COSI TRACFIN — France’s systematic reporting duties

A COSI is not a suspicious activity report. It is a monthly extract of facts that you owe TRACFIN whether or not anything looks wrong — and filing one does not discharge the duty to file the other. The communication systématique d’informations sits in Article L. 561-15-1 of the Code monétaire et financier, one article after the déclaration de soupçon, and rests on two decrees with hard numeric triggers: money remittance funded by cash or e-money, and cash above €10,000 a month. This piece covers both limbs, who is caught — including firms with no French licence — the ERMES channel after February 2025, and three worked cases.

1. What a COSI is, and what it is not

Article L. 561-15-1 requires the persons listed in Article L. 561-2 to communicate to the service designated in Article L. 561-23 — TRACFIN — information on certain operations presenting an elevated risk of money laundering or terrorist financing. The article identifies those operations by three objective handles: the country the funds come from or go to, the nature of the operation, and the legal structures involved. It leaves the detail to a décret en Conseil d’État, and has been in force in this form since December 2016.

Two features make the COSI structurally different from the déclaration de soupçon in Article L. 561-15.

• No suspicion is required, and none is asserted. A COSI is triggered by a threshold being crossed. The analyst forms no view; the extract reports what happened, and the population it produces is overwhelmingly ordinary.
• It does not replace anything. Paragraph II of L. 561-15-1 states that the information transmitted operates sans préjudice of declarations made under Article L. 561-15. A transaction can and often should be in both files.

Practitioners speak of COSI 1 and COSI 2. They are two obligations with different decrees, different populations and different systems behind them.

2. COSI 1 — money remittance funded by cash or electronic money

Article D. 561-31-1 covers the operations at 6° of II of Article L. 314-1 — money remittance — carried out from a cash deposit or by means of electronic money. That funding condition is the point of the limb: a remittance debited from a payment account already inside the regulated system is out of scope; a remittance funded by notes over a counter, or by an e-money balance, is in.

Two thresholds apply, and both matter:

• €1,000 per operation — a single remittance at or above this amount is reportable on its own.
• €2,000 cumulative per client over a calendar month — smaller operations reaching this figure in aggregate are reportable together, even where none comes close to €1,000.

The decree also sets the content: identification and contact details of the persons authorised to make the communication, identification of the client, the type of operation, its reference and date, the amount, and the designation of the counterparty institution with the details it holds on its own client. The deadline is within thirty days following the month in which the operation was paid.

3. COSI 2 — cash above €10,000 in a calendar month

Article R. 561-31-2, in the form given to it by the decree of 18 April 2018, covers cash deposits into and withdrawals from deposit or payment accounts opened in customers’ names, where the cumulative amount over a calendar month exceeds €10,000. Four details do the work.

• Deposits and withdrawals count together. The article is explicit that operations count whether carried out alternately or cumulatively. A month of €6,000 in and €5,000 out is over the threshold; separate counters per direction understate the population.
• Currency is irrelevant. Euro and foreign-currency cash aggregate into the same monthly figure.
• The population is customer accounts. Accounts held by the financial-sector persons listed at 1° to 7° of Article L. 561-2 are outside the limb.
• Consumer-credit operations are excluded where they attach to credit governed by Article L. 312-1 and following of the Code de la consommation.

As with the remittance limb, the communication is due within thirty days following the month concerned. And a reform that took effect in February 2020 allows TRACFIN to exercise its information-gathering powers on the basis of a COSI alone — the extract is an independent basis on which the unit can come back and ask for more.

4. Who is caught — including firms with no French licence

The two limbs draw their population from different parts of Article L. 561-2.

The categories at the head of L. 561-2 are worth reading slowly. 1° covers credit institutions and financial bodies, including branches; 1° bis payment institutions and their branches; 1° ter electronic money institutions and their branches. And 1° quater covers credit institutions, payment institutions, electronic money institutions and crypto-asset service providers from other EU or EEA Member States that operate in France through agents or distributors, along with crypto-asset service providers distributing electronic money.

That last category surprises groups. A firm authorised in another Member State, passporting into France under freedom of services with no French branch and no French authorisation file, is within scope of the cash limb the moment it operates through a French agent or distributor network.

5. The channel — ERMES, and what changed on 1 February 2025

Communications reach TRACFIN through ERMES, the secure dematerialised platform that also carries the déclaration de soupçon. The arrêté of 6 June 2013 set the transmission arrangements; the arrêté of 23 January 2025, in force from 1 February 2025, amended it to generalise ERMES across the professions subject to Article L. 561-2.

The fallback has narrowed to two circumstances: unavailability of the platform, or a particular urgency preventing its use; in either case the report may go by post or email using a dematerialised form. Professions that relied on a derogation from electronic filing no longer have one, and a firm still documenting a paper route as a normal option is describing a superseded procedure.

Access is tied to the declarant and correspondent registered with TRACFIN — which is why D. 561-31-1 requires their identification and contact details inside the communication itself. A leaver who is still the only registered user is a filing outage waiting for a deadline.

6. Worked example — the aggregate nobody aggregated

Facts: an electronic money institution offers remittance from an e-money balance. In March a customer sends nine transfers of €280 — €2,520 in total — to three beneficiaries in two countries. Every operation is far below €1,000, and the monitoring system raises no alert.

Which rule applies: D. 561-31-1’s second threshold. The remittances are funded by electronic money, so the funding condition is met, and the cumulative figure for the client over the calendar month exceeds €2,000. The set is reportable even though no single operation is.

What the practitioner does: builds the extract as a monthly aggregation by client and funding method, not a filter on individual amounts, and runs it against the closed month — the €2,000 test cannot be evaluated until the month ends. Reconciles the count against the remittance ledger so a change in product mix shows up as a change in COSI volume rather than as silence.

Outcome: the firm that filters on €1,000 alone reports a fraction of its population and has no way of noticing. There is no rejection message for a COSI that was never sent, and the gap surfaces years later in an inspection, priced as a systematic failure.

7. Worked example — the COSI filed instead of the déclaration

Facts: a business customer deposits €4,000 and €7,500 in cash in the same month and immediately transfers the balance out to a newly added beneficiary abroad. The analyst sees the €11,500 aggregate, confirms the account is in the COSI 2 population, and closes the alert with a note that the operation “will be reported to TRACFIN in the monthly COSI”.

Which rule applies: both. The cash aggregate crosses the R. 561-31-2 threshold, so the COSI is due on its own terms. But paragraph II of L. 561-15-1 preserves the Article L. 561-15 obligation: where there is knowledge, suspicion or good reason to suspect, the déclaration is owed independently — and cash in, immediate onward transfer to a new foreign beneficiary, is a classic reason to form one.

What the practitioner does: separates the two decisions in the case template so they cannot collapse into one another. The COSI question is a data question answered by a rule; the déclaration question is analytical and answered by a person. The file records both answers and the reasoning for the second.

Outcome: the alert closes as COSI-only where the facts are genuinely neutral, and escalates where they are not. A team that treats the COSI as an exit route will, over a year, quietly convert suspicion reports into threshold reports that assert nothing.

8. Worked example — the passported firm with a French distributor

Facts: a payment institution authorised in another Member State distributes payment accounts in France through retail distributors who accept cash top-ups. It has no French branch, files no French prudential returns, and its compliance map records France as a freedom-of-services market with obligations owed to its home supervisor.

Which rule applies: 1° quater of Article L. 561-2. EEA payment institutions and electronic money institutions operating in France through agents or distributors are inside the population for the cash limb, alongside French-authorised institutions. The absence of a French licence is not the test.

What the practitioner does: resolves scope before the data question. Confirms whether the French presence runs through agents or distributors; if it does, registers a declarant and correspondent with TRACFIN, arranges ERMES access, and defines the account population the €10,000 aggregate is measured over. Then maps which system holds the cash-in records — frequently the distributor’s, which is a problem to solve in the distribution contract rather than in the extract.

Outcome: the obligation is identified from the distribution model, not the licence register. Firms that build their host-state obligation map from passporting notifications alone will not find this one.

9. Building the extract so it survives the second year

A COSI process is a reporting pipeline, not a case-handling process, and it fails in the ways pipelines fail.

• Define the population in writing before any query — which accounts, which funding methods, which exclusions. The financial-sector and consumer-credit exclusions each need an owner and a source field, or they become a hand-maintained list.
• Aggregate on the closed calendar month. Running the extract mid-month produces a population that is wrong in a way that looks plausible.
• Reconcile volumes month on month and treat a step change as an incident until explained. The characteristic failure is a drop to zero after a product change, and nothing downstream reports it.
• Keep the declarant and correspondent registrations current, and rehearse the fallback.
• Record the COSI decision and the suspicion decision separately in every file that touches both.

FAQ

What to do, today

• Establish which limb or limbs apply — remittance funded by cash or e-money, cash on customer accounts, or both — and write the conclusion down with the article reference beside it.
• Test your French footprint against 1° quater if you operate through agents or distributors without a French authorisation. Scope first, data second.
• Rebuild the extract as a monthly aggregation by client, not a per-transaction filter, and confirm deposits and withdrawals share a counter.
• Check your ERMES declarant and correspondent registrations, and that the procedure reflects the position after 1 February 2025.
• Split the COSI decision from the suspicion decision in your case template, and sample closed alerts for cases where the first answered the second.

Related: ERMES — filing a déclaration de soupçon with TRACFIN · Comunicazioni oggettive — Italy’s objective cash communications · The declaración mensual de operaciones — Spain’s monthly return