The French Anti-Corruption Agency is flexing its muscles

Introduction

On July 9, 2026, the AFA’s Enforcement Committee (the Committee) handed down an unprecedented decision since the entry into force of the Sapin 2 Law of December 9, 2016 on transparency, the fight against corruption and the modernisation of economic life (known as “Sapin 2”).

As a reminder, the AFA is notably responsible for monitoring compliance with Article 17 of Sapin 2, which requires companies subject to his provision¹ and their directors to implement systems and controls, that is a full compliance programme to detect and prevent corruption, consisting of eight measures: a code of conduct, an internal whistleblowing system, a risk map, third-party due diligence procedures, accounting controls, a training programme, a disciplinary regime and an internal monitoring and assessment system. 

From this shift in approach, two main lessons can be drawn:

• First, the Committee is breaking with the preventive approach it had adopted until now. From now on, it will assess potential violations of French anti-corruption requirements by referring to the findings made during the AFA’s inspection, rather than the status of the Sapin 2 anticorruption programme implemented by the controlled entity on the date on which the Committee rules.
• Second, its decision appears to spell the end of a form of leniency. The Committee will no longer hesitate to impose financial penalties, specifically naming and shaming companies and their directors.

Breaches will be assessed on the date of the inspection

Until now, the Committee had issued only two decisions: on July 4, 2019 (Company S. SAS and Mrs C. matter) and February 7, 2020 (Company I. and Mr. C.K. matter). In both cases, it assessed the compliance of the companies’ anti-corruption programme as they stood at the time of its ruling. Since the Committee is only seized of potential administrative (i.e., disciplinary) proceedings once the AFA’s inspection has been completed, which can take anywhere from a few months to over a year, controlled entities until now had ample time to remedy the shortcomings identified by its inspectors.

In its decision of July 9, 2026, the Committee departs from this approach: breaches are now assessed as at the date on which the findings were made during the inspection phase. It grounds this solution by the very purpose of Sapin 2. In its view, limiting potential breaches to those existing on the date of the ruling would “deprive the law of all scope and effectiveness by allowing the breaches that the law is specifically intended to penalise to continue for an indefinite period”². Such an enforcement approach would also create “unfair competition between companies that agree to invest in complying with the law and those that refrain from doing so”³.

As a result, corrective or remedial measures taken ex post, after the inspection, however substantial, will no longer be sufficient to eliminate the breaches identified; they will only be taken into account when determining the quantum of the potential sanction.

Clouds on the horizion for the company and its directors 

Sapin 2 empowers the Committee to impose financial penalties of up to EUR1 million on legal entities and EUR200,000 on individuals. Until now, it had never used this power, the two previous cases having resulted merely in compliance injunction orders.

The Commission is thus exercising its power to issue penalties for the first time here, by imposing two financial penalties which, whilst anonymised, have received extensive media coverage:

• A EUR350,000 administrative penalty against the company, in view of the number of breaches found, their persistence since 2017 and their seriousness having regard to the objectives of the law and the business sector concerned, as well as the remedial measures implemented since the inspection and the company’s financial situation.
• A EUR60,000 administrative penalty against its chairman on the grounds that, in his capacity as the group’s founder, main shareholder, chairman of the supervisory board and “a professional well aware of the corruption risk in his sector”, he “could not have been unaware of the implications of the anti-corruption programme with which he was required to comply” and had “the necessary authority to implement compliance measures”⁴.

Impact for individuals and legal entities subject to Sapin 2

Ten years after Sapin 2 came into force, the message could not be clearer: remediation or compliance measures deployed during the proceedings will no longer allow defendants referred to the Committee to avoid liability that may have significant implications for the good standing and reputation of those entities and their top-level managers caught by the Sapin 2 requirements.

They must now realise: the threat is no longer theoretical but very real, and they must ensure without delay that the eight measures set out in Article 17 are effectively implemented and operational.

The Litigation and Investigations practice at A&O Shearman Paris closely monitors substantive, procedural and litigation-related developments arising from Sapin 2. Our lawyers are standing by to assist you with criminal, regulatory, civil and commercial matters.

Footnotes

1. Companies subject to Article 17 of the Sapin 2 Act are those that meet both of the following conditions: (i) employ at least 500 employees or belong to a group of companies whose parent company has its registered office in France and headcount includes at least 500 employees; and (ii) have a turnover or consolidated turnover exceeding EUR100 million. here the company establishes consolidated accounts, the measures must also apply to its subsidiaries and the companies it controls.

2. AFA Sanctions Committee, Decision No. 25-01 of July 9, 2026, p. 7.

3. AFA Sanctions Committee, Decision No. 25-01 of July 9, 2026, p. 7.

4. AFA Sanctions Committee, Decision No. 25-01 of July 9, 2026, pp. 9 and 10.