First AFA Financial Penalties Send Strong Message on Sapin II Compliance

What happened?

Background. The Sapin II Act requires companies employing at least 500 staff and with a turnover exceeding €100 million to implement anti-corruption framework, compliance with which is monitored by the French Anti-Corruption Agency (AFA).

The facts. Following an audit carried out between 2024 and 2025, the AFA found that the company had complied with only one of the eight legal obligations. A key point: unlike previous decisions in 2020 and 2021, no prior formal notice was served on the company before sanctions were imposed.

A clear message from the Commission. It ruled that breaches are assessed at the date of the audit report, and not at the date of its decision – a position intended to prevent companies from "playing for time" at the expense of those that invest in achieving compliance.

The financial penalty. €350,000 for the company and €60,000 for its chairman, against legal ceilings of up to €1,000,000 (legal entities) and €200,000 (natural persons). The director was held personally liable due to his strategic role within the company.

Implications for Businesses

Key takeaways in France. This decision confirms that the anti-corruption framework of the Sapin II Act is now fully operational, including its direct enforcement provisions, with no intermediate stages. The companies concerned – particularly those in the most exposed sectors – should therefore verify the effectiveness of their compliance programs without delay.

Practical implications, including for international groups. This decision is particularly relevant for non-French groups with operations, subsidiaries, or regional headquarters in France. While Article 17 formally targets certain French companies, the AFA emphasized the importance of a consistent group-wide compliance framework, including within foreign subsidiaries. Some of the deficiencies identified by the AFA concerned the absence of anti-corruption measures at subsidiary level. The decision also reflects a broader international enforcement trend: regulators increasingly expect anti-corruption programs to be effectively implemented, documented and tested, rather than existing only as formal policies.

Increased focus on individual accountability. The penalty imposed on the company's chairman serves as a reminder that senior executives who have the authority and resources to implement compliance measures may face personal liability where significant deficiencies persist. Anti-corruption compliance oversight therefore remains a key board-level and senior management responsibility.

What should companies do now?

In light of this decision and the three pillars of the AFA's recommendations, companies may usefully:

• Ensure that they meet the dual threshold under Article 17 of the Sapin II Law: employing at least 500 employees and generating annual turnover exceeding €100 million;
• Ensure that the governing body assumes its steering and oversight role (Pillar 1);
• Verify that the risk mapping is up to date and reflects the actual exposure of the company and its subsidiaries (Pillar 2) ;
• Verify the effective and documented implementation of the eight measures under Article 17, ensuring consistency across subsidiaries and controlled entities (Pillar 3);
• Test the effectiveness of key controls through the three levels of control (operational, detective, internal audit) recommended by the AFA (Pillar 3) ;
• Define corrective measures in the event of deficiencies, as part of a formalized action plan subject to regular monitoring and reporting to the governing body (Pillar 3).

[1] For reference, Article 17 of Act No. 2016-1691 of 9 December 2016, known as the “Sapin II Act”, requires eight preventive measures: a code of conduct, an internal whistleblowing scheme, risk mapping, procedures for assessing third parties, accounting controls, a training program, a disciplinary scheme and an internal control system.