KYC/eIDV compliance in France: AML/CFT, GDPR and eIDAS 2.0 in 2026

KYC compliance in banking, fintech or insurance sits inside a complex legal mesh. Each text carries a distinct purpose: personal data protection, anti-money-laundering, digital identity security, system resilience. Understanding how they articulate is the first step toward a robust setup.

The seven regulatory instruments applicable in France are:

• GDPR (EU Regulation 2016/679 — the EU's personal data law): the foundation of personal-data protection, applicable to any identity collection.
• AML/CFT (anti-money-laundering and counter-terrorism financing — in French, LCB-FT; French Monetary and Financial Code, art. L561-1 ff.): customer due-diligence duties, suspicious-activity reporting to Tracfin (the French financial intelligence unit).
• AMLD6 (the 6th EU Anti-Money Laundering Directive — EU Directive 2018/1673): EU harmonization of predicate offences for money laundering and terrorism financing.
• eIDAS 2.0 (the EU electronic ID regulation — EU Regulation 2024/1183): assurance levels for eID (electronic identity), the upcoming EUDI Wallet (EU digital identity wallet).
• PSD2 (EU Directive 2015/2366): strong authentication of payments and access to banking data.
• DORA (the EU digital operational resilience act — EU Regulation 2022/2554): digital operational resilience of financial entities, in application since January 2025.
• NIS2 (the EU cyber-resilience directive — EU Directive 2022/2555): cybersecurity duties for essential and important entities, transposed into French law.

Official sources. Texts are consolidated on EUR-Lex and Légifrance (the official French legal portal). Reference authorities are the ACPR (French banking and insurance regulator), Tracfin (French financial intelligence unit), the EBA (European Banking Authority), the AMF (French financial markets regulator), the ANJ (French online gambling authority) for iGaming and the CNIL (French data protection authority) for the GDPR side.

Many actors perceive a tension between the data minimization imposed by GDPR and the enhanced due diligence imposed by AML/CFT. The CNIL and ACPR have clarified this point: GDPR compliance does not exempt from AML/CFT duties, and vice versa. Concretely, you can keep data collected for customer identification for five years after the end of the business relationship, in line with article L561-12 of the Monetary and Financial Code.

The legal basis for processing is legal obligation (article 6.1.c of the GDPR) when collection is done under AML/CFT, and contract or legitimate interest when it is done for commercial customer knowledge. This distinction shapes the customer-information notice and retention duration. We systematically audit every source we mobilize: each one is compliant with GDPR and applicable local laws. Audited compliance is the cardinal value of our method.

AML/CFT (anti-money-laundering and counter-terrorism financing) structures most of the obligations in France. Whether you operate a bank, an insurance company, a regulated fintech, an accounting or law firm, a real-estate agency, a crypto-asset service provider (CASP) or a licensed online-gambling operator under the ANJ (French online gambling authority), you apply a graduated setup based on the risk level, imposed by the Monetary and Financial Code.

Three levels of due diligence apply depending on the customer's risk profile:

1. Simplified due diligence — low-risk clients (listed entities, EU public authorities), lightened identification measures. 2. Standard due diligence — the default regime: identification, identity verification, knowledge of the purpose and nature of the business relationship. 3. Enhanced due diligence — high-risk clients: politically exposed persons (PEPs), high-risk third countries, complex or unusual operations. Additional measures: senior-management approval, documented source of funds, enhanced ongoing monitoring.

The annual Tracfin report publishes indicators every year: in 2023, more than 175,000 suspicious-activity declarations were received, in steady growth over five years. This rise illustrates the growing pressure on AML/CFT setups and the need to industrialize the detection of weak signals. We help you reinforce that detection by mobilizing transactional, government, telecom and media sources, audited one by one.

Concrete case. An online bank welcomes 60,000 new clients every year. Without an electronic identity verification (eIDV) flow embedded in the path, onboarding abandonment reaches 25%, meaning 15,000 lost clients. With a setup built on transactional data, abandonment drops to 5%, meaning 3,000 abandonments. The differential represents €39.4 million of net CLTV on the basis of a €300 acquisition cost and a €3,600 customer lifetime value.

The AMLD6 directive (the 6th EU Anti-Money Laundering Directive), transposed into French law in 2020, broadened the scope of predicate offences for money laundering. Twenty-two categories of offences are now recognized: drug trafficking, human trafficking, corruption, tax fraud, cybercrime, environmental offences. The directive also harmonizes the level of penalties: up to four years' imprisonment for individuals and dissuasive financial sanctions for legal entities.

AMLD6 also introduces the liability of legal entities: a bank, a fintech or a crypto-asset service provider can be prosecuted for failure in its anti-money-laundering setup. This extended liability makes the traceability of identity checks critical. Whether you operate in France or across the eurozone, we select for you sources whose processing chain is documented and auditable, compliant with GDPR and applicable local laws.

Adopted in 2024, the eIDAS 2.0 regulation (the EU electronic ID regulation) introduces the European Digital Identity Wallet (EUDI Wallet) by 2026. Three assurance levels structure the eID (electronic identity):

• Low level: simple authentication, low probability of identity misuse.
• Substantial level: factor combination, reduced probability of misuse.
• High level: strong authentication with verified documentary proof and biometric link, very low probability of misuse.

For customer knowledge, eIDAS 2.0 requires member states to mutually recognize notified identification schemes. You will be able to onboard a German resident through a French bank via their EUDI Wallet without asking for additional supporting documents, provided the assurance level is sufficient.

The PSD2 directive has imposed strong customer authentication (SCA) for most online payments since 2019. This duty articulates with KYC: payer identification must rest on at least two factors among knowledge, possession and inherence. PSD2 also opens access to payment data (open banking under PSD2), creating new opportunities to reinforce identity through transactional data. We mobilize this verified purchase data as a complement to the other KYC blocks.

Since January 2025, the DORA regulation (the EU digital operational resilience act) requires financial entities to operate a framework for managing IT-related risks. Four pillars structure the duty: ICT risk management, major-incident reporting, digital operational resilience testing and management of risks from critical third-party providers. For a setup relying on external providers (eIDV, biometrics, sanctions screening), DORA imposes enhanced due diligence on those partners.

The NIS2 directive (the EU cyber-resilience directive), transposed into French law, broadens the scope of entities subject to cybersecurity duties. Fintechs, payment service providers and crowdfunding platforms are now covered. You cannot think of customer knowledge independently of the cybersecurity of the information system that supports it. We audit every source we propose under the angle of operational resilience, in line with your chain of critical providers.