The Anti-Bribery and Anti-Corruption Review: France

Introduction

A few years ago, France was widely perceived as lagging behind international standards in terms of its anti-corruption efforts. Limited resources available to the criminal authorities, procedural hurdles to prosecuting acts committed abroad and a general lack of successful prosecution of French companies all contributed to this assessment. This situation changed significantly following the enactment in late 2016 of a sweeping anti-corruption reform known as Sapin II.2

The new, strengthened anti-corruption framework has far-reaching consequences for French and foreign groups alike. Of particular note are the following:

  1. an affirmative obligation for companies above certain thresholds to design and implement a compliance programme to prevent corruption, which the French anti-corruption agency (AFA, also created by Sapin II) is responsible for monitoring and assessing;
  2. an extension of the extraterritorial reach of French anticorruption laws;
  3. enhanced protection for whistle-blowers; and
  4. the introduction of a new kind of agreement allowing a legal entity to settle corruption allegations with criminal authorities (akin to a deferred prosecution agreement in the United States).

Domestic bribery: legal framework

Under French law, corruption, including active and passive bribery (corruption) and influence-peddling, is a criminal offence punishable by up to 10 years of imprisonment and fines of up to €1 million for individuals and €5 million for legal entities, which may be increased in both cases to an amount corresponding to twice the proceeds of the offence,3 as well as related sanctions.

i Domestic bribery law and its elements

The French Penal Code criminalises both active4 and passive corruption.5 Corruption offences include bribery of domestic public officials,6 domestic judicial staff7 and private individuals.8

A bribe is defined as any offer, promise, donation, gift or reward unlawfully offered or requested, without any restriction as to the value of such an advantage. The AFA identifies sponsorship, patronage, fees and commissions, travel and entertainment expenses, gifts and hospitality, donations and legacies as transactions presenting high risks of bribery.9

A public action may be initiated within six years of the offence. Special provisions are applicable to the investigation of offences related to potential acts of corruption: surveillance, infiltration, interception of telecommunications, sound recordings and fixation of images, and protective measures.10

French law also criminalises influence peddling: that is, offering directly or indirectly gifts, promises, donations, presents or benefits of any kind to a person entrusted with public authority, entrusted with a public service mission or invested with a public elective mandate, for him or herself or for another person.11

ii Definition of public official

Under the French Criminal Code, a public official is defined as 'any representative of a public authority or any person exercising a public function or holding elected office'.12 The definition of foreign public officials is the same.13 Persons holding a judicial office are excluded from the scope of public officials, and corruption concerning them is covered under a separate offence.14

ii Penalties

Natural persons guilty of corruption offences are liable to 10 years' imprisonment and a fine of up to €1 million, which can be increased to twice the value of the proceeds, except for private commercial bribery, which is punishable by five years' imprisonment and a fine of up to €500,000, which can be increased to twice the value of the proceeds. The fine may be increased to €2 million or an amount equivalent to twice the proceeds of the offence if it is committed by an organised group.15 Passive bribery of judicial officials can be aggravated when it is committed for the benefit or to the detriment of a person subject to criminal prosecution: the offence then becomes a felony punishable by 15 years' imprisonment and a fine of €225,000.16 In addition, five complementary penalties can be imposed on the perpetrator of corruption, including confiscation of the proceeds of the offence and disbarment from public procurement.17

As for legal persons, the maximum penalty applicable is five times the fine provided for natural persons,18 and it may be accompanied by specific penalties, which may include dissolution, exclusion from public contracts or a ban on making public offers on financial markets.19 In addition, the implementation of a mandatory compliance programme, as set forth in greater detail in Section X, may be incurred for certain bribery offences.20

Enforcement: domestic bribery

Prior to 2017, there was little incentive for companies to come forward and cooperate with the French criminal authorities in the context of corruption investigations, because there was no effective legal mechanism to settle.

This changed with the enactment of Sapin II: a legal entity can now settle corruption allegations with criminal authorities, which often will be the National Financial Prosecutor (PNF), by negotiating a convention judiciaire d'intérêt public (CJIP), akin to a deferred prosecution agreement in the United States.

The purpose of this mechanism is to incentivise companies to come forward regarding offences that are difficult to detect, while allowing companies to continue to qualify for public tenders and other forms of licences in jurisdictions where applicable laws provide for automatic disqualification in the event of a guilty plea or criminal conviction.

Under this mechanism, the public prosecutor may offer to legal entities (but not individuals) the possibility of entering into a settlement agreement requiring:

  1. the payment of an amount proportionate to the advantages derived from the offences, capped at 30 per cent of the company's average annual turnover for the past three years;
  2. the implementation of a compliance programme under the supervision of the AFA, at the expense of the company, if appropriate; and
  3. compensating the damage suffered by any victim.

The company officials remain accountable as individuals. In this regard, they can be assisted by an attorney before providing their consent to a settlement agreement. The agreement must be validated by a judge after hearing from both the legal entity and any victim. Following its validation, the agreement terminates the criminal proceedings without the company being convicted or having admitted wrongdoing. After a judge validates the settlement agreement, the company has the right to withdraw within 10 days. Once final, the settlement agreement is published on the website of the French Ministry of Justice and the French Ministry of the Budget.21

Foreign bribery: legal framework

Sapin II broadens the jurisdiction of French laws and courts by relaxing the principle of territoriality. As a result, the extraterritorial reach of French legislation was significantly extended, meaning that there is a greater possibility of French criminal liability for directors and officers of both French and non-French companies for acts of corruption committed abroad, with a potential extension of criminal liability to legal entities as well.22

Sapin II has also relaxed or eliminated certain procedural impediments to prosecutions of violations of French anti-corruption laws. Under the current law:

  1. French anti-corruption laws apply to acts committed abroad by French nationals, French residents, or persons whose business activity is in all or in part performed in France,23 even if the conduct is not prohibited in the foreign jurisdiction. Previously, this was only the case if the acts in question were also prohibited under the laws of the foreign jurisdiction. That requirement has now been abolished.
  2. Likewise, prosecution in France previously required either a criminal complaint by the victim of the acts of corruption or prosecution by foreign authorities. After Sapin II, French prosecutors may act – sua sponte or pursuant to a complaint by certain private parties, such as NGOs or associations fighting corruption – even in the absence of a prosecution abroad.
  3. French law applies to accomplices acting in France in relation to acts of corruption committed abroad, so long as the relevant conduct is an offence both in France and in the relevant foreign jurisdiction (i.e., without the requirement of a definitive judgment in the relevant foreign jurisdiction establishing that the offence has been committed, as was required prior to Sapin II).

As an illustration of this enforcement trend, the PNF, a special prosecutors' office created in 2013 with jurisdiction over serious economic and financial crime, including tax fraud, money laundering and corruption, was reportedly investigating between 90 and 100 cases of international corruption of foreign public officials as of 31 December 2018.24

Associated offences: financial record-keeping and money laundering

i Financial record-keeping

Different sources under French law provide for the obligation of truthful financial record-keeping. Most companies must provide the court registry with annual accounts, an annual report and an auditors' report on their annual accounts. Listed companies are required to publish several financial information reports on a quarterly basis and may also be brought before the French Financial Markets Authority (AMF), which is responsible for overseeing the financial and securities markets. The AMF can carry out inspections and investigations to ensure that entities comply with specific professional obligations.

French law prohibits false or misleading financial accounts or reporting, even though related offences are not frequently associated with acts of corruption.

ii Money laundering

French law criminalises money laundering, defined as 'the act of facilitating, by any means, the false justification of the origin of the assets or income derived from a crime or misdemeanour that has procured a direct or indirect profit' or 'the act of assisting in the placement, dissimulation or conversion of the direct or indirect proceeds of a crime or offence'.25 Money laundering is punishable by a maximum of five years' imprisonment and a fine of €375,000 (€1.875 million for legal entities).26 Aggravated money laundering is punished by up to 10 years of imprisonment and a fine of €750,000 (€3.75 million for legal entities).27 These amounts may be increased to up to half the value of the assets or funds that were the object of the laundering activities, and five times that amount for legal entities.28

On 20 February 2019, the Paris Criminal Court found Swiss bank UBS guilty of illegally soliciting French clients and laundering the proceeds of tax fraud, and imposed a fine of €3.7 billion after trial, in addition to a fine to the French subsidiary of €15 million, five executives facing suspended prison sentences and personal fines, and €800 million in damages being payable to the French state. The Court found UBS guilty of money laundering with the aggravated factor defined in Article 324-2 of the French Criminal Code; that is, that it was 'committed in a habitual matter or using the means available as a result of a professional activity'. The judgment is under appeal, with a decision expected in December 2021.

In addition, the European Union published six directives between 1991 and 2018 on the fight against money laundering and terrorist financing.29 These European directives have been transposed into French law, including in the Monetary and Financial Code.

These regulations apply to financial (banking and insurance sectors) and non-financial (taxation, accounting, law, gambling and sports, trading in valuables sectors) professions, and require the intervention of various supervisory authorities with powers of investigation and sanction. In France, TRACFIN is the financial intelligence unit responsible for collecting and analysing information that entities subject to regulation must report, while the PNF has jurisdiction over nationwide money laundering-related offences. Professionals are required to report any suspicious transactions to TRACFIN whenever they 'know, suspect or have good reasons to suspect that a transaction may originate from an offence punishable by a prison sentence of more than one year or are related to the financing of terrorism'.30

Enforcement: foreign bribery and associated offences

i The PNF

The PNF specialises in the prosecution of three categories of offences: offences against probity (corruption, influence peddling or favouritism); offences against public finances; and offences against the proper functioning of financial markets. The PNF can initiate an investigation on its own initiative or following a complaint or whistle-blower alert.

On 2 June 2020, the Ministry of Justice issued guidelines (i.e., guidance addressed to members of the judicial branch) establishing guidance regarding the fight against international corruption and, in particular, outlining the PNF's central role.31

The guidelines highlight the PNF's role in reporting, analysing and investigating acts of corruption. In particular, the PNF has an active role in the treatment and processing of any source of information regarding foreign companies, since its jurisdiction extends to acts of corruption or influence peddling committed by any entity outside of France that exercises part or all of its economic activity within the French territory. The PNF may prosecute legal entities with a subsidiary, office or any other establishment in France. These channels for uncovering international corruption can include, but are not limited to, criminal mutual assistance requests, national or international press articles, information gathered through the OECD Working Group on Bribery in International Business Transactions, whistle-blower alerts and self-reporting.

Investigations led by the PNF aim at identifying the financial circuit and individuals involved in the corruption scheme, as well as their level of implication. Investigations may consist of document review, witness interviews, custody searches, accounting and tax investigations and, specifically regarding acts of corruption or influence peddling of a foreign official, wiretapping.

Upon completion of the investigation, the PNF may close the proceedings, refer the matter to an investigative magistrate for further investigation or decide to prosecute by referring the matter to the relevant criminal court.

ii The settlement of allegations of corruption, influence peddling, tax fraud, laundering of tax fraud and related offences

As noted above, a legal entity can also settle allegations of corruption, influence peddling, tax fraud and laundering of tax fraud with criminal authorities by negotiating a CJIP, akin to a deferred prosecution agreement in the United States.32

The first CJIP was concluded with HSBC Private Bank Suisse SA in October 2017, in connection with the laundering of proceeds of tax fraud. To date, 14 CJIPs have been entered into, for a total amount exceeding €3 billion:

  1. six for laundering of tax fraud, tax fraud and complicity in tax fraud; and
  2. eight in corruption cases: three relating to a system of illegal commissions set up by an employee, one for corruption of foreign public officials in Libya, one for corruption of foreign public officials in Algeria, one as part of a coordinated settlement to resolve a joint investigation by US, UK and French authorities into bribery and corruption relating to both foreign public officials and private customers, one for corruption of foreign public officials in Central Asia, and one for corruption of foreign public officials in Togo and breach of trust.

In particular, Société Générale SA agreed to settle charges of corruption with both US and French criminal authorities on 4 June 2018. This was the first coordinated resolution by US and French authorities involving a foreign bribery case, for a total penalty of US$585 million, split equally between the US Department of Justice (DoJ) and the PNF.33

This case highlights the potential for greater coordination by authorities in multiple jurisdictions, thereby limiting the imposition of multiple penalties on a company for the same conduct, as well as the increased risk of enforcement actions against multinational companies based on violations of anti-corruption laws across several jurisdictions.

The CJIP concluded between HSBC Private Bank (Suisse) SA and the PNF expressly notes that while HSBC Private Bank Suisse SA did not 'voluntarily disclose the facts to the French criminal authorities, or acknowledge its criminal liability during the course of the investigation [. . .], one must recognise that when the investigation started and until December 2016, the French legal system did not provide for a legal mechanism encouraging full cooperation'. This can be interpreted as a strong signal that now that the CJIP is available, French authorities expect companies to self-report and cooperate. They have indicated as much on repeated occasions.

On 26 June 2019, the AFA and the PNF co-signed common guidelines on the legal regime of the CJIP, designed to 'encourage legal entities to adopt a cooperative approach with the judicial authorities and the AFA'.34

The common guidelines list the prerequisites and additional criteria taken into account by the public financial prosecutor before initiating settlement negotiations, namely:

  1. a proposal by the PNF in the course of preliminary investigations as an alternative to criminal proceedings (Article 41-1-2 of the French Code of Criminal Procedure) or during judicial investigations (Article 180-2 of the French Code of Criminal Procedure). The guidelines also mention that the company itself may express its interest in concluding a CJIP;
  2. sufficient evidence of acts of corruption or influence peddling;
  3. an absence of previous sanctions for such acts;
  4. implementation of an effective compliance programme;
  5. cooperation during the investigation and implementation of internal investigations;
  6. voluntary compensation of the victims of wrongful acts, even before the settlement negotiations are considered; and
  7. voluntary disclosure of relevant facts by the company.

Akin to the '9-47.120 FCPA Corporate Enforcement Policy' published by the DoJ,35 the guidelines also enumerate the aggravating and mitigating factors that will be taken into consideration when negotiating the overall amount of the sanction. Among the factors weighing in the company's favour are self-disclosure, the quality of the cooperation, the efficacy of its compliance programme and the thoroughness of the internal investigations conducted by the company. Nevertheless, the guidelines do not provide specific metrics on the magnitude of fine reductions that a company may obtain by self-reporting and cooperating.

According to the AFA and the PNF, their common guidelines on the legal regime of the CJIP will 'constitute for economic operators and foreign judicial authorities a factor of predictability and legal certainty.'36 As indicated in its public guidance, the PNF appears to take an approach similar to that of its international counterparts in that it provides credit for cooperating with criminal investigations and seeks to impose disgorgement of any related financial benefits that the misconduct created. However, the PNF does not specify the precise calculation of those benefits.

The PNF's central role in the fight against international corruption has been reaffirmed in the Ministry of Justice's 2020 guidelines, in which the Ministry of Justice also insists on the different channels for uncovering international corruption, such as whistle-blower alerts, self-reporting, and domestic and foreign press articles containing 'credible and detailed factual elements.'37

International organisations and agreements

France is a party to many international agreements, including:

  1. the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions, which entered into force in 1999;
  2. the Criminal Law Convention on Corruption of the Council of Europe, which entered into force in 2002;
  3. the Civil Law Convention on Corruption of the Council of Europe, which entered into force in 2003;
  4. the United Nations Convention against Transnational Organized Crime, which entered into force in 2003; and
  5. the United Nations Convention Against Corruption, adopted in Merida in 2003 and which entered into force in 2005.

As part of its mission to disseminate information to help prevent and detect bribery, the AFA contributes to the implementation of France's international commitments, in particular through the development of bilateral cooperation. The AFA may conclude cooperation agreements with foreign authorities carrying out similar missions of prevention and detection of corruption.38 It regularly receives foreign delegations, organises or takes part in international cooperation actions, and exchanges best practices and training. With the support of the Council of Europe, as part of a joint initiative with the Italian National Anti-Corruption Authority, the AFA also contributed to the launch of the Network of Corruption Prevention Authorities in October 2018, which it chaired in 2020.

Finally, France participates in the European Public Prosecutor's Office (EPPO),39 which is an independent body of the European Union responsible for investigating, prosecuting and bringing to judgment crimes against the financial interests of the EU. The EPPO started its operations on 1 June 2021.

Legislative developments

i Implementation of Directive (EU) 2019/1937

In December 2019, a directive of the European Union came into force to establish common minimum standards for the protection of whistle-blowers in reporting breaches of EU law that are harmful to the public interest.40 The Directive requires the establishment of several reporting channels and an escalation process. Member States have two years to transpose the text into domestic law; this period is extended to four years concerning the establishment of internal reporting channels in private companies with 50 to 249 employees. In France, a draft law 'aimed at improving the protection of whistle-blowers' was tabled in the National Assembly on 21 July 2021 in order to implement the Directive by 31 December 2021.

This bill considers several measures, including:

  1. the requirement that whistle-blowing be without 'direct financial consideration' instead of being 'selfless';
  2. the reinforcement of the options available to report via an independent and secure external channel, such as the French Defender of Rights, which would be called upon to play a key role in this new system;
  3. the ability of the Defender of Rights to give an opinion on a whistle-blower's status at the latter's request; and
  4. the nullity of retaliation measures such as the demotion or refusal to promote a whistle-blower, forced transfers, salary reductions, early termination or cancellation of a contract, or other practices amounting to intimidation, harassment, discrimination and blacklisting.

ii Law No. 2020-1672 of 24 December 2020 on the European Public Prosecutor's Office, environmental justice and specialized criminal justice

The Law on the European Public Prosecutor's Office, environmental justice and specialised criminal justice of 24 December 2020 extends the scope of action of the PNF to the fight against anticompetitive practices, and lifts the requirement that a legal entity acknowledge the facts and accept the criminal characterisation before entering into a CJIP. This mechanism is also extended to several high-profile environmental offences.41

In addition, the law introduces the European Public Prosecutor's Office (EPPO) into national law. It specifies the powers and duties of members of EPPO at the national level. The prosecutors forming part of EPPO have jurisdiction throughout the national territory to investigate, prosecute and bring to trial the perpetrators of and accomplices in criminal offences affecting the financial interests of the European Union. The law also designates the Paris judicial court and the Paris Court of Appeal as competent to hear related cases.

Other laws affecting the response to corruption

i French 'Blocking Statute'

Adopted in 1968, and amended in 1980, the Blocking Statute prohibits the transfer outside of France of certain information unless the proper channels provided by international treaties are used. Article 1 provides that, subject to international treaties or agreements, French nationals, French permanent residents and any director, representative, agent or employee of a French legal entity are prohibited from communicating economic, commercial, industrial, financial or technical information to foreign public officials if it is harmful to France's sovereignty, security or essential economic interests.42 Article 1 bis provides that '[s]ubject to treaties or international agreements and applicable laws and regulations, it is forbidden for any person to request, search or communicate under written, oral, or any other form, documents or information of an economic, commercial, industrial, financial, or technical nature for the purpose of constituting evidence for or in the context of foreign judicial or administrative proceedings'.'43

Violations of the Blocking Statute carry a maximum penalty of six months of imprisonment, a fine of up to €18,000 for individuals and €90,000 for legal entities, or both.44 On 12 December 2007, in the Christopher X case, the French Cour de Cassation upheld the conviction of a French lawyer for the communication of information obtained to serve in US proceedings.45 In 2014, the protective aspect of the Blocking Statute was reaffirmed when a Court of Appeal used it to shield a French party from pre-trial discovery.46

The Blocking Statute permits disclosure of documents or information in accordance with French laws and regulations in force (including the EU's General Data Protection Regulation (GDPR)47 and the French data protection legislation) and with treaties or international agreements such as the Hague Convention on the Taking of Evidence Abroad.48

The French Data Protection Authority (CNIL) has provided guidance on the interaction between French data protection law and the Blocking Statute, and has considered that the proportionality requirement in a US-style discovery context could only be satisfied if the processing and transfer of personal data were made in compliance with the applicable duty of confidentiality and the Blocking Statute.49

Treaties such as mutual legal assistance treaties,50 as well as the Hague Convention, contain mechanisms allowing for foreign disclosure. Discovery may be obtained through the Hague Convention by way of a letter of request sent by a court in the requesting state or by diplomatic or consular personnel of the requesting state.51

ii Protection of whistle-blowers

Until recently, France had disparate sets of rules protecting different types of whistle-blowers. Following the enactment at the end of 2016 of Sapin II, French law now provides for a unified set of rules protecting whistle-blowers, subject to the implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (see Section VIII).

Sapin II defines a whistle-blower as an individual who, in a disinterested manner and in good faith, discloses a crime, a misdemeanour or a serious and clear violation of an international commitment legally ratified or approved by France, a serious threat to the public interest or, where applicable, a violation of a company's code of conduct.52 The whistle-blower must have personal knowledge of the reported facts. Certain facts, information or documents that are subject to national security or medical secrecy, or that are covered by legal privilege, are excluded from the scope of whistle-blower rules. In addition, certain persons acting in the course of their jobs cannot claim the status of whistle-blower, such as journalists, witnesses called to appear before a court or public servants denouncing facts they are aware of as part of their jobs (e.g., judges and labour inspectors).

In principle, French law does not require a person to provide information under whistle-blowing policies. This must remain optional for employees.

There are three distinct obligations for French companies to set up a whistle-blower system:

  1. Article 8 of Sapin II requires companies with more than 50 employees to implement an internal whistle-blower mechanism;
  2. Article 17 of Sapin II also requires the implementation of a whistle-blower protection mechanism for companies that are subject to an affirmative obligation to prevent corruption through the implementation of an anti-corruption compliance programme; and
  3. Law No. 2017-399 of 27 March 2017 on the corporate duty of vigilance requires the implementation of an alert mechanism for disclosing risks of severe violations of human rights, health risks and serious environmental damage.53 While the mechanism provided in Law No. 2017-399 is distinct from the internal whistle-blowing system required under Sapin II, the AFA recommends establishing, where appropriate, a single technical system for receiving alerts, as long as the requirements laid down in the two sets of rules are met.54

Compliance

Before Sapin II, French law did not mandate the implementation of an anti-corruption compliance programme and was thus perceived as falling short of international standards, particularly when compared to the 1977 US Foreign Corrupt Practices Act (FCPA) and the 2010 UK Bribery Act (UKBA).

Article 17 of Sapin II introduced mandatory compliance programme requirements, which had to be implemented by 1 June 2017 as part of a new set of proactive anti-corruption obligations. This requirement applies to:

  1. French companies having 500 or more employees and a turnover above €100 million;
  2. foreign companies belonging to a group having a French parent company, 500 or more employees in total and a consolidated turnover above €100 million; and
  3. all of the subsidiaries of (a) and (b).

As a result, any French entity that belongs to a group having a French parent company, 500 or more employees in total and a consolidated turnover above €100 million is subject to this obligation.

i Mandatory compliance programmes

The AFA is in charge of monitoring and assessing compliance programmes. It is headed by a magistrate under the joint supervision of the Ministry of Finance and the Ministry of Justice and possesses broad investigative and sanctioning powers.

On 22 December 2017, following a broad public consultation, the AFA published its Guidelines for public and private legal entities to prevent and detect acts of corruption (AFA 2017 Guidelines), which were revised on 12 January 2021 (Guidelines).55

The Guidelines are 'inspired by the best international standards'.56 Similar guidelines have been issued in the United States by the DoJ and Securities and Exchange Commission (2012),57 as well as in the United Kingdom by the Ministry of Justice (2010).58 The Guidelines are nonetheless a unique and thorough set of non-binding measures and procedures, different from and in certain respects more stringent than other anti-corruption standards, such as those established by the FCPA or the UKBA.

Top management's commitment to preventing and detecting corruption

Inspired by its Anglo-Saxon counterparts and the 'tone at the top' approach, the AFA emphasises that the implementation of a risk management strategy and an anti-corruption compliance programme relies on the commitment of a company's top management to establish a culture of integrity, transparency and compliance.59

Although the involvement of companies' top management was not contemplated per se by Sapin II, it is at the forefront of the Guidelines. The AFA recommends that the commitment from top management be based on the following principles:

  1. adopting a zero-tolerance approach to corruption, especially by ensuring that the resources allocated are proportionate to the risk incurred and by using the organisation's audit reports to guarantee that the anti-corruption system is 'organised, effective and up to date';
  2. mainstreaming anti-corruption measures in the company's policies and procedures, with a particular focus on human resources management procedures, internal alert systems for reporting suspected cases of corruption and other applicable policies related to any process defined as high-risk by the risk map (see below);
  3. governance of the corruption prevention and detection programme, especially by appointing a compliance officer responsible for overseeing the deployment, implementation, evaluation and updating of the anti-corruption compliance programme;
  4. providing human and financial resources that are proportionate to the company's risk profile; and
  5. engaging in broad-based communication aimed at all staff about the company's bribery prevention and detection policy.

Enactment of a detailed and regularly updated anti-corruption code of conduct

A code of conduct defining and illustrating prohibited behaviours likely to constitute acts of corruption must be implemented. In that respect, the Guidelines specify that such code of conduct should not be merely a collection of best practices, but rather should prohibit those practices that are deemed inappropriate in light of the organisation's specific circumstances. The code must address gifts, invitations, facilitation payments, conflicts of interest, patronage and sponsorship and, where appropriate, lobbying.

The code of conduct, updated periodically, must be written in French, using simple and clear terms. It may be translated into one or more languages in order to be understood by employees from other countries.

Implementation of a detailed operational internal alert system

The Guidelines outline 10 operational items that an internal alert system established pursuant to Sapin II should include. They relate to:

  1. the role of the line manager in directing and assisting his or her colleagues;
  2. the person designated (from within or outside the company) to collect alert reports;
  3. the measures implemented to ensure confidentiality of the disclosures and of a whistle-blower's identity;
  4. the procedures applicable to authors of reports in providing information or documents;
  5. the procedures for communicating with the author of a report;
  6. the applicable steps to notify the authors upon receipt of an alert report and the time period necessary to decide on its admissibility;
  7. the measures taken to notify the author of a report at the end of the procedure and, where appropriate, the persons targeted by the alert;
  8. the procedure used, if no action is taken, to destroy the information on file identifying the author;
  9. whether the automated processing of disclosures is used, with the authorisation of the CNIL; and
  10. if applicable, the policy used to process anonymous reports.

The Guidelines also specify that the internal alert system is distinct from two other legal mechanisms, namely:

  1. the procedures implemented pursuant to Articles 6 to 16 of Sapin II to ensure the protection of whistle-blowers reporting a crime or a major and clear violation of an international commitment or law; and
  2. the whistle-blowing mechanism provided by Law 2017-399 of 27 March 2017 on the corporate duty of vigilance for parent and ordering companies.

The Guidelines mention the possibility of enacting a single system for processing the various disclosures mentioned above.

Six-step methodology for risk mapping

Article 17 of Sapin II provides that a risk map must be implemented and regularly updated. In that respect, the Guidelines stress that risk mapping potential acts of corruption serves two purposes: identifying, assessing, prioritising and managing corruption risks that are inherent in the organisation's activities; and informing top management and providing the compliance team with the required transparency for preventing and detecting those risks.

The Guidelines recommend following a six-step methodology:

  1. clarifying roles and responsibilities for elaborating, implementing and updating the risk map;
  2. identifying risks that are inherent in the organisation's activities;
  3. assessing exposure to corruption risks;
  4. assessing the adequacy and effectiveness of the procedures aimed at managing these risks;
  5. prioritising and addressing net or residual risks; and
  6. formalising and updating the risk map.

Third-party due diligence procedure

Sapin II requires companies to implement due diligence and risk assessment procedures relating to 'clients, rank one suppliers and intermediaries'. The Guidelines extend this obligation to all third parties – clients, main suppliers, subcontractors or intermediaries – with whom the organisation has or is about to initiate a relationship, with an emphasis on third parties identified in the risk map as presenting a risk of corruption.60

In addition, the AFA recommends using multiple indicators and gathering different sets of information, listed in the Guidelines, before initiating or continuing a contractual relationship.

Accounting control procedures

With respect to the obligation to implement control procedures aimed at ensuring that accounting systems are not used to conceal acts of corruption, the Guidelines note that, while companies are not required to establish new accounting procedures, they should nonetheless consider the concealment of acts of corruption as one of many risks that may arise when records are not prepared regularly, sincerely and faithfully. The Guidelines provide that controls can be performed internally or externally, but, in either situation, companies are advised to adopt a three-level procedure to conduct accounting and financial audits:

  1. at the first level, the persons responsible for preparing and approving journal entries should ensure that entries, especially if done manually, are properly substantiated and documented;
  2. at the second level, independent employees or collaborators should perform controls throughout the year to ensure that the first level of control is conducted accurately; and
  3. at the third level, internal audits should confirm the compliance of all accounting control procedures with the requirements of the company, and ensure that these procedures are scheduled at regular intervals and updated frequently.61

Corruption risk training

With respect to the requirement that training programmes for executives and employees most exposed to the risk of corruption be implemented, the Guidelines provide that the head of human resources should work with the compliance officer to identify which managers and other employees are most exposed to the risk of corruption. Companies should also enact a broader training and awareness plan so that all employees, regardless of their degree of exposure, are gradually trained to prevent and detect corruption.

The training should be delivered in an appropriate format, either in-person or as e-learning modules, and in a language that the target audience understands.

Internal monitoring and assessment

Article 17 of Sapin II creates an obligation to implement an internal control procedure to evaluate the effectiveness and implementation of existing measures. The Guidelines recommend the adoption of a three-level process:

  1. at the first level, controls by operational or support staff, or by line managers;
  2. at the second level, a monitoring plan designed by the compliance officer or any other designated manager covering the prevention and detection of corruption in its entirety; and
  3. at the third level, an internal audit to determine whether corruption prevention and detection measures are effective.

ii The AFA's Sanctions Commission

The AFA has both an advisory and supervisory role, managed by two separate teams. In its advisory role, the AFA provides guidance regarding the detection and prevention of corruption by companies, including by issuing guidance on what an effective compliance programme should include. In its supervisory role, the AFA conducts audits to assess the quality and effectiveness of compliance programmes, and acts as a monitor. The AFA, however, does not have jurisdiction to bring charges if it uncovers any misconduct. In such a case, the AFA notifies the relevant public prosecutor of any such suspicious conduct.

The AFA is conducting compliance audits assessing the implementation of the aforementioned obligations,62 and non-compliance can result in administrative fines of up to €1 million. If such an audit is conducted, the fulfilment of the guidelines laid down by the AFA, as well as the periodic reassessment of existing programmes, will prove critical.

The first hearing of the Sanctions Commission of the AFA took place on 25 June 2019 against a French electrical equipment manufacturer for alleged violations of five anti-corruption obligations under Article 17 of Sapin II, namely the implementation of a risk map, a code of conduct, an internal alert system, third-party evaluation and accounting control procedures. In its 4 July 2019 decision, the Sanctions Commission of the AFA declined to issue an injunction or impose a financial penalty, while providing additional guidance on how to implement adequate compliance programmes. One notable aspect of the ruling is that it indicates that Sonepar remedied any deficiencies in its compliance programme between the date of the AFA's director's report on Sonepar's alleged violations and the decision of the Sanctions Commission. The Sanctions Commission held that 'on the date on which it made a ruling, none of the breaches relied on by the Director of the AFA to propose the issuing of an injunction [were] identified by the Sanctions Commission.'63

On 7 February 2020, the Sanctions Commission of the AFA rendered a second decision against a French multinational specialising in mineral-based products.64 The Sanctions Commission ruled that its code of conduct and accounting procedures and controls did not comply with the requirements of Article 17 of Sapin II. With respect to the former, it ordered the company to update its code of conduct by 1 September 2020. With respect to the latter, the Sanctions Commission noted that the company had engaged in a financial and accounting reorganisation and requested that the company provide evidence demonstrating its complete implementation of accounting control procedures by 31 March 2021.

The fact that the Sanctions Commission's hearings are public is a powerful incentive for companies to ensure that their compliance programmes are satisfactory in the eyes of the AFA. To that end, companies would be well advised to comply, to the fullest extent possible, with the French specific guidelines, which can differ significantly from their foreign equivalents.

iii Anti-corruption due diligence in the context of mergers and acquisitions

On 12 March 2021, the AFA updated its 'Practical Guide – Anti-Corruption Due Diligence in the Context of Mergers and Acquisitions',65 which encourages potential acquirers, regardless of their characteristics (business model, size, staff, nature of activities, etc.), to evaluate the risks associated with the potential involvement of the target company in a corruption case and the quality of the target's compliance programme in order to assess the extent to which any deficiencies will need to be addressed once the transaction is completed.

Under French law, legal entities are criminally liable for offences committed by them or their representatives for their benefit.66 As for civil liability, the consequences of any misconduct by the target will be borne by the acquiring entity if the target is merged into the acquirer or if both merge to form a new company.

Consistent with its prior general guidance, the AFA has indicated, through non-binding guidelines, its stated goal of helping French companies meet the highest international anti-corruption standards, including in the context of mergers and acquisitions. The AFA's Guide stands out in particular for the level of detail that it provides to companies on the steps that they should take.

The AFA defines different steps that acquirers should consider implementing before and after signing transaction documentation:

  1. gathering information related to the target's anti-corruption history, including whether it has been previously involved in any corruption cases;
  2. during the period between the signing and the closing, conducting further assessments as necessary, including with respect to the target's high-risk third-party relationships, accounting controls and whistle-blowing alert systems; and
  3. obtaining additional information by means of questionnaires, document requests or even on-site visits, as necessary.

The AFA notes that the level of detail of the due diligence depends on the level of risk identified. Such risk assessment should be managed by an employee appointed by the company to manage the due diligence process (or an external adviser) and should be based on different factors, including the company's relationship with third parties, the countries and sectors in which it operates, its activity and business model, and its history of prior convictions. Upon completion of the transaction, the acquirer should ensure that its compliance programme is appropriately implemented throughout the target and that any corrective measures are properly executed. If any suspicions of corruption appear during the due diligence process, an audit may be warranted. To the extent that any misconduct is uncovered, the company should promptly terminate these actions and consider disciplinary sanctions against the employees involved.

Outlook and conclusions

On 7 July 2021, two French MPs issued a report assessing the impact of Sapin II and formulated 50 proposals to reform the French anti-corruption legal framework.67

One of the main proposals concerns a structural reorganisation of the AFA, whose role would be centred on administrative coordination and strategic programming support. The advisory and control functions currently performed by the agency would be transferred to the High Authority for Transparency in Public Life, which would become a largely independent administrative authority competent in matters of public ethics and corruption prevention.

This proposed entity, named the High Authority for Probity, would be entrusted with the AFA's advisory and control functions. Other proposals include the removal of the condition that the headquarters of a parent company be located in France, in order to subject small subsidiaries of foreign groups established in France to the obligation to implement compliance programmes under Article 17 of Sapin II, and the strengthening of the confidential nature of opinions issued by in-house counsel, to align with the legal privilege applicable to communications with outside counsel.

Footnotes

1 Guillaume de Rancourt is counsel and Camille Martini is associate at Cleary Gottlieb Steen & Hamilton LLP.

2 Law No. 2016-1691 dated 9 December 2016 on transparency, combating corruption and the modernisation of economic life (Sapin II).

3 See Articles 432-11 and 433-1 of the French Criminal Code. All influence-peddling offences are punishable by five years' imprisonment and a fine of €500,000 for individuals and €2.5 million for legal entities, except for active and passive influence peddling by public officials, which is punishable by 10 years' imprisonment and a fine of €1 million, which may be increased in either case to an amount corresponding to twice the proceeds of the offence. Comp. Articles 434-9-1 (domestic judicial staff), 433-2 (private individuals), 435-4 (foreign public officials) and 435-10 (foreign judicial staff) with Article 433-1 (domestic public officials) of the French Criminal Code.

4 Article 433-1 of the French Criminal Code.

5 Article 432-11 of the French Criminal Code.

6 Articles 433-1 and 432-11 of the French Criminal Code.

7 Article 434-9 of the French Criminal Code.

8 Articles 445-1 and 445-2 of the French Criminal Code.

9 AFA, Guidelines to help private and public sector entities prevent and detect corruption, influence peddling, extortion by public officials, unlawful taking of interest, misappropriation of public funds and favouritism (January 2021), ¶ 298.

10 Article 706-1-1 of the French Criminal Code.

11 See Articles 433-1, 433-2, 434-9-1, 435-4 and 435-10 of the French Criminal Code.

12 Articles 432-11 and 433-1 of the French Criminal Code.

13 Articles 435-1 and 435-3 of the French Criminal Code.

14 Article 434-9 of the French Criminal Code.

15 Article 433-1 of the French Criminal Code.

16 Article 434-9 of the French Criminal Code.

17 Articles 432-17 and 433-25 of the French Criminal Code.

18 Article 131-38 of French Criminal Code.

19 Article 131-39 of the French Criminal Code.

20 Articles 131-39-2, 433-26, 434-48, 435-15 and 445-4 of the French Criminal Code.

21 Article 41-1-2 of the French Code of Criminal Procedure, amended by Law No. 2020-1672 of 24 December 2020 on the European Public Prosecutor's Office, environmental justice and specialized criminal justice.

22 To recall, the French Criminal Code criminalises active and passive bribery of foreign or international public officials (Articles 435-1 and 435-3 of the French Criminal Code) and of foreign or international judicial staff (Articles 435-7 and 435-9 of the French Criminal Code).

23 Article 435-11-2 of the French Criminal Code.

24 U Bernalicis and J Maire, Information report on the evaluation of the fight against financial delinquency, registered with the Presidency of the National Assembly on 28 March 2019, No. 1822, p. 173. The number of ongoing investigations related to offences against probity including corruption has increased from 239 in 2018 to 318 in 2020. See U Bernalicis and J Maire, Information report on the implementation of the conclusions of the information report (No. 1822) of 28 March 2019 on the evaluation of the fight against financial delinquency, registered with the Presidency of the National Assembly on 6 July 2021, No. 4314, p. 92.

25 Article 324-1 of the French Criminal Code.

26 ibid.

27 Article 324-2 of the French Criminal Code.

28 Article 324-3 of the French Criminal Code.

29 See Council Directive 91/308/EEC of 10 June 1991 on prevention of the use of the financial system for the purpose of money laundering; Directive 2001/97/EC of the European Parliament and of the Council of 4 December 2001 amending Council Directive 91/308/EEC on prevention of the use of the financial system for the purpose of money laundering; Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing; Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No. 648/2012 of the European Parliament and of the Council; Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU; Directive (EU) 2018/1673 of the European Parliament and of the Council of 23 October 2018 on combating money laundering by criminal law.

30 Articles L561-15 to L561-23 of the French Monetary and Financial Code.

31 French Ministry of Justice, Guidelines on criminal policy in the fight against international corruption (2 June 2020).

32 Article 41-1-2 of the French Code of Criminal Procedure.

33 See Société Generale SA deferred prosecution agreement.

34 AFA and PNF, Guidelines for the implementation of the Convention judiciaire d'intérêt public (26 June 2019), p. 2.

35 DoJ, '9-47.120 – FCPA Corporate Enforcement Policy'. The FCPA Guide provides a non-exclusive list of factors to be considered by the DoJ when determining whether to bring charges and negotiating plea or other agreements. See also DoJ and US Securities and Exchange Commission, 'A Resource Guide to the US Foreign Corrupt Practices Act', 2nd edition (July 2020).

36 AFA and PNF, Guidelines for the implementation of the Convention judiciaire d'intérêt public (26 June 2019), p. 2.

37 French Ministry of Justice, Guidelines on criminal policy in the fight against international corruption (2 June 2020).

38 See, e.g., Technical cooperation protocol concluded between AFA and the General Inspectorate of the Government of Vietnam, on 15 January 2018, in Hanoi, aimed at strengthening the technical capacities of Vietnamese authorities.

39 Articles 1-5 of Law No. 2020-1672 of 24 December 2020 on the European Public Prosecutor's Office, environmental justice and specialized criminal justice.

40 Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

41 See Law No. 2020-1672 of 24 December 2020 on the European Public Prosecutor's Office, environmental justice and specialised criminal justice, which created a new Article 41-1-3 in the French Code of Criminal Procedure.

42 Law No. 68-678 of 26 July 1968 relating to the communication of documents and information of an economic, commercial, industrial, financial or technical nature to foreign natural or legal persons, modified by Law 80-538 of 16 July 1980, Article 1.

43 ibid., Article 1 bis.

44 ibid., Article 3.

45 Cass Crim, 12 December 2007 No. 07-83228.

46 Nancy Court of Appeal, 4 June 2014, No. 14/01547.

47 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

48 Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters, 18 March 1970, 23 UST 2555, 847 UNTS 231.

49 Commission nationale de l'informatique et des libertés, Délibération No. 2009-474 (23 July 2009), (concerning recommendations for the transfer of personal data in the context of US court proceedings known as discovery). Article 48 of the GDPR provides that judgments of a foreign court requiring the transfer of personal data will be enforced so long as they are based on an international agreement in force between the two countries.

50 See, e.g., Treaty on Mutual Legal Assistance in Criminal Matters Between the United States of America and France, US-Fr, 10 December 1998, TIAS No. 13010.

51 Hague Convention on the Taking of Evidence Abroad in Civil and Commercial Matters, 18 March 1970, 847 UNTS 231, Article 1.

52 Law No. 2016-1691 dated 9 December 2016 on transparency, combatting corruption and the modernisation of economic life, Article 6. See also ibid., Article 17.

53 Law No. 2017-399 of 27 March 2017 on the corporate duty of vigilance, Article 1 (which added a new Article L. 225-102-4 to the French Commercial Code). This obligation applies to companies employing, at the end of two consecutive financial years, 'at least 5,000 employees within the company and its direct and indirect subsidiaries whose head office is located on French territory, or at least 10,000 employees within the company and in its direct or indirect subsidiaries whose head office is located on French territory or abroad'.

54 AFA, 2021 Guidelines, p. 34. See also AFA, Guidelines for public and private legal entities to prevent and detect acts of corruption (December 2017), p. 12.

55 The new Guidelines became effective on 13 January 2021, with a six-month period for companies to adapt their compliance programmes to the extent required.

56 AFA 2017 Guidelines, p. 3.

57 See DoJ, '9-47.120 – FCPA Corporate Enforcement Policy' (last updated in November 2019).

58 See Ministry of Justice of the United Kingdom, 'Guidance about procedures which relevant commercial organisations can put into place to prevent persons associated with them from bribing' (March 2011).

59 AFA's Guidelines, pp. 13–15.

60 AFA Guidelines, pp. 63–64.

61 AFA Guidelines, p. 10.

62 To date, the AFA has initiated over 110 audits. See AFA, annual report 2018 (referencing 47 audits); annual report 2019 (referencing 36 additional audits) and annual report 2020 (referencing 30 additional audits).

63 Sanctions Commission of the AFA, Decision No. 19-01, Société S SAS et Mme C (4 July 2019), p. 15.

64 Sanctions Commission of the AFA, Decision No. 19-02, Société I et M. C K (7 February 2020).

65 AFA's Practical Guide – Anti-corruption due diligence for mergers and acquisitions, 2nd edition (12 March 2021). The AFA had published the first edition on 17 January 2020. The updated version takes into account the 25 November 2020 decision of the Criminal chamber of the Cour de Cassation (Cass Crim, 25 November 2020, No. 18-86.955 whereby in the case of a merger where a company is acquired by another company falling within the scope of the Council Directive 78/855/EEC of 9 October 1978 on the mergers of public limited liability companies, the acquiring company may be sentenced to a fine or to seizure measures for acts constituting an offence committed by the company being acquired prior to its acquisition.

66 Article 121-2 of French Criminal Code.

67 R Gauvain, O Marleix, Information Report on the assessment of the impact of Law No. 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernisation of economic life, known as Sapin II, registered with the Presidency of the National Assembly on 7 July 2021, No. 4325.

The Law Reviews content