicion;
5. supporting documents (invoices, bank statements, contracts, etc.).

Tracfin acknowledges receipt and keeps the filing strictly confidential.

3.3 The tipping-off prohibition#

Article L.561-19 CMF strictly forbids disclosing the existence or content of an SAR — to the client, to any third party, or even to another professional working on the same file. Breaching this prohibition constitutes a criminal offence under article L.574-1 CMF (up to €22,500 fine). The firm therefore continues its engagement as normal, unless the engagement itself is being used as a vehicle for the suspected operation — in which case it must be terminated in accordance with the applicable professional standard.

On the client side, several warning signals justify a preventive conversation with the firm before a formal suspicion crystallises:

• material use of cash above the legal thresholds (€1,000 for B2B payments in France today; €10,000 EU-wide under AMLR from 2027);
• shell entities or multiple layers of interposition without genuine economic substance;
• cross-border flows with FATF-monitored jurisdictions (list updated quarterly at fatf-gafi.org);
• a beneficial owner that is difficult to trace (holding chains, fiduciary arrangements);
• a mismatch between declared income and observable wealth (real estate, vehicles, lifestyle).

Addressing these points proactively protects the firm's engagement — and, ultimately, the director from criminal exposure for complicity or receipt of proceeds.

To these formal exposures add the reputational risk with the firm's banking partners (closure of professional accounts, refusal of bond facilities) and with professional indemnity insurers.

Our expert-comptable perspective, drawn from Ordre inspections observed in practice since 2024.

1. Static UBO files. Many firms identify the UBO at onboarding and never update the record. Article L.561-12 requires a dynamic review process. An undisclosed transfer of 30 % of the capital invalidates the original risk rating.
2. Uniformly "standard" risk classification. An Ordre inspector will check whether the documented rating is coherent with the client's sector, its transaction flows and any adverse signals. An e-commerce client with marketplace flows should typically tip into enhanced risk on at least one criterion.
3. Confusion between an SAR and informal signalling. The legal threshold is reasonable suspicion — not proof. Too many firms wait for certainty and file late.
4. No formally designated AML officer. Article R.561-23 requires the formal appointment of an AML correspondent (correspondant LCB-FT) and a named SAR filer (déclarant). Many smaller firms conflate the two roles and lose the audit trail.
5. Unencrypted paper records. During an inspection, the examiner checks confidentiality: a client file stored in clear in an unlocked cabinet is treated as nearly equivalent to no record-keeping at all.

Who is subject to AML/CFT obligations in France?#

Article L.561-2 CMF lists more than thirty regulated professions, including French chartered accountants (entry 12°), commissaires aux comptes (statutory auditors), lawyers, notaries, real-estate agents and crypto-asset service providers (PSAN). No turnover threshold applies — any firm registered with the Ordre des experts-comptables is fully in scope.

What is Tracfin's role, and how is a SAR submitted?#

Tracfin (Traitement du renseignement et action contre les circuits financiers clandestins) is France's financial intelligence unit, attached to the Ministry of Finance. SARs are filed through the Ermes online portal at https://www.economie.gouv.fr/tracfin. Tracfin enriches the report with its own intelligence databases and may transmit it to the autorité judiciaire, to the DGFiP (French tax authority), to the URSSAF or to the DGCCRF.

What does a firm risk if it fails to file an SAR?#

An administrative fine of up to €1 million per breach (article L.561-36-1 CMF), professional disciplinary sanctions up to removal from the Ordre roll, and criminal exposure for complicity in money laundering — up to ten years' imprisonment and a €750,000 fine (articles 324-1 and 324-2 of the Code pénal).

Can an SAR be disclosed to the client concerned?#

No. Article L.561-19 CMF strictly forbids any disclosure of the existence or content of an SAR to the client or to any third party. Breaching the prohibition is a criminal offence (up to €22,500 fine, article L.574-1 CMF). The firm continues its engagement without alerting the client.

What does AMLR / AMLD6 change for 2026-2027?#

Regulation (EU) 2024/1624 (AMLR) and Directive (EU) 2024/1640 (AMLD6), adopted in May 2024, establish a European AML Authority (AMLA) based in Frankfurt and harmonise due-diligence obligations across the EU. Most AMLR provisions apply from 10 July 2027. Key changes include: a harmonised EU-wide cap on cash payments set at €10,000, an extension of obliged entities to professional sports clubs, and strengthened beneficial-owner register requirements.

Further reading: our analysis of Exit Tax 2026, our guide to DAC 7 platform obligations and our DAC 8 crypto-asset obligations playbook — regulations that sit alongside AML/CFT in the broader cross-border compliance framework.