ERMES — filing a TRACFIN déclaration de soupçon

In France, the person who files a suspicious transaction report is not the firm. It is a named individual, formally designated by the firm’s directors, holding a personal certificate and a personal twelve-digit signature number. That runs through everything: who can register, what the certificate is for, why a declaration cannot be corrected once sent, and why a compliance team of one is a single point of failure. This piece covers registration, the two roles, the RGS certificate, the télédéclarant number, the XML import route, and what a soupçon étayé must contain.

1. What ERMES is

ERMES — Échange de Renseignements par Messagerie en Environnement Sécurisé — is TRACFIN’s online declaration platform. It has existed since 2012, it is free, and it is available around the clock. It carries three distinct kinds of traffic:

• Suspicion reports — the déclaration ou information de soupçon (DS/IS) under Articles L.561-15 and L.561-15-1 of the Code monétaire et financier;
• Systematic communications — the COSI, which are threshold-driven rather than suspicion-driven;
• Two-way file exchange with TRACFIN — notably responses to its droit de communication (Article L.561-25 CMF) and appels à vigilance (Article L.561-26).

That third function is the one firms underestimate. ERMES is not only an outbound reporting channel; it is the inbound channel through which TRACFIN asks for things, with response obligations attached. A firm where nobody watches the inbox has missed half of what the platform is for.

2. Who may register, and in which role

Registration is reserved to natural persons authorised to make a suspicion report — the professionals listed at Article L.561-2 CMF — or to transmit spontaneous information under Articles L.561-27 and L.561-28. Registrations from anyone outside those categories are rejected, and TRACFIN verifies category membership by requiring supporting documents such as a Kbis or equivalent, the INSEE record, or the entity’s statutes.

There are two roles, and the distinction shapes how a team is built:

The consequence for resourcing is direct: registering a second person is not an IT task but a governance act requiring a director’s signature. Firms that discover this during an incident discover it too late.

3. The certificate, and what it is not for

For strong authentication, ERMES requires an authentication certificate at RGS two-star or three-star level — RGS being the French référentiel général de sécurité — and, critically, on a physical medium: a smart card, USB token or equivalent. A software-only certificate does not satisfy it.

TRACFIN does not issue these. They come from certification authorities qualified to issue ERMES-compatible RGS certificates, and TRACFIN publishes the list of authorised authorities alongside the registration terms. Obtaining one means an identity-verification process run by the certification authority, physical delivery of the token, and installation on the workstation — and ERMES technical support explicitly does not cover installing the components needed for strong authentication.

Two planning points follow. Lead time: issuance is an external process with its own identity checks and physical delivery, so it belongs on the critical path of a French AML build. And renewal: ERMES publishes a dedicated changement de certificat procedure, which tells you rotation is a foreseen event — and that an expired certificate is an access outage, not a formality.

4. The twelve-digit télédéclarant number

The certificate authenticates the user. It does not sign the declaration. The electronic signature of a declaration is made with the twelve-digit numéro de télédéclarant issued during registration. It is personal and strictly confidential.

Two rules attach to it, and they pull in opposite directions:

• Lost is recoverable. A declarant who has forgotten the number can retrieve it themselves through a dedicated ERMES form.
• Compromised is not. If the number is compromised, the declarant must contact ERMES operational support without delay so a new twelve-digit number is generated.

Sharing the number to cover an absence is therefore not a workaround — it is a compromise event by definition, with a mandatory support call attached. The answer to holiday cover is a second designated, registered declarant.

5. Filing by XML import rather than by form

A declaration can be keyed into the online form, or built as XML and imported. For any firm filing at volume the import route is the only workable one, and TRACFIN publishes the technical documentation in the ERMES documentation area — filtered by profession, because schema and guidance differ across a population running from banks and payment institutions to notaries, casinos and art dealers.

The import file is a batch: one envelope carrying one or more declarations, each containing, in a fixed arrangement, the reporting organisation, the declarant and their télédéclarant number, a follow-up contact, the report’s context (legal basis and nature of the suspicion), the free-text analysis, the persons concerned, the transactions and any attachments.

Three structural properties cause most of the rework:

• Persons come in exactly two shapes — natural or legal, with no third category. Sole traders must be resolved into one of the two before mapping, and getting that wrong is the commonest defect in machine-generated declarations.
• Order carries meaning. The arrangement of the persons block determines which party the platform treats as the report’s primary subject, and therefore how the declaration presents once imported.
• Your internal reference travels with the file. The declaration carries a référence interne alongside TRACFIN’s registration number, and both are searchable in the tracking screen — which is what makes a case in your own system reconcilable to a filing months later.

Validate against the published schema before submitting. An import rejected on structure costs a cycle; an import accepted with the wrong primary subject costs manual rework inside the platform.

6. What a soupçon étayé must contain

TRACFIN is unusually explicit about report quality, and its guidance reads as a set of rejection criteria. The declaration is the conclusion of a reasoned analysis — one that cannot be carried out by automated systems alone. The expected sequence: an alert is raised; it is analysed against customer knowledge, transaction review and open-source research; and where doubt persists, further information is sought from the customer.

The analysis must test whether the transactions are consistent with the customer’s personal profile (age, occupation, corporate purpose, domicile, date of entry into relationship) and financial profile (assets, turnover). Against Article R. 561-31 III, four kinds of declaration do not meet the requirement:

7. Timing, and the duty to keep reporting

Under Article L.561-15 CMF the declaration must be made as soon as the suspicion arises and before the transaction is executed, so that TRACFIN can exercise its right of opposition. The professional must correspondingly refrain from carrying out any transaction it suspects is linked to money laundering or terrorist financing.

Reporting after execution is permitted by derogation in two situations: where it was impossible to postpone execution, and where the suspicion arose only afterwards. In both, TRACFIN must be informed without delay. And the duty does not end at filing: any new element capable of undermining, reinforcing or altering a declaration already sent must be reported without delay.

That rule is what makes the complementary declaration a live process rather than an exception. A sent declaration cannot be modified. The mechanism for adding to it is a complémentaire declaration, opened by choosing that option on the form and selecting the initial declaration it supplements — identified by its registration number, the numéro A/R.

8. Three scenarios

Scenario 1 — the sole declarant on annual leave. A branch has one registered declarant. An escalation arrives the week they are away, and a colleague proposes using their credentials. Facts to rule: the télédéclarant number is personal and strictly confidential, and sharing it is a compromise event requiring immediate contact with operational support to regenerate it. What the compliance officer does: register a second declarant — which needs a director’s designation under R.561-23, so it starts weeks ahead. The failure mode is a suspicion waiting for someone to return from holiday, against a rule that says report before executing.

Scenario 2 — the report that only cited the requisition. A firm receives a judicial requisition about a customer and files a declaration whose substance is that the requisition exists. Facts to rule: a declaration merely reporting the receipt of a judicial requisition or an administrative information request does not meet the requirements of Article R. 561-31 III. What the analyst does: treat the requisition as a trigger for analysis, not its conclusion — run the transaction review, test consistency against the customer’s personal and financial profile, and file on what that finds, or record why it found nothing. The failure mode is a filing that is technically accepted and analytically empty.

Scenario 3 — the sole trader mapped as a company. A firm generating declarations from its case system maps a customer registered with a business identifier onto the legal-person block, because it has a registration number. Facts to rule: the import format admits only natural persons and legal persons, and a sole trader is a natural person carrying on a business. What the engineer does: resolve legal form from the official register’s legal-category code, not from the presence of a business identifier, and route sole traders to the natural-person block with the activity recorded there. The failure mode is a legal person that does not exist, in a report naming a real individual.

9. Operating the platform

Two configuration choices are worth making deliberately rather than inheriting.

Mode cloisonné. By default, each user sees only their own data — declaration history, acknowledgements, drafts. An organisation can ask TRACFIN by email to lift it, so all strongly-authenticated declarants see the organisation’s full history; lifting applies to every such declarant, not selectively. For a team of one it is invisible; for a team that reviews each other’s filings or reconstructs history after turnover, it is the difference between an auditable function and a set of private inboxes.

Visibilité restreinte. For secure file exchanges, the default is that all of an organisation’s declarants and correspondents can see and answer any TRACFIN request. The alternative restricts each user to requests addressed to them personally, and also applies organisation-wide.

Finally, the support boundary is a compliance rule, not a service-desk convention. Technical support is a call centre outside TRACFIN whose staff are not authorised to know the facts communicated to the service, and users must never give it anything about a declaration’s content. Content questions go to TRACFIN’s operational support address. Getting that wrong is a disclosure, not a ticketing error.

10. What to do, today

• Count your registered declarants. If the answer is one, start the designation and registration of a second now — it needs a director’s signature.
• Put RGS certificate expiry dates in the compliance calendar and rehearse the change-of-certificate procedure before you need it.
• Never share the télédéclarant number. Treat any sharing as a compromise requiring a new number from operational support.
• Write the four deficient-declaration patterns into your SAR quality checklist, and reject internally on them before TRACFIN does.
• Decide deliberately whether to lift mode cloisonné — an auditable AML function generally needs organisation-wide visibility.
• Wire the inbound side into a monitored process: droit de communication and vigilance calls arrive through the same platform.
• If you file at volume, build against the published import schema and validate before submission.

Related: TRACFIN — reporting suspicious activity in France · The French AML framework beyond TRACFIN · AML data returns compared across the EU · Reporting channels compared across the EU