Anti-Corruption Compliance Must Be Demonstrable Before an AFA Review
Maeva Melchior – 15/10/2026
An anti-corruption program is tested not only by the measures a company adopts, but also by what it can demonstrate at the time of a regulatory review.
That distinction is central to Decision No. 25-01 of 9 July 2026. The Sanctions Commission of the French Anti-Corruption Agency (Agence française anticorruption, AFA) imposed financial penalties of €350,000 on a holding company and €60,000 on its chairman for failures to comply with Article 17 of the Sapin II Act.
The decision is significant beyond those amounts. It shows why the timing, scope and evidence of a compliance program matter to both the company and its leadership.
A program must cover the risks it is designed to address
The AFA’s review identified seven breaches of the eight obligations under Article 17(II). These included the absence of corruption risk mapping across the group, shortcomings in third-party assessment, accounting controls, training and internal monitoring, and the lack of an enforceable code of conduct and disciplinary regime within one subsidiary.
The Commission noted that work on the group’s risk mapping had begun only in early 2024, years after the statutory obligations took effect. That omission had implications for the other measures: assessments, controls and training must be designed around the risks to which the business is actually exposed.
The practical question is therefore not whether a company has assembled the expected policies. It is whether those measures cover the relevant entities and risks, operate in practice and can be evidenced.
Remediation matters, but timing changes its effect
The decision also clarifies what happens when shortcomings are addressed during enforcement proceedings.
Under Article 17(IV), the AFA’s director may refer a case to the Sanctions Commission to seek an injunction, a financial penalty, or both. A prior injunction is not a condition for seeking a penalty. In this case, the AFA sought financial penalties directly.
The Commission assessed the breaches at the date retained for the final control report, rather than at the date of its own decision. Measures implemented subsequently could not erase breaches already established at that point. They did, however, matter when the Commission determined the amount of the penalties.
This distinction leaves room for remediation. It also makes clear why a company cannot rely on remediation after a review as a substitute for meeting its obligations beforehand.
Governance is part of the evidence
The chairman was fined personally. The Commission’s reasoning was tied to his position in this company: he founded the group, held senior leadership roles, was closely involved in its management and had the authority to initiate compliance work. The Commission also found that the company had sufficient resources to act.
Personal liability did not follow from his title alone. The decision examined what he knew, what he could do and the resources available to him.
For companies subject to Article 17, this makes anti-corruption compliance a governance question as well as a matter for legal and compliance teams. Leadership must be able to show how risks were identified, how measures were deployed across the relevant entities and how their operation was monitored.
The lasting lesson of the AFA’s decision is one of evidence and timing. A program needs to be in place, appropriate to the organisation and capable of being demonstrated before a review exposes its gaps.