Consolidating France’s investigation ecosystem

In summary

The past year has been eventful for compliance and investigations in France. Agencies continued to publish guidelines and clarifications regarding the French investigations arena, and legislation was enacted to strengthen whistle-blower protection. NGOs have become increasingly active in the area of the duty of vigilance, and a ruling was made on the first action brought against a French group based on this ground. Compliance and diligence regarding environmental matters have gained pace, with nine environmental CJIPs being concluded and the EU proposal on corporate sustainability due diligence on the horizon.

Discussion points

• Sapin II and CJIP
• AFA guidelines on internal investigations, conflict of interest, anti-corruption accounting controls and probity for officials
• Whistle-blower protection
• Reform of the blocking statute
• Duty of Vigilance Law
• Corporate sustainability due diligence

Referenced in this article

• Sapin II
• AFA guidelines on internal investigations, conflict of interest, anti-corruption accounting controls and probity for officials
• Law No. 2022-401 of 21 March 2022
• Decree No. 2022-1284
• 2017 Duty of Vigilance Law
• Paris Judicial Court, Judgment No. RG 22/53942, 23 February 2023
• 2022 EU proposal for a directive on corporate sustainability due diligence

Introduction

In 2022, French compliance activity was marked, on the one hand, by the presidential and legislative elections, which slowed down legislative activity, and, on the other hand, by the Russian invasion of Ukraine, which justified the implementation of sanctions against Russian assets.

In this context, 2022 was again a year of consolidation for France’s compliance, investigations and white-collar crime ecosystem, with limited statutory changes and a few noteworthy developments from courts and administrative agencies.

After making great strides since it heightened its anti-corruption standards with the Law of 9 December 2016 on transparency, corruption and modernisation of the economy (Sapin II), France has since demonstrated that it is now a key player in the global white-collar crime and anti-bribery landscape.

In anti-bribery compliance in particular, the French Anti-Corruption Agency (AFA) keeps building on Sapin II by providing guidance on specific topics, auditing compliance programmes of private and government entities and bringing cases in front of its sanctions board.

The judicial part of this effort also proved newsworthy in 2022, with the National Financial Prosecutor’s Office (PNF) continuing to seek high fines against corporate defendants as part of judicial public interest agreements (CJIP),^[1] and other regional prosecutors stepping in to do the same.

Bribery and corruption issues still occupied the centre stage of the compliance and white-collar crime landscape, but other areas of compliance law have recently seen renewed interest. Environmental, social and governance (ESG) issues have been a staple of French compliance law since the 2017 Duty of Vigilance Law mandated large corporations to create and publish a dedicated vigilance plan and exposed non-compliant corporations to a potentially large liability risk.

While very few cases have tested the actual implementation of the Duty of Vigilance Law, the risks associated with those issues resurfaced as, in early 2022, the EU commission proposed a draft directive^[2] that would extend some aspects of the French and German duty of vigilance regimes to the European Union.

Russian invasion of Ukraine

Russia’s invasion of Ukraine has had consequences on white-collar crime and compliance regulations in France. Numerous sanctions against Russia and Russian assets have been adopted at both the European and national levels. These new sanctions have led to a strong increase in activity in terms of compliance. White-collar and compliance lawyers provided legal support to economic and financial actors whose activity was impacted by the sanctions imposed.

As the conflict progressed and evolved, sanctions against Russian assets and Russian entities were reinforced and accumulated. As at the time of writing, the European Union has adopted 10 sets of sanctions implementing freezes on the assets of the Russian central bank and natural or legal persons close to the Russian government. Council Regulation (EU) No. 2022/263 also prohibits a number of financial and economic operations related to Russian entities.

The European Commission has published answers to frequently asked questions (FAQ) to guide companies in the application of its sanctions.^[3]

At the national level, the Directorate General of the Treasury and the Prudential Supervision and Resolution Authority (ACPR), which is responsible for supervising the banking and insurance sectors, have published a FAQ^[4] and best practice guides for the application of the freezing measures resulting from the Council Regulation (EU) No. 833/2014, which was adopted following Russia’s annexation of Crimea.

As at the time of writing, no sanctions for violations of restrictive measures and economic sanctions against Russia have been imposed by the ACPR or the criminal courts. Nevertheless, this risk is taken very seriously by economic and financial actors because of the economic and reputational consequences that convictions could have on their company.

Sapin II and CJIP

When assessing the French anti-bribery landscape in its late 2021 assessment report,^[5] the Organisation for Economic Co-operation and Development’s working group on bribery noted that since its last assessment in 2014, France has carried out ‘a significant number of reforms’ that have provided France with ‘a modern institutional framework and legal tools to combat foreign bribery more effectively’.

Among those key reforms was Sapin II, which is France’s comprehensive anti-corruption reform and a response to laws such as the US Foreign Corrupt Practices Act and the UK Bribery Act. The law toughened sanctions on corruption, imposed stringent compliance obligations on large corporations and created the AFA.

The Financial Action Task Force’s Mutual Evaluation Report of 17 May 2022 noted that France has a favourable framework for effectively combating money laundering and terrorist financing, although improvements have also been proposed.

Based on AFA audits and sanctions procedures of private entities, the AFA pays extremely close attention to the risk-mapping process (which is supposed to inform all other measures), the code of conduct and the top management’s commitment to anti-bribery. Corporations that are subject to the above-mentioned requirements should be aware that merely having the required measures in place is not sufficient as the AFA controls their quality and practical implementation.

Sapin II introduced major procedural changes for white-collar cases, with the creation of the equivalent of the deferred prosecution agreement: the CJIP.^[6] It gives prosecutors a transactional tool to negotiate with corporate plaintiffs for a limited number of offences, including:

• active public agent bribery and influence peddling offences (eg, active foreign public agent bribery);
• active and passive private bribery offences (private commercial bribery or sports bribery);
• tax fraud (since 2018);
• laundering proceeds of tax fraud; and
• substantial harm to the environment (since 2020).

Once frowned upon by the French legal community, which is traditionally reticent on transactions in criminal law, the CJIP is now a popular tool. While some of its limits are now being tested, in particular regarding the treatment of natural persons, it has proved essential to the resolution of many high-profile cases, particularly those involving international cooperation, and has allowed France to levy more than €3.7 billion in fines since 2017.

Sapin II anti-bribery compliance requirements

Throughout 2022 and early 2023, the AFA continued its audits at corporations that are mandated by article 17 of Sapin II to have anti-corruption compliance programmes. Carried out at the initiative of the AFA’s director or on the request of authorities (or approved non-governmental organisation (NGOs)), the audits verify whether the company has a proper compliance programme in place.

Although AFA investigators do not have the police powers required for coercive searches (unlike competition, tax or judicial police dawn raids), they can request any information or professional document that is useful for the audit and can conduct interviews with managers and employees. Audited corporations cannot claim professional secrecy to decline to answer questions or requests for documents, and individuals or entities may be fined in the case of obstruction.^[7]

In addition, under article 40 of the Criminal Procedure Code, the AFA must report any wrongdoing it discovers as part of its mission. This means that it frequently refers wrongdoing it discovers to prosecutors (either the PNF or local prosecutors).

The most recent figures show that the agency has referred 23 cases since its creation in 2017.^[8] The AFA regularly receives reports from third parties, which may inform its decision to audit an entity.

The AFA is expected to continue its mission across industries, especially since the substantial reduction of its scope considered earlier in 2022 has been dropped by legislators.

In 2019 and 2020, the first two cases were brought by the AFA’s director to its independent sanctions board for allegedly defective anti-bribery compliance programmes. Additional hearings on those cases were held in 2021, but no other new case has been brought before the sanctions board.

The agency’s first case, brought on charges of defective risk-mapping, code of conduct and third-party evaluation procedures, was dismissed by the sanctions board, noting, for some charges, that the corporation had taken swift and appropriate remedial actions after the AFA inspection pointed out flaws in its programme. The decision also confirmed the non-binding status of the AFA’s recommendations.

The second case concerned multiple counts of non-compliance with Sapin II and led the sanctions board, for the first time, to enjoin the company to adapt its code of conduct (which did not contain the elements mandated by law and merely redirected to another policy) and accounting controls under penalty of a fine. In July^[9] and November 2021,^[10] the sanctions board decided that the company had now complied with these two injunctions and, therefore, ended the proceedings.

While no sanction has been imposed to date, the cases helped establish the AFA as a key enforcement player in the French compliance space and as a credible threat to entities that are being investigated and audited.

The AFA has also integrated some elements of the cases in its recommendations, notably restating that the recommendations have no legal force but that an entity stating that it has followed those recommendations benefits from a prima facie presumption of compliance with the law. In turn, similar to the ‘comply or explain’ principle used in corporate governance, an entity subject to article 17 of Sapin II that decides not to follow some of or all the recommendations must demonstrate that its choices enable it to meet the requirements of Sapin II.

Guidelines on CJIP

Since the last guidelines published in 2019, the legislator has significantly modified the scope of the CJIP by extending it to new offences (tax fraud, introduced in 2018 and giving rise to the first CJIPs in 2019, and environmental offences, introduced in 2020) and by modifying some of its terms and conditions under Law No. 2018-898 of 23 October 2018 and Law No. 2020-1672 of 24 December2020.

On 16 January 2023, the PNF published new guidelines^[11] on the implementation of the CJIP. Beyond the need to reflect the latest legislative developments, the guidelines were necessary to clarify and state the PNF’s doctrine after more than three years of negotiation practice, the conclusion of 13 new CJIPs and the rise of certain criticisms against this procedural alternative to prosecution.

The guidelines aim to reinforce the transparency and predictability of the CJIP. In particular, they specify the assessment of the company’s good faith, the methods for calculating the public interest fine, the system of exchanges between the defendant and the public prosecutor’s office and the consequences of the company’s cooperation.

The guidelines methodically articulate the various public interest components of the CJIP. The PNF emphasises the effectiveness of the CJIP in the treatment of criminal cases, be it through the speed of the process, the guarantee of the execution of the sanction or the prevention of recidivism. It also insists on the reinforcement of France’s criminal and economic sovereignty, especially when it is necessary to coordinate with foreign authorities.

The scope of the guidelines differs significantly from that of previous guidelines by emphasising good faith and the notion of informal discussions. The aim is to reassure companies and their advisers of the risks involved in cooperating and transmitting information in the context of discussions, should the negotiations fail.

The PNF is taking a step towards the bar by providing guarantees of fairness in the discussions leading to the conclusion of a CJIP. It encourages companies to cooperate in a concrete way by making up for the shortcomings of the law with regard to the guarantees provided on the fate of the information provided in the event that negotiations fail.

Update on CJIP in 2022

Seven CJIPs were signed in 2022 based on Sapin II, which is more than in previous years. Regarding environmental matters, nine CJIPs were validated. The largest agreement of 2022 was concluded by three companies of the McDonald’s group in May, with a fine of €508 million and duties and penalties owed to the tax authorities amounting to €737 million – a total amount of over €1.2 billion.

This sum places McDonald’s in second place on the podium of heaviest fines but remains far behind the record of the Airbus CJIP concluded in 2020: the aeronautics giant agreed to pay €2 billion of the nearly €19 billion fine incurred to end the proceedings against it.

On another note, novelty attracts: nine ‘environmental’ CJIPs were concluded in 2022. The CJIP on environmental matters, introduced at the end of 2020 based on the anti-corruption CJIP, has what it takes to please companies: it allows companies to avoid criminal prosecution and, therefore, avoid gaining an entry on their criminal record. Companies are participating in good faith in a procedure that advocates say allows for the rapid handling of environmental crimes. As the first anniversary of the scheme approaches, opinions on it are divided.

The environmental CJIP immediately attracted the French Biodiversity Agency, which is dedicated to safeguarding biodiversity on French territory. The Agency appreciates that the procedure encourages dialogue and has become a stakeholder in five of the current environmental CJIPs.

AFA’s guidelines on specific matters

Joint guidelines on internal investigations

France’s main anti-corruption authorities have jointly published draft guidelines to help companies carry out internal investigations. The AFA and the PNF published the guidance on 7 March 2022. The document, which was open to public consultation until 8 April 2022, sets out best practices for how and when companies should conduct internal investigations and encourages businesses to report wrongdoing to the PNF as soon as they find out about potential misconduct.

Lawyers in France said that the draft does not propose any disruptive changes but instead provides companies with a useful resource that ties together established best practices and legal principles. It is the first time that French authorities have provided written guidance on corruption investigations.

On 14 March 2023, following consultations with relevant stakeholders, the AFA and the PNF published a final version of the guide.^[12] The guidelines aim to inform companies, regardless of whether they are subject to article 17 of Sapin II, and public industrial and commercial establishments about the design and implementation of an internal anti-corruption investigation system while respecting individual rights and freedoms. The guidelines describe the facts that justify the launch of an investigation, the conditions under which an investigation must be conducted and the consequences to be drawn from the investigation to help organisations better take advantage of this specific practice. It, therefore, is a tool that companies can use to identify the points of vigilance and good practices in this area.

Guidelines on conflict of interest

To inform companies and prevent conflicts of interest from arising, organisations are advised to identify conflict-of-interest situations that could impact their activities or operations and develop a prevention policy tailored to their sector or industry, their structure and their governance agreements. If a conflict of interest occurred, the guidelines^[13] offer guidance on how to manage it through an anti-corruption programme.

Guidelines on anti-corruption accounting controls

In April 2022, the AFA published guidelines^[14] that addressed anti-corruption accounting controls, which should be established by deepening or complementing existing accounting controls to target risk scenarios highlighted in the risk map.

Guidelines on probity for officials

In July 2022, ahead of France hosting the 2023 Rugby World Cup and the 2024 Summer Olympic Games, the AFA and the Ministry of Sports released two joint guidelines^[15] aimed at helping sports federations and the Ministry to prevent and detect probity offences during the organisation of competitions or the conduct of public policies promoting sports.

On 15 September 2022, the AFA released a guide entitled ‘Public Officials: the Risks of Breaches of Probity Concerning Gifts and Invitations’^[16] to help public officials identify the risk scenarios to which they may be exposed when accepting hospitality and define a set of appropriate rules to protect themselves against those scenarios.

In releasing these guidelines, the AFA assumes a proactive role in the prevention of corruption, emphasising the importance of the role of training actors that are likely to be exposed to the risk of corruption when organising competitions and similar events.

Whistle-blower protection

Law No. 2022-401 of 21 March 2022 aimed at strengthening the protection of whistle-blowers entered into force on 1 September 2022. It amended some of the limitations of the protection system introduced by Sapin II that were highlighted in a report of July 2021.^[17]

First, the definition of a whistle-blower is now more flexible as it is no longer necessary for whistle-blowers to act in a ‘disinterested manner’, which was an ambiguous notion, particularly in cases of conflict between the whistle-blower and their employer; instead, whistle-blowers must now act without ‘direct financial compensation’. Moreover, in a professional context, the whistle-blower is no longer required to have personal knowledge of the facts subject to their report.

Second, Law No. 2022-401 revamped the reporting process. A whistle-blower is no longer compelled to report within the organisation as a priority; instead, they may choose to report either internally to the supervisor, the employer or any designated adviser or externally to an administrative, judicial or professional authority.^[18] The report will only be directly made public if:

• no appropriate action has been taken within three months of making an external alert (regardless of whether it was preceded by an internal alert) or six months of reporting the alert to the judicial authority or to a European or national institution);
• there is an imminent and serious danger; or
• referring the matter to one of the competent authorities would put the whistle-blower at risk of reprisals or would not allow the subject of the disclosure to be effectively remedied, owing to the particular circumstances of the case (in particular, if evidence may be concealed or destroyed or if the whistle-blower has serious grounds for believing that the authority may have a conflict of interest, be in collusion with the reporter of the facts or be implicated in those facts).^[19]

Third, to facilitate reporting, Law No. 2022-401 improved the protection of whistle-blowers by extending the list of prohibited retaliation measures, including intimidation and damage to reputation, especially on social media networks.^[20]

The non-liability of whistle-blowers owing to their report was also extended: they cannot be held liable for any damage caused by their good faith report, nor can they be held criminally liable for intercepting or removing confidential documents that contain information to which they had lawful access.^[21]

The maximum fine that may be imposed on plaintiffs for abusive or dilatory complaints was increased from €30,000 to €60,000.^[22]

On 3 October 2022, France issued Decree No. 2022-1284 governing procedures for collecting and processing whistle-blowers’ reports. The Decree provides guidance to entities (ie, companies with more than 50 employees, municipalities with more than 10,000 inhabitants and state administrations) that are under an obligation to set up appropriate procedures to alert management and escalate reports from personnel or external staff.^[23]

The above-mentioned entities must set up a channel for receiving alerts, which allows any person to send an alert in writing or orally. The channel permits the transmission of any element, regardless of form or medium, that is likely to support the alert.

The author of the alert must be informed in writing of the receipt of the alert within seven working days. The entity must also inform within a reasonable period the whistle-blower in writing of the measures taken to assess the accuracy of the allegations and, where appropriate, to remedy the subject matter of the alert, as well as the reasons for those measures.

The channel must guarantee the impartial handling of the report and ensure the confidentiality of the information collected, particularly with regard to the whistle-blower’s identity. In this regard, article 9 of Sapin II seeks to guarantee the strict anonymity of the whistle-blower and the information provided throughout the reporting process. The unlawful disclosure of that information is punishable by two years’ imprisonment and a €30,000 fine.

Decree No. 2022-1284 also provides a list of the public authorities that must establish this procedure, depending on the field concerned. Each authority must review its procedure at least every three years, taking into account its experience and that of other competent authorities.

The AFA is responsible for dealing with reports of corruption. The analysis and treatment of the report may lead the AFA to forward it to another competent service or authority, if necessary, based on article 40 of the Code of Criminal Procedure.

Towards reform of the French blocking statute?

Since 1968, France has had a blocking statute designed to prevent the abuses of entering into discoveries or subpoenas on French entities or individuals. The statute criminalises the transmission of information to foreign courts outside the channels set forth by treaties (eg, the 1970 Hague Convention for civil matters or the mutual legal assistance treaties for criminal issues). Although it was applied recently (in an attempt to conduct depositions in the Executive Life case), it is widely considered as not being strictly enforced (notably by the US Supreme Court in its 1987 Aérospatiale decision).

In 2022, rather than opting for a bill and increasing penalties in the event of a violation of the blocking statute, the government chose to clarify the reporting process via a decree enacted in February,^[24] followed by a regulation in March.^[25] The decree indicates that companies receiving requests that may fall within the scope of the blocking statute must inform the SISSE.

In practice, a filing must be submitted to the SISSE, which has one month to reply regarding the applicability of the blocking statute. The violation of the obligation to report to the SISSE is not sanctioned by any specific penalty.

Although these 2022 amendments help identify the relevant agency, it does not make the incurred penalties higher, nor does it substantially change how the law is enforced. For these reasons, these technical changes alone are unlikely to change the current position of foreign courts when assessing the credibility and actual enforcement risk of the French blocking statute.

In parallel with these French developments, EU-level solutions are also in the works. EU projects, including the upcoming e-evidence regulation, are intended to pursue this effort and offer a common defence of EU companies and data while still providing a framework for cooperation against crime. Trilogue negotiations on this regulation started in February 2021 between the European Parliament, the Council and the Commission.

Following its experience with Sapin II, France is spearheading an EU-level push to adopt common legislation on the detection and prevention of corruption. This may imply a new role for the EPPO, which is, for now, an independent prosecution body focused on defending the financial interests of the European Union across its member states’ courts.

Duty of Vigilance Law now EU-wide?

Enacted on 27 March 2017, the Duty of Vigilance Law is France’s initiative to promote the accountability of large corporations regarding the prevention of ESG risks related to their operations (including their subsidiaries and business partners, such as subcontractors or suppliers).

The Law applies to companies with at least 5,000 employees within their company and in their direct and indirect subsidiaries when their registered office is in France, and 10,000 employees when their registered office is located abroad. This includes French subsidiaries of foreign companies or global groups insofar as they meet the above-mentioned requirement.

The ‘vigilance plan’ is the key measure of the Duty of Vigilance Law, requiring qualifying companies to set up a plan containing measures designed to identify and prevent risks of human rights violations, serious physical or environmental damage and safety risks. This includes measures such as risk mapping and mechanisms for collecting alerts and monitoring the measures implemented.

The plan must be published in the corporation’s annual report, which can be enjoined to establish and publish a plan if it fails to do so.^[26]

Failure to comply with the Law exposes the corporation to a new form of liability in the event of an incident, where it can be liable for damages ‘repairing the harm that [its] compliance with the law could have avoided’.^[27] This means that, although the occurrence of an accident in a subsidiary or subcontractor does not necessarily mean that the corporation is liable (as a fault is required), companies are bound by a duty of vigilance that comprises thoroughly implementing the vigilance plan.

The very broad writing of the Law means that only the first liability cases will allow us to grasp its real extent and assess whether it has attained its goal to foster accountability without creating an overly burdensome liability regime. To date, few proceedings have been initiated,^[28] and no decision on the merits has been handed down in France.

More than 263 companies are subject to the duty of vigilance. Of these, 44 still did not have a compliance plan in December 2022. In practice, the number of companies with a due diligence plan is higher than 263 because companies falling within the scope of the law include due diligence obligations in their contracts with their co-contractors.

These obligations of vigilance are corroborated by the Climate and Resilience Law, which, through the insertion of new provisions in the Commercial Code and the Public Contracts Code, broadens the scope of the duty of vigilance to include imported deforestation (as of 1 January 2024) and provides for a measure of exclusion from public procurement contracts in the event of a violation of the duty of vigilance.

NGOs are becoming increasingly active in the area of vigilance. To date, formal notices have been sent to 19 companies, eight of which have been summoned under article 225-102(4) of the Commercial Code.

In the past few years, NGOs have actively tracked qualifying corporations’ compliance with the law,^[29] and proceedings were initiated in 2019 against a French oil company, alleging insufficiencies in the vigilance plan regarding extraction operations in Uganda and pursuing, as a first remedy, an injunction to correct the plan.^[30] The case hit a procedural roadblock on 30 January 2020 as the Nanterre Civil Court declined jurisdiction in favour of the commercial court, which plaintiffs consider less likely to support their case. On 10 December 2020, the Versailles Court of Appeal confirmed the decision and the jurisdiction of the Nanterre Commercial Court.

On 28 February 2023, the first vice president of the Paris Judicial Court, in summary proceedings, ruled^[31] on the first action brought against a French group, based on the duty of vigilance in relation to the aforementioned project in Uganda. The ruling provides a number of clarifications on the duty of vigilance:

• There is a discrepancy between the larger goals targeted by the duty of vigilance and the details regarding the means of implementation. Neither the legislator nor the regulatory authority has given any indication on this subject, and there is no decree to date implementing the law on due diligence.
• The collaborative dimension (with the stakeholders) regarding the elaboration of the due diligence plan manifests in the form of a formal notice prior to the referral to the judge, which establishes a phase of dialogue and exchange.

Corporate sustainability due diligence

In February 2022, after public consultation, the European Commission proposed a directive on corporate sustainability due diligence that would set an obligation for corporations to perform due diligence on human rights and environmental risks. Administrative authorities designated by each member states would be in charge of imposing fines in the case of non-compliance, which would perhaps cure some of the enforcement deficiencies observed in France, and victims would have the right to take legal action against those companies for ‘damages that could have been avoided with appropriate due diligence measures’.

On 9 February 2023, members of the European Parliament’s environment committee voted to strengthen requirements on climate protection in the proposed EU rules on corporate accountability. The proposal on corporate sustainability due diligence, presented by the European Commission in February 2022, would require large companies and small and medium-sized enterprises in high-risk sectors to prevent human rights violations and identify adverse environmental impact along their value chain. The vote has not yet been submitted to the European Parliament. It is, therefore, an important topic to follow in 2023.

Notes