First “Direct” Pecuniary Sanction Under Sapin II: Compliance Lessons from Decision 25-01 (Société V and MS)

On July 9, 2026, the Sanctions Commission (“Commission”) of the French Anti-Corruption Agency (Agence française anticorruption) (“AFA”) issued Decision No. 25-01 (“Decision”), marking the first time since the anticorruption compliance obligations under Article 17 of the Sapin II Law (Law No. 2016-1691 of December 9, 2016) (“Sapin II Law”) took effect in June 2017 that the AFA has imposed direct financial penalties on a French holding company (“Company”) and one of its executives for failing to implement corruption prevention and detection measures, without first seeking an injunction.

The Decision confirms, among other things, that (i) the AFA may impose financial penalties without first pursuing an injunction; (ii) compliance deficiencies are assessed at the date of the AFA’s control, not the Commission’s decision; (iii) post-audit remediation, while relevant to sanctions, does not extinguish liability; and (iv) senior executives may incur personal financial liability where they had authority and resources to implement an effective compliance program but failed to do so.

Background

The AFA conducted a compliance audit of the Company and its subsidiaries between June 28, 2024 and July 9, 2025, issuing its final control report with adverse findings on September 26, 2025. The AFA identified seven breaches of Article 17(II), finding the Company lacked (i) a group-wide corruption risk assessment; (ii) a code of conduct for employees of a foreign subsidiary; (iii) a disciplinary regime for that subsidiary; (iv) third-party due diligence procedures; (v) multilevel anticorruption accounting controls; (vi) risk-based anticorruption training; and (vii) an internal control and evaluation framework. The AFA concluded that grievances (iv)–(vii) stemmed from the Company’s failure to finalize its group-wide risk map, since these obligations presupposed a completed risk assessment not yet in place, while grievances (ii) and (iii) were specific to the foreign subsidiary’s failure to integrate a code of conduct and disciplinary regime into its internal regulations.

The Company did not contest the breaches but argued that remedial work since mid-2025 had addressed all issues (except foreign subsidiary matters requiring local collective bargaining). In its December 2025 defense memorandum, the Company requested that the Commission either note compliance and impose no sanction, or issue a formal notice with a deadline rather than a fine. The AFA Director maintained in her March 2026 reply that breaches must be characterized at the control date of July 9, 2025, with post‑control remediation relevant only to quantum, seeking fines of at least €400,000 against the Company and €80,000 against the executive. After further submissions in May and June 2026, the Commission held a public hearing in June 2026 and rendered its Decision on July 9, 2026.

Key Legal Holdings

Direct Sanction Without Prior Injunction

Under Article 17(IV), upon identifying a compliance failure, the AFA Director may issue a warning, refer the matter to the Commission for an injunction requiring remediation, or seek a pecuniary sanction. The Commission held that the statute does not mandate a graduated enforcement process requiring an injunction before sanctions. Rather, the AFA has discretion to choose the appropriate route, including proceeding directly to sanctions where warranted by the nature, seriousness, and duration of breaches.

This marks a notable departure from prior enforcement practice (Decision 19-01 (2019) and Decision 19-02 (2020)), where the AFA had only requested compliance injunctions, subject to penalty for non-compliance, and companies avoided monetary penalties after remedying deficiencies before the Commission’s decision. Here, the AFA Director pursued sanctions from the outset, relying on long-standing and extensive compliance failures. The Commission endorsed this pathway and imposed the first direct pecuniary sanction under Article 17 of the Sapin II Law. The Decision signals that serious, persistent compliance deficiencies may now expose companies and executives to financial sanctions without a prior injunction.

Compliance Failures Assessed at Time of AFA Control

The Company argued that, under the Commission’s prior decisions (Decision No. 19-01 (2019), Decision No. 19-02 (2020), and Decision No. 19-2 (2021)), compliance failures should be assessed at the Commission’s decision date. Because it had remediated the identified deficiencies before the 2026 hearing, the Company contended no sanction should be imposed.

The Commission rejected this argument, explaining that those earlier decisions arose in a different procedural context where the AFA had sought compliance injunctions, requiring the Commission to assess whether companies had complied by its decision date. Here, the AFA referred the matter directly for financial penalties, so the relevant assessment date was the date of the AFA’s control and final report. The Commission emphasized that allowing companies to avoid liability by remedying deficiencies only after inspection would undermine the legislation’s preventive purpose and disadvantage companies that invested in compliance from the outset. It further noted that, seven years after Sapin II took effect, experienced professionals in a corruption-exposed sector could not reasonably claim ignorance of their obligations. The decision establishes that compliance failures are assessed at the audit date. Post-audit remediation may affect penalty amount but does not extinguish liability for historical non-compliance.

Risk Mapping as Central Obligation

The Commission emphasized that work on a risk map by the Company only began in early 2024—seven years after Sapin II took effect. Risk mapping is foundational; without it, companies cannot appropriately design third-party due diligence, accounting controls, training, or internal monitoring. The other breaches flowed directly from this failure.

Foreign Subsidiary Compliance

The Company argued that local labor law required an industry-wide labor agreement (un accord collectif) before implementing a code of conduct and disciplinary regime at its foreign subsidiary, which was beyond its unilateral control. The Commission accepted that local constraints posed genuine difficulties, and an agreement was eventually reached in 2026. Nevertheless, it found that diligence efforts were “very late” (très tardives), with no meaningful action before December 2025, despite the control report having been issued on July 9, 2025 and adverse findings notified on September 26, 2025. The breaches were upheld, but these circumstances were considered in determining sanctions.

Personal Liability of Senior Executives

The executive concerned was founder, president, principal shareholder, and chairman of the supervisory board. The Commission held that given his functions and involvement, he could not have been unaware of Sapin II requirements after seven years. He had authority to launch and oversee compliance efforts, and the Company had sufficient financial and human resources to comply. Therefore, his personal responsibility was engaged and he was sanctioned alongside the Company. The Decision underscores that individuals subject to Article 17 may incur personal financial liability where they possess the authority and resources to ensure implementation of required compliance measures.

The Commission is Not Bound by AFA Request

Under Article 17(V), the Commission may impose fines up to €1 million on legal entities and €200,000 on individuals, with amounts required to be proportionate to the seriousness of the breach and financial circumstances. The Commission emphasized its independence from AFA recommendations. Given the seriousness, breadth, and duration of the deficiencies, as well as sector-specific corruption risks, the Commission determined financial penalties were warranted. It ultimately imposed a €350,000 fine on the Company and €60,000 on its chairman—both below the AFA’s requested minimums. The reduction reflected mitigating factors including significant post-control remediation efforts, resources devoted to compliance, and labor-law constraints that delayed foreign subsidiary implementation. While acknowledging these corrective actions, the Commission cautioned that it remained too early to assess effectiveness of recently implemented controls and noted that the AFA may conduct follow-up inspections to evaluate their practical operation.

Anonymization as Default; Nominative Publication as Additional Sanction

Under article 31 of the Commission’s Rules of Procedure, decisions are anonymized by default unless the Commission orders publication as part of penalties under Article 17(V). Here, the Company had expressly requested confidential treatment, which the AFA did not oppose, and the Commission determined that nominative publication was not warranted. Given the nature and sensitivity of the Company’s sector, nominative publication would cause disproportionate prejudice to the Company and its executive and would fail to strike a proper balance between public interest and economic interests. The Decision was therefore published in anonymized form.

Key Compliance Takeaways

1. Do not wait for an AFA control. Compliance programs must be effective on an ongoing basis. Deficiencies will be assessed at the control date, not the Commission’s decision date. Post-audit remediation may reduce penalties but will not eliminate liability for historical non-compliance. The AFA can directly request penalties without first requesting an injunction—an assertive posture addressing criticism that companies could wait to be controlled before making serious compliance efforts.
2. Build the compliance program around a robust risk assessment. Risk mapping is the cornerstone of the Sapin II framework. Third-party due diligence, training, accounting controls, and monitoring cannot be effectively designed without documented understanding of corruption risks by business activity and geography.
3. Apply compliance standards across the entire group. Parent companies must implement anticorruption measures throughout their corporate groups, including foreign subsidiaries. Local legal, labor, or data privacy constraints may mitigate sanctions but do not excuse non-compliance. Companies should identify local obstacles early, engage local counsel, and document good-faith implementation efforts.
4. Senior executives (dirigeants) face personal exposure. The Commission confirmed that individuals with authority and resources to implement compliance measures (typically legal representatives or senior executives (dirigeants)) may be held personally liable for failure to do so. Under Article 17, this exposure does not extend to non-executive board directors in their capacity as board members. Active oversight by those with operational responsibility, supported by clear documentation and governance records, remains essential.
5. Remediation is expected, but not a defense. Companies should remediate identified deficiencies immediately. While prompt remediation remains an important mitigating factor, it will generally affect penalty amount rather than liability findings.
6. Test global anticorruption programs against Sapin II requirements. Article 17 applies to companies with their registered office in France, and to global groups with a French-incorporated parent, with at least 500 employees and annual consolidated turnover exceeding €100 million. Unlike the FCPA and UK Bribery Act, which primarily establish substantive antibribery offenses and may apply based on a US or UK jurisdictional nexus regardless of company size, Article 17 imposes a separate, affirmative obligation on covered companies to implement specified anticorruption compliance measures. Companies meeting Article 17 thresholds should not assume a compliance program designed principally to satisfy DOJ, SEC, or UK Ministry of Justice expectations will automatically satisfy French requirements. Sapin II requires demonstrable implementation of a distinct and auditable framework, including risk mapping, third-party due diligence, accounting controls, training, and internal monitoring tailored to identified corruption risks. This Decision reinforces that deficiencies in those measures may give rise to administrative sanctions, even absent any proven act of bribery.
7. Compliance programs must be tested, not merely adopted. Policies alone are insufficient. Companies should conduct periodic, risk-based testing of compliance controls, including third-party due diligence, training effectiveness, accounting controls, whistleblowing mechanisms, and overall program effectiveness, and document corrective actions.
8. Heighten controls in high-risk sectors. The Commission expressly considered the Company’s operation in a corruption-exposed sector. Companies in higher-risk industries should calibrate due diligence, training, monitoring, and governance to their specific risk profile rather than relying on generic compliance frameworks.
9. Understand the anonymization framework. Decisions are anonymized by default. Nominative publication is a separate punitive measure requiring Commission justification. Companies facing enforcement may request confidential treatment and should be prepared to demonstrate concrete, case-specific, and disproportionate harm outweighing the public interest if the Commission considers nominative publication.

This Decision demonstrates that the AFA will now pursue direct sanctions for longstanding compliance failures rather than relying on graduated remediation. Companies that have delayed implementation should assume regulators increasingly expect mature, functioning, and demonstrably effective compliance programs, not promises of future remediation.

For multinational organizations, the message extends beyond France: boards, executives, and compliance officers should ensure anticorruption programs are risk-based, operational across the group, and capable of withstanding regulatory scrutiny before an investigation or audit begins.