AFA Anti-Corruption Compliance and Financial Penalties: First Sanction Imposed on a Company and Its CEO by the Sanctions Commitee

The Sanctions Committee of the French Anticorruption Agency (AFA) has, for the first time since its creation, imposed a financial penalty [1] on a company and its CEO for failing to fulfil their legal obligations to implement compliance programmes, without a preliminary injunction.

As a reminder, the Sapin II Law (2016) requires large companies to implement a comprehensive anticorruption program — including risk mapping, a code of conduct, training, accounting controls, and third-party due diligence — 8 mandatory measures in total. [2]

The three previous decisions, issued between 2019 and 2021 [3], had been limited to an injunction to ensure conformity or a finding that no breach had occurred, without any financial penalty.

The decision of 9 July 2026 therefore marks a genuine turning point, not only by imposing the first fine under Article 17 of the Sapin II Law without recourse to the preliminary injunction procedure [4], but also by holding the CEO personally liable (a power of the Committee that had, until then, remained purely theoretical) [5].

This decision brings light on a fundamental question: at what date should the breach be assessed?

The company and its CEO had argued that the breach should have been assessed on the date the Sanctions Committee  issued its decision and that as such the compliance measures, which were completed in December 2025, should be taken into account, meaning that there would no longer be grounds for a penalty.

The Sanctions Committee however rejected this argument: since it was directly seized for sanction purposes (rather than for the purpose of issuing an injunction), the breaches must be assessed on the date of the inspection report, and not on the date of the hearing.

While subsequent compliance does not, therefore, remedy the breach, it may still have an impact on the amount of the fine and lead to a reduction of the penalty. In this case, a penalty of a moderate amount was imposed to take account of the remedial measures put in place.

The decision sends a strong signal to companies falling within the ambit of Article 17: establishing a robust, operational and well-documented compliance programme is no longer an option.  The AFA now has no hesitation in referring matters directly to its Sanctions committee, without a preliminary injunction, and in holding CEOs personally accountable.  

It is therefore essential for companies to take proactive steps: map their risks, formalise their compliance framework, train their teams and document their controls, without waiting for an inspection by the AFA. The cost of a compliance programme, however demanding, will always be lower than that of a financial penalty accompanied by personal liability of the CEO and publication of the decision.