France expects larger companies to prove they prevent corruption: Sapin II requires eight anti-corruption measures from companies with at least 500 employees and turnover above EUR 100 million, and the AFA can fine failures even where no bribery occurred. The largest groups must publish a human rights and environmental vigilance plan. Employers with 50 or more staff need an internal whistle-blowing procedure. EU sanctions apply directly and banks and other professions report suspicions to Tracfin.
Sapin II and the AFA
The Sapin II law of 9 December 2016 defines the missions of the Agence française anticorruption (AFA): it issues recommendations, controls anti-corruption programmes and receives external reports of probity breaches. Companies and groups with at least 500 employees and turnover above EUR 100 million must operate eight measures: a code of conduct, an internal whistle-blowing system, a corruption risk map, value-chain assessment procedures, accounting controls, training, a disciplinary regime and internal monitoring. The AFA describes its scope as companies with their registered office in France meeting the thresholds alone or through their group, so a large French subsidiary of a foreign group should assume it is covered.
The AFA sanctions committee can order a company to bring its programme into line within up to three years and fine it up to EUR 1 million, and its managers up to EUR 200,000, for an inadequate programme even without any bribery. Where offences are alleged, prosecutors can agree a CJIP, a settlement with a fine of up to 30% of average annual turnover and, where required, up to three years of AFA-monitored compliance.12345
Duty of vigilance and whistle-blowing
A company with its registered office in France must publish and implement a vigilance plan if, over two financial years, it employs at least 5,000 people with its French subsidiaries or 10,000 with its French and foreign subsidiaries. A French company of 5,000 or more whose foreign parent has no plan covering it is also caught. The plan covers human rights, health and safety and environmental risks across subsidiaries, subcontractors and suppliers. Non-compliance can lead to a court order, civil liability and exclusion from public contracts.
Employers with at least 50 employees must set up an internal whistle-blowing procedure after consulting the CSE. Whistle-blowers can also go directly to external authorities, including the Défenseur des droits, and are protected against retaliation.678
AML and sanctions
EU sanctions regulations apply directly in France. The Direction générale du Trésor is the contact point for financial sanctions, receives asset-freeze declarations and maintains the national register of asset freezes, which counterparties should be screened against. Tracfin, the ministry's financial intelligence service, receives suspicion reports from more than 50 obliged professions, so French banks will apply full beneficial ownership and source-of-funds checks at onboarding and during the relationship.910
| Regime | Who is covered | Main obligation | Enforcer |
|---|---|---|---|
| Sapin II article 17 | 500+ employees and turnover above EUR 100m (company or group) | Eight anti-corruption measures | AFA; fines up to EUR 1m (company), EUR 200,000 (individuals) |
| Duty of vigilance | 5,000+ employees with French subsidiaries, or 10,000+ including foreign subsidiaries, over two years | Publish and implement vigilance plan | Courts, on application by interested parties |
| Whistle-blowing | Employers with 50+ employees | Internal reporting procedure after consulting the CSE | Défenseur des droits; courts |
How it works, step by step
- Check headcount and turnover of French entities against the Sapin II, vigilance and whistle-blowing thresholds2368Company (self-assessment)
- Build or localise the eight anti-corruption measures, starting with the risk map, for the French entity24AFA (control)
- Set up the internal whistle-blowing procedure once 50 employees is reached, after consulting the CSE8Employer; CSE
- Screen counterparties against EU sanctions lists and the national register of asset freezes9Direction générale du Trésor
No timings or fees are shown unless an official source states them.
Documents usually needed
- Anti-corruption code of conduct incorporated into the French internal rules
- Corruption risk map and third-party assessment files
- Whistle-blowing procedure and report-handling records
- Vigilance plan and implementation report in the management report (largest groups)
- Sanctions screening records
Common mistakes
- Assuming a global group policy satisfies Sapin II without a French risk map and local controls.
- Overlooking that AFA fines apply for an inadequate programme even where no bribery occurred.
- Counting only French headcount for the duty of vigilance when the 10,000 test including foreign subsidiaries may be met.
- Assuming a French subsidiary is outside the vigilance duty because its foreign parent is not French; a parent plan must actually cover it.
- Not offering an internal whistle-blowing channel once a French entity reaches 50 employees.
When the business crosses borders
- Settlements with French prosecutors (CJIP) can impose AFA-monitored compliance programmes on groups operating in several countries.
- Vigilance plans cover suppliers and subcontractors outside France.
- EU sanctions apply to EU nationals wherever they are and to entities established under member-state law, including French subsidiaries of foreign groups.
Questions businesses ask
Does Sapin II apply to the French subsidiary of a foreign group?
The AFA controls companies with their registered office in France that have at least 500 employees and turnover above EUR 100 million, alone or through their group. A French subsidiary meeting the thresholds should assume it is covered and take advice on how group figures are counted.32
What is a CJIP?
A settlement with French prosecutors for probity, tax fraud or environmental offences, with a fine of up to 30% of average annual turnover and possibly up to three years of AFA-monitored compliance. Meeting its terms ends the prosecution.5
Who must publish a vigilance plan?
Companies with their registered office in France employing, over two financial years, at least 5,000 people with French subsidiaries or 10,000 including foreign subsidiaries, and some large French subsidiaries of foreign groups.6
What this guide does not yet confirm
These points need checking with a qualified local professional in France before you rely on them.
- Effect on the French duty of vigilance of the EU Corporate Sustainability Due Diligence Directive as amended by the 2025-2026 omnibus simplification was not confirmed.
- How group headcount and turnover are aggregated for a French subsidiary of a foreign group under article 17 was not confirmed in detail; the official sources word the group test differently.
- Maximum criminal penalties for corruption, the detailed Tracfin reporting rules and any mandatory insurance requirements were not confirmed.
- Corporate governance code expectations (AFEP-MEDEF) for listed companies were not reviewed.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The missions of the Agence française anticorruption (AFA) are defined in article 3 of the Sapin II law of 9 December 2016; they include issuing recommendations, controlling anti-corruption programmes and, since the law of 21 March 2022, receiving external reports of breaches of probity. The AFA also coordinates the national multi-year anti-corruption plan (2025-2029, published 14 November 2025) and can be asked by the courts to monitor compliance programmes imposed under a CJIP.
Companies employing at least 500 people with turnover above EUR 100 million, and groups whose parent company has its registered office in France employing at least 500 people, must implement eight anti-corruption measures under article 17 of Sapin II. The eight measures are a code of conduct, an internal whistle-blowing system, a corruption risk map, procedures for assessing the value chain, internal or external accounting controls, training, a disciplinary regime and internal control and evaluation of the measures.
Official government portal; page undated. The AFA's own wording of the scope is in fr-risk-g01.
The AFA controls companies and public industrial and commercial bodies (EPIC) with their registered office in France that employ at least 500 people and have annual turnover above EUR 100 million, or that belong to a group meeting these criteria. Since the law of 13 June 2025 on drug trafficking, port terminal operators below these thresholds are also covered. Article 17 requires eight prevention and detection measures.
The AFA sanctions committee can order a company and its representatives to bring their compliance procedures into line within up to three years and can impose fines of up to EUR 1 million on companies and EUR 200,000 on individuals. Fines must be proportionate to the seriousness of the breaches and the party's financial situation. The committee can order publication of its decision at the party's expense. This is an administrative sanction, separate from criminal liability for bribery.
A company accused of breaches of probity, tax fraud or environmental offences can settle with the public prosecutor through a convention judiciaire d'intérêt public (CJIP), with a public-interest fine of up to 30% of its average annual turnover and, where required, a compliance programme under AFA supervision for up to three years. Code of Criminal Procedure, article 41-1-2. Performance of the obligations extinguishes the prosecution. The AFA reports 30 CJIPs for probity offences, 20 of them with AFA-monitored programmes.
The reference period for average turnover was not stated on this page.
A capital company with its registered office in France must establish, publish and implement a vigilance plan if, over its last two financial years, it and its French subsidiaries employ at least 5,000 people, or it and its French and foreign subsidiaries employ at least 10,000. Commercial Code, article L.225-102-4. Covers SA, SCA, SE and SAS. A French company with 5,000 or more employees whose foreign parent has not adopted a plan covering it is also covered; subsidiaries are exempt where the controlling company's plan covers them. The plan contains a risk map, assessment procedures for subsidiaries, subcontractors and suppliers, mitigation actions, an alert mechanism set up with trade unions and a monitoring system.
Official government portal; page undated. Effect of the EU Corporate Sustainability Due Diligence Directive as amended was not covered.
A company that fails to establish or publish its vigilance plan can be given formal notice with three months to comply, after which any person with standing can ask the court to order compliance under penalty payments; a company can also be held civilly liable for harm caused by a failure of vigilance. Commercial Code articles L.225-102-4 and L.225-102-5. A public buyer may exclude a company that did not establish a plan for the previous year (Code de la commande publique, article L.2141-7-1). The plan and its implementation report are included in the management report.
Official government portal; page undated. Effect of EU due diligence reforms not covered.
Employers with at least 50 employees must establish an internal procedure for receiving and handling whistle-blower reports, after consulting the CSE. Whistle-blowers can report externally, directly or after an internal report, to the Défenseur des droits, the judicial authority, competent authorities or EU bodies, and are protected against retaliation. Legal basis: law 2016-1691 (articles 6 to 13), law 2022-401 of 21 March 2022 and decree 2022-1284 of 3 October 2022.
The Direction générale du Trésor is the French contact point for implementing EU financial sanctions, receives declarations on asset freezes and suspected circumvention, and maintains the national register of asset freezes (registre national des gels). EU sanctions regulations apply directly to all natural and legal persons operating in the EU, to EU nationals wherever they are and to entities established under member-state law.
Tracfin, the financial intelligence service of the Ministry of the Economy, receives suspicious-transaction reports from the more than 50 professions subject to anti-money-laundering obligations under the Monetary and Financial Code. Obliged professions include banks, insurers and digital asset service providers, and in the non-financial sector notaries, casinos and commercial court clerks, among others. The financial sector provides nearly 93% of reports.
Questions on this topic
10 statements on anti-corruption, vigilance, whistle-blowing and sanctions in France
