Fintech & Digital Payments Compliance in France

France is open to online payment, e-money and money transfer businesses, including firms licensed elsewhere in the European Economic Area that operate through agents or distributors. The ACPR authorises and supervises them, including for anti-money laundering; Tracfin receives suspicious transaction reports; the Direction générale du Trésor runs the national asset-freeze register.

The biggest obstacle for a new entrant is the verification design. French law lists the remote methods it accepts, and the ACPR has sanctioned payment firms for weak customer knowledge, monitoring and oversight of agent networks, so an onboarding flow built only for conversion will not pass supervision.

1. Who regulates this sector

2. Licensing and authorisation

The Code monétaire et financier (CMF) reserves payment services and e-money issuance to authorised providers. The main routes for a non-bank are:

Payment institution

Before providing payment services, a payment institution must obtain an agrément from the ACPR, issued after the Banque de France's opinion, and only to a legal person (art. L522-6 CMF). The ACPR notifies its decision within three months (art. R522-1). Minimum capital is €20,000 for money remittance only, €50,000 for payment initiation only and €125,000 for other payment services (arrêté of 29 October 2009, art. 4).

Simplified payment institution

A lighter agrément is available where forecast payment volume stays below a ceiling set by decree (art. L522-11-1): three million euros per month, averaged over twelve months (art. D522-1-1).

E-money institution

Issuing and managing e-money requires an ACPR agrément, again after the Banque de France's opinion (art. L526-7), and minimum capital of €350,000 (arrêté of 2 May 2013, art. 4).

Account information services

Account information service providers register with the ACPR instead of seeking full authorisation (art. L522-11-2), and must hold professional liability insurance (art. L522-7-1).

Agents, distributors and passporting

A payment service provider may act through agents, which it must register with the ACPR (art. L523-1). The provider "demeure pleinement responsable" (remains fully responsible) for its agents and must bring them within its internal control and anti-money laundering framework (art. L523-3). EU payment and e-money institutions that use agents or distributors in France are themselves obliged entities under French anti-money laundering law (art. L561-2, 1° quater).

Exclusions and penalties

Limited-network instruments are excluded, but must be notified to the ACPR once twelve-month volume exceeds one million euros (art. L521-3). Providing payment services without authorisation is punishable by three years' imprisonment and a fine of €375,000 (art. L572-5); the same penalties apply to unauthorised e-money issuance (art. L572-13).

3. AML, KYC and customer due diligence

Payment institutions and e-money institutions are obliged entities under art. L561-2 CMF (1° bis and 1° ter). Their core duties are:

• Identify and verify before onboarding. Before entering a business relationship, firms identify the customer and any beneficial owner and verify these elements "sur présentation de tout document écrit à caractère probant" (on presentation of any reliable written document) (art. L561-5). For a natural person, identification data are surname, first names, and date and place of birth (art. R561-5).
• Occasional customers. Money remittance (transmission de fonds) requires identification and verification before the transfer whatever the amount; other occasional operations are caught above €15,000, cash or e-money operations above €10,000, or on suspicion (art. R561-10).
• Knowledge and monitoring. Firms keep constant vigilance over the relationship and check that operations match their up-to-date knowledge of the customer (art. L561-6). If they cannot complete due diligence, they must not execute any operation or start or continue the relationship (art. L561-8).
• Enhanced due diligence. Additional measures apply to politically exposed persons, anonymity-favouring products and high-risk countries; since 24 December 2025 their intensity and frequency must match the customer's risk profile (art. L561-10). Remote onboarding is not on this list.
• Beneficial owners. A beneficial owner is a natural person holding more than 25% of capital or votes, or otherwise controlling the company. Since 31 July 2024, access to the beneficial ownership register kept by INPI (the national business register) is limited to supervisors, obliged entities and persons with a legitimate interest.
• Asset freezes. Freezes apply without delay (art. L562-4). The joint DG Trésor and ACPR guidelines (updated 16 March 2026) expect screening before onboarding, customer-base screening as soon as a list changes (weekly screening is insufficient) and screening of transfers before settlement.
• Retention. Customer and due diligence records are kept for five years after the account is closed or the relationship ends, and transaction records for five years after execution (art. L561-12).

E-money exemption and simplified measures

Simplified measures may be applied where risk is low (art. L561-9). E-money issuers may skip identification and verification only if every condition of art. R561-16-1 is met: the e-money buys consumer goods or services only (not crypto-assets), stores no more than €150 and, if reloadable, is capped at €150 of storage and payments per 30 days and used only in France; it cannot be loaded with cash (with narrow exceptions) or with unverified e-money; and the issuer monitors transactions. Cash redemptions over €50, and payments initiated online or by remote device over €50 per transaction, always require full due diligence.

Reporting

Firms report to Tracfin any sums or operations they know, suspect or have good reason to suspect derive from an offence punishable by more than one year's imprisonment or are linked to terrorist financing (art. L561-15). Tracfin states that there is no reporting threshold and that the report must normally be filed before the transaction is executed, through its ERMES platform. Money remittances funded by cash or e-money are also reported systematically from €1,000 per operation or €2,000 per customer per calendar month, within 30 days after the month of payment (art. R561-31-1).

4. Identity verification and onboarding

Art. R561-5-1 CMF lists the methods that verify identity on their own:

• an electronic identification means certified or attested by ANSSI at the eIDAS "substantiel" or "élevé" level, or issued under a scheme notified to the European Commission at those levels (1°);
• an electronic identification means presumed reliable under the postal and electronic communications code (2°);
• for a customer physically present, the original of a valid official photo document, with a copy taken (3°);
• for a legal person, an official register extract less than three months old (4°).

Where none of these can be used, art. R561-5-2 requires at least two of six measures: a copy of an official document; certification of that copy by an independent third party; a first payment from or to an account in the customer's name at a regulated EU, EEA or equivalent institution; confirmation of identity by a qualifying regulated third party; a remote identity verification service certified by ANSSI at the "substantial" level of the EU identity-proofing requirements (Implementing Regulation (EU) 2015/1502); or an advanced or qualified electronic signature, seal or qualified registered delivery service.

How the ACPR reads these rules

The ACPR's identification guidelines (16 December 2021) set three limits. Physical presence "exclut le recours à la vidéoconférence" (rules out videoconference) (para. 35). The first-payment measure "ne saurait néanmoins reposer sur la simple présentation d'un RIB au nom du client" (cannot rest on merely showing a bank details slip in the customer's name): the firm must check that the payment actually comes from that account; e-money wallets do not qualify, and for a card payment the firm checks that the card is not linked to an e-wallet and that the cardholder holds the account (para. 46). Biometrics and videoconference may be used if they meet R561-5-1 or R561-5-2 (para. 48).

Certified remote verification and EU guidelines

ANSSI certifies remote identity verification providers (prestataires de vérification d'identité à distance, PVID) against its requirements framework (v1.1 of 1 March 2021) and publishes the list of certified providers. A certified service checks the document's authenticity, detects that the user in the video is live, and compares the face with the document photo or with the photo in the document's chip. Only passports and identity cards of EU, EEA and Swiss nationals and listed residence permits and travel documents are accepted. The European Banking Authority's guidelines on remote customer onboarding (EBA/GL/2022/15), with which the ACPR has declared compliance for all obliged entities it supervises, apply since 2 October 2023 and require liveness detection in unattended flows, capture during the session, comparison with the document photo and time-stamped records.

5. Digital channels: what's different

Bottom line: remote onboarding is not treated as higher risk in France, but it must use one of the verification methods the CMF lists, and a video call or a copied document alone never replaces meeting the customer in person.

Remote is not, by itself, high risk

Art. L561-10 CMF does not list non-face-to-face onboarding among its enhanced due diligence triggers; the ACPR guidelines treat the channel, including the internet, as one factor in the firm's risk classification.

Strong customer authentication

Payment service providers must apply strong customer authentication when the payer accesses a payment account online, initiates an electronic payment or acts remotely in a way that carries a fraud risk; for remote electronic payments, it must dynamically link the amount and the payee (art. L133-44 CMF).

Pending changes

The AMLR [Adopted, applies 10 Jul 2027] allows verification by an identity document plus reliable independent sources, or by eIDAS electronic identification at the substantial or high level (art. 22(6)). AMLA's final draft standard on customer due diligence [Draft, not adopted] would allow other remote document-based solutions only where the customer cannot present a document in person and has no access to qualifying electronic identification, with documented justification.

6. Data protection and biometrics

Biometric data used to identify a person uniquely are sensitive data, prohibited unless an exception applies (GDPR art. 9; Informatique et Libertés law, art. 6). The CMF does not itself authorise face matching, so firms rely on explicit consent, which the CNIL considers valid only if "le recours à la biométrie" is not "imposé sans alternative" (biometrics are not imposed without an alternative); the eID and two-measure routes can serve as that alternative. The CNIL prefers templates stored on the user's device and treats selfie-to-document matching for remote account opening as authentication, not identification. An impact assessment is likely required for large-scale sensitive data (GDPR art. 35(3)(b)), and credit scoring and payment-fraud processing are on the CNIL's mandatory list. Face matching used only to confirm a claimed identity falls outside the AI Act's high-risk biometric category; creditworthiness scoring becomes high-risk from 2 December 2027.

7. Sector-specific obligations

Oversight of agents and distributors

The ACPR's December 2025 review of eight money transfer providers found agent oversight "largement perfectible" and expects risk-based agent controls and anti-money laundering training before agents start and every year.

Operational resilience

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 to payment institutions, account information service providers and e-money institutions, covering ICT risk, incident reporting and oversight of ICT providers such as onboarding vendors.

Instant payments

Under Regulation (EU) 2024/886, euro-area providers have had to offer payee verification since 9 October 2025, and instant transfer providers screen their own users against EU sanctions after each list change and at least daily, instead of screening each instant payment. Payment and e-money institutions must offer sending and receiving instant euro transfers by 9 April 2027 [Applies 9 Apr 2027].

Buy now, pay later

Ordonnance n° 2025-880 of 3 September 2025 transposes the revised EU Consumer Credit Directive and brings split and deferred payments within consumer credit rules, with stronger creditworthiness assessment and pre-contractual information [Adopted, effective 20 Nov 2026].

8. Risk indicators and red flags

Payment, e-money and money transfer typologies (ACPR and Tracfin)

• Shared identifiers: the same identity document or phone number used by several customers.
• Multiple identities: one customer operating under several identifiers.
• Fan-out transfers: one sender paying many beneficiaries.
• Romance and pension fraud: large transfers to Africa linked to romance scams or abuse of elderly people's pensions.
• Shell companies: newly created firms at a domiciliation or coworking address moving large sums quickly through payment accounts.
• Prepaid cards: cards reloaded with prepaid coupons, which Tracfin calls a favoured laundering and terrorist financing vehicle.
• Organised networks: patterns linked to organised crime detected by payment account managers.

9. Enforcement and penalties

The ACPR's Commission des sanctions may impose sanctions ranging from a warning or reprimand (blâme) to withdrawal of authorisation, and, instead or in addition, a fine of up to €100 million or 10% of annual net turnover for breaches of the anti-money laundering chapter, EU anti-money laundering rules and restrictive measures. Unauthorised activity is a criminal offence (section 2).

• MoneyGram International SA (15 April 2026, procedure n° 2024-06): a Belgian payment institution operating in France through an agent network (1,156 retail agents at the time of inspection) received a reprimand and a €1.3 million fine for inadequate customer knowledge, miscalibrated monitoring, missing enhanced reviews, late and missing reports to Tracfin and weak agent oversight.
• Treezor (9 April 2024): a reprimand and a €1 million fine for weak customer risk profiling and deficient transaction monitoring.

10. Recent changes and what to watch

• 10 July 2027:[Adopted, applies 10 Jul 2027] the AMLR applies. Its e-money exemption (art. 19(7)) covers only non-reloadable instruments up to €150, narrower than today's French exemption.
• 20 November 2026:[Adopted, effective 20 Nov 2026] consumer credit reform covering split and deferred payments. Buy now, pay later products need creditworthiness checks and new disclosures.
• 30 September 2026:[Draft, not adopted] AMLA final report on the customer due diligence standard, to be sent to the European Commission. Remote document-based verification would become a justified fallback.
• 16 March 2026:[In force] updated DG Trésor and ACPR asset-freeze guidelines. Screening must follow every list change; weekly batch screening is not enough.
• 1 January 2026:[In force] AMLA takes over the EBA's anti-money laundering mandates; EBA guidelines stay in force until replaced.
• 9 October 2025:[In force] payee verification and daily sanctions screening of users for euro instant transfers.
• EU Payment Services Regulation:[Political agreement, not adopted] the deal was agreed on 27 November 2025 and approved by Parliament's economic committee on 5 May 2026; it would require payee name and IBAN matching, make providers liable for fraud losses where prevention is inadequate and require refunds in some bank-impersonation scams.

11. What this means for identity verification

• Offer an eID route first. An eIDAS substantial or high identity (for example France Identité's digital identity, certified at the high level; FranceConnect admits banks case by case for their due diligence obligations) satisfies verification in one step, and the AMLR and the draft EU standard favour it.
• Design the fallback as two measures. Document capture alone is one measure; pair it with an ANSSI-certified service, a verified first payment from the customer's own account, or a qualified electronic signature.
• Verify the first payment, not the account number. Match the incoming payment to an account in the customer's name, and exclude e-money wallets.
• Plan for 2027. Reloadable anonymous e-money and default document-plus-selfie flows may need redesign under the AMLR and the draft standard.