CNAPS approval for a private security company director: the 2026 process

Quick answer. The director's CNAPS approval (article L612-6 of the internal security code) is requested from the CNAPS, which checks good standing, professional aptitude and, for foreign nationals, lawful residence. It is valid for 5 years and is a condition for directing, managing or being a partner of a private security company. Without it, neither registration nor a signed contract allows you to invoice.

Many founders come to us with a project already well advanced: premises identified, client quotes in hand, first recruitments in sight, assuming it is enough to register the company to start. Yet without the CNAPS authorisations, the activity simply cannot begin. In this sector, regulation takes priority over the commercial calendar, and it is precisely this gap that creates the cash-flow difficulties we see most often. Here is how we structure this aspect in our company incorporation files.

Private security activities fall under Book VI of the internal security code (CSI), supervised by the CNAPS (National Council for Private Security Activities). This is not a single approval but three distinct and cumulative authorisations. This is the point that most often surprises founders, because each serves a different control purpose.

Our reading: the approval controls the person of the director, the authorisation controls the structure, the professional card controls each field agent. None of these authorisations exempts you from the others, and how they are sequenced over time is what determines the real start date of the activity.

Article L612-6 sets out the principle: "No one may carry out, on an individual basis, an activity mentioned in article L. 611-1, nor direct, manage or be a partner of a legal entity carrying out that activity, unless they hold an approval issued in accordance with terms defined by decree of the Council of State."

The approval is subject to substantive conditions set by the code (notably articles L612-6 and L612-7). Presented qualitatively, they concern:

• good standing: compatibility of behaviour and antecedents with the activity, which involves a criminal record check;
• professional aptitude: evidence of a recognised qualification;
• lawful residence, for foreign nationals.

The request is filed with the CNAPS, which reviews it and then issues the authorisation. The approval is valid for 5 years.

The underestimated risk. A director's antecedent can block the whole project, even where the company is sound and the funds are in place. We therefore raise this subject at the very first meeting, before any incorporation costs are committed. Spotting a good-standing issue before paying registry fees, the legal notice and the drafting of the articles means avoiding tying up several thousand euros in a structure that will not be able to operate.

Hayot Expertise tip. Before any incorporation spending, first secure the feasibility of the director's approval. It is the first building block: if it does not hold, the rest of the legal set-up has no reason to exist.

The operating authorisation (article L612-9 et seq. of the CSI) concerns the structure itself: the legal entity or the sole trader. It is issued by the CNAPS and is the key that allows the company to offer its services.

In practice, the order of operations is decisive. The operating authorisation is tied to a registered company and an approved director. We therefore coordinate the company's registration and the filing of the requests to avoid back-and-forth and periods during which the structure exists but cannot invoice. This coordination is as much a cash-flow matter as a legal one: every week of delay between registration and obtaining the authorisation is a week of fixed costs (rent, any salaries, subscriptions) with no revenue.

Each agent employed or assigned to a security activity must hold a professional card (article L612-20 of the CSI), valid for 5 years. This must be built into the forecast from the start: an agent without a card cannot be assigned to the field, which directly affects the company's ability to honour its contracts.

In a sector where payroll represents most of the costs, this point has a direct operational consequence: you can only answer a tender if you have carded agents available. The time taken to obtain cards then becomes a genuine commercial capacity factor, on a par with cash flow. Payroll management and hours tracking in this sector require a specific set-up, which we cover in our analysis of the accountant's role for a private security company.

A common case. The sole trader who personally carries out the assignments holds all three authorisations: the director's approval, the operating authorisation and the professional card. They must therefore meet the good-standing and aptitude checks both as a director and as a field agent.

The director's approval and the professional card are valid for 5 years. Their renewal must be requested at least 3 months before expiry. The point of vigilance is unequivocal: an expired authorisation interrupts the right to operate.

Here are the steps we follow in our incorporation files, in order:

1. check the future director's good standing and professional aptitude upfront;
2. gather the supporting documents for qualification and, where relevant, residence;
3. align the company's registration with the CNAPS filing timeline;
4. file the director's approval request with the CNAPS;
5. file the company's operating authorisation request;
6. arrange the professional cards for the first agents;
7. record the renewal deadlines (5 years) in a schedule, with a 3-month alert.

A few reflexes seem to us priorities when setting up a private security company:

• Do not sign a client contract with an effective date earlier than obtaining the operating authorisation: you would risk delivering a service without a valid authorisation.
• Do not underestimate the CNAPS review period in your cash-flow plan: budget to cover fixed costs during this period with no revenue.
• Check the required professional qualification before recruiting: an agent without a card cannot be assigned, and the necessary training takes time.
• Keep a 5-year schedule of authorisations: the expiry of an approval or a card is never notified on your behalf.

In the incorporation files we support, the most frequent bottleneck is not accounting but timing. We received a founder who already held signed contracts with sites to guard: company registered, first agent recruited, premises leased. The operating authorisation had not yet been issued. The result: the company existed, bore costs, but could not invoice a single service. The commercial launch promised to clients was several weeks ahead of the regulatory reality.

Our conviction, built on this type of file, is that a private security project is steered backwards: you start from the foreseeable date of obtaining the CNAPS authorisations, then align registration, recruitments and client commitments accordingly, not the other way round. It is the gap between the commercial logic ("I have clients, I start") and the regulatory logic ("I start when the authorisations are issued") that creates cash-flow strain. Our role is to align the legal timeline, the cash-flow forecast and the CNAPS review period so that the commercial launch coincides with obtaining the authorisations.

Beyond the approval, this sector has its own management constraints: the prevention and security collective agreement, hours tracking, a large payroll. We detail them on our dedicated page on accounting for private security companies and we support the set-up of payroll and social management, so that regulatory compliance and financial steering move forward together. This article is for information; a decision specific to your situation requires a review of your file and the law in force.