Sapin II: First Financial Penalties Imposed by the AFA Sanctions Committee

In Decision No. 25-01 of July 9, 2026, the AFA Sanctions Committee imposed, for the first time since the entry into force of Law, No. 2016-1691 of December 9, 2016, known as "Sapin II," monetary sanctions on a company (€350,000) and its president in his personal capacity (€60,000) for failing to comply. Both sanctions were imposed for failing to adhere with obligations to prevent and detect acts of corruption proscribed in Article 17, II of the aforementioned law (legal caps: €1 million and €200,000).

Following an inspection conducted from June 2024 to July 2025, the AFA identified breaches spanning seven of the eight obligations set forth in Article 17, II: lack of risk mapping; lack of due diligence procedures for assessing third parties (clients, first-tier suppliers, and intermediaries); insufficient or absent anti-corruption accounting controls (Levels 1 through 3); and lack of a training program for executives and staff most at risk and of an internal control and assessment system. The company was further charged with the absence of a code of conduct at one of its subsidiaries and with the lack of a disciplinary policy applicable to that subsidiary's employees.

Four key lessons emerge:

• Direct sanction upheld: For the first time, the AFA director referred the matter to the Sanctions Committee for the purpose of imposing a sanction, without a prior injunction. Article 17, IV does not require a "graduated response"; the choice of enforcement strategy rests with the AFA.

• Breach assessed as of the date of the AFA's final inspection report: A breach is now assessed as of the date of the AFA's final inspection report, rather than as of the date on which the Committee rules. Remediation carried out after that report therefore no longer erases the breach; it operates only as a mitigating factor affecting the amount of the penalty. This approach breaks with decisions in 2020 and 2021, which set aside any penalty where the company had brought itself into compliance before the Commission ruled. That leniency was, however, explained by the nature of the referrals at issue, which sought an injunction to comply: once that objective was met, the penalty no longer served any purpose. The logic is reversed where the matter is referred to the Sanctions Committee directly for the purpose of imposing a penalty; once established at the final inspection report stage, the breach is settled and cannot be erased by subsequent remediation.

• Remedial measures limited to the amount: Not bound by the AFA's requests (at least €400,000 and €80,000), the Committee imposed lower amounts in light of the corrective measures and mitigating circumstances regarding two allegations.

• Personal sanction against the executive: The Committee determined that, as the founder, chairman, and principal shareholder—a "skilled professional"—operating in a sector exposed to corruption risks, the sanctioned executive could not have been unaware of his obligations seven years after the law took effect, especially since he had the authority and resources to initiate compliance efforts.