France Sapin 2 anti-corruption compliance for SMEs 100-499 employees in 2026: why anticipate the obligation
France Sapin 2: 500-employee and €100M turnover thresholds, 8 mandatory program measures, AFA penalties up to €1M. Why SMEs below threshold should anticipate the framework.
This topic is part of our service
Outsourced CFO in France | Fractional finance leaderExpert note: This article was written by our chartered accountancy firm. Information is current as of 2026. For a personalised review of your situation, contact us.
Updated on 13 May 2026.
Article 17 of Law no. 2016-1691 of 9 December 2016 (Sapin 2) imposes an anti-corruption compliance program on companies with more than 500 employees and €100 million turnover. SMEs below these thresholds are not legally required, but the French Anti-Corruption Agency (AFA) strongly encourages mid-caps with 100-499 employees to voluntarily adopt best practices — for 3 reasons: growth anticipation, contractual demand from large clients subject to the law, and emerging ESG governance expectations.
This practical 2026 guide presents the 8 mandatory measures, the precise thresholds, the AFA sanctions commission penalties (up to €1M for company + €200,000 for director), and arguments to voluntarily anticipate the framework at SME level.
Executive summary#
- Legal thresholds: > 500 employees AND > €100M turnover, French HQ (cumulative).
- 8 mandatory measures: code of conduct, risk mapping, alert, third-party assessment, controls, sanctions, training, evaluation.
- Penalties: up to €1M company + €200k director + public procurement exclusion.
- SMEs below threshold: not legally required but subject to contractual pressure from large clients.
- Setup cost: €80-250k year 1 for SMEs; €30-60k for lightweight setup.
1. Legal framework and thresholds#
Article 17 of the Sapin 2 Law#
Article 17 requires the management body of a subject company to take measures to prevent and detect corruption or influence trading, in France or abroad. Failing this, its responsibility can be engaged before the AFA sanctions commission.
Application thresholds#
Subject companies have simultaneously:
| Condition | Threshold |
|---|---|
| Headcount (at 31 December N-1) | > 500 employees |
| Consolidated turnover (excl. VAT) | > €100M |
| Registered office | In France |
Thresholds assessed at individual company level OR group level if the parent is a subject parent.
Out of scope#
- SMEs and mid-caps below thresholds (but encouraged by AFA).
- Public establishments (specific regime).
- French subsidiaries of foreign groups (depending on governance).
2. The 8 mandatory program measures#
| Measure | Description |
|---|---|
| 1. Code of conduct | Document describing prohibited behaviours — integrated into internal rules |
| 2. Internal alert mechanism | Secured channel for employees to report breaches |
| 3. Risk mapping | Identification and prioritisation of corruption risks per activity, geography, third party |
| 4. Third-party assessment | Due diligence on clients, suppliers, intermediaries (3 risk levels) |
| 5. Internal accounting controls | Anti-fraud procedures on invoicing, expense notes, payments |
| 6. Disciplinary regime | Internal sanctions in case of breach |
| 7. Training for exposed managers and staff | Annual training plan for at-risk functions |
| 8. Control and evaluation system | Annual internal audit + KPIs + continuous improvement |
3. Risk mapping — practical methodology#
Principle#
Risk mapping is the cornerstone. It must be:
- Activity-specific (services, industry, distribution, BTP).
- Geographic (foreign presence, at-risk countries per Transparency International CPI).
- Documented (methodology, sources, update frequency).
- Updated at least every 2 years or upon major events.
4-step methodology#
- Identification of exposed business processes (purchasing, export sales, public contracts, lobbying).
- Assessment of probability × impact for each risk (5x5 matrix).
- Prioritisation by score (major risks = priority treatment).
- Documented action plan with prevention and detection measures.
Our expert view#
Classic trap: filling out a "generic" mapping downloaded from an AFA guide without adapting to actual activity. The AFA controls coherence between mapping and effective risk nature. A BTP SME with French-speaking African activity presenting mapping without any geographic risk is immediately suspect. The mapping must reflect operational reality.
4. Whistleblower mechanism — Sapin 2 + GDPR articulation#
Reinforced 2022 legal framework#
Law no. 2022-401 of 21 March 2022 (transposition of EU Directive 2019/1937) reinforced whistleblower protection with:
- Extended legal protection against retaliation.
- Absolute confidentiality of whistleblower and accused identities.
- Data retention: 5 years minimum, with possible anonymization.
- Information to persons on their data processing (GDPR).
Technical implementation#
Three options:
- Internal channel managed by company.
- Specialised external platform (Whispli, WhistleB, Convercent).
- External mandator (lawyer, independent accountant).
For an SME of 100-499 employees, option 2 is usually the most balanced (€3,000-€10,000/year).
5. AFA sanctions commission penalties#
Corporate sanctions#
| Breach | Maximum sanction |
|---|---|
| Total program absence | €1,000,000 fine |
| Incomplete or failing program | Notice + fine if no remediation |
| Decision publication | Reputational damage |
| Public procurement exclusion | Up to 5 years |
Individual sanctions (directors)#
| Breach | Maximum sanction |
|---|---|
| Failure to implement program | €200,000 fine for director |
| Individual publication | Personal damage |
| Criminal record (if penal offense) | Influence trading, corruption |
6. Worked example — 120-employee SME exporting to Maghreb#
Profile: SME 120 employees, €18M turnover including 35% Maghreb export (Algeria, Morocco, Tunisia). Below Sapin 2 threshold legally but: systematic demand for code of conduct by local distributors; ministerial tenders requiring compliance attestation; French bank reinforcing controls on international flows.
12-month implementation plan#
| Quarter | Action | Estimated cost |
|---|---|---|
| Q1 | Diagnosis and risk mapping | €12,000 |
| Q2 | Code of conduct + policy drafting | €8,000 |
| Q3 | Whistleblower platform + initial training | €15,000 |
| Q4 | Internal audit + third-party assessment | €18,000 |
| Total year 1 | €53,000 | |
| Annual recurring | €18,000/yr |
For €18M turnover, program costs 0.3% of revenue — profitable ratio vs public procurement access and bank trust.
7. The underestimated risk#
Frequent trap: an SME below threshold considers it has "nothing to do". Wrong in 80% of cases. Large subject groups contractually cascade their obligations to critical suppliers — mandatory codes of conduct, annual ethical audits, termination clauses in case of violation. An SME refusing to sign loses contracts progressively. Conversely, an SME 100-499 employees with a lightweight setup gains credibility and pre-empts the setup cost when crossing the future threshold.
8. Director decision checklist#
- Exposure diagnosis: do I have large subject-group clients? Export to at-risk countries?
- Setup level: full compliance (subject) or lightweight (below threshold)?
- Calendar: alignment with HR project (500-employee recruitment) or commercial (tenders)?
- Budget: €80-250k year 1 full / €30-60k lightweight.
- Compliance officer: externalised or internalised?
- Other framework articulation: NIS 2, CSRD, DDADUE, law 2017-399.
9. 2026-2027 watchpoints#
- Threshold evolution: not announced for 2026 but discussion on lowering to 250 employees (Conseil d'État, OECD recommendations).
- Enhanced AFA audit: sanctions commission publicly announced targeted controls.
- CSRD articulation: since 2025, CSRD companies must report on anti-corruption indicators.
- Public procurement: new obligation since 2025 of non-conviction attestation for corruption.
Closing thoughts#
Sapin 2 law today far exceeds its original legal scope. Through contractual cascade, bank requirements and CSRD obligations, every B2B SME 100-499 employees with international activity or public procurement is indirectly concerned. Anticipating the setup is a modest investment (€30-60k) with quick return in client trust and growth preparation.
Our firm advises SMEs and mid-caps on Sapin 2 compliance program setup, from initial diagnosis to annual audit. Contact our experts.
Frequently asked questions
À partir de quels seuils mon entreprise est-elle assujettie à Sapin 2 ?
L'article 17 de la loi Sapin 2 s'impose aux entreprises ayant simultanément : (1) plus de 500 salariés ET (2) plus de 100 millions d'euros de chiffre d'affaires, avec siège social en France. Les seuils s'apprécient au niveau de la société individuelle OU du groupe si la société mère est tête de groupe assujettie. Les PME et ETI sous ces seuils ne sont pas légalement obligées mais sont vivement encouragées par l'AFA à adopter volontairement les bonnes pratiques — particulièrement si elles sont fournisseurs de groupes assujettis (cascade contractuelle).
Quelle différence entre Sapin 2, loi Vigilance 2017-399 et DDADUE 2027 ?
Trois dispositifs distincts mais convergents : Sapin 2 (2016) cible spécifiquement la corruption et le trafic d'influence, avec un programme conformité en 8 mesures. Loi Vigilance 2017-399 (« loi Rana Plaza ») impose aux très grands groupes français (5 000 ou 10 000 salariés) un plan de vigilance couvrant droits humains, environnement et chaîne d'approvisionnement. DDADUE 2027 (transposition de CSDDD) étend le devoir de vigilance européen à des groupes plus petits (1 000 sal., 450 M€ CA) avec impact indirect sur les PME fournisseurs. Les trois dispositifs se cumulent pour les très grands groupes.
Combien coûte la mise en place d'un programme conformité pour une PME ?
Pour une PME de 100-499 salariés qui choisit de mettre en place volontairement le programme Sapin 2 (anticipation de croissance ou demande client), le coût moyen est de 80 000 à 250 000 € pour la première année et 30 000 à 80 000 € récurrent. Postes principaux : cartographie initiale des risques (15-30 k€), formalisation du code de conduite et procédures (10-20 k€), dispositif lanceur d'alerte (5-15 k€), formation initiale dirigeants et acheteurs (5-15 k€), évaluation des tiers (système IT + procédures, 20-50 k€), audit interne récurrent (15-30 k€/an), référent compliance interne (50-80 k€/an si à temps plein). Pour les entreprises sous-seuil, un dispositif allégé à 30-60 k€ est généralement suffisant pour répondre aux demandes contractuelles des clients grands groupes.
Le dirigeant est-il personnellement responsable en cas de défaut ?
Oui. L'article 17 de la loi Sapin 2 vise nominativement « l'instance dirigeante » et la responsabilité personnelle peut être engagée devant la commission des sanctions de l'AFA. Sanctions individuelles : amende jusqu'à 200 000 €, publication de la décision, mais aussi inscription au casier judiciaire si infraction pénale caractérisée (trafic d'influence, corruption active passive). La responsabilité pénale personnelle reste séparée de la responsabilité administrative de l'entreprise (qui peut être condamnée à 1 M€ d'amende AFA + suspension du droit aux marchés publics).
Comment articuler le dispositif lanceur d'alerte avec le RGPD ?
L'articulation est précisément encadrée par la loi n° 2022-401 du 21 mars 2022 (transposition de la directive UE 2019/1937) et la doctrine CNIL. Trois principes : (1) confidentialité absolue de l'identité du lanceur d'alerte et des personnes mises en cause (durée minimale de conservation 5 ans, anonymisation possible) ; (2) finalité limitée — les données collectées ne peuvent servir qu'à l'enquête et au suivi ; (3) information des personnes sur le traitement des données à caractère personnel les concernant, avec droit d'accès et de rectification. Le dispositif doit être déclaré comme traitement RGPD, avec analyse d'impact (AIPD) recommandée. Le DPO (s'il existe dans l'entreprise) doit être consulté sur la configuration technique du canal d'alerte.
Article written by Samuel HAYOT
Chartered Accountant, registered with the Institute of Chartered Accountants.
Regulated French accounting and audit firm based in Paris 8, built to support companies across France with a digital and decision-oriented approach.
Sources
Official and operational sources cited for this page.
- Légifrance — Loi n° 2016-1691 du 9 décembre 2016 (Sapin 2), art. 17
- AFA — Recommandations destinées à aider les personnes morales
- AFA — Guide pratique anticorruption à destination des PME et petites ETI
- Légifrance — Loi n° 2022-401 du 21 mars 2022 (whistleblowers transposition UE 2019/1937)
- AFA — Directive CSRD et obligations anticorruption
This topic is part of our service Outsourced CFO in France | Fractional finance leader
Need a quote or personalised advice?
Our accountancy firm supports you through all your steps. Get a free quote to review your situation and receive a bespoke fee proposal, or contact us directly.