Autorité de contrôle prudentiel et de résolution

Quick Facts
Overview and History
ACPR Regulatory Powers and EU Mandate
Legislative Framework for ACPR Registration 2024 to 2026
Leadership and Organizational Structure
License and Capital Requirements
Sector Specific Regulations
ACPR Supervision and DORA Compliance
Enforcement Statistics and Sanctions Policy
License Verification and State Registers
Fraud Prevention and Influencer Regulations
Industry Criticism of the ACPR License Process
Practical Takeaways for Business Operations
Key Takeaways 

 

Quick Facts

Overview and History

The Autorité de contrôle prudentiel et de résolution functions as the central pillar of financial security in France, operating in deep integration with the Banque de France. The period from 2024 to early 2026 stands as a defining epoch for this regulatory body, as its primary focus has shifted from classical banking oversight to managing the risks of digitalization, cyber resilience, and stringent regulation of the fintech sector. The regulator actively implements a strategy of managed friction by deliberately raising entry barriers through rigorous authorization processes. This approach is designed to transform Paris into a jurisdiction of the highest financial integrity within the European Union, making an ACPR registration a gold standard for compliance. ACPR implements a strict approach to prudential supervision, demanding from market participants not only formal compliance but real operational resilience in 2026.

ACPR Regulatory Powers and EU Mandate

The mandate of the authority is dual in nature, encompassing microprudential supervision of individual financial institutions and the macroprudential assessment of systemic risks to prevent crises. Operating under the "Building 2025 Together" strategic plan, the regulatory operations are guided by seven core challenges, which prominently include technological change, climate risks, and maintaining financial stability in a high interest rate environment. The regulator diligently monitors macro financial contagion, particularly tracking the transmission of risks from non bank financial intermediaries to the traditional banking sector through private credit exposures.
"The supervisory mandate for the 2025 to 2026 cycle is heavily focused on macro financial contagion and the operational resilience of digital infrastructure." (Source: acpr.banque-france.fr, 2025)

Legislative Framework for ACPR Registration 2024 to 2026

The legislative landscape in France underwent a massive transformation driven by the integration of the European digital finance package. The foundational document for the crypto industry became the Markets in Crypto Assets regulation, requiring a complete overhaul of the French Monetary and Financial Code. Ordinance 2024-936 of October 2024 and Decree 2025-169 of February 2025 established the legal framework to phase out the local PSAN regime and transition to pan European standards. Simultaneously, the banking sector saw the implementation of the CRD VI and CRR III package, while cybersecurity requirements are now strictly governed by the Digital Operational Resilience Act. The European MiCA regulation necessitated a complete overhaul of the French Monetary and Financial Code throughout 2024 and 2025.

Timeline of Major Regulations

Leadership and Organizational Structure

The authority operates under a highly integrated model with the central bank, aligning supervisory practices with macroeconomic analysis. François Villeroy de Galhau serves as the Chairman of the ACPR in his capacity as Governor of the Banque de France, having overseen the strict integration of climate risks into the supervisory review process. A significant leadership transition occurred in January 2026 when Emmanuelle Assouan took over as Secretary General, succeeding Nathalie Aufauvre. The General Secretariat is supported by specialized directorates overseen by Deputy Secretaries General Frédéric Hervo, Frédéric Visnovsky, and Evelyne Massé, who manage critical functions such as market authorizations, on site inspections, and international affairs.
"Since January 2026, Emmanuelle Assouan has led the General Secretariat, ensuring continuity in the rigorous approach to banking supervision." (Source: acpr.banque-france.fr, 2026)

Key Leadership Positions (2026)

License and Capital Requirements 

Securing an ACPR license in France is characterized by an exceptionally rigorous completeness check process. While the theoretical timeline for obtaining a payment institution or electronic money institution license ranges from three to six months, industry realities in 2025 show that the process frequently extends to twelve months or more. The primary bottleneck for applicants is the completeness check, as initial application files are rarely deemed sufficient on the first attempt. The regulator explicitly prioritizes the sustainability of business models over market expansion, making the issuance of brand new banking licenses a rare occurrence. The completeness check has become a major barrier, frequently extending the actual time to license to 12 months or more.

Capital Requirements by License Type (2026)

Sector Specific Regulations

Banking License Requirements

Throughout the 2025 to 2026 supervisory cycle, the authority intensified its scrutiny of the banking sector while acting as the gatekeeper for the Single Supervisory Mechanism. Common Equity Tier 1 capital requirements remained stable around 11.2 percent, but the regulator significantly heightened its focus on Pillar 2 requirements. Banks burdened with high exposures to leveraged finance and commercial real estate face demands for higher capital buffers. Persistent weaknesses in internal governance resulted in qualitative measures requiring immediate remediation. While CET1 requirements remained stable at 11.2 percent for 2026, the regulator aggressively increased individual Pillar 2 capital add ons.

Forex Regulation France and CFD Markets

Forex regulation in France operates through a collaborative effort between the ACPR and the financial markets authority (AMF). The joint unit actively suppresses the marketing of high risk financial products, maintaining strict prohibitions on the promotion of binary options and highly leveraged contracts for difference. Regulators actively target gamified investment platforms that utilize intricate fee structures to obscure the actual risk of capital loss. The promotion of high risk products like binary options and leveraged CFDs remains strictly prohibited for financial influencers in France.

Crypto License France: CASP and Digital Asset Providers

The shift to European regulations created the most disruptive regulatory event for digital assets between 2024 and 2026. Digital asset service providers registered under the legacy national framework before December 2024 received a grandfathering clause allowing them to operate strictly within France until July 1, 2026. After this hard stop, operating without a full European crypto license in France carries penalties of up to two years in prison and a 30,000 euro fine. Companies failing to obtain MiCA authorization must initiate an orderly cessation of their business activities no later than March 30, 2026.

DeFi Regulation: Unregulated Protocols

Acknowledging that true decentralized finance protocols fall outside the standard European scope, French regulators pioneered a dedicated framework for disintermediated finance. The centerpiece is the concept of smart contract certification. This framework proposes that smart contracts undergo rigorous security audits to verify the absence of vulnerabilities and the factual execution of advertised business logic.
"Smart contract certification covers code security, governance transparency, and the verification of financial business logic." (Source: acpr.banque-france.fr, 2025)

Fintech and E money Institution Licenses

The French fintech sector faces mounting regulatory friction. The mandatory implementation of the Instant Payments Regulation by October 2025 forced companies to overhaul technical infrastructure to support payee verification systems. High capital requirements, including the fixed 350,000 euro base for electronic money institutions, continue to present a formidable barrier. The Instant Payments Regulation mandated all payment institutions to implement a verification of payee system by October 9, 2025.

OTC Trading and Exchange Providers

Over the counter trading desks are under intense scrutiny regarding anti money laundering directives. The regulatory strategy explicitly targets the weakest links in the payment chain, penalizing institutions that fail to implement robust automated transaction monitoring systems. Enforcement strategy focuses entirely on the weakest links that fail to deploy effective automated transaction monitoring systems.

JONUM Regime and iGaming

To address the explosion of play to earn models, France introduced the experimental JONUM regime in February 2026. This three year trial creates a distinct legal category bridging gambling and video games. To prevent addiction, the total crypto prize pool cannot exceed 20 percent of annual revenue, with individual winnings capped at 25,000 euros per year. The 2026 JONUM decree legally capped individual Web3 gaming winnings in crypto assets at 25,000 euros per year.

Coins, Tokens, and Stablecoins Regulation

The supervisory authority is expanding its capabilities to oversee significant stablecoins. Regulators have integrated advanced blockchain analytics into their daily supervisory toolkits to trace tokenized financial assets. The regulator is actively preparing for the supervision of significant stablecoins by integrating blockchain analytics into its core toolkit.

ACPR Supervision and DORA Compliance

The architecture of financial supervision modernized rapidly to counter systemic cyber threats. The enforcement of the Digital Operational Resilience Act (DORA) shifted regulatory focus to active resilience testing. Regulators now mandate highly granular reporting on ICT risks associated with third party cloud providers.
"The implementation of the Digital Operational Resilience Act moved from preparation to strict enforcement, requiring granular reporting on ICT risks." (Source: acpr.banque-france.fr, 2026)

Enforcement Statistics and Sanctions Policy 

The sanctions committee demonstrated an increasing willingness to levy substantial financial penalties for breaches in anti money laundering protocols. In a landmark decision in July 2025, Banque Delubac faced a 600,000 euro fine for failures in its compliance framework. The 600,000 euro fine issued to Banque Delubac in 2025 highlighted the regulator's zero tolerance policy for hollow compliance structures.

Major Enforcement Actions (2025 to 2026)

License Verification and State Registers 

Verifying the legal status of financial entities remains mandatory. Authorized banks and credit institutions are cataloged in the official REGAFI database. The completeness check at the authorization stage now acts as a strict quasi licensing process. The required completeness check essentially functions as a rigorous quasi authorization process for all new market entrants.

Fraud Prevention and Influencer Regulations

Retail investor protection surged due to digital marketing proliferation. A decree enacted in November 2025 formalized strict requirements for financial influencers, mandating a written contract for any promotion exceeding 1,000 euros.
"As of January 1, 2026, any commercial influence collaboration exceeding 1,000 euros in value must be formalized in a written contract." (Source: entreprendre.service-public.gouv.fr, 2026)

Industry Criticism of the ACPR License Process

Industry associations criticize the practice of gold plating, where French authorities impose stricter national requirements than European directives. Startups argue that a massive compliance wall has been erected, driving innovation to other EU jurisdictions. The combination of high capital requirements and mandatory cybersecurity audits creates a significant barrier to entry for small fintechs.

Practical Takeaways for Business Operations

Operating in France leading up to 2026 requires high legal readiness. The death of legacy domestic regimes means market consolidation is inevitable. Paris is positioning itself as a hub of high integrity. Firms unable to meet the strict capital, governance, and IT resilience standards will be forced to exit the market or merge by July 2026.

Key Takeaways 

• The transitional period for crypto businesses ends on July 1, 2026, after which a full MiCA license is mandatory.
• A new smart contract certification framework audits DeFi protocols for code security and transparency.
• The JONUM decree validates Web3 gaming with a 25,000 euro annual cap on individual crypto winnings.
• Base capital requirements are 125,000 euros for crypto custody and 350,000 euros for electronic money issuance.
• Enforcement strategy now places heavy financial penalties directly on individual managers for systemic failures.
  
  

FAQ

1. What is ACPR France and what does it regulate?
2. Is crypto regulated in France and under what legal framework?
3. What licenses are required for crypto companies and financial providers?
4. How can I verify if a company holds a valid license in France?
5. How long does it take to get a crypto license in France and why do applications fail?
6. What are the penalties for operating without a license or violating regulations?
7. Are client funds and crypto assets protected by deposit insurance mechanisms?
8. How can a client file a complaint against a regulated financial company?

FAQ

1. What is ACPR France and what does it regulate?

The ACPR is the primary prudential supervision authority in France, supported by the central bank. It regulates banks, insurance firms, payment institutions, and enforces compliance for digital asset providers.

2. Is crypto regulated in France and under what legal framework?

Yes, it is strictly regulated. The framework has transitioned to the European MiCA regulation, implemented via Ordinance 2024-936.

3. What licenses are required for crypto companies and financial providers?

Crypto entities must obtain a CASP authorization. Payment institutions require status with base capital between 50,000 and 350,000 euros.

4. How can I verify if a company holds a valid license in France?

Financial agents and banks are registered in the REGAFI database. Digital asset providers are listed on regulatory white lists.

5. How long does it take to get a crypto license in France and why do applications fail?

It frequently takes 12 months or longer. Applications typically fail due to inadequate internal controls or failure to meet DORA cybersecurity mandates.

6. What are the penalties for operating without a license or violating regulations?

Operating without authorization can lead to two years in prison and a 30,000 euro fine. Corporate breaches trigger massive penalties and professional bans for directors.

7. Are client funds and crypto assets protected by deposit insurance mechanisms?

Banking deposits have classical insurance, while the crypto sector relies on mandatory asset segregation and liquid capital buffers.

8. How can a client file a complaint against a regulated financial company?

Complaints can be submitted through retail investor protection directorates, which can trigger unannounced audits.