Crypto & Virtual Assets Compliance in France

France is open to online crypto businesses, but only through the MiCA authorisation route. The Autorité des marchés financiers (AMF) authorises crypto-asset service providers and supervises their conduct, while the Autorité de contrôle prudentiel et de résolution (ACPR) supervises their anti-money laundering and counter-terrorist financing (AML/CFT) controls. Tracfin receives suspicious transaction reports.

The biggest obstacle for a new entrant is the authorisation file itself: MiCA requires a registered office and effective management in the EU, minimum capital, and documented AML/CFT and ICT controls before the first customer is onboarded. Firms that relied on the French national regime and had no MiCA authorisation by 1 July 2026 were removed from the register automatically.

1. Who regulates this sector

2. Licensing and authorisation

Under Article 59 of Regulation (EU) 2023/1114 (MiCA), only a legal person authorised as a crypto-asset service provider (prestataire de services sur crypto-actifs, PSCA) under Article 63, or a listed financial entity such as a bank or investment firm under Article 60, may provide crypto-asset services in the EU. Providers need a registered office, effective management and at least one resident director in the EU (Article 59(2)).

The French transition is over

Under article 8 III of loi n° 2023-171, the national "PSAN" registration regime (articles L54-10-1 to L54-10-6 of the Code monétaire et financier, CMF) ceased to apply at the end of the MiCA transitional period, which MiCA Article 143(3) capped at 1 July 2026. The AMF delisted PSAN without MiCA authorisation on 2 July 2026; there is no equivalence regime for third-country providers. On 6 July 2026 France had 31 authorised providers and the EU 283.

Application and timeline

Applications use the AMF's PSCA forms, including a DORA cybersecurity self-assessment. MiCA Article 62 requires a description of internal control mechanisms and procedures to manage money laundering and terrorist financing risks, ICT documentation and client asset segregation procedures. The regulator has 25 working days to check completeness and 40 working days from a complete file to decide (Article 63(2) and (9)).

A provider authorised in another Member State can serve French customers after notifying its home regulator under MiCA Article 65. ESMA's interim MiCA register (last updated 22 October 2026) and the AMF white list show who is authorised. Authorised providers taking on clients of winding-down firms must first complete AML/CFT checks.

3. AML, KYC and customer due diligence

Crypto-asset service providers authorised under MiCA Article 59, including French branches of providers based elsewhere in the EU, are obliged entities under CMF article L561-2, 7° bis (current version in force since 5 August 2026). Providers authorised only for crypto portfolio management or advice, and certain investment firms and fund managers offering crypto services, fall under 7° quater instead. The ACPR supervises AML/CFT compliance for 7° bis providers and the AMF for advice-only and portfolio-management-only providers (L561-36 and L561-36-1), a split that ordonnance n° 2024-937 kept in place when MiCA took effect.

No threshold for occasional customers. Before carrying out any operation for an occasional customer, a crypto-asset service provider must identify and verify that customer and any beneficial owner, whatever the amount (R561-10 II 5°). This is stricter than the €1,000 threshold in the EU Anti-Money Laundering Regulation (AMLR), which applies from July 2027 (Article 19(3)).

Customer due diligence

Before entering a business relationship, identify the customer and any beneficial owner and verify those elements on reliable evidence (L561-5). For a natural person, the identification data are surname, first names, and date and place of birth (R561-5).

Ongoing monitoring

Constant vigilance and careful examination of operations throughout the relationship, consistent with the customer's profile (L561-6).

Enhanced due diligence

Required for politically exposed persons, products or operations that favour anonymity, and operations linked to FATF or EU high-risk countries (L561-10, in force since 24 December 2025).

Beneficial owners

More than 25% of capital or votes, or control. Obliged entities keep full access to the INPI register.

Suspicious transaction reporting

Under L561-15, providers report to Tracfin, with no monetary threshold, sums and operations they know or suspect derive from an offence punishable by more than one year's imprisonment or are linked to terrorist financing. Tracfin requires the report before the transaction is executed, so it can exercise its right of opposition; reports go through the ERMES platform.

Asset freezes

L562-4 requires obliged entities to apply freeze measures without delay and to inform the Minister of the Economy immediately. The Direction générale du Trésor publishes the national register of freezes, covering national, EU and UN measures, with a public API (latest publication 27 October 2026). EBA Guidelines EBA/GL/2024/15 on restrictive measures apply to crypto providers from 30 December 2025; the AMF adopted them as position DOC-2025-02.

4. Identity verification and onboarding

Article R561-5-1 CMF (in force since 5 April 2021) sets the primary verification routes. A provider can verify identity through an electronic identification means certified or attested by ANSSI at the eIDAS "substantial" or "high" assurance level, or one issued under a scheme notified to the European Commission at those levels; or, when the customer is physically present, through the original of a valid official photo identity document, keeping a copy.

Where those routes cannot be used, R561-5-2 requires at least two of the following measures:

• a copy of an official identity document;
• verification and certification of that copy by a third party independent of the customer;
• a first payment from or to an account in the customer's name at a bank or payment institution in the EU, the EEA or an equivalent third country;
• direct confirmation of identity from a third party meeting the reliance conditions of L561-7;
• a remote identity verification service certified by ANSSI (or a body it authorises) at the "substantial" level of the identity-proofing requirements of Implementing Regulation (EU) 2015/1502, known as PVID;
• a qualified or advanced electronic signature or seal, or a qualified electronic registered delivery service.

ANSSI publishes the certification framework for these remote services (arrêté of 28 March 2021). The ACPR's identification guidelines (December 2021 version) confirm that verification may be remote, that the in-person document route excludes videoconferencing, that biometrics and video are usable within R561-5-1 or R561-5-2, and that reading the machine-readable zone alone is not verification. ACPR inspections of crypto firms found verification shortcomings, including where specialised providers were used, and detected impersonation cases.

5. Digital channels: what's different

Bottom line: French AML rules are channel-neutral in what they require, but they prescribe exactly which evidence counts online: a certified eIDAS identity, or two listed remote measures, never a scan of an ID document on its own.

Two measures, not one

Without a certified eIDAS identity, a remote flow must combine two R561-5-2 measures, for example an ID document copy plus a first payment from an own-name bank account. An ANSSI-certified PVID service counts as one measure.

Remote onboarding quality is a risk factor

EBA risk factor guidelines for crypto providers (EBA/GL/2024/01, still in force under AMLA) treat remote solutions that do not meet the EBA remote onboarding guidelines (EBA/GL/2022/15) as higher risk, as are darknet-linked IPs, anonymisers, shared devices and inconsistent IP data.

What is changing

AMLA's final draft standards on customer due diligence [Final draft, not yet adopted], sent to the Commission on 1 October 2026, cover non-face-to-face verification and electronic identification.

6. Data protection and biometrics

The General Data Protection Regulation (GDPR) and the loi Informatique et Libertés apply, supervised by the CNIL. Due diligence data meet the legal obligations in L561-5 and R561-5 and are kept for five years after the relationship ends (L561-12; Article 26 of Regulation (EU) 2023/1113 for travel rule records). Customers exercise their right of access to data processed solely for AML purposes through the CNIL, which releases them only if this would not reveal a suspicious transaction report (L561-45); telling a customer about a report is prohibited (L561-18).

Biometrics

Face matching processes biometric data "for the purpose of uniquely identifying a natural person", which GDPR Article 9(1) and article 6 of the loi Informatique et Libertés prohibit unless an exception applies. The CNIL considers that, unless a legal text makes biometrics mandatory or expressly authorises them, only explicit consent (Article 9(2)(a)) can be relied on, that biometrics cannot be imposed without an alternative, and that templates should preferably stay on devices under the user's exclusive control (recommendation on multi-factor authentication, 20 March 2025). French AML rules do not require biometrics, so an eIDAS identity or two R561-5-2 measures without face matching can serve as that alternative. Large-scale processing of biometric data requires a data protection impact assessment (GDPR Article 35(3)(b)). One-to-one verification that a person is who they claim to be is excluded from the AI Act's high-risk biometric category (Regulation (EU) 2024/1689, Annex III, point 1(a)).

Travel rule data and blockchains

Travel rule data may be processed only to prevent money laundering and terrorist financing; commercial use is prohibited, and new clients must receive GDPR information before the relationship or occasional transaction starts (Regulation (EU) 2023/1113, Article 25). The European Data Protection Board advises against storing personal data on a blockchain (Guidelines 02/2025, version 2.0, adopted 7 July 2026), and the CNIL recommends that any personal data recorded on-chain take the form of a cryptographic commitment.

Personal data breaches must be notified to the CNIL within 72 hours of awareness (GDPR Article 33). Crypto-asset service providers are also within the Digital Operational Resilience Act (DORA), whose separate major ICT incident reports start with an initial notification no later than 24 hours after awareness.

7. Sector-specific obligations

Travel rule

Regulation (EU) 2023/1113 has applied since 30 December 2024. Every transfer must carry the originator's name, ledger address or account, and address with official document and customer numbers (or date and place of birth), plus the beneficiary's name and address or account; the originator's data are verified before transfer (Article 14(1), (2) and (6)). Unlike transfers of funds, crypto transfers carry these requirements regardless of amount (recital 30). The EBA travel rule guidelines (EBA/GL/2024/11) apply from 30 December 2024; both the ACPR and the AMF (position DOC-2024-08) apply them.

Self-hosted wallets

For transfers to or from a self-hosted address, the provider must obtain and hold the originator and beneficiary information. Above €1,000, it must take adequate measures to assess whether the address is owned or controlled by its customer (Articles 14(5) and 16(2)). French law adds a risk-based layer for all self-hosted transfers: providers must assess the risk and apply enhanced measures (L561-10-4, in force since 30 December 2024), choosing among verifying the identity of the originator or beneficiary, collecting more information on the origin and destination of the assets, and enhanced ongoing monitoring (R561-21-1).

Anonymity-enhancing coins

From 10 July 2027, AMLR Article 79 bans anonymous crypto-asset accounts and accounts allowing anonymisation or obfuscation, including through anonymity-enhancing coins. Until then, products favouring anonymity trigger enhanced due diligence (L561-10).

Tax reporting of users

France applies Directive (EU) 2023/2226 (DAC8) through articles 1649 AC bis to 1649 AC sexies of the Code général des impôts; décret n° 2025-1276 (in force since 25 December 2025) sets the due diligence. Providers must obtain a self-certification of each user's tax residence when the relationship starts, and from existing users before 1 January 2027, and check that it is plausible against the documents collected for AML due diligence (décret article 15).

8. Risk indicators and red flags

Crypto-asset typologies (ACPR, Tracfin and EBA)

• Mixers and tumblers: funds that pass through services that break traceability.
• Privacy coins: assets with optional or mandatory anonymity features.
• Anonymised access: VPNs, proxies, Tor or a darknet-linked IP address.
• IP mismatch: an IP address in a different country from the declared residence.
• Shared devices: one IP address or device used by several unrelated customers.
• Peeling and smurfing: funds split across many addresses or small transfers.
• Illicit sources: links to ransomware, hacks, scams or darknet markets.
• Money mules: vulnerable customers making frequent or high-value transfers.

Tracfin's 2024-2025 threat assessment calls crypto-assets an established part of illegal financial networks, also used to evade sanctions. Its "rug pull" scam warning signs include social-media promotion, promised safe returns, sudden token price rises and AMF-blacklisted assets.

9. Enforcement and penalties

For AML/CFT and asset-freeze breaches, the ACPR's Commission des sanctions applies L612-39 (L561-36-1):

• disciplinary sanctions graded by seriousness: warning, reprimand (blâme), ban on certain operations, temporary suspension or dismissal of managers, and partial or total withdrawal of authorisation;
• instead of or in addition, a financial penalty of up to €100 million or 10% of annual net turnover for breaches of the AML/CFT chapters of the CMF and of EU AML/CFT and restrictive-measures rules.

For MiCA conduct and authorisation breaches, the AMF Commission des sanctions can impose a warning, reprimand, temporary or permanent ban, and a fine of up to €100 million or ten times the profit made (L621-15 III a), which covers authorised crypto-asset service providers listed in L621-9 II 21°).

ACPR inspections of crypto providers reported in October 2025 found weak customer data, risk profiles and transaction monitoring, with outcomes from follow-up letters to disciplinary measures and register removals. The AMF blacklist is the most visible action against online operators: on 8 July 2026 it added seven unauthorised crypto-asset websites.

The CNIL fined a company selling cryptocurrency wallets €750,000 on 10 October 2024 for data security and retention failings.

10. Recent changes and what to watch

• 10 July 2027: [Adopted, applies 10 Jul 2027] The AMLR applies directly, harmonising due diligence and banning accounts in anonymity-enhancing coins.
• 21 October 2026: [Proposal, not legislation] French authorities proposed stronger ESMA supervision of significant providers, a DeFi framework and clearer staking and lending rules in the MiCA review.
• 7 October 2026: [Consultation response] AMLA asked for staking, lending, DeFi control and unauthorised stablecoins to be addressed in the MiCA review.
• 1 October 2026: [Final draft, not yet adopted] AMLA submitted final draft standards on customer due diligence, business relationships and group-wide controls to the European Commission.
• 2 July 2026: [In force] The national PSAN regime ended; providers without MiCA authorisation were delisted and must wind down.
• 1 January 2026: [In force] AMLA took over the EBA's AML/CFT mandates; existing EBA guidelines remain in force until replaced. DAC8 crypto tax reporting applies from the same date.
• 25 December 2025: [In force] Décret n° 2025-1276 sets DAC8 tax due diligence; existing users must provide tax-residence self-certifications before 1 January 2027.

11. What this means for identity verification

• Two routes. Offer certified eIDAS identity where available and a two-measure fallback, such as a document check plus an own-name bank payment, or a certified PVID service.
• A document copy is one measure only and always needs a second.
• Verify every occasional customer, whatever the amount.
• Biometrics need explicit consent, a non-biometric route and an impact assessment; keep templates on the device where possible.
• Capture travel-rule and tax data at onboarding: address, document number or date and place of birth, and tax residence.
• Check self-hosted wallets: ownership above €1,000, risk-based measures below it.
• Use IP and device signals as risk inputs, and re-verify when data are doubtful or risk changes.