The French administrative order (arrêté) of 3 November 2014 (2014 Order) establishing a framework on internal control for financial institutions subject to the supervision of the French banking authority (Autorité de contrôle prudentiel et de résolution, ACPR) was recently amended by the French order (arrêté) of 6 January 2021 on the system and internal controls to fight money laundering and terrorist financing (AML Internal Controls Order).
The purpose of the AML Internal Controls Order, which substantially repeats the provisions of the 2014 Order, was to extend these requirements to a larger part of entities subject to anti-money laundering and terrorist financing (AML CFT) obligations subject to the supervision of the ACPR, as the 2014 Order only applied to a restricted part of these entities - for instance, branches of European Union credit institutions or insurance companies where not subject to this order, whereas they are subject to the ACPR supervision as far as AML CFT is concerned.
Even though most of the obligations established in the AML Internal Controls Order already existed under the 2014 Order, a few new provisions were introduced. Among them, two new functions were created: the relevant entities should appoint, as from 1 March 2021, a person in charge of the permanent control and a person in charge of the periodic control of the AML CFT system and the assets freezing.
Further, additional requirements were introduced regarding outsourcing of AML CFT functions. In this respect the relevant entities should inform the ACPR of any outsourcing of AML CFT functions or modification of such an outsourcing arrangement, and insert a certain number of items in these outsourcing agreements (e.g. training obligation applicable to the third party provider, communication of information obligations by and to the regulated entity, protection of confidential information, etc.). It is to be noted that the entities which entered into such outsourcing agreement before the entry into force of the AML Internal Controls Order (1 March 2021) benefit from a one-year period of time to modify their agreements to comply with these new requirements.
The AML Internal Controls Order was modified by an order (arrêté) of 25 February 2021 to ensure consistency of the terms used the 2014 Order and the AML Internal Controls Order, as they inter alia cover the same topic. In this respect, cross-references were introduced in relation with the functions it established, such as the head of permanent control.
and then 