QLB: the ACPR annual AML questionnaire for payment firms

Every French payment and e-money institution owes the ACPR an annual account of its anti-money-laundering framework, and it is filed as a structured return, not as a letter. The instrument is the QLB — the questionnaire sur le dispositif de lutte contre le blanchiment des capitaux et le financement du terrorisme. Since 1 January 2024 it has run on ACPR Instruction n° 2022-I-18, which replaced the older questionnaire and split it into a general version and two lighter variants. It is filed through OneGate, against an XBRL taxonomy, signed by a dirigeant effectif, and it is due on 31 March. This guide covers who files which version, the table structure, the two submission formats, the accreditation and signature prerequisites that take weeks to obtain, and how to read a rejection.

1. What the QLB is, and what the ACPR does with it

The QLB is the ACPR’s standing instrument for assessing the compliance and the effectiveness of a supervised institution’s AML/CFT framework. It is not a formality filed and forgotten. The ACPR’s AML/CFT directorate uses it as the base input for its annual off-site assessment of each institution, and inspectors take it with them into on-site examinations, where the answers given are compared against what the procedures and controls actually do. Answers are expected to be sincere, objective, and to correspond to the framework in place at the institution or, where relevant, at group level.

That has a practical consequence worth stating plainly: the QLB is the document against which an inspection team will test you. An optimistic answer given in March becomes an exposure in October. Treat it as a controlled regulatory return with named preparers, evidence behind each answer, and a review by the responsable du dispositif LCB-FT before signature.

2. Which version you file

Instruction 2022-I-18 created four questionnaires across the banking and insurance sectors: a general questionnaire, two lightened banking versions (allégé Banque 1 and allégé Banque 2), and a simplified insurance version. Manual currency exchangers and digital-asset service providers sit outside this set — they have their own dedicated questionnaires.

You determine your own version. Table B0-1 — Détermination du questionnaire applicable Banque (code TB.00.10) opens with a filter question: did your activity over the last calendar year consist exclusively of guarantee business, factoring, or the reception, transmission, execution of orders or portfolio management for institutional clients established in the EEA? Answer yes and you file the allégé Banque 1 version and stop answering the rest of that table. Further questions in B0-1 capture the entity that was authorised during the year but had not started trading by 31 December, the pure refinancing subsidiary that delegates AML/CFT and asset-freezing to other French group entities, and — directly relevant to passporting firms — the French branch of an EEA financial institution that carried out none of the activities notified to the ACPR under the European passport procedure during the year. A branch answering yes to that one then has to quantify the prospecting it did that led to relationships or transactions booked at its head office or elsewhere in the group.

3. The table structure

The questionnaire is built from tables B0 to B10. Which of them you send depends on the version you determined, and the ACPR’s methodological guide — annexe 5 to the instruction — sets the content rules table by table. A concordance table maps the questions back to the previous instruction, 2019-I-24, which is useful when you are reusing prior-year evidence.

Two mechanics matter more than the list itself. First, the B0 table is a contents page: for each required table it carries “remis” or “non remis”, and for the tables common to every version “non remis” is not an allowed answer. Second, tables not required for your version must simply be absent from the submission — in XBRL, no filing indicator at all, rather than a negatively valued one.

The group approach is submitted by every institution, but the filter question inside B4 decides whether you answer the rest of it. Answer yes to the question on supervised foreign entities and you owe the complementary B4-1 list, which is accepted only as an Excel file deposited directly in OneGate under the dedicated report, even by firms that file everything else in XBRL.

4. Two formats, one channel

You may file in XBRL, generating an instance against the ACPR’s LCB-FT taxonomy, or in the Excel maquette the ACPR publishes for firms without an XBRL toolchain — the ACPR then converts the workbook to XBRL itself. The taxonomy is versioned per collection: version 2.4.0.1 applies to the 31 December 2025 reference date, with the release notes carrying the year’s changes. The submission domains differ by format: the Excel route goes through domain DBB, the XBRL route through domain BLC.

Both routes terminate at OneGate, and three prerequisites gate them. The firm must be accredited to the SURFI collection on OneGate, requested separately on the production and the homologation portals. The return must be signed by a dirigeant effectif declared to the ACPR, holding a strong signature certificate and signing software. And the firm must have filed its déclaration des droits à signer on OneGate, naming who is entitled to sign. None of the three is instant. The ACPR’s own advice is to start them well before the deadline, and to rehearse the whole deposit on the test portal first.

5. The deadlines, and the in-year obligations

The annual return splits across two dates. Tables other than the group approach are due on 31 March; the group-approach tables are due on 30 June. The ACPR’s permanent control service checks the state of the collection after each date, so a missing filer is visible within days, not at year-end.

Two obligations run outside that calendar. Table B2-1 must be refreshed whenever the head of the AML/CFT framework or a TRACFIN declarant or correspondent changes — a monthly update rhythm, not an annual one. And table B9, the declaration of a defaulting payment service provider in the payment chain, is submitted on a quarterly rhythm where it applies. For both of these stand-alone submissions the B0 contents table is not filed, and in XBRL it must carry no filing indicator.

Late filing is not a soft failure. The ACPR points to Article L. 612-25 of the Code monétaire et financier, which allows it to issue an injunction backed by a periodic penalty payment.

6. Three situations, worked through

A Luxembourg e-money institution with a French branch that sold nothing this year. The branch was notified under the passport but carried out none of the notified activities during the calendar year. In B0-1 it answers yes to the branch question, which opens the two follow-ups: how many people it prospected in a way that led to relationships or transactions booked at head office or elsewhere in the group, and how many head-office or group relationships it may prospect for. A dormant branch is not an exempt branch — it still files, and it still has to be able to count its prospecting.

A French payment institution whose AML head resigns in September. Nothing waits for the next annual cycle. The firm refreshes B2-1 with the new responsable du dispositif LCB-FT and, if the TRACFIN declarant or correspondent changed with the role, those entries too. The submission is the B2-1 table alone: no B0, no filing indicator for B0, signed and deposited the same way as the annual return. Firms that treat the deadline as the trigger discover in March that the ACPR has held a stale named contact for six months.

A rejected deposit on 30 March. After the deposit, OneGate returns a compte rendu de traitement under Suivi → Remises → Détail, in the annexed documents. A red cross means the return was rejected. The CRT downloads as a zip of three files, one of which is a workbook whose “Résumé” sheet flags the nature of the anomaly per table in a “Validé” column; clicking an ERROR cell jumps to the sheet where cells in red carry the taxonomy check that fired. Correcting it has a trap: before depositing a corrective return, the report in OneGate must be reinitialised, which clears the previously deposited file. Skip that step and the correction is not taken into account, and the firm believes it has filed when it has not.

7. How to prepare it without a March panic

The QLB draws on evidence that lives in different places: the risk classification behind B1, the governance and delegation map behind B2-2, the internal-control plan and its findings behind B3, the due-diligence and monitoring rules behind B5, the screening and freezing framework behind B6, and hard counts behind B8. The statistical table is the one that most often derails a submission, because the counts have to be reconcilable to a system of record and consistent with what the firm reported elsewhere — to TRACFIN, and in its prudential returns.

• Fix the population and reference period first: the last calendar year, at entity level, with a documented rule for what counts as a business relationship.
• Assign each table an owner and a named evidence source, and keep the extraction query or report with the answer.
• Use the Excel maquette even if you file in XBRL — the ACPR recommends it precisely because it helps confirm which QLB type applies and whether the return will be accepted.
• Deposit once in the homologation environment before production, so that taxonomy errors surface before the deadline rather than on it.
• Read the CRT every time. A deposit that was accepted by the portal is not the same as a return that passed its checks.

8. FAQ

9. What to do, today

• Check your OneGate accreditation to the SURFI collection on both the production and test portals, and confirm at least one dirigeant effectif holds a valid signature certificate with signing rights declared.
• Run B0-1 now and record, in writing, which QLB version applies and why — the determination drives every other table.
• Confirm your B2-1 entries are current. If the AML head, TRACFIN declarant or correspondent changed since your last filing, submit the update rather than waiting for March.
• Download the current taxonomy release notes and check them against last year’s mapping before you start populating.
• Book a homologation deposit at least three weeks before 31 March, and diarise the group-approach tables separately for 30 June.

Related: OneGate — the Banque de France reporting channel · The Carte de Visite Fonctionnelle · The French AML framework beyond TRACFIN · France reporting calendar for payment institutions · ERMES TRACFIN — filing a déclaration de soupçon