Key takeaways:
- AML/CFT refers to all the rules imposed on professionals to prevent, detect and report money laundering and terrorist financing.
- Who is concerned? The financial sector historically, but also many non-financial professions, including SMEs and mid-sized companies.
- Three pillars structure the framework: customer identification, transaction monitoring and suspicious transaction reporting to Tracfin.
- 2026–2027 timeline: the new European package, with its 6th directive and the AMLA authority, will reshape the framework by July 2027.
AML/CFT: what is it? Definition and key challenges
Behind this somewhat technical acronym lies a major issue for every company. AML/CFT aims to prevent criminal money from entering the legitimate economy. It is an area where governance and compliance come together, and where support from corporate governance experts experts makes a difference.
The official definition of AML/CFT
AML/CFT, or anti-money laundering and countering the financing of terrorism, refers to all the regulatory obligations imposed on regulated professionals. Their purpose: to detect, prevent and report suspicious financial transactions.. In France, this framework is based on Articles L.561-1 and following of the French Monetary and Financial Code. It relies on a risk-based approach, in accordance with European directives and the recommendations of the FATF, the Financial Action Task Force.
Money laundering and terrorist financing: two concepts to distinguish
The acronym covers two distinct offences, but ones that are often linked in practice:
- Money laundering reintroduces illicitly sourced funds into the legitimate economy. These funds may, for example, come from drug trafficking, tax fraud or corruption.
- Terrorist financing works in the opposite way: the funds may come from a legal source, but are used to finance terrorist acts. The framework addresses these two risks together because they exploit the same weaknesses in the system.
The historical origins of the AML/CFT framework
It all began with the first European directive in 1991, which focused on money laundering. The scope was then expanded to terrorist financing and subsequently refined with each new directive. This development was based on the recommendations of the FATF, created in 1989. Since then, the regulations have continued to become more stringent.
The AML/CFT regulatory framework in France and Europe
The regulatory framework is built at two levels. Europe sets the direction through directives and regulations. France transposes them into national law and ensures their enforcement. This two-tier structure explains the breadth of the framework applicable to companies.
Would you like to learn more about Anti-Money Laundering?
The French Monetary and Financial Code
In France, everything starts with the Monetary and Financial Code. Articles L.561-1 and following define the persons subject to the rules, their due diligence obligations and the applicable penalties. Two authorities oversee compliance with these rules:
- The ACPR, operating under the Banque de France, supervises banks and insurers.
- The AMF regulates market participants.
Tracfin, finally, receives and analyses reports.
The European AML/CFT Directives (4th, 5th and 6th)
The European Union has built its framework through successive waves. The 4th Directive introduced a graduated risk-based approach. The 5th Directive, transposed into French law in February 2020, strengthened transaction transparency. Then came the major turning point. In June 2024, Europe adopted a comprehensive “AML package”, including the 6th AML/CFT Directive (EU Directive 2024/1640). This should not be confused with the 2018 criminal law directive, known as “6AMLD”, which focuses solely on the criminalisation of money laundering.
AMLA: the new European anti-money laundering authority
This is the major new development introduced by the 2024 package. AMLA, or the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, was established by EU Regulation 2024/1620. Based in Frankfurt, it began operations in July 2025. Its mission is twofold: to directly supervise around forty major cross-border entities and coordinate national authorities.
In France, the ACPR and AMF remain the supervisors for the vast majority of regulated entities. The new European framework will fully apply from 10 July 2027, and AMLA’s direct supervision will begin on 1 January 2028.
Who is subject to AML/CFT obligations?
The question comes up constantly, and the answer is often surprising. The scope of the obligations extends far beyond the banking sector alone. In France, fifty professions are subject to them.
Traditionally regulated financial professions
The core of the framework remains the financial sector. Banks, credit institutions, insurance companies and digital asset service providers are on the front line. The insurance sector deserves particular attention, as life insurance can be used as a vehicle for money laundering.
Non-financial professions and new entrants
The scope has expanded significantly. Notaries, lawyers, accountants, real estate agents, casinos and company domiciliation firms are now also concerned. The 2024 European package adds new entrants, such as luxury goods businesses. This sector also saw reports increase by 254% in one year, although it remains behind the overall flow.
SMEs and mid-sized companies: when AML/CFT applies to you
Many SME and mid-sized company executives think the subject is reserved for large banks. This is a common misconception. As soon as an activity involves consulting, lending, investment or certain transactions, the regulations may apply.. An appropriate framework then becomes essential. Working with a compliance consulting firm allows you to clarify your situation. You can then build an AML/CFT framework proportionate to your actual exposure, without unnecessarily adding complexity to your internal processes.
AML/CFT risk classification: methodology and steps
The entire modern framework is based on a simple idea: not all customers present the same level of risk. Risk classification therefore consists of assessing each situation in order to adapt the level of due diligence. This is the foundation of any effective framework.
Why AML/CFT risk classification is essential
Without classification, it is impossible to focus efforts where they matter. This mapping makes it possible to allocate the right resources to the right risks. It avoids treating a known local customer and an opaque entity based in a third country in the same way. It is also a regulatory requirement, monitored by the authorities.
The 4 areas of analysis: customer, product, channel, geographical area
The assessment is based on four complementary areas:
- The first concerns the customer: their profile, their business activity and any politically exposed person status. This preliminary verification has a name: due diligence.
- The second concerns the product or service.
- The third examines the distribution channel, particularly remote relationships.
- The last focuses on the geographical area and exposure to high-risk third countries.
The 3 levels of due diligence: simplified, standard, enhanced
Simplified due diligence applies to low-risk situations.
Standard due diligence constitutes the ordinary regime.
Enhanced due diligence is required in the face of high risks, for example in the case of a politically exposed person or a complex business relationship.
Each level involves proportionate measures.
The operational obligations of the AML/CFT framework
Once the risks have been classified, it is time for action. The framework is based on three major operational obligations. Together, they form a coherent chain, from the start of the business relationship through to the reporting of anomalies.
Customer identification and know-your-customer (KYC)
It all starts with knowing your customer, or KYC for “Know Your Customer”. Before entering into a business relationship, the company must verify the identity of its customer and identify the actual beneficial owner. Customer knowledge then continues throughout the relationship.
Ongoing transaction monitoring
Knowing your customer is not enough. Constant vigilance must then be exercised over their transactions. The objective is to identify unusual transactions or transactions that are inconsistent with the known profile. This monitoring increasingly relies on automated tools. However, the rise of artificial intelligence raises new challenges. An AI Act compliance consulting firm can provide guidance on this issue. Our IA Act guide details these implications for SMEs and mid-sized companies.
Suspicious transaction reporting to Tracfin
The final link in the chain is suspicious transaction reporting. Tracfin is the French financial intelligence unit, attached to the Ministry of the Economy. Any regulated entity that suspects a link to money laundering or terrorist financing must submit a report to it.. Reassuringly, a report made in good faith does not incur liability for the reporting party.
AML/CFT training: a legal obligation that should not be overlooked
It is often forgotten, but AML/CFT training is not optional. It is a legal obligation set out in the Monetary and Financial Code. A framework is only as effective as the people who implement it on a daily basis.
Who must receive AML/CFT training within the company?
Mandatory AML/CFT training applies to all employees exposed to these risks. This primarily concerns customer-facing teams and compliance functions. Every employee has a role to play in detecting suspicious transactions. Individual accountability is at the heart of the framework.
Mandatory content of AML/CFT training
Useful training explains the regulatory framework, money laundering typologies and warning signs. It details internal due diligence and reporting procedures. The objective is to know how to respond to a real-life situation.
Certification, e-learning and in-person training
Several formats are available depending on requirements:
- E-learning offers flexibility and traceability, which are valuable in the event of an inspection.
- In-person training encourages discussion and the study of real-life cases.
An AML/CFT certification can help showcase the skills acquired.
Bringing your AML/CFT framework into compliance: our methodology
Compliance may seem intimidating. When properly managed, however, it can become a structured and controlled project. Our approach consists of three clear steps, designed to save you time.
Mapping your AML/CFT risks
- Step 1
It all starts with a precise assessment of your current situation. We analyse your business activity, customers, channels and geographical exposure. This mapping identifies your actual risks and gaps in relation to the regulations. It forms the basis of the entire framework to come.
Deploying a tailor-made AML/CFT framework
- Step 2
The next step is operational implementation. We help you put due diligence procedures, a reporting process and the appropriate tools in place.. Each measure is proportionate to your risk profile. The objective is a robust yet streamlined framework that provides protection without paralysing your business.
Managing and evolving your programme
- Step 3
Compliance is never static. Risks evolve, and so does regulation, as demonstrated by the 2027 European timetable. We support you in the ongoing management of your programme and the training of your teams.. In practical terms, Eterra’s expertise combines governance and compliance to embed the framework sustainably. This allows you to stay one step ahead without tying up disproportionate internal resources.
Anticipate, don't suffer the consequences of AML/CFT
AML/CFT is a pillar of economic security and a guarantee of trust with your partners. With the new European framework coming into force in July 2027, it is better to anticipate than react. Building a robust framework today means protecting your company and its reputation over the long term. Our teams are here to guide you every step of the way.
