Rapport de contrôle interne LCB-FT (ACPR, 30 April)

French payment and e-money institutions send the ACPR two annual AML documents a month apart, and most compliance calendars only show the first. The QLB questionnaire is due on 31 March. The rapport sur l’organisation des dispositifs de contrôle interne de LCB-FT et de gel des avoirs is due on 30 April. It is a narrative report on a template fixed by ministerial order, signed by the effective managers, and it is where the ACPR reads how your controls actually worked last year. This guide covers the legal basis, who files on which template, the five sections of the solo report, the 2021 change to how it is written, and three worked cases.

1. Legal basis

The report is required by Articles R. 561-38-6 (solo basis) and R. 561-38-7 (consolidated basis) of the Code monétaire et financier. Its content and filing rules are set by the arrêté du 21 décembre 2018 relatif au rapport sur l’organisation des dispositifs de contrôle interne de lutte contre le blanchiment des capitaux et le financement du terrorisme et de gel des avoirs, published in the Journal officiel of 27 December 2018.

The order was amended by the arrêté du 6 janvier 2021 on AML/CFT and asset-freeze controls, the cross-sector order that took the AML provisions out of the arrêté of 3 November 2014 on internal control. Article 27 of the 2021 order confirms that supervised entities and group parents produce the R. 561-38-6 and R. 561-38-7 reports under the 2018 order. Before 2019, the AML part of the banking sector’s general internal-control report under the 2014 order was set by a letter from the ACPR’s Secretary General. That part now sits in this dedicated report.

For a payment institution the effective managers are those under Article L. 522-6 III CMF, and for an e-money institution those under Article L. 526-8 II. The next report covers 2026 and is due on 30 April 2027.

2. Who files, and on which template

Article 1 of the order sets the scope. For the banking and payments sector it covers the entities in points 1° to 1° quater of Article L. 561-2 CMF: credit institutions, payment institutions, e-money institutions and the related categories listed there. The ACPR’s 2019 presentation of the regime confirms that French branches of European institutions file on an individual basis.

There is one exclusion for payment firms. Institutions authorised only for the services in points 7° and 8° of Article L. 314-1 II CMF, which are payment initiation and account information, are outside the order. A PI that adds any other payment service comes into scope from the year it does so.

EEA payment and e-money institutions that operate in France through agents or distributors (point 1° quater) follow a different route. Their report is signed by the permanent representative under Article L. 561-3 VI CMF or, failing that, by the effective managers, and it is delivered on paper, not through the portal.

Group parents under Article L. 561-33 CMF and central bodies also file the Annex II consolidated report, on the prudential consolidation perimeter. It covers intra-group information exchange on customers, enhanced examinations and suspicious-activity reports, obstacles in third countries, and how the group supervises the controls of its subsidiaries and branches.

3. What the solo report contains: Annex I

Annex I opens with a preamble on the significant events of the year that affected the AML/CFT and asset-freeze framework or the firm’s risk exposure. Examples given are a reorganisation, new products, and new or changed AML tools. Five sections follow.

1. Main ML/TF risk factors. The low-risk factors the firm has identified beyond those in the regulation and the simplified measures applied (Article L. 561-9 CMF). The high-risk factors beyond the regulation and the enhanced measures applied (Article L. 561-10-1). For terrorist financing, the firm’s own TF risk factors (Article L. 561-4-1) and the main criteria or scenarios used to detect atypical transactions.

2. Internal control of AML/CFT and asset freezing. This is the core of the report. Under 2.1 (Articles R. 561-38-3 and R. 561-38-4) it asks for: (a) headcount or FTEs at 31 December for second-level permanent control and for periodic control, including TRACFIN declarants and correspondents, and the name of the provider if periodic control is outsourced; (b) the criteria or thresholds the procedures use to identify significant incidents and main deficiencies; (c) permanent controls performed in the year, with scope, date and frequency, the incidents and deficiencies found, and the corrective measures with planned dates and progress; (d) the same for periodic controls, plus how corrective actions are followed up. Under 2.2 (Article R. 562-1) it asks how asset-freeze screening works: automated or manual; which categories of person in the customer base are screened; which flows are screened, incoming and outgoing, domestic and international, payers and payees; screening frequency and the treatment of occasional customers; which lists are used and whether they come directly from an authority or from an external provider; the fuzzy-matching and date-of-birth rules; any fallback if automated screening fails; and how alerts are handled and freezes applied.

3. Deficiencies found by foreign supervisors in the year, with sanctions or measures where they affect the entity directly, and the corrective action taken. The annex notes that this heading can concern French branches whose EEA head office was criticised by its home supervisor, EEA institutions operating in France through agents or distributors, and French subsidiaries of a sanctioned foreign parent.

4. Specific arrangements. (a) Outsourcing: the providers used for AML or asset-freeze operations, including database and screening providers, what they do and how they are controlled (Article R. 561-38-5). Firms using payment agents or e-money distributors describe how they recruit and control them, and give the percentage of agents or distributors controlled in the year. (b) Third-party introducers under Article R. 561-13. (c) Money transfers: the criteria separating occasional customers from business relationships (Article L. 561-2-1), and, for intermediary and payee PSPs, how missing or incomplete payer and payee information is detected, in real time or after the event. (d) Cross-border correspondent banking.

5. Additional information for branches of EEA institutions. How AML/CFT and asset-freeze tasks are split between the branch and head office or other group entities, and how that split is documented. In particular: whether branch staff can use head-office tools and see head-office information on the branch’s customers, and whether branch officers have responsibilities equivalent to those at head office, or how they report to it functionally.

Point 4(c) still cites Regulation (EU) 2015/847 and the 2018 joint guidelines on missing information. That regulation was repealed and replaced by Regulation (EU) 2023/1113, applicable from 30 December 2024. Describe the current controls under the current regulation, and say so in the answer.

4. How the 2021 amendment changed the writing rules

As published in 2018, Annex I asked for synthetic answers of five to ten lines, or about 1,000 characters, per heading. It also told firms that had already reported to describe only what had changed since the previous year. The 2021 order replaced that opening paragraph. Firms now answer sections 1 and 2, and sections 3 and 4 where relevant, “insisting in particular” on what changed between one year and the next. The length guidance is gone, and a report that says only “no change” no longer meets the text.

In practice, keep a stable base description of each control, update it every year, and mark clearly what changed. A reader should be able to understand the framework from this year’s report alone.

5. Worked example: a French EMI with 300 distributors

Facts: A French-authorised EMI distributes prepaid products through 300 retail distributors. Its second-level control team audited 45 distributors on site in 2026 and reviewed the rest remotely.

What the rule says: Heading 4(a) asks for the recruitment process, the control system and the percentage of distributors controlled in the year. Heading 2.1(b) asks for the thresholds that turn a finding into a significant incident.

What the practitioner does: The AML officer defines “controlled” in the report before giving a number. For example, 15% controlled on site and 100% subject to remote review, with the remote-review criteria stated. Distributor findings are linked to the incident thresholds, so a reader can see which were escalated and why.

Outcome: A percentage the ACPR can test during an inspection. An undefined “100% controlled” would not survive a request for the evidence.

6. Worked example: the French branch of an EEA payment institution

Facts: A payment institution authorised in another Member State has a French branch. Screening and transaction monitoring run on head-office platforms. The branch has a local AML officer and a TRACFIN declarant.

What the rule says: The branch files an individual report on Annex I. Section 5 asks how tasks are split, whether branch staff can use head-office tools and data, and how branch officers relate to head office. Section 3 may apply if the home supervisor criticised the head office in the year.

What the practitioner does: The branch AML officer describes the split in a short matrix covering CDD, monitoring, screening, alert handling, TRACFIN reporting and periodic control, with the document that formalises each part. FTEs under 2.1(a) are reported on an allocated basis for head-office staff who work on the French perimeter, with the allocation method stated. Any home-supervisor finding on screening goes under section 3, with its French consequences.

Outcome: A report that matches the branch’s QLB answers and the documented service arrangements with head office, and shows the ACPR who is accountable in France.

7. Worked example: a screening outage

Facts: In October 2026 the provider feeding an EMI’s sanctions lists had a two-day update failure. The EMI noticed on day two, re-screened its customer base and flows once the lists were updated, and found no match.

What the rule says: Heading 2.2 asks whether lists come from an authority or a provider, whether a fallback exists if automated screening fails, and how alerts and freezes were handled. Heading 2.1(c) asks for incidents and corrective measures, and heading 4(a) for the controls on providers.

What the practitioner does: The AML officer reports the event as an incident if it meets the firm’s own threshold, describes the re-screening and the result, and states the corrective measure: for example, a daily reconciliation of list versions against the official source, and a contractual notification duty for the provider. The preamble mentions it as a significant event.

Outcome: The ACPR learns of the incident from the firm, with the fix already in place, rather than finding it during an inspection.

8. Building the annual cycle

• Throughout the year: keep an incident log against the thresholds described under 2.1(b), so the report is compiled from records rather than from memory.
• January: freeze FTEs at 31 December and extract the permanent and periodic control plans with their results.
• By 31 March: file the QLB, and use the same facts and figures for the report.
• April: draft the Annex I report, obtain signature by the effective managers or their delegate, and file by 30 April. Check OneGate access and signature rights well before then.
• Groups: collect subsidiary and branch results early enough to write the Annex II consolidated report by the same date.

FAQ

What to do, today

• AML officer: add 30 April to the calendar next to the QLB’s 31 March, with a named owner.
• Compliance: write down the significant-incident thresholds used under 2.1(b), if the procedures do not state them.
• Branches of EEA firms: draft the section 5 task-split matrix now and have head office confirm it.
• Screening owner: document the list sources, matching rules and fallback, so heading 2.2 is compiled from evidence.

Related: QLB — the ACPR annual AML questionnaire · The French AML framework beyond TRACFIN · The French reporting calendar