A new piece of French legislation came into force on 1st June, “The Law on Transparency, the fight against corruption and the modernisation of economic life” – also known as ‘Loi Sapin II’. With this new law comes lengthy obligations for those businesses with a presence in France.
Government guidance?
It was anticipated that the newly formed French anti-corruption agency, Agence Francaise Anti-corruption (AFA), would release implementation guides for businesses looking to become compliant with the incoming legislation. However, these have not yet materialised.
Unfortunately, the delay in providing guidance does not mean that companies can postpone their arrangements to comply with the new rules. The Act has come into force on 1st June, along with the penalties for not adhering to it which could include monetary fines from the Sanctions Commission of up to €200,000 for natural persons and €1million for legal persons.
Which businesses are affected by Loi Sapin II?
Businesses affected by the new legislation includes those that are either:
- headquartered in France with 500+ employees
- have an operation in France with an annual turnover of €100million
- part of a group which meets one of the above thresholds
There are also specific requirements for smaller companies of 50 or more employees (see ‘It’s not just big businesses’, below).
How will larger businesses be affected?
The Act imposes several new, anti-corruption related provisions on larger qualifying companies. Article 17 requires qualifying businesses to:
- incorporate a Code of Conduct into the company’s internal regulations
- complete and regularly update risk mapping of the company’s exposure to external solicitations for the purpose of corruption
- ensure accounting controls are in place
- provide corruption and trading in influence training for all relevant employees and managers
- have an internal reporting system requirement (whistleblowing requirement)
Whistleblowing requirement
Whilst the Act has not specified a structure which the whistleblowing procedure must take, some parameters have been imposed.
What should be included
With Article 6 broadening the term “whistleblower”, this in turn broadens what must be covered by your internal reporting system. From 1st June, this includes:
- a crime or offence
- a serious and manifest violation of:
- an international engagement duly ratified or approved by France
- a unilateral act decisions of an international organisation made on the basis of such an undertaking, law or regulation
- a serious threat or prejudice to the public interest
CNIL considerations
The general understanding is that, once the official implementation guidance is released, CNIL will re-evaluate the Single Authorisation (AU-004) to reflect these changes. Until that time, advising them of the changes you are making in line with the new legislation is still advised.
There is also no reference made to the existing CNIL provisions so these are likely to run concurrently meaning reporting systems can also include reports on:
- financial, accounting banking and anti-corruption
- anti –competitive practices
- health and safety
- environmental protection
- discrimination and harassment at work
The nature and subjects of the disclosure
The location in which an alleged act took place (as detailed in a whistleblowing report) does not have to be within France – provided the subject of the report is a French National or a person habitually resident or exercising all or part of his economic activity on French territory.
This allows for prosecutors to pursue those who have committed corruption abroad, circumventing the dual criminality requirement, which could be an important addition to companies with an international presence.
Confidentiality requirement
Another requirement of the Act in relation to Whistleblowing is found in Article 9.
It mandates that strict confidentiality is maintained surrounding the identities of the report author, the person targeted by the report and the information collected by all addressees of the report.
It’s not just big businesses
Whilst much is made of the requirements of big businesses, smaller companies are not entirely off the hook.
The Act still requires businesses with 50 or more employees to establish a procedure for employees to report concerns relating to the business and its staff, beyond the scope of acts related to corruption.
What now?
It is recommended that all affected businesses ensure compliance with Loi Sapin II from 1st June, which means a whistleblowing system should be put in place immediately (if it is not already).
The State Council’s Decrees and The Anti-Corruption Agency’s guidelines will, hopefully, be released imminently.
Meanwhile, CNIL has so far been quiet on the subject but will have to reassess its single authorisation procedure to allow for the new extended scope for whistleblowing policies.
If they do not, full authorisation will be required which will lead to delays in implementation times and, as such, difficulty in enforcing penalties for non-compliance. As this is out of qualifying companies’ control it is for you to evidence you have made sufficient attempts to be compliant.
Implementing those requirements that are within your control would be a positive first step.
Thank you very much for sharing this detailed post ..It was very helpful and I really enjoyed reading it.