Anti-corruption in France: first AFA sanction and 2025 report

The French Anti-Corruption Agency (Agence française anticorruption, AFA) published its 2025 activity report in July 2026. Beyond its institutional review, the report contains a number of figures and trends that are directly relevant to companies and their legal and compliance departments: a sharp increase in reports received, continued recourse to the judicial public interest agreement (convention judiciaire d'intérêt public, CJIP), persistent weaknesses in anti-corruption programmes, and an expanded scope for Article 17 of the Sapin II Law. In the immediate aftermath of this publication, on 9 July 2026, the AFA Sanctions Committee issued its first decision imposing financial penalties on a company and its legal representative under the same Article 17. Below is an overview of the key takeaways.

As in previous years, the AFA's activity report provides a useful stock-take of the Agency's action and, more broadly, of trends in the prevention and enforcement of integrity offences. The 2025 edition comes against the backdrop of the adoption of an EU anti-corruption directive, the publication of France's National Multiannual Anti-Corruption Plan 2025-2029 (Plan national pluriannuel de lutte contre la corruption, PNPLC), and the entry into force of the 13 June 2025 law aimed at freeing France from the grip of drug trafficking. This year, it is also informed by an unprecedented decision, which warrants attention at the outset.

First financial penalty under Article 17: key practical takeaways

By decision no. 25-01 of 9 July 2026, published in anonymised form, the AFA Sanctions Committee imposed a financial penalty of €350,000 on a company and €60,000 on its legal representative, personally. Nine years after the entry into force of the law, these are the first financial penalties imposed on the basis of Article 17. The Committee’s two previous decisions – no. 19-01 of 4 July 2019 and no. 19-02 of 7 February 2020 – had resulted, respectively, in no measure being ordered and in two compliance injunctions.

Following a control conducted from June 2024 to July 2025, seven of the eight obligations set out in Article 17, II were at issue: risk mapping, a code of conduct and related disciplinary regime enforceable against employees of a subsidiary, third-party due diligence, anti-corruption accounting controls, training for exposed personnel, and internal monitoring and assessment procedures. The reasoning of the decision nevertheless remains relatively concise as regards the detailed assessment of the company’s compliance programme: the Committee notes in particular that several shortcomings were not disputed at the date of the control and that certain remedial steps had been taken late.

Three points are worth noting.

• First, the AFA Director referred the matter directly to the Sanctions Committee for the purpose of imposing a penalty, without first seeking a compliance injunction. The Committee upheld that choice: Article 17, IV provides for two distinct routes – injunction and sanction – without establishing a graduated response requiring the former to precede the latter. The Agency’s management therefore retains control over its enforcement strategy.
• Second, and this is likely to be the point of greatest interest for companies subject to Article 17, the Committee held that the shortcomings were to be assessed at the date of the final control report, not at the date on which it issued its decision. The company argued, relying on the two previous decisions referred to above, that its compliance remediation – completed in December 2025 – precluded any sanction. The Committee rejected that argument by distinguishing the previous cases: where it had been seized for the purpose of imposing an injunction, it necessarily had to assess the state of compliance at the date of its decision; where it is seized directly for the purpose of imposing a sanction, it is no longer constrained in that way. It added that the opposite approach would deprive the law of useful effect and create a distortion between companies that invest in compliance and those that do not, before rejecting the argument based on Article 7 of the European Convention on Human Rights, noting that the wording of Article 17, II has remained unchanged since 2016. Remediation after the final control report is therefore taken into account only at the stage of determining the amount of the penalty. The scope of this finding outside the specific context of a direct referral for sanctions remains to be clarified, as the Committee expressly based its distinction on the purpose of the referral.
• Third, the legal representative’s personal liability was upheld. The Committee noted that, as founder of the group, chairman and main shareholder, he had the authority and resources necessary to initiate compliance with the law, seven years after it entered into force.

As regards quantum, the Committee – which recalled that it was not bound by the Agency’s requests, the latter having sought at least €400,000 and €80,000 respectively – took into account the number, duration and seriousness of the shortcomings, but also the remedial measures taken since the control and mitigating circumstances in relation to two of the findings. The statutory caps are €1 million for legal entities and €200,000 for individuals.

The decision may be challenged before the Paris Administrative Court by way of a full jurisdiction appeal within two months of notification. Its takeaways will therefore need to be assessed, where relevant, in light of any subsequent litigation.

Whistleblowing reports: a sharply rising detection channel

The most striking figure concerns reports received by the AFA in its capacity as an external whistleblowing authority: the number of reports nearly tripled in a single year, rising from 802 in 2024 to 2,257 in 2025. This increase, also observed by other external reporting authorities, confirms the growing role of whistleblowing in detecting integrity offences.

That said, the figure calls for a nuanced reading. A large majority of the reports received fall outside the AFA's remit or are inadmissible: only 242 were admissible in 2025, i.e. 11% of the total (compared with 202 in 2024 and 109 in 2023). Moreover, these admissible reports overwhelmingly concern public-sector entities (76%), with economic operators accounting for only 19% of the organisations or individuals named. Of these 242 reports, 18 were referred to the public prosecutor under Article 40 of the Code of Criminal Procedure (compared with 17 in 2024).

For companies, the lesson lies less in the raw volume than in the trend: whistleblowing – whether internal or external – is establishing itself as a detection channel in its own right, and the diligent handling of reports is becoming a genuine risk-management issue.

Controls of economic operators: concrete follow-up and persistent weaknesses

In 2025, the AFA opened 10 new controls of economic operators, bringing the total number of controls conducted since 2017 to 175. Their outcome is noteworthy: the AFA's director issued five formal warnings and referred one matter, concluded in the second half of 2025, to the Sanctions Committee. On a procedural note, the report recalls that controlled companies may, in addition to submitting written observations on the draft report, request a hearing with the Agency's management to present their observations orally – a right that was exercised in every case in 2025, resulting in eleven such hearings over the year.

On substance, the report reiterates by-now familiar findings. At the AFA's "rendez-vous" event held on 10 February 2025, which took stock of 129 controls, the Agency noted an overall improvement in maturity, although programmes do not always reflect a genuine risk-based approach. The Agency also indicated that certain sectors would be prioritised for its 2025-2026 controls, chief among them healthcare and prison-related services. Recurring weaknesses include:

• risk maps built around overly generic risk scenarios;
• codes of conduct lacking practical illustrations and not always incorporated into internal work rules;
• third-party due diligence – particularly regarding customers – that remains insufficiently systematic;
• poorly defined anti-corruption accounting controls;
• internal whistleblowing mechanisms that remain underused.

These findings largely overlap with the shortcomings identified in the Sanctions Committee’s decision of 9 July 2026.

The report also devotes substantial attention to French subsidiaries of foreign groups, following the AFA's follow-up review of nine such subsidiaries in the automotive sector. This review found that anti-corruption programmes were often closely modelled on those of the parent company without sufficient adaptation to the French legal framework: an absence of risk mapping specific to the subsidiary, codes of conduct taken directly from the group – in seven cases out of nine – with limited adaptation to the local context, whistleblowing channels centralised at parent-company level, and internal audits rarely addressing the specific requirements of the Sapin II Law. The Agency accordingly recommends that international groups implement a more granular, local adaptation of their programmes: risk mapping expressly covering French operations, dedicated staff for compliance follow-up, and more systematic communication to subsidiaries of their specific obligations. This is a point directly relevant to the many international groups with a French presence.

Key takeaways

Several points of vigilance emerge for legal and compliance departments:

• following an Article 17 control, the AFA Director may refer the matter directly to the Sanctions Committee for the purpose of imposing a financial penalty, without any prior injunction. In that configuration, the shortcoming is assessed at the date of the final control report, not at the date on which the Committee issues its decision: remediation carried out in the meantime does not erase the finding and is taken into account only at the stage of determining the amount of the penalty. For controlled companies, the key issue is therefore to document precisely, from the outset of the control phase, any steps taken, their timing and, where applicable, their effectiveness;
• whistleblowing is establishing itself as a central detection channel: the quality of the reporting and handling mechanism, as well as the conduct of any resulting internal investigations, warrant continued attention;
• the weaknesses identified by the AFA remain stable from year to year – risk mapping and third-party due diligence chief among them – and constitute priority areas for improvement;
• the work undertaken by the AFA on third-party due diligence, following the public consultation held between July and October 2025, should provide a useful reference framework, bearing in mind that the envisaged guidance notes are not intended to be prescriptive or exhaustive.