Guide to Remote Verification for Businesses Operating in France [Updated November 2021]
How to onboard French users in a compliant way.
France has transposed the principles of the Fifth AML Directive into its Financial and Monetary Code, giving French businesses more flexibility when onboarding users online. The changes were ushered in by Decree № 2020-118 issued February 12th, 2020 and Decree № 2021-387 issued April 2, 2021.
According to the decrees, remote verification is now considered as secure as face-to-face verification. Also, the list of AML compliant verification providers has expanded to include services certified by the National Cybersecurity Agency of France (ANSSI).
Let’s dive deeper into the updated identification and verification requirements in France.
Who’s affected
The changes impact French businesses obligated to follow French AML regulations and report to the Financial Markets Authority (AMF) and the Prudential Supervision and Resolution Authority (ACPR), France’s national financial regulators. This includes a wide range of entities:
- banks and credit institutions;
- payment and e-money institutions;
- investment companies;
- insurance companies;
- crowdfunding intermediaries;
- crypto businesses and ICO issuers.
The new rules also apply to foreign firms onboarding French clients if they are established in the EU/EEA and operate in France through a branch or an agent.
What’s changed
The new measures are in line with the principles of the Fifth AML Directive, which champions the use of remote verification by businesses. The amendments to the French Monetary and Financial Code simplify requirements for remote verification and expand the list of qualified providers.
- Remote verification is now considered as secure as face-to-face verification. This means that French businesses no longer have to apply additional diligence measures—such as requesting supporting documents—when onboarding clients online.
- French businesses now benefit from a greater choice of remote verification solutions. Providers conforming to Regulation (EU) N°910/2014 (eIDAS Regulation) are now subject to more flexible security requirements, even when they’re used as a single method of verification. Moreover, as of April, 2020, French businesses can use providers certified by the ANSSI under the same regulation.
How to stay compliant
Identity information to require
Firms must identify the purpose and the nature of the business relationship they are establishing with a client.
If the client is a natural person, firms must obtain their first and last name, as well as their date and place of birth.
If the client is a legal entity, firms must obtain its legal form, name, registration number, head office address and the place of actual activity if it differs from the legal address. It is also required to identify the beneficial owner of the legal entity. This can be done by collecting the same information required from natural persons.
The beneficial owner is a person who directly or indirectly owns more than 25% of a company’s capital/voting rights or otherwise exercises ultimate control over it.
Documents to check
To get onboarded online, natural persons must provide one of the following official documents:
- national identity card;
- passport;
- driver license;
- residence permit;
- receipt for a residence permit/residence card/asylum application in progress.
The copy of the document must be valid and bear the owner’s photo. From February, 2020, clients no longer need to provide a second supporting document to confirm their identity.
In order to onboard legal entities, a firm can obtain any act or extract from the official register (for example, K-bis) not older than three months or an extract from the official Journal.
Which verification solutions can be used solely?
Businesses can choose from three sole verification solutions approved by French regulators:
- Providers known as “national identification schemes” with substantial or high levels of security under the eIDAS Regulation. These are identification and authentication platforms mutually recognised by EU member states. The approved French schemes are FranceConnect+ and l’Identité Numérique;
- Providers certified by the ANSSI as having substantial or high levels of security under the eIDAS Regulation. On March 1, 2021, ANSSI issued a rule set for remote verification providers to guide services willing to apply for certification;
- Software certified by the ANSSI as having substantial or high levels of security under Article L102 of the French Postal and Electronic Communications Code.
Which verification solutions can be used in combination?
If the first three solutions are not available, businesses can use a combination of at least two of the following measures:
- Obtaining a copy of one official document (see the section “What documents to check”);
- Verifying and certifying a copied document through an independent third-party;
- Requiring that the first transaction be made by an AML-obliged entity established in EU/EEA or a third country with equivalent AML-CFT requirements;
- Verifying the client through a third party that meets requirements under the Article L561-7 of the French Monetary and Financial Code. This includes:
- AML-obliged entities with a registered office in France, except intermediaries in banking operations, payment services, and crowdfunding, or a law or accounting professional;
- AML-obliged entities under foreign law, established in an EU or EEA Member State;
- third countries with equivalent AML-CFT requirements;
- Using remote verification providers certified by the ANSSI as having a substantial level of security under the requirements of the Annex of Regulation (EU) 2015/1502;
- Obtaining an electronic signature or an electronic seal under the eIDAS Regulation.
The adopted measures make remote verification more available for businesses while enabling them to check French users faster and easier—all without neglecting security and compliance.
