Learn how customer due diligence in France works, including KYC checks, beneficial ownership, risk assessment, enhanced vigilance and ongoing monitoring.
Customer due diligence (CDD) is a core component of France’s anti-money laundering and counter-terrorist financing (AML/CFT) framework, known in French as LCB-FT. It helps covered organizations establish who their customers are, understand who ultimately owns or controls them, assess financial crime risks and monitor relationships over time.
Under the French Code monétaire et financier, applicable organizations must conduct customer identification and verification, collect information about the purpose and nature of business relationships, and apply appropriate ongoing vigilance. The precise obligations depend on the organization’s regulated activities and the circumstances of the relationship.
This guide explains the French CDD framework, the practical verification process, risk-based vigilance, enhanced checks, ongoing monitoring and the actions required when concerns arise.
Customer due diligence is the process of establishing and verifying customer identity, understanding relevant ownership and control, assessing risk and maintaining appropriate knowledge of the customer throughout the relationship.
Article L. 561-5 of the French Code monétaire et financier addresses customer identification and verification. Article L. 561-5-1 requires covered entities to collect relevant information about the purpose and nature of a business relationship before entering into it and update that information throughout the relationship.
CDD can involve:
Identifying customers and verifying their identity using appropriate evidence.
Identifying and verifying beneficial owners where applicable.
Understanding the customer’s activities and intended use of the service.
Assessing risks associated with the customer, geography, products and transactions.
Reviewing customer information and monitoring activity as required.
Requirements can differ between an ongoing business relationship and an occasional transaction. Organizations must determine which legal provisions apply rather than assume identical checks or thresholds in every situation.
AML covers the broader framework for preventing and detecting money laundering and terrorist financing. KYC (Know Your Customer) focuses on establishing customer identity and understanding relevant customer information. CDD brings these activities together with risk assessment and continuing vigilance.
KYC is therefore an important part of CDD, while CDD operates within the wider AML framework. Read the guide to the differences between KYC and AML for a more detailed comparison.
Article L. 561-2 identifies the persons and entities subject to French AML/CFT obligations. Depending on their activities and the applicable statutory conditions, these include banks, payment and electronic-money institutions, relevant insurance and investment businesses, certain financial intermediaries, notaries, lawyers acting within specified activities, accountants, auditors and other designated professionals.
Not every French business is automatically subject to the same CDD obligations. For example, a professional may be covered only when performing particular activities defined by law. Sector-specific rules and exemptions can also affect the applicable requirements.
Organizations should assess their legal status, activities, supervisory framework and customer relationships before determining their obligations. The French AML/CFT legislation on Légifrance provides the statutory scope.
The principal requirements combine identification, verification, understanding the relationship and ongoing vigilance.
Customer identification and verification: Establish who the customer is and verify the information using appropriate reliable evidence.
Beneficial ownership: Identify the natural persons who ultimately own or control a customer when required.
Purpose and nature: Understand why the relationship is being established and what activity is reasonably expected.
Risk-based vigilance: Apply measures proportionate to the identified risks, including additional checks where required.
Ongoing monitoring: Keep relevant information current and examine transactions in the context of the customer’s known profile.
These legal obligations should be distinguished from internal procedures, such as particular approval workflows or review schedules. Internal controls should implement applicable requirements without being mistaken for universal statutory rules.
For an individual, collect the identifying information required by the applicable rules. For a company, establish its legal identity using relevant registration details, legal name, registered office and corporate information.
Where someone acts for the customer, establish their authority to represent that person or entity. Collect information appropriate to the relationship and the organization’s legal obligations.
Collecting information is not the same as verifying it. Verification means assessing whether appropriate evidence supports the customer’s claimed identity.
Depending on the circumstances and applicable rules, evidence may include identity documents, reliable independent records, corporate registers or suitable electronic verification methods.
Investigate expired documents, inconsistent details, poor-quality evidence and unexplained discrepancies. A digital check or automated screening result should not automatically be treated as conclusive. If required verification cannot be completed, escalate the case and determine whether the relationship may legally proceed.
A beneficial owner is the natural person who ultimately owns or controls a company. Under Article R. 561-1, the relevant criteria for a company include direct or indirect ownership of more than 25% of its capital or voting rights, or control exercised through other means. The applicable legal definitions and fallback provisions must also be considered.
Review ownership charts, company records, shareholder information and other reliable evidence. Look beyond the immediate shareholder when several companies or other entities form an ownership chain.
Illustrative example: A French company is owned by two holding companies registered in different jurisdictions. Rather than treating those holding companies as the final owners, the compliance team traces the ownership chain to the natural persons who ultimately own or control the business. Unexplained discrepancies are investigated and documented.
The lesson is that registered ownership and ultimate control are not always the same.
Establish why the customer wants the product or service and what activity is reasonably expected. Depending on the relationship, relevant information may include the customer’s business model, anticipated transaction types, expected volumes, counterparties and geographic exposure.
Source-of-funds checks help establish where money used in a particular transaction or relationship originates. Source-of-wealth checks concern how a person accumulated their overall wealth. Additional evidence may be appropriate when required by law or justified by the risk.
Assess relevant customer, geographic, product, delivery-channel and transaction risks. Screening may include checks for politically exposed persons (PEPs), applicable sanctions and other relevant risk information.
A screening alert is an indication requiring assessment, not automatic proof of wrongdoing. Resolve potential matches using reliable identifying information and document the outcome.
The risk assessment should determine the nature and intensity of vigilance. See FCI’s guide to AML risk assessment best practices for further guidance.
Before onboarding, confirm that required checks have been completed and material discrepancies resolved. Escalate higher-risk cases or incomplete verification through the appropriate compliance process.
If mandatory CDD measures cannot be performed, applicable French rules may prevent the organization from establishing or continuing the relationship or carrying out the transaction. Assess the specific legal requirements and reporting implications rather than treating refusal, internal escalation and suspicious transaction reporting as interchangeable decisions.
French AML/CFT compliance follows a risk-based approach. The following table is an operational comparison, not a claim that every organization must use an identical three-tier classification.
|
Vigilance approach |
When it may apply |
Main considerations |
|
Simplified vigilance |
Where legally permitted and the risk supports it |
Apply only permitted reductions; retain required controls |
|
Standard CDD |
Routine onboarding and customer relationships |
Identify, verify, understand and assess the relationship |
|
Enhanced vigilance |
Higher-risk circumstances or specific legal triggers |
Conduct additional checks and apply appropriate safeguards |
Simplified vigilance is not a blanket exemption from AML/CFT obligations. Organizations must establish that the legal conditions are satisfied and consider whether suspicion or other risk factors require stronger measures.
Enhanced vigilance involves additional scrutiny where required by law or justified by risk. Its precise form depends on the customer, transaction and applicable provisions.
Build your understanding of CDD and risk-based controls: Explore FCI’s AML/KYC online training to study customer verification, beneficial ownership, risk assessment and monitoring in a structured learning programme.
PEPs are individuals who hold or have held prominent public functions. Relevant family members and close associates may also fall within applicable PEP-related requirements.
Article L. 561-10 provides for complementary vigilance in specified circumstances. Depending on the case, measures may include appropriate senior-management approval, establishing source of wealth or source of funds, and enhanced ongoing monitoring.
PEP status does not establish that a person has committed a crime. It indicates potential exposure that must be managed in accordance with the applicable requirements.
Geographic risks can arise from a customer’s residence, business activities, counterparties or transaction routes. Organizations should consult applicable EU measures, relevant official country lists and current French requirements.
Article L. 561-10 addresses specified situations involving countries or territories identified by the FATF/GAFI or European Commission. The required response depends on the applicable measures and risk circumstances; an internal high-risk classification should not be confused with a universal legal designation.
Opaque ownership structures, inconsistent explanations, unexplained funding and transactions without an apparent economic purpose may justify further investigation.
Article L. 561-10-2 requires enhanced examination of particularly complex or unusually large transactions, or those that appear to lack economic justification or a lawful purpose. Relevant inquiries include the origin and destination of funds, the transaction’s purpose and the identity of the beneficiary.
Risk indicators are reasons to investigate, not conclusions of criminal conduct.
CDD continues after onboarding. Article L. 561-5-1 requires covered entities to update relevant information about the purpose and nature of a business relationship throughout its duration.
Ongoing vigilance may involve:
Updating customer and beneficial-owner information when required.
Reviewing material changes in ownership, business activity or risk.
Comparing transactions with the customer’s known profile.
Investigating alerts and recording decisions.
Adjusting the intensity of review to applicable rules, risk and relevant changes.
Customer reviews and transaction monitoring are related but distinct controls. A periodic review updates understanding of the customer; transaction monitoring examines activity for unusual or potentially suspicious patterns.
There is no single review interval that should automatically be applied to every customer. Organizations should follow applicable requirements and their risk-based procedures.
When checks reveal discrepancies or unusual activity, staff should follow established escalation procedures. The appropriate response may include obtaining further evidence, resolving a screening match, restricting onboarding where legally required or referring the case to the compliance function.
Covered entities have obligations to report suspicions to TRACFIN in accordance with the applicable legal framework. The designated reporting process, timing and scope depend on the circumstances and relevant law. Staff should follow internal procedures and applicable confidentiality restrictions; they should not disclose a suspicious transaction report to the customer where prohibited.
An alert does not automatically prove wrongdoing or mean that every case requires a report. The decision must be assessed and documented by the appropriate function.
For official information, consult TRACFIN and the applicable provisions of the French Code monétaire et financier.
Common weaknesses include:
Collecting documents without verifying them: Assess the reliability and consistency of the evidence.
Missing beneficial owners: Trace ownership and control through relevant layers.
Applying identical checks to every customer: Tailor vigilance to legal requirements and assessed risk.
Accepting screening alerts without investigation: Resolve potential matches before reaching a conclusion.
Failing to update customer information: Reassess material changes throughout the relationship.
Keeping incomplete records: Document evidence, decisions and the rationale for actions.
Ignoring escalation procedures: Refer unresolved concerns to the appropriate compliance function.
Poor decision documentation: Record verification evidence, decisions, and the rationale behind actions taken.
These improvements help make CDD more consistent, defensible and useful for identifying financial crime risks.
Use this general checklist as an operational aid. Adapt it to applicable law, sector-specific requirements and approved internal procedures.
Onboarding and identification
Identify the customer and verify their identity.
Establish representative authority where relevant.
Collect information about the purpose and nature of the relationship.
Ownership and risk
Identify and verify beneficial owners where applicable.
Conduct relevant PEP and sanctions screening.
Assess and document customer risk.
Determine appropriate vigilance measures.
Approval and escalation
Resolve material discrepancies.
Complete required additional checks.
Record decisions and supporting rationale.
Escalate concerns through approved procedures.
Ongoing vigilance
Update customer information as required.
Monitor relevant transactions and activity.
Reassess material changes in risk.
Investigate alerts and assess reporting obligations.
Effective CDD depends on staff understanding not only which information to collect, but also how to verify it, recognize risk indicators, investigate discrepancies and document decisions.
FCI provides resources on AML compliance training, AML compliance training in France and AML training requirements in France. These resources can help readers explore the broader compliance and learning context.
For professionals seeking structured learning, the AML/KYC online training course covers customer due diligence, beneficial ownership, risk-based approaches, digital verification, monitoring and TRACFIN reporting principles. Training can support staff understanding but does not replace an organization’s own controls, legal analysis or procedures.
Customer due diligence in France combines reliable customer identification, verification of beneficial ownership where applicable, understanding the business relationship, proportionate vigilance and ongoing monitoring. When concerns arise, organizations must investigate, document decisions and follow the applicable escalation and reporting requirements.
The key is to apply current French AML/CFT law to the organization’s specific activities and risks rather than rely on a one-size-fits-all process. Consult official legislation and supervisory guidance as requirements evolve.
Learn about KYC in France, including identity verification, beneficial ownership, risk-based due diligence and ongoing AML/CFT requirements.
Learn how to prevent payment fraud in France with this complete AML compliance guide covering KYC, transaction monitoring, TRACFIN, ACPR, PSD2, and fraud prevention best...
Financial crime can pass through legitimate businesses long before anyone recognizes the money as criminal proceeds. Anti-Money Laundering, or AML, is the set of laws,...
