France: A New Era of Corporate Accountability and Cross-Border Investigations

Global Investigations Review

France

Marine Gourlet, Paul Fortin, Hippolyte Marquetty, Dan Benguigui, Julie Lombard-Veysset, A&O Shearman

This is an extract from the Edition 10 of GIR’s The Practitioner’s Guide to Global Investigations. The whole publication is available here.

This is an Insight article, written by a selected contributor as part of GIR’s co-published content. Read more on Insight

General context, key principles and hot topics

1. Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

Corporate investigations in France increasingly reveal that companies may be held liable for a broad spectrum of offences, many of which have significant cross-border implications.

A notable trend in France at present is the increased emphasis on investigations concerning tax matters. For example, one of the most high-profile cases currently underway is the cum-cum investigation, which centres on sophisticated financial schemes allegedly designed to evade French dividend taxes. This case is particularly notable for its unprecedented scale: five major French banks were simultaneously raided by the police over several days. The investigation has also prompted extensive cooperation among authorities from several European countries, with the German prosecutor’s office joining the police raid operations, demonrating a high level of cross-border enforcement capability.

Another major ongoing investigation involves a leading international streaming platform, suspected of money laundering, tax fraud and undeclared employment. This has resulted in coordinated searches in both Paris and Amsterdam.

Allegations of corruption and breaches of probity remain a significant area of concern. For example, a prominent French aerospace and defence multinational is currently under investigation for suspected bribery of foreign public officials and influence peddling, with authorities from France, the United Kingdom, the Netherlands and Spain all participating in the investigation.

These examples underscore a clear trend towards international collaboration in the fight against corporate misconduct. Furthermore, French companies are frequently prosecuted for workplace accidents and violations of safety regulations, which are widely reported in the media. This serves as a reminder that corporate liability in France extends beyond financial crimes to include the protection of employees’ health and safety.

2. Outline the legal framework for corporate liability in your country.

Under Article 121-2 of the French Criminal Code, legal entities – excluding the state – may be held criminally liable for offences committed on their behalf by their organs (individuals or bodies empowered by law or the company’s by-laws to act on behalf of the entity) or representatives (persons who, whether formally or in practice, possess the necessary authority, competence or resources, or have received a delegation of powers from the company’s organs). To establish corporate liability, it is necessary to identify the specific individual, organ or representative responsible for the offence, which can be complex in practice.

Recent case law has confirmed that, in the context of mergers and acquisitions, the acquiring company assumes liability for offences committed by the absorbed company.

3. Which law enforcement authorities prosecute (or regulate) corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

A variety of law enforcement and regulatory authorities are responsible for overseeing corporate conduct in France. The Public Prosecutor’s Office, including specialised branches such as the National Financial Prosecutor’s Office (PNF), handles the enforcement of criminal law. Independent regulatory bodies also play key roles; for example:

• the French Anti-Corruption Agency (AFA) oversees anti-corruption compliance;
• the tax administration, operating under the supervision of the Ministry of Economics and Finance is responsible for tax matters;
• the Financial Markets Authority regulates investment services providers, issuers and financial markets;
• the Prudential Supervision and Resolution Authority (ACPR) (the French banking regulator) supervises the banking and insurance sectors;
• the Competition Authority addresses antitrust issues; and
• the French Financial Intelligence Unit (Tracfin) monitors suspicious activity reports of financial crime and coordinates with the PNF.

These authorities are vested with investigative and regulatory enforcement powers. Protocols are in place to facilitate coordination and referrals between these bodies and either their respective enforcement committees or criminal authorities. More generally, under Article 40 of the French Code of Criminal Procedure, all public officials are required to report any offence they become aware of to the Public Prosecutor’s Office.

4. What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

There is no threshold of suspicion required for authorities to initiate an investigation in France. Prosecuting authorities have broad discretion to investigate and prosecute any crime or offence they suspect. In addition, under the French Code of Criminal Procedure, a victim may compel the initiation of proceedings in the following ways:

• they may trigger a formal investigation by filing a criminal complaint and registering as a civil party if an initial complaint has not produced any results; or
• they may compel the prosecution of a specific defendant by filing a direct summons to appear before a criminal court, thereby bypassing the need for a prior investigation.

These mechanisms provide victims with avenues to ensure that their complaints are addressed, even if the authorities initially decline to act.

Investigators have a range of powers, the scope of which may vary depending on the nature and seriousness of the facts under investigation. These powers can include relatively unobtrusive actions, such as conducting surveillance from public areas, as well as more intrusive measures, such as deploying recording devices or accessing electronic data.

5. How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

The lawfulness or scope of a notice or subpoena issued by an authority can generally be challenged before the same judge or authority who will ultimately rule on the merits of the case, once the investigation has concluded. However, there is a significant exception for matters subject to a formal investigation led by an investigating judge. In these cases, any challenge must follow a specific procedural route, within a strict timeline, and be brought before a specific division of the court of appeal.

6. Does your country make use of cooperative agreements giving immunity or leniency to individuals who assist or cooperate with authorities?

The French legal system provides immunity for specific offences (such as money laundering) when a person who has attempted to commit a crime notifies the administrative or judicial authorities in time to prevent the offence from being committed.

In addition, sanctions may be reduced in various situations. For specific offences, the custodial sentence incurred by a person who has committed a crime or offence may be reduced if, by notifying the authorities, they have enabled the offence to be stopped or have prevented it from causing damage, or they have helped identify other perpetrators.

Certain forms of negotiated resolution also provide for leniency mechanisms. Public interest judicial agreements (CJIPs) – the French equivalent of deferred prosecution agreements – allow companies to reach settlements with prosecutors, subject to court approval. To enter into a CJIP, a company must acknowledge the facts under investigation and may be subject to a financial penalty, without any formal finding of guilt. Cooperation – such as conducting an internal investigation and voluntarily disclosing its findings – can lead to a reduced financial penalty but does not eliminate the possibility of sanctions or confer immunity. For example, in 2022, Airbus entered into a CJIP in which the company’s exemplary cooperation was specifically taken into account in reducing the fine.

For individuals, agreements can also be reached with prosecuting authorities, most notably through guilty pleas; however, these procedures do not provide immunity in exchange for cooperation.

7. What are the top priorities for your country’s law enforcement authorities?

French law enforcement authorities currently prioritise combating organised crime, drug trafficking and violence against individuals. These priorities were outlined in the most recent general criminal policy issued on 27 January 2025.

With regard to the prosecution of corporate misconduct, the PNF places significant emphasis on cases involving corporate tax matters, due to their significant financial impact. The PNF also strongly focuses on corrupt practices (e.g., corruption and influence peddling) and actively pursues market abuse (principally, share price manipulation and insider dealing). More broadly, the authorities’ main objectives are to protect public safety, ensure financial integrity and uphold the rule of law in both criminal and financial matters.

Investigations into environmental, social and governance (ESG) matters – such as human rights violations and environmental or climate-related concerns – also represent an emerging trend. This is largely driven by intense pressure from non-governmental organisations and the media on corporate firms.

8. To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what constitutes an effective compliance programme?

French law enforcement authorities place significant importance on corporations having effective compliance programmes.

Supervised financial, banking and insurance institutions have long been subject to compliance obligations, particularly the requirement to establish and implement an anti-financial crime compliance programme. This includes measures addressing anti-money laundering, counterterrorism financing, sanctions and embargoes, and fraud.

However, the real catalyst for the development of a compliance culture in France – and the corresponding expectations from enforcement authorities – was the enactment of the Sapin II Law (Law No. 2016-1691 of 9 December 2016, as amended in 2022). This legislation introduced strict anti-corruption requirements for large companies and established the AFA to monitor compliance by covered entities and their senior management with the new anti-bribery and anti-corruption requirements. The AFA publishes guidelines and thematic guides on its website to help regulated companies implement efficient compliance programmes.

Beyond being a legal requirement for many companies operating in France, the implementation of an effective compliance programme can also result in reduced penalties in negotiated settlements involving alleged criminal misconduct. For instance, a Danish bank recently entered into a CJIP with the Public Prosecutor’s Office following an investigation into money laundering allegations. The CJIP acknowledged that the compliance measures undertaken by the bank to ‘considerably reinforce its internal control system’ allowed it to secure a reduction in the penalty. Conversely, regulated companies convicted of criminal misconduct whose compliance programmes are deemed insufficient by the courts may face harsher or additional penalties, including the mandatory implementation of a compliance programme under the close supervision of the AFA.

Separately, the adoption of a vigilance plan addressing ESG issues has also become a binding obligation for many large companies and corporate groups, following the enactment of the Duty of Vigilance Law (Law No. 2017-399 of 27 March 2017). The Law requires large companies to implement measures to prevent serious human rights and environmental violations. In this area, case law is beginning to provide helpful details and guidance on what constitutes an effective programme. A recent decision – the first of its kind – involving the French company Groupe La Poste highlighted the importance of effective risk mapping, due diligence on third parties, dedicated whistleblowing channels and ongoing monitoring.

Cyber-related issues

9. Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

France has established a comprehensive regulatory framework for cybersecurity, combining both legal measures and dedicated institutional oversight. The central authority responsible for cybersecurity and cyber defence is the French Cybersecurity Agency (ANSSI), which was created in 2009. ANSSI plays a pivotal role in shaping national policy, coordinating responses to cyber threats and supporting both public and private sector entities in enhancing their cyber resilience.

France’s regulatory approach to cybersecurity has evolved significantly over the past two decades. In 2006, the government introduced the interministerial framework for vital importance sectors, which aims to protect operators of vital importance whose activities are essential to the nation’s functioning. Building on this, France has transposed key European Union directives and implemented related EU regulations. Directive (EU) 2016/1148 (the NIS Directive) was transposed into French law in 2018 and established common standards for the security of network and information systems. More recently, Directive (EU) 2022/2555 (the NIS 2 Directive) introduced stricter cybersecurity requirements and criminal provisions. While the law to transpose the NIS 2 Directive has not yet been adopted, it is currently in preparation, alongside the law to transpose Regulation (EU) 2022/2554 (the Digital Operational Resilience Act). This Regulation imposes specific obligations on the financial sector to ensure digital operational resilience.

When cybersecurity failings or incidents occur, public or private operators that provide essential services and whose operations could be seriously disrupted by issues affecting their information systems are required to promptly notify ANSSI, which is responsible for the technical management of security incidents. These operators must report significant security incidents, defined as incidents that affect the networks and information systems necessary for the provision of essential services and that have, or are likely to have, a significant impact on service continuity. This reporting obligation enables ANSSI to coordinate and implement an effective response.

Digital service providers (legal entities offering search engines, online marketplaces and cloud computing services) are also required to report all incidents that have a significant impact on the networks and information systems necessary for the provision of their services within the EU, regardless of whether they are classified as essential service operators. An incident is generally considered to have a significant impact based on the information available to the provider, assessed against certain criteria. For example, this includes situations where the digital service has been unavailable for more than 5 million user-hours, where the incident results in the loss of confidential data affecting over 100,000 EU-based users or where the incident causes material losses exceeding €1 million to at least one EU-based user. These thresholds help determine the seriousness of the incident and guide the provider’s response.

After consulting with the operator or digital service provider, ANSSI may decide to inform the public of an incident or require the provider to do so, particularly when public disclosure is necessary to prevent or address an incident or is justified by reasons of public interest. Additionally, if an incident has significant consequences for services provided in other EU Member States, ANSSI will inform the competent authorities or bodies of those states, which may choose to alert the public.

When a security incident results in a personal data breach, it is mandatory to notify the French Data Protection Authority (CNIL) within 72 hours of becoming aware of the breach. This requirement applies whenever the breach is likely to pose a risk to the rights and freedoms of natural persons, in accordance with Article 33 of Regulation (EU) 2016/679 of 27 April 2016 (the EU General Data Protection Regulation (GDPR)). In cases where the breach is likely to result in a high risk to the rights and freedoms of the data subjects, the affected individuals must also be notified directly. This notification must be clear and include an explanation of the nature of the breach, its potential consequences and the measures taken or proposed to address it, as required under Article 34 of the GDPR.

In the financial sector, major incidents involving information and communication technologies, and operational or payment security services, must be reported to the ACPR, which is the designated competent authority for these reporting obligations. Relevant corporate entities may also be subject to separate reporting obligations to the French Markets Authority and the European Central Bank.

10. Does your country prosecute cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

France has developed a comprehensive statutory framework, primarily codified in the Criminal Code, to address and prosecute a broad spectrum of cybercrimes. The French Criminal Code contains specific provisions targeting attacks on automated data processing systems. Article 323-1 et seq. of the Code criminalises unauthorised access, interference and other forms of cyberattacks. Extortion, including acts perpetrated through ransomware, is expressly criminalised under Article 312-1.

While the Criminal Code does not define ‘online hate speech’ or ‘cyber harassment’ as distinct offences, conduct such as incitement to hatred, violence or discrimination committed via digital means is prosecutable under existing legal provisions. These behaviours are principally addressed through the Law on the Freedom of the Press of 29 July 1881 as well as under Article 222-33-2-2 and related provisions of the Criminal Code.

French law asserts jurisdiction over online offences that cause harm to individuals residing in France or to legal entities headquartered in the country. Pursuant to Article 113-2-1 of the Criminal Code, any offence committed or attempted via an electronic communications network that results in harm to a French resident or entity is deemed to have been committed on French territory. This provision significantly extends the extraterritorial reach of French authorities, empowering them to investigate and prosecute online offences originating outside France when the victim is located within its borders.

The law enforcement response to cybercrime in France is both centralised and specialised. Since the enactment of Law No. 2016-731 of 3 June 2016, the Paris Public Prosecutor’s Office has held national jurisdiction over offences involving automated data processing systems and the judicial handling of ransomware cases. These matters are handled by a dedicated section known as J3.

At the operational level, several specialised units have been established to combat cybercrime, including:

• the Cyber Command of the Ministry of the Interior, created within the National Gendarmerie in December 2023;
• the Anti-cybercrime Office within the national police; and
• the Cybercrime Enforcement Brigade within the Paris police prefecture.

Cross-border issues and foreign authorities

11. Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

French criminal law is fundamentally governed by the principle of territoriality, meaning that as a general rule, offences must be committed within the French territory to fall under the jurisdiction of French courts. However, a variety of exceptions allow French law to apply to acts committed outside France. One key exception concerns French nationals: French criminal law may apply to offences committed abroad by or against French nationals, even if the acts occurred outside French territory.

Another important exception allows for the prosecution in France of accomplices to offences committed abroad, provided that the principal offence is also recognised as a criminal offence in the country in which it was committed. Additionally, for certain lesser offences (those not classified as crimes under French law), prosecution is contingent upon the principal perpetrator having been convicted abroad.

French courts may also exercise ‘universal jurisdiction’ over certain offences when French law expressly provides for it or when an international convention grants this jurisdiction. For example, French courts may prosecute a person residing in France for acts committed abroad if those acts constitute crimes listed in Article 689-2 et seq. of the French Criminal Code. These specific offences include terrorism, torture, piracy, crimes against humanity, war crimes, offences involving nuclear materials, offences against the safety of maritime and air navigation, corruption involving EU officials and certain crimes against cultural property.

In summary, while the principle of territoriality is central to French criminal law, its reach can extend beyond national borders in various circumstances, particularly to protect French interests and address serious international crimes.

12. Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

One of the main challenges in cross-border investigations in France is navigating the differences in legal systems and cooperation mechanisms. Within the European Union, investigators benefit from established frameworks that facilitate information-sharing and coordination. However, outside the EU and in the absence of formal cooperation agreements, the process can become much more complex and unpredictable, often depending on the specific country involved. For example, obtaining information from jurisdictions with strict banking secrecy laws has historically been particularly difficult.

Another challenge arises from issues concerning data collection and disclosure. The French Blocking Statute (Statute No. 68-678 of 26 July 1968, modified by Statute No. 80-538 of 16 July 1980) requires companies to seek authorisation from the Strategic Information and Economic Security Service (SISSE) before sharing certain information with foreign authorities. Data protection rules and the need to comply with local laws in each relevant country also add further complexity.

13. Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

In France, the principle of double jeopardy is recognised under the doctrine of ne bis in idem, which is enshrined in several binding international legal instruments. This principle generally prohibits an individual or entity from being prosecuted or punished more than once for the same conduct. However, in practice, France applies this principle rather narrowly.

In the context of international matters, French criminal courts typically do not recognise the binding effect of foreign criminal judgments for offences that fall within French territorial jurisdiction. As a result, a corporation may be prosecuted in France even if it has already been subject to proceedings abroad for the same facts, reflecting France’s strong emphasis on national sovereignty. There is a limited exception to this rule: if the conduct occurred outside France, prosecution for the same facts may be barred under French law if:

• the facts, parties and subject matter are identical;
• a final judgment has been rendered abroad; and
• the foreign sentence has either been served or is time-barred.

For domestic matters, recent case law permits multiple charges (also referred to in French law as ‘legal qualifications’, meaning different legal characterisations of the same act) to be brought in relation to a single act, except where one charge is a necessary element or aggravating circumstance of another or where it is a specific form of a more general offence. Consequently, it is generally possible for a corporation to face several charges arising from the same conduct, subject to these exceptions.

Unlike the United States, France does not have a formal policy or general mechanism to coordinate penalties and prevent multiple authorities from imposing overlapping sanctions for the same facts. While French law does cap the total amount of penalties at the level of the highest individual sanction available – reflecting the constitutionally protected ‘proportionality principle’ – it does not preclude the accumulation of criminal and administrative sanctions, or multiple administrative sanctions, for the same facts. Corporations operating in France may therefore face multiple proceedings and sanctions for the same underlying facts, both domestically and internationally.

14. Are ‘global’ settlements common in your country? What are the practical considerations?

Global settlements are not widespread in France, although they are becoming increasingly common. Notable recent examples include the Airbus CJIP, which was concluded with the PNF in parallel with deferred prosecution agreements entered into with the UK Serious Fraud Office (SFO) and the US Department of Justice, as well as the Danske Bank CJIP, which referenced coordinated settlements with authorities in other jurisdictions. Global settlements are expected to become more prevalent, particularly in light of the recent announcement by the PNF, the SFO and the Swiss Prosecutor’s Office regarding the creation of a joint task force dedicated to investigating and prosecuting corruption-related offences.

15. What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

Decisions issued by foreign authorities do not have any binding or automatic effect on investigations or proceedings concerning the same matter in France.

However, in practice, French judges may consider these decisions as factual elements during their own investigations. This is particularly relevant when a foreign court rules that certain investigative acts carried out on their territory as part of a French investigation are invalid under applicable international cooperation treaties. For example, in 2020, the investigation division of the Paris Court of Appeal annulled all investigative measures carried out in Brazil as part of a French investigation, following a Brazilian court’s decision to invalidate those measures on legal grounds (Case No. 20-86 907, 15 September 2021).

Economic sanctions enforcement

16. Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

France implements sanctions primarily as part of international initiatives led by the United Nations (UN) and the European Union. At the national level, these sanctions are enforced through official decrees or orders in accordance with the French Monetary and Financial Code. The French Treasury regularly provides updated guidance to businesses regarding applicable asset-freezing measures. Sanctions may target specific countries, or legal or natural persons, and address particular concerns, such as the proliferation of chemical weapons. Recent examples include the implementation of the EU sanctions packages against Russia, which include asset-freezing measures and restrictions on designated individuals and entities.

17. What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

France has intensified its enforcement of sanctions in recent years, reflecting the European Union’s increasingly comprehensive sanctions regimes. The Ministry for Europe and Foreign Affairs is responsible for formulating France’s sanctions policy, while the French Treasury manages the financial implementation of these measures. Customs authorities play a crucial role in detecting restricted goods and are empowered to initiate investigations and enforcement actions. This was demonstrated in a recent case concerning alleged violations of sanctions against Russia and Iran (Case No. 24/04855, Paris Court of Appeal, 5 March 2025).

Violations of sanctions regulations constitute a criminal offence in France. Offenders are subject to penalties of up to five years’ imprisonment and a fine of at least the value of the goods or funds involved in the offence or attempted offence, which may be increased to double that amount in accordance with Article 459 of the French Customs Code.

18. Do the authorities responsible for sanctions compliance and enforcement in your country cooperate with their counterparts in other countries for the purposes of enforcement?

Yes. In France, the authorities responsible for sanctions compliance and enforcement actively collaborate with their counterparts in other countries. This cooperation is primarily coordinated at the EU and UN levels, where sanctions are typically adopted and managed on a global scale. French authorities participate in joint investigations, exchange information and coordinate enforcement actions with international partners to ensure the effective implementation of sanctions.

19. Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

France has not enacted national blocking legislation specifically concerning third-country sanctions. However, it does apply the EU Blocking Statute (Council Regulation (EC) No. 2271/96), which is designed to protect EU individuals and companies from the extraterritorial application of certain foreign sanctions, particularly those imposed by the United States on countries such as Iran.

Under the EU Blocking Statute, EU persons and entities are generally prohibited from complying with the specified foreign sanctions unless they have received express authorisation from the European Commission. Any foreign administrative, judicial or arbitral decisions based on these sanctions are not recognised and have no legal effect within the European Union. Additionally, EU operators are required to inform the European Commission within 30 days if the sanctions have economic or financial effects on their activities. In cases of severe hardship, they may apply to the Commission for an exemption.

20. To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Sanctions blocking legislation is governed at the EU level through the EU Blocking Statute. In practice, enforcement by local authorities is limited and the effectiveness of the Statute is generally regarded as low by practitioners. The Court of Justice of the European Union has held that a proportionality assessment must be carried out, weighing the objectives of the Statute against the likelihood and extent of economic losses that a European operator may incur if they comply with the prohibition (Case C-124/20, 21 December 2021). Enforcement is nuanced and takes into account the practical impact on businesses.

Before an internal investigation

21. How do allegations of misconduct most often come to light in companies in your country?

Allegations of a company’s liability may come to light through various means in France, including the following, which are not ranked by importance:

• Whistleblowing: Internal or external disclosures made under the whistleblower procedure set out in Articles 8 and 17 of the Sapin II Law form an important structured channel of disclosure. This mechanism enables employees or third parties, acting in good faith and without personal gain, to alert the company or the relevant authorities to wrongful conduct.
• Audits: Internal or external audits, whether initiated by company management or an audit committee or required by an investor, may uncover accounting, financial or compliance irregularities.
• Media leaks: Information leaked to the media can quickly attract public attention and prompt internal or public investigations.
• Judicial investigations: Offences may be uncovered during the course of a judicial investigation, which is conducted under the authority of an investigating judge rather than a prosecutor.
• Regulatory inspections: Inspections by independent administrative authorities (such as the AFA, the Financial Markets Authority, the CNIL or the Directorate General for Competition Policy, Consumer Affairs and Fraud Control) may uncover factual or documentary breaches.
• Activism: Advocacy, public campaigns or legal action by non-governmental organisations or trade unions serve as an external check on corporate behaviour, often bringing issues to light.
• Legal claims: Civil lawsuits or criminal complaints filed by alleged victims of misconduct can also reveal wrongdoing in a company.

Information gathering

22. Does your country have a data protection regime?

France’s personal data protection regime is founded on two complementary sources. The first is Law No. 78-17 of 6 January 1978, known as the Information Technology and Freedoms Law, a foundational text that has been regularly updated. The second is the GDPR, which has been directly applicable since 25 May 2018.

The GDPR establishes the general European framework, setting out key principles such as lawfulness, fairness, transparency, data minimisation, purpose limitation, accuracy, storage limitation, security and accountability. It also strengthens individual rights, including rights of access, rectification, erasure, objection, portability, restriction and protection against automated decision-making. In addition, the GDPR imposes obligations to notify data breaches and, where applicable, to appoint a data protection officer.

The Information Technology and Freedoms Law was amended by Ordinance No. 2018-1125 of 12 December 2018 to incorporate the provisions of the GDPR into French law. In particular, it clarifies the supervisory and enforcement powers of the CNIL, provides for specific rules for processing sensitive data (such as health data, criminal records and biometric data), introduces special regimes for scientific research, archives and public data, and sets out the conditions under which minors may consent to the processing of their personal data.

Together, these instruments form a coherent system that, while primarily governed by the GDPR, retains a distinctly French character through legislative intervention and the active role of the CNIL. This ensures a careful balance between digital innovation and the protection of individual freedoms.

23. To the extent not dealt with above at question 9, how is the data protection regime enforced?

The CNIL is France’s independent data protection authority. Its primary mission is to ensure that the processing of personal data is conducted in accordance with privacy laws, particularly the GDPR.

The CNIL monitors how personal data is collected, stored and used by both public and private organisations, ensuring compliance with data protection regulations. It also plays an important advisory role by issuing recommendations and guidelines to help organisations understand and fulfil their legal obligations. In addition, the CNIL investigates complaints from individuals regarding data breaches or the misuse of personal information, holding organisations accountable for their data practices. Although the GDPR removed many previous requirements to notify the CNIL of data processing activities in advance, the authority still retains the power to grant prior authorisation for certain sensitive data processing activities in specific circumstances.

The CNIL is vested with significant enforcement powers, including the authority to conduct inspections, request documentation and question individuals or organisations. It can issue warnings, order organisations to comply with data protection requirements and suspend data processing activities when necessary. For serious violations, the CNIL has the power to impose administrative fines.

Breaches of data protection regulations may also lead to criminal convictions.

24. Are there any data protection issues that cause particular concern in internal investigations in your country?

Internal investigations in France pose significant data protection challenges, primarily due to the stringent requirements of the GDPR. A central concern is ensuring that any collection and processing of personal data is lawful, necessary and proportionate to the objectives of the investigation. Individuals conducting these investigations are typically regarded as data controllers and must adhere to all GDPR obligations, including the requirement to carry out a data protection impact assessment if the investigation is likely to present a high risk to individuals’ rights and freedoms.

It is generally mandatory to inform individuals about the processing of their personal data. However, this notification can be delayed or limited if providing the information would compromise the investigation or is protected by legal privilege, provided that any exceptions are properly justified. The rights of individuals whose data is being processed – such as the right to access or erase their personal data – may also be restricted if exercising these rights would jeopardise the investigation or infringe the rights of others.

Particular caution is required when transferring data outside the EU, as both GDPR provisions and the French Blocking Statute may apply. Ultimately, the primary challenge lies in balancing strict GDPR compliance with the need to maintain confidentiality and legal privilege, both of which are essential for the effectiveness of internal investigations.

25. Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

French law imposes strict limitations on employers’ access to employees’ communications. Employers may review communications that are presumed to be work-related only if this is necessary for a legitimate business purpose, is proportionate and employees have been properly informed in advance. In contrast, communications that are explicitly marked as ‘personal’ or ‘private’ are protected and cannot be accessed by employers except where there is clear evidence of misconduct, and even then, only under stringent conditions. Article L1222-4 of the French Labour Code requires that any collection of personal information about an employee through a system or device must be disclosed to the employee beforehand.

The use of modern tools, such as corporate WhatsApp groups and messaging platforms, presents additional challenges. When the company provides the platform, all messages are presumed to be professional in nature unless they are clearly identified as private. Employers may review conversations that are not marked as private, but they must comply with GDPR requirements and ensure that employees are notified in advance.

Enforcement of these rules is rigorous: communications obtained unlawfully are inadmissible in civil courts, the CNIL can impose substantial fines and intentional violations may result in criminal penalties. To mitigate legal risks, employers should implement clear and narrowly focused monitoring policies and ensure managers are trained on the proper handling of employee communications.

Dawn raids and search warrants

26. Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Dawn raids are a frequently used investigative tool, which may be carried out by either criminal or administrative authorities, depending on the nature of the suspected offence. These searches are generally intended to prevent the destruction of evidence and to safeguard the integrity of ongoing investigations.

Under French criminal law, police officers – acting under the supervision of a judge or prosecutor – may search company premises for evidence if there is probable cause to suspect a criminal offence. Searches generally occur between 6am and 9pm. During the operations, officers are authorised to seize any items or documents relevant to the investigation, including electronic data, unless the underlying information is protected by legal privilege. If access is denied, they may forcibly enter the premises and may enlist IT specialists to access encrypted files or computer systems. To avoid the risk of evidence being tampered with or destroyed, companies are not given advance notice of these searches.

Administrative dawn raids, although also unannounced, are governed by distinct legal frameworks and are subject to stricter requirements of necessity and proportionality. Authorities such as the French Competition Authority, as well as the tax, banking or financial authorities, and customs officials, may conduct these raids, but they must first obtain an order from a judge.

Companies subjected to a dawn raid have several legal remedies if they believe the search was improperly conducted. They may immediately object to the seizure of specific items – particularly those protected by legal privilege – and request that these objections be recorded in the official search report. Following the search, companies have the right to challenge the validity of the search or the seizure of materials by filing a motion for annulment. Grounds for this challenge may include the absence of a valid order, actions by authorities that exceed the scope of that order or violations of fundamental rights during the search.

27. How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

French law has progressively developed a framework to protect privileged material during dawn raids. As a general principle, Article 66-5 of Law No. 71-1130 of 31 December 1971 (supported by extensive case law) provides that all correspondence exchanged between a lawyer and their client, regardless of its form, is protected by legal privilege and is therefore immune from seizure.

However, this protection has serious limitations outside the strict context of criminal defence. Communications solely concerning advisory work are more vulnerable. Although case law is not consolidated in this area, courts have, in some cases, permitted the seizure of documents containing legal advice from external counsel, particularly in the context of tax planning. Privilege may also be lost where the lawyer involved is suspected of having assisted in the underlying offence. More broadly, privilege does not extend to documents that reveal the lawyer’s own participation in alleged wrongdoing.

With respect to remedies, a specific procedure exists involving a special judge – the judge for freedoms and detention – who is empowered to review disputed materials and, where appropriate, order the return of documents covered by legal privilege. Subject to these limited exceptions, the combination of statutory protections and judicial oversight ensures that privileged material can, in principle, be lawfully shielded from seizure in France.

28. Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Whether an individual can be compelled to testify in France depends primarily on their status as either a suspect or a witness. Suspects benefit from the right to remain silent throughout criminal proceedings – a fundamental principle of French criminal law that protects individuals from self-incrimination. Accordingly, a suspect cannot be compelled to testify or provide evidence against themselves at any stage of the proceedings.

By contrast, individuals who are not suspects but are summoned as witnesses are, in principle, required by law to testify when called upon by judicial authorities. Witnesses are legally obliged to appear and provide truthful testimony; giving false testimony constitutes the criminal offence of perjury, which is punishable by up to five years’ imprisonment and a fine of €75,000. If necessary, the police may require a witness to remain in their presence for up to four hours to secure their statement. Should a witness refuse to testify without a legitimate legal justification, they may be subject to a fine of €3,750.

There are, however, certain privileges that may exempt an individual or a company from the duty to testify. Professional secrecy or legal privilege may provide certain professionals, such as lawyers or doctors, with a legitimate reason to refuse disclosing confidential information gathered in the course of their professional activities. In addition, close family members of the accused, such as spouses, parents or children, may refuse to testify against their relative.

Whistleblowing and employee rights

29. Describe the whistleblowing framework in your country. What financial incentive schemes, if any, exist for whistleblowers? What legal protections are in place for whistleblowers?

France has developed a comprehensive whistleblowing framework, essentially established by the Sapin II Law and further strengthened by the Waserman Decree of 2022, which transposed the EU Whistleblowing Directive (Directive (EU) 2019/1937 of 23 October 2019)into French law. This framework has been designed to encourage the reporting of misconduct while providing robust protections for whistleblowers.

In recent years, the rights and protections granted to whistleblowers in France have been significantly enhanced. They are now able to report concerns through channels that ensure their anonymity, which serves as a vital safeguard against retaliation. French law explicitly prohibits and sanctions any form of retaliation against whistleblowers, including dismissal, demotion or any other adverse professional consequences. Importantly, whistleblowers are protected not only when they report internally within their organisation, but also when they report externally to competent authorities or, under certain circumstances, to the public.

French law does not provide for direct financial incentives for whistleblowers. It explicitly requires that whistleblowing be carried out ‘without direct financial compensation’.

30. What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

French law does not provide a specific regulatory framework for internal investigations. Instead, investigations are governed by general principles of labour law, which require respect for employee dignity and prohibit any conduct that is humiliating or vexatious. Employers are also obligated to act in good faith throughout the investigative process.

Best practice guidance is outlined in recommendations from various authorities, including the Defender of Rights, the CNIL and the AFA, as well as in court decisions concerning the admissibility of evidence in proceedings. These sources emphasise several key principles, including maintaining the confidentiality of investigations, upholding the presumption of innocence for employees at all times and, in certain circumstances, allowing employees to be assisted by external counsel.

There is generally no legal distinction between employees, officers and directors with respect to their rights during internal investigations, as individuals are generally entitled to similar protections. Conversely, contractual obligations imposed on officers, directors or employees as part of an internal investigation may vary.

31. Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must or should take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

As a general principle under French employment law, employees’ rights do not differ simply because a person is suspected of misconduct. The presumption of innocence applies, meaning that until misconduct is proven, the employee generally retains similar rights and protections to that of any other employee.

When an employee is implicated or suspected of misconduct, the employer must follow established disciplinary procedures as set out in the French Labour Code. One of the precautionary measures available is precautionary suspension, which allows the employer to temporarily remove the employee from the workplace while an investigation is being conducted. This measure is not a sanction in itself but it is intended to protect the interests of the company and ensure a fair investigation.

If, after a thorough investigation, the alleged misconduct is established, the employer may take appropriate disciplinary action. Possible measures include a simple warning, a formal reprimand or, in the most serious cases, dismissal for misconduct. The chosen sanction must be proportionate to the gravity of the misconduct and must comply with the procedural requirements set by law, including the right of the employee to present their case.

32. Can an employee be dismissed for refusing to participate in an internal investigation?

Yes, an employee may be dismissed for refusing to participate in an internal investigation. This stems from the general obligation of employees to contribute to the smooth functioning of the company and to comply with the employer’s lawful instructions, within the limits of legality and their assigned duties.

French case law has affirmed this principle (Case No. 12/01540, Pau Court of Appeal, 24 April 2014). In that case, the employee had been summoned to attend an interview as part of an internal investigation stemming from a complaint filed by a resident of a retirement home. The employee refused to participate in the interview, arguing that she had not been allowed to be accompanied by a staff representative. The employer considered this refusal as professional misconduct and issued a formal warning. The employee was later dismissed for gross misconduct, partly on the basis of her refusal to cooperate with the internal investigation.

The court eventually upheld the employer’s decision, finding that the employee’s refusal to participate in the investigation constituted a breach of her professional obligations. The court emphasised that the employer has a duty to investigate complaints and that employees are required to cooperate with these procedures. Refusing to attend the interview without valid justification was deemed a disciplinary fault that justified dismissal.

Commencing an internal investigation

33. Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

Internal investigations are not specifically regulated by French law. This means that there is no legal requirement to prepare a formal document setting out the terms of reference or the investigatory scope before commencing an internal investigation. The approach to internal investigations can therefore vary significantly.

It is generally considered good practice to define the main steps of the investigation in advance, including the issues to be examined, the individuals to be interviewed and the documents to be reviewed. However, it is important to recognise that internal investigations are, by nature, often evolving processes. New facts and issues may emerge as the investigation progresses, which may require the initial scope to be adjusted. Therefore, while it is advisable to set out the main parameters of the investigation at the outset, it is equally important to remain flexible and to adapt the scope as necessary in response to developments.

34. If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally required to take or should consider taking?

In principle, and subject to limited exceptions, a company that becomes aware of a potential issue before the authorities may delay reporting or disclosure to the authorities until it has investigated the issue internally. It is generally crucial for a company to first understand the facts and circumstances of the issue, assess its nature and seriousness, and decide how to best respond.

If the issue comes to the company’s attention through a whistleblower report, the company may be legally required to address the alert. This includes acknowledging receipt of the report, investigating the matter and responding to the whistleblower within a specific time frame, as required by French law.

After the internal investigation, if the facts are substantiated, there is generally no legal obligation to report the matter to the authorities unless the situation falls within specific categories where mandatory reporting is required. For instance, there are mandatory reporting obligations in areas such as cybersecurity, market abuse, terrorist financing, money laundering and sanctions violations. In these cases, failure to report may result in liability, noting that protections exist for those who submit reports in good faith.

35. What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

When a company in France receives a notice or subpoena from a law enforcement authority requesting the production or preservation of documents or data, it must act promptly and carefully to comply with legal obligations and avoid potential sanctions.

The first step is to notify the company’s legal department without delay. The legal team should coordinate the response, ensuring that all actions are diligent and in accordance with the law. The legal department will assess the notice or subpoena, determine its scope and organise the collection or preservation of the requested documents or data.

It is important to note that, subject to the possibility of challenging the legality of the request, the company is generally required to comply. The legal department should review whether there are grounds to contest the request, such as issues with its validity or scope.

Failure to respond to these requests can expose the company to significant criminal and financial penalties. Several specific offences exist for obstructing or failing to comply with requests from various authorities. Non-compliance with requests from the French police, for instance, can result in a €3,750 fine. Non-compliance with French administrative authorities’ requests may lead to fines or, in some cases, imprisonment; for example, failure to respond to the AFA may lead to fines of up to €30,000, while failure to respond to the Financial Markets Authority or the Competition Authority may lead to fines of up to €300,000 and two years’ imprisonment.

36. At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

Companies are generally not required to disclose the existence of an internal investigation, except in specific circumstances.

For companies listed on a regulated market, the European Market Abuse Regulation (Regulation (EU) No. 596/2014 of 16 April 2014) requires the prompt disclosure of any inside information, defined as:

information of a precise nature, which has not been made public, relating, directly or indirectly, to one or more issuers or to one or more financial instruments, and which, if it were made public, would be likely to have a significant effect on the prices of those financial instruments or on the price of related derivative financial instruments.

However, this obligation typically applies to the underlying facts revealed by the investigation (such as major fraud or corruption), rather than to the mere existence of the investigation itself.

There is no general legal duty to disclose contact with authorities.

37. How are internal investigations viewed by local enforcement bodies in your country?

Internal investigations are generally viewed positively by local enforcement bodies in France, as they align with the broader culture of compliance that is increasingly encouraged by regulatory authorities. The communication of findings from an internal investigation is encouraged by official guidelines and may result in more lenient sanctions for the related misconduct. This approach reflects a broader trend towards increased transparency and proactive risk management within organisations. It is seen as a way for companies to demonstrate their commitment to ethical standards and regulatory compliance.

Attorney–client privilege

38. Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Internal investigations are not automatically protected by confidentiality. However, when an investigation is conducted by or under the supervision of a lawyer, it is generally covered by legal privilege. This protection is robust but not absolute, as criminal authorities may challenge its applicability where they believe the privilege does not relate to the exercise of defence rights.

Both the PNF and the AFA have issued controversial guidance suggesting that investigation reports may not always be protected by legal privilege. However, this stance is not supported by French statutory law or case law. The European Commission and the French Bar Association have publicly disagreed with these interpretations. Furthermore, legislative clarification is expected to reinforce that materials stemming from an internal investigation led by external lawyers are protected by legal privilege.

To maximise confidentiality, companies are strongly advised to engage external legal counsel from the outset of an internal investigation. They must also ensure that all related communications and documents are clearly labelled as confidential and tied to legal advice or defence.

39. Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

The key principle is that legal privilege protects all communications between a lawyer and their client, whether the client is a corporation or an individual. The privilege belongs to the client, who may choose to waive it. For the privilege to apply, the lawyer must be directly involved in the communication; if a third party is included, the client loses the benefit of legal privilege. French law does not distinguish between individuals and corporations in this regard. The aim is to ensure that clients can communicate freely and confidentially with their lawyers.

40. Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Legal privilege only applies to advice provided by external counsel. In contrast, in-house lawyers are considered as non-independent employees, whose communications with management or colleagues are not protected by privilege, even if marked as confidential or relate to anticipated litigation. A parliamentary bill aimed at extending confidentiality to in-house counsel has been under discussion since February 2024.

41. Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to investigations in your country?

Legal privilege applies strictly to advice given by French lawyers. To ensure maximum protection, it is advisable for companies to involve external lawyers in any communications with foreign counsel. While correspondence between French and foreign lawyers is not automatically covered by legal privilege, it may be protected if certain conditions are met – particularly if the correspondence is clearly labelled as ‘attorney privileged’. The confidentiality of these communications also depends on whether the foreign lawyer is admitted in a European or non-European country.

42. To what extent is waiver of the attorney–client privilege regarded as a cooperative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Waiving the attorney–client privilege is neither mandatory nor routinely expected by authorities in the context of cooperation. Legal privilege is a fundamental principle, protected by French law, and lawyers cannot be released from this obligation by their clients.

However, clients may choose to disclose certain privileged materials, such as excerpts from an internal investigation report, if they believe doing so serves their strategic interests. Voluntarily sharing information relevant to an ongoing investigation or upcoming trial may be viewed by authorities as a cooperative step and could be taken into account during settlement discussions.

43. Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

The concept of limited waiver of privilege does not exist in France. If privileged information is disclosed, it does not automatically lose its protected status, even if shared with third parties. Each situation must be assessed on a case-by-case basis, taking into account the specific circumstances.

44. If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Because the concept of limited waiver does not exist in France, if privileged information is disclosed on a limited basis in another country, it would not automatically be treated as a waiver of privilege under French law. In particular, if the relevant information remains confidential and has not entered the public domain, legal privilege may still apply in France.

However, disclosing protected information to a third party outside the attorney–client relationship always carries a risk of losing privilege under French law. Each situation must be assessed on a case-by-case basis.

45. Do common interest privileges exist as concepts in your country? What are the requirements and scope?

The concept of common interest privilege is not formally recognised by French law. Nevertheless, in practice, confidentiality is preserved through the strict protection of communications between lawyers, as well as between a lawyer and their own client. Written communications exchanged between lawyers are, by default, considered confidential.

When multiple clients share a common interest, their lawyers may coordinate as a ‘co-defence’, ensuring that all exchanges remain confidential by communicating exclusively between lawyers.

46. Can privilege be claimed over communications with third parties?

Legal privilege in France may extend to communications with third parties, provided they are acting under the lawyer’s direction and in connection with the lawyer’s professional duties. For example, law firm staff and secretaries are bound by professional secrecy in the same way as lawyers. Likewise, when a lawyer shares documents with a private expert for the purpose of obtaining technical analysis necessary for the client’s defence, this does not breach privilege, as the expert is contractually bound by confidentiality. Therefore, privilege can generally be maintained as long as confidentiality obligations are respected.

Witness interviews

47. Does your country permit the interviewing of witnesses as part of an internal investigation?

French law does not specifically regulate internal investigations, including the interviewing of witnesses. However, case law recognises the possibility of interviewing witnesses as part of an internal investigation. The French Supreme Court has confirmed that interviewing witnesses, as well as individuals whose interview is requested by the person under investigation, is permitted. This approach is also recommended by the French Defender of Rights (an independent public institution responsible for protecting citizens’ rights and freedoms), which encourages the collection of witness statements to ensure a fair and thorough process. Therefore, while not expressly provided for by applicable statutes, interviewing witnesses is permissible.

48. Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

In France, a company can generally assert legal privilege over internal witness interviews and attorney reports of interviews when these are conducted by external counsel as part of an internal investigation. This protection typically extends to the entire investigation process, including interviews, document reviews, legal analyses and reports.

49. When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

The rules governing internal witness interviews in France are not set out in statute but have instead been developed by French courts on a case-by-case basis. When a lawyer conducts a witness interview, the legal profession’s code of ethics applies, imposing duties of loyalty, prudence and fairness. There is no legal obligation for the employer to allow employees to be assisted by external counsel, and due process requirements do not expressly apply, as the interview is neither a disciplinary hearing nor a judicial proceeding.

Nevertheless, professional guidance and rules issued by the French Bar Association recommend that lawyers leading an interview inform the person being interviewed that they may be assisted or advised by a lawyer if it appears, before or during the interview, that they may be accused of misconduct as part of the internal investigation. The investigator must remain impartial; anyone who is in open conflict with the interviewee should not be permitted to conduct the interview. The process must be conducted confidentially and within a reasonable time frame. The interview must also be thorough and balanced, taking into account both incriminating and exculpatory evidence, and all investigative measures must be proportionate to the individual’s right to privacy.

These standards apply equally to interviews with external witnesses. No special authorisation is required to approach third parties; the lawyer’s ethical obligations continue to govern the interviewer’s conduct, ensuring the same standards of fairness, discretion and proportionality.

50. How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

Interviews conducted as part of an internal investigation generally follow a structured process. The company begins by identifying the individuals to be interviewed and arranging meetings, often after interviewees have signed a non-disclosure agreement. At the outset of the interview, the interviewer explains the purpose of the meeting, the context of the investigation and the key principles governing the process, such as confidentiality. If the interview is conducted by a lawyer, it must also be made clear that the lawyer represents the company and not the interviewee.

During the interview, questions are asked and relevant documents may be presented to the interviewee to clarify facts or obtain explanations. Although it is possible to record the interview, this is uncommon in practice and requires the express consent of the employee. Typically, notes are taken and a written summary or a verbatim transcript of the interview is prepared. If a verbatim transcript is produced, it is generally signed by the interviewee; if a summary is prepared, a signature is not required.

Employees may be given the opportunity to be assisted by their own legal counsel during the interview. However, there is no legal obligation for the company to offer this possibility, as the interview does not constitute a disciplinary hearing or a judicial proceeding (subject to the ethical recommendation imposed on lawyers conducting interviews under their code of ethics, as discussed in question 49).

Reporting to the authorities

51. Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

In France, there is generally no legal obligation to report misconduct to law enforcement authorities. However, the law provides for several exceptions. If an individual becomes aware of a crime (as defined in the French Criminal Code) that could be prevented, its consequences limited or if there is a risk of reoffending, they are legally required to report it, unless they are bound by professional secrecy. Failure to comply with this obligation may result in criminal liability under Article 434-1 et seq. of the Criminal Code.

There are also sector-specific reporting requirements; for example, financial institutions are required to report suspicions of money laundering or terrorist financing under Article L561-15 of the French Monetary and Financial Code.

52. In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

A company may choose to self-report to law enforcement authorities even in the absence of a legal obligation if it is in its best interest to do so, including from a risk assessment and exposure perspective. This may be the case when there is clear evidence of misconduct, and self-reporting could result in a more favourable outcome, such as the possibility of reaching a settlement, obtaining reduced penalties or better managing reputational risk.

The same considerations may apply to self-reporting to authorities in other countries, particularly when the misconduct in question has cross-border implications or could be subject to investigation in multiple jurisdictions. In these situations, it is important to assess the cross-border consequences of self-reporting and to consider the conditions under which the double jeopardy principle may apply, to minimise the risk of facing multiple sanctions for the same conduct.

53. What are the practical steps needed to self-report to law enforcement in your country?

There is no general legal obligation to self-report to law enforcement authorities in France, nor is there a formalised procedure for self-reporting under criminal law. The approach is determined on a case-by-case basis, depending on the particular circumstances and the stage of any internal or external investigation. In practice, companies or individuals may choose to make informal contact with the relevant authorities, such as the public prosecutor or regulators, to discuss the matter and potential volunteering of relevant information. In certain areas, such as antitrust law, specific procedures and published guidelines exist for leniency applications. In these instances, strict requirements must be met, including being the first to report the misconduct and providing comprehensive and detailed information.

Responding to the authorities

54. In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

When a company in France receives a notice or subpoena from a law enforcement authority, it is required to respond, to avoid administrative or criminal penalties, which may include fines or imprisonment. Companies may engage in dialogue with the authorities, either by submitting written or oral observations, or by resorting to specific legal procedures to challenge or request certain investigative measures. In many cases, it is also possible to negotiate a settlement with the authorities before formal charges are brought.

55. Are ongoing authority investigations subject to challenge before the courts?

Ongoing investigations by authorities in France can be challenged, and available procedures would depend upon the stage of the investigation and the applicable procedural framework. In white-collar matters, during a preliminary investigation, certain actions – such as the seizure of materials – may be disputed through specific procedural channels. Similarly, the validity of investigative measures can be challenged before courts, should the company eventually be referred to trial.

In the context of a judicial investigation, it is possible to appeal the orders issued and decisions made by the investigating judge before a specific court, known as the Investigating Division of the Court of Appeal, which is responsible for reviewing the legality of the proceedings. Specific rules and deadlines must be observed when appealing to this Court.

56. In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

If authorities in France and another country issue separate requests concerning the same facts, the company should respond to each request independently, as both countries may conduct their investigations separately. The principle of double jeopardy applies in France only after a final conviction for the same facts.

The French Blocking Statute may also be applicable when responding to foreign requests for information, the violation of which is criminally sanctioned. To comply with the Blocking Statute, the company must oppose the request to the relevant foreign authority and ask that it be routed through the relevant international cooperation channels.

In addition, interactions with the SISSE may also be required to ensure full compliance with the obligations imposed under the Blocking Statute.

57. If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for and produce material in other countries to satisfy the request? What are the difficulties in that regard?

If French authorities request documents that are located abroad, the response will depend on the applicable law in that foreign country. While the company is generally required to provide the requested information, it must first review the local regulations, including data privacy laws and any applicable blocking statutes, of the country where the documents are held, to ensure compliance before disclosing any material.

58. Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for cooperation with foreign authorities?

French law enforcement authorities routinely share information with their foreign counterparts. Within the European Union, cooperation is facilitated through established channels, including the European Public Prosecutor’s Office, Europol, Eurojust and the European Anti-Fraud Office. All exchanges of information must adhere to strict legal procedures to ensure the proper handling and protection of sensitive data.

59. Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

French law enforcement authorities are required to maintain the confidentiality of information obtained during an investigation. They are subject to strict secrecy obligations, and any unauthorised disclosure of this information may result in criminal penalties, including fines.

60. How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

In this situation, the company should refrain from producing the documents directly. Instead, it is advisable to inform the French authority of the legal conflict and request that it pursues the appropriate international cooperation channels, such as submitting a formal mutual legal assistance request under Article 694 et seq. of the French Code of Criminal Procedure. This approach helps ensure compliance with both French and foreign laws, while also respecting international legal obligations.

61. Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Yes, the French Blocking Statute (originally enacted in 1968 and revised in 2022) generally prohibits the direct transfer of documents or information to foreign public authorities outside of established international cooperation channels (i.e., international treaties or agreements such as memoranda of understanding). This applies to material of an economic, commercial, industrial, financial or technical nature that is intended to serve as evidence in foreign judicial or administrative proceedings, or in the context of these proceedings (Article 1 bis).

When a French company receives a notice or subpoena from a foreign authority, it must ensure that the request has been routed through the appropriate cooperation channel. In addition, the company may be required to engage with the SISSE before disclosing any information. Non-compliance with the Statute may result in six months’ imprisonment and a €90,000 fine.

62. What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

The risks associated with the voluntary production of materials to authorities in France vary depending on the specific circumstances. Whether documents are submitted voluntarily or under compulsion during an investigation, they become part of a case file. While in principle these materials remain confidential and protected by investigative secrecy, their inclusion in the file could make them accessible to the parties involved in the proceedings. Moreover, the underlying facts may ultimately become public during a trial phase or through the publication of a decision.

In certain circumstances, however, and in accordance with legal requirements or established practice – such as during formal negotiations of a French guilty plea procedure (CRPC) or a CJIP – documents provided voluntarily are treated as confidential. In these cases, the authorities may not rely on these materials if the negotiations fail, and the documents will not be made public.

Prosecution and penalties

63. What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Individuals found guilty of misconduct in France may be subject to imprisonment, fines and additional sanctions such as community service, mandatory training or disqualification from certain professions or from holding public office.

Companies may incur substantial fines of up to five times the amount imposed on individuals. Where provided for by law, they may even be liable to fines proportional to the proceeds of the offence or the advantage gained. In addition, they may also face further penalties, including the forfeiture of profits derived from the offence, temporary or permanent bans on certain activities, debarment from public tenders and the publication of the court’s decision in designated newspapers (a ‘name and shame’ penalty).

64. Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

Penalties imposed by French courts are territorial in nature, meaning they apply within the borders of France. However, penalties imposed in France may also impact a company’s ability to operate or bid for contracts abroad, depending on the regulations of other countries and relevant international treaties and agreements. For example, a conviction for offences such as corruption or fraud can result in suspension or debarment from public contracts throughout the European Union.

65. What do the authorities in your country consider when fixing penalties?

When determining penalties, French authorities take into account the seriousness and duration of the offence, the harm caused to third parties, any impact on public order and interference with the orderly functioning of markets, and the offender’s financial resources (including turnover for companies, revenues for individuals and any profits derived from the offence), as well as their personal circumstances (such as any prior convictions).

The court’s objective is to ensure that the penalty is individualised, proportionate and appropriately tailored to both the specific facts of the case and the offender’s particular situation.

Resolution and settlements short of trial

66. Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Yes, the French equivalent of a deferred prosecution agreement is known as a CJIP. This mechanism is limited to certain economic and financial offences, such as corruption, influence peddling and tax fraud, as well as money laundering offences linked to these underlying crimes. It has also been recently extended to cover environmental offences.

A CJIP enables legal entities to settle certain criminal investigations without admitting guilt or liability. It is not available to individuals. Under a CJIP, the company agrees to pay a public interest fine and may also be required to implement a remediation plan (for example, by overhauling its anti-bribery and anti-corruption compliance systems and controls under monitorship) and to compensate victims for any losses. The agreement must be approved by a judge and becomes public.

Other settlement mechanisms are available to both corporates and individuals, such as the CRPC. However, unlike a CJIP, a CRPC requires an admission of guilt and results in a criminal conviction.

67. Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

French law does not provide for reporting restrictions or anonymity for corporates entering into a CJIP. Once the CJIP is approved by a judge, it is immediately published, notwithstanding any potential ongoing related criminal proceedings. Although the CJIP may refer to the involvement of certain individuals, it generally avoids explicitly naming them.

Nevertheless, defending individuals in matters in which the company they worked for (or even managed) has entered into a CJIP can prove more challenging, particularly when the facts are closely linked.

Furthermore, guidelines from the PNF do not address how CJIPs or CRPCs should be coordinated, nor do they resolve the inherent conflict of interest faced by executives who may be asked to cooperate while also facing personal criminal or civil exposure.

68. Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Before entering into a settlement with French law enforcement, companies should carefully assess the available procedural options. Entering into a CJIP enables a company to avoid a criminal conviction but may require active cooperation – including potentially conducting internal investigations – and results in public disclosure. By contrast, a CRPC leads to a criminal conviction and may impose restrictions on business activities, such as exclusion from public procurement contracts.

Companies considering settlement must also bear in mind that doing so does not shield individuals from prosecution. Executives or employees may still face criminal proceedings. This was illustrated in a high-profile corruption case where the company entered into a CJIP but the criminal court refused to approve its CEO’s guilty plea just two weeks later.

Companies should also take into account the potential ramifications of related foreign investigations or proceedings when evaluating whether to settle in France.

69. To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

In France, external corporate compliance monitors are appointed only in specific circumstances. This is most common in CJIPs, where the AFA serves as the monitor, supervising the company’s compliance improvements.

The use of monitors is also becoming increasingly common in the context of environmental CJIPs, where the role may be fulfilled by the French Biodiversity Office or the Ministry of the Environment. Unlike in some other countries, France does not routinely appoint independent external monitors. Instead, monitoring responsibilities are generally entrusted to designated public authorities.

70. Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Yes, private plaintiffs in France may initiate civil actions independently of criminal proceedings to seek compensation.

Private plaintiffs do not have automatic access to investigation files. However, they may gain access during the investigation or trial phase if they formally register and are admitted as civil parties in the criminal proceeding. To do so, they must demonstrate that they have suffered harm as a result of the offences being prosecuted.

Publicity and reputational issues

71. Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

At the investigatory stage of a criminal case, investigations are confidential as a rule. Prosecutors have the authority to lift this confidentiality in specific circumstances to communicate about ongoing cases, as provided for under Article 11 of the French Code of Criminal Procedure.

Once a case proceeds to court, hearings are generally held in public. However, exceptions exist to protect the dignity and privacy of minors or victims of certain offences, allowing courts to restrict public access when necessary. These rules are designed to strike a balance between transparency and the protection of sensitive interests.

72. What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

Companies generally manage corporate communications by implementing internal protocols and appointing trained spokespersons to ensure messaging remains consistent and accurate, particularly in sensitive situations. In the event of a corporate crisis, it is common – especially for larger or publicly traded companies – to engage public relations firms for expert advice and media relations support.

73. How is publicity managed when there are ongoing related proceedings?

When there are ongoing related proceedings, publicity is generally managed by upholding the confidentiality of the investigation for those who are bound by secrecy, such as judges and lawyers. Like public investigators, these actors in the proceedings are legally obligated to maintain confidentiality and are prohibited from disclosing information about the case.

In contrast, individuals who are not subject to this obligation, such as the accused, may have greater freedom to communicate publicly, depending on their chosen strategy and within the boundaries set by law.

Duty to the market

74. Is disclosure to the market mandatory in circumstances where a settlement has been agreed but not yet made public?

In general, disclosure to the market is not required when a settlement has been reached but has not yet been made public. However, exceptions exist for certain regulated entities, such as listed companies, which may be obligated to disclose ‘inside information’ under applicable laws – in particular, the EU Market Abuse Regulation.

If a settlement constitutes information that could have a significant impact on the price of the company’s securities (or related financial instruments), disclosure may be necessary unless a valid exemption applies (for example, where confidentiality must be preserved during ongoing negotiations or investigations). In the absence of these requirements, confidentiality is typically maintained until the settlement is officially announced.

Environmental, social and corporate governance

75. Does your country regulate or prosecute environmental, social and governance matters?

ESG matters are commonly referred to as corporate social responsibility in France. The French regulatory framework for ESG is shaped by both national legislation and EU regulations, ensuring that companies operate in a responsible and transparent manner. Key French laws include:

• the Duty of Vigilance Law, which requires large companies to implement and publish a vigilance plan to identify and prevent serious human rights violations and environmental harm within their own operations and supply chains;
• the Law on the Growth and Transformation of Companies (Law No. 2019-486 of 22 May 2019), which modernises corporate governance and encourages companies to consider social and environmental issues in their business strategies and decision-making processes; and
• the Energy and Climate Law (Law No. 2019-1147 of 8 November 2019), which mandates climate-related disclosures and aligns national policy with the Paris Agreement.

French law requires that all ESG disclosures and reports be clear, accurate and publicly accessible, thereby reinforcing transparency and accountability. French companies must comply with major EU regulations such as the Sustainable Finance Disclosure Regulation (Regulation (EU) 2019/2088 of 27 November 2019), the European Taxonomy Regulation (Regulation (EU) 2020/852 of 18 June 2020) and the Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464 of 14 December 2022). These regulations standardise and expand ESG reporting requirements, ensuring that information is reliable and comparable across the market.

Collectively, these national and EU instruments form a comprehensive legal framework that compels French companies to integrate ESG considerations into their operations and reporting, thereby supporting both domestic and European sustainability objectives.

76. Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address environmental, social and governance matters, and what has been the response to any recent regulatory or legislative change?

Although uncertainty remains, significant regulatory and legislative changes concerning ESG matters are expected in the coming year. Influenced by the Draghi report on European competitiveness and evolving global political dynamics – including the outcome of the US presidential election – there is a discernible trend towards easing ESG-related regulatory and administrative requirements.

The EU’s Omnibus Directive (Directive (EU) 2025/794,adopted on 26 February 2025) and the ‘Stop the Clock’ Directive (Directive (EU) 2025/795, adopted on 3 April 2025) have already postponed key implementation deadlines and reduced both due diligence reporting obligations and the number of companies subject to ESG regulations.

These developments reflect a broader shift towards prioritising economic performance and streamlining ESG compliance requirements across Europe.

77. Has there been an increase in related litigation, investigations or enforcement activity in recent years in your country?

In recent years, France has experienced a marked increase in ESG-related litigation, investigations and enforcement activity. This trend is notably reflected in the creation of specialised judicial divisions, such as the 34th Division of the Paris Tribunal (established on 2 September 2024) and the 5-12 Division of the Paris Court of Appeal (established on 5 March 2024), which are both dedicated to cases involving the Duty of Vigilance Law.

Litigation under the Duty of Vigilance Law has increased significantly, most recently resulting in the conviction of the French group La Poste for failing to implement an adequate vigilance plan. Other major French multinationals are currently facing legal actions on similar grounds. In addition, there has been a notable rise in complaints and investigations concerning issues such as greenwashing and alleged human rights violations.

These developments are unfolding amid heightened judicial and regulatory scrutiny, as well as increasing pressure from the media and non-governmental organisations.

Anticipated developments

78. Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

In the coming year, France is expected to further strengthen its regulatory and enforcement framework addressing corporate misconduct. The national multi-annual anti-corruption plan for 2024–2027 is likely to introduce additional measures aimed at enhancing integrity in both the public and private sectors. These initiatives reflect a broader trend towards increased corporate responsibility, tighter compliance requirements and heightened scrutiny of financial and tax practices.

At the EU level, ongoing discussions regarding the Omnibus legislation (specifically, the Omnibus Directive and the ‘Stop the Clock’ Directive) may lead to further adjustments in compliance obligations and enforcement mechanisms. As a result, companies will likely need to review and adapt their compliance programmes, placing greater emphasis on risk assessment, internal controls and proactive reporting to meet evolving regulatory expectations.

This article first appeared on Lexology | Source