Regulatory update: Order of 29 July 2026 implementing Directive (EU) 2024/1619

The Order of 29 July 2026 further completes the transposition into French law of Directive (EU) 2024/1619 of 31 May 2024 (“CRD VI”), following on from Ordinance No. 2026-255 of 8 April 2026 and Decree No. 2026-309 of 24 April 2026. In particular, it amends the rules relating to internal control, prudential supervision, environmental, social and governance risks (“ESG”), crypto-assets, as well as the regime applicable to French branches of third-country credit institutions.

1) Strengthening of internal control functions

The Order strengthens the role of internal control functions. The risk management function is now required to play an active role in the development of the institution’s risk strategy, as well as in significant risk management decisions, and to monitor the effective implementation of that strategy. The compliance function is, for its part, required to ensure that compliance risk is taken into account in significant risk management decisions. The internal audit function is also responsible for independently reviewing the implementation of the institution’s risk strategy.

The Order also strengthens the control arrangements applicable to activities carried out by institutions, their subsidiaries and their branches, in particular with a view to preventing the unauthorized conduct of certain banking activities. It also introduces specific requirements regarding the accounting records policy and the monitoring of transactions of third-country branches, which must be subject to periodic review by an independent third party. 

2) Integration of ESG risks

The new framework further strengthens the integration of ESG risks into the prudential supervisory process.

The French Prudential Supervision and Resolution Authority (Autorité de contrôle prudentiel et de résolution, “ACPR”) is now required to assess the governance and risk management processes implemented by institutions to address such risks, as well as their exposure thereto. This assessment must take into account, in particular, the plans developed by institutions and the progress made in addressing ESG risks, notably in light of climate neutrality objectives.

3) Crypto-assets

A prior risk assessment is now required before any new exposure to a crypto-asset. Institutions must ensure that they have appropriate processes and procedures in place to manage, in particular, market, liquidity, concentration, credit and operational risks. Specific requirements also apply where crypto-assets do not have an identifiable issuer. Such new exposures to crypto-assets fall within the scope of the ACPR’s prudential supervision. In particular, the ACPR is required to review the governance and risk management processes implemented by institutions in this respect. 

4) Strengthened framework for third-country branches

The Order introduces a new classification of such branches into two categories. Category 1 includes branches whose assets amount to at least €5 billion or which meet certain conditions relating to the acceptance of repayable funds from the public. All other branches fall within Category 2.

This classification gives rise to differentiated prudential requirements. Category 1 branches must maintain an endowment of capital equal to at least 2.5% of their average liabilities, subject to a minimum of €10 million, whereas the applicable ratio is 0.5% for Category 2 branches, subject to a minimum of €5 million. Assets held to meet this requirement must be held in specifically designated accounts with a credit institution established in France or, subject to certain conditions, in the form of reserves held with the Banque de France.

The ACPR is also granted enhanced powers in relation to such branches. In certain circumstances, it may require a branch to be converted into a subsidiary, notably where the branch is of systemic importance or where the aggregate amount of assets held by branches of the same group in the European Union reaches certain thresholds.

The Order further specifies the criteria enabling the ACPR to assess whether a third-country branch is of systemic importance. These include, in particular, its size, the complexity of its structure and business model, its degree of interconnectedness with the French and European financial systems, its market share, and the potential consequences of an interruption of its activities (Article 59, new Article 22). Where significant risks to financial stability are identified, the ACPR may impose additional prudential requirements or require the restructuring of the branch’s assets or activities.

5) Framework for restructuring procedures

Certain rules relating to applications for authorization, changes in circumstances and the withdrawal of authorization are also amended. The Order further establishes the framework applicable to procedures relating to the acquisition and disposal of qualifying holdings, significant transfers of assets and liabilities, and merger and demerger transactions. Notifications submitted to the ECB or the ACPR must contain the information required under European legislation and the forms published by the ACPR, such information being proportionate and appropriate to the nature of the transaction. The ECB or the ACPR must acknowledge receipt of a complete notification within ten working days. For acquisitions and disposals of qualifying holdings and for merger and demerger transactions, the assessment period may not exceed sixty working days.

6) Adjustments to the own funds buffer framework

The framework governing own funds buffers is also evolving, in particular through the review of certain buffers where the own funds floor provided for under the CRR becomes the reference level for the calculation of own funds requirements. It also provides for greater consideration of climate-related risks in the setting of the systemic risk buffer.