France implements CRD6: key changes to banking market access and supervision

French Ordinance no. 2026-255, published in the Official Journal of the French Republic on 9 April 2026 (the Ordinance), implements Directive (EU) 2024/1619 (CRD6) into French law through a series of amendments to the French Financial and Monetary Code (Code monétaire et financier).

The French legislator has explicitly indicated in the Rapport au Président de la République accompanying the Ordinance its choice of an implementation with no material goldplating. Indeed, the absence of over-implementation in the French law is a deliberate policy choice flagged as necessary to preserve the attractiveness of the Paris banking and financial market.

Below is a summary of the key provisions.

The French banking monopoly and its new exceptions

Prior to the Ordinance, pursuant to French banking monopoly rules, third-country credit institutions wishing to provide banking services in France were already required to establish and obtain an authorisation from the French Prudential Supervision and Resolution Authority (ACPR) to establish a local licensed subsidiary, an EEA licensed subsidiary passported into France or a local third-country branch (TCB). This requirement was applied regardless of whether the client relationship was initiated by the institution or by the client.

CRD6 is the first EU-level instrument to harmonise the conditions under which third-country institutions may access EU banking markets. Under the new rules, firms outside the EU will be prohibited from providing “core banking services” (i.e. taking deposits, lending and provision of guarantees/commitments) to clients in the EU on a cross-border basis unless they establish a branch in that Member State (a TCB) and apply for authorisation for such branch to commence or continue carrying out their banking activities. It should be noted that third-country branches will have no passporting rights of their own (as was the practice in France), and therefore credit institutions anticipating operating in multiple Member States may require multiple TCBs to be incorporated or consider subsidiarisation to benefit from the passport. The regime also distinguishes TCBs of systemic importance, which are subject to greater supervision, and introduces broad supervisory powers that apply to all TCBs. This distinction is also provided for under the Ordinance, which also enables the ACPR to request a TCB to convert as a subsidiary if it reaches certain materiality thresholds (as provided for under CRD6). The qualitative and quantitative thresholds entailing greater supervision will be set by secondary legislation (arrêté du ministre chargé de l’Economie).

The requirement to establish a TCB does not apply in all cases as CRD6 introduces some exemptions. However, such exemptions are narrow and do not extend to investment services or ancillary services, which remain subject to the MiFID/MiFIR framework. The Ordinance implements these exemptions by carving out three categories of transactions third-country institutions may carry out in France without establishing a TCB, which are strictly in line with CRD6:

• Reverse solicitation: there is no need to establish a TCB to provide banking services to a client established or residing in France which approached the third-country institution on its “own exclusive initiative” for that specific banking service. The Ordinance closely mirrors CRD6’s anti-circumvention language: the exemption falls if any element shows that the third-country institution has solicited the client. Cross-selling of product categories beyond what was originally solicited is expressly prohibited unless conducted through a TCB;
• Interbank transactions: there is no need to establish a TCB where the French client is itself a credit institution or financing company (société de financement);
• Intra-group exemption: there is no need to establish a TCB for transactions with group entities. Although French banking monopoly rules already accounted for an intra-group exemption, the Ordinance extends the exemption’s perimeter to group entities within the meaning of the EU Accounting Directive.

Prudential treatment of TCBs

On the prudential side, France historically adopted a stricter approach by aligning TCB requirements with those of French credit institutions, subject to individual exemptions granted by the ACPR (generally granted on the basis of the reciprocal treatment of branches of French credit institutions in such third country). This approach is not in line with CRD6, and upholding it would result in French requirements sitting materially above those of other Member States, to the detriment of the Paris financial market. Key modifications to align the French approach to the EU’s include considering that the application of CRR-equivalent capital and liquidity requirements to TCBs becomes a derogatory regime triggered by individual ACPR decision, rather than the default position, and removing the individual exemption regime. However, the ACPR may require (i) the conversion of a TCB into a locally incorporated subsidiary, (ii) impose additional Pillar 2 capital endowment requirements on individual TCBs or (iii) require TCBs to establish a local management committee.

Governance, fit & proper and key function holders

The Ordinance formally introduces the concept of key function holders (titulaires de postes clés) into the French Monetary and Financial Code (i) extending it to the chief financial officer (directeur financier) and (ii) confirming it includes the heads of risk management, compliance and internal audit functions of credit institutions and financing companies, as provided for under CRD6.

Key function holders are subject to ongoing fit & proper requirements (with an ex post notification requirement for qualifying institutions).

For management body members, “independence of mind” is added as an express fit & proper criterion alongside the existing honorability, knowledge, competence and experience requirements.

Finally, large institutions as defined under French law (such definition being in line with that in CRR) are now required to notify ex ante the ACPR of CEO, deputy CEO, effective director (dirigeant effectif) and chair nominations at least 30 working days before the appointee takes office. This early notification is designed solely to allow the ACPR to prepare its assessment and does not replace or prejudge the outcome of the existing ex post assessment framework.

Internal control and risk management

The Ordinance replaces the existing concept of risk management function (fonction de gestion des risques) with the broader concept of internal control functions (fonctions de contrôle interne), now encompassing risk management, compliance and internal audit on an equal footing. This terminological shift has substantive effect. All three functions now benefit equally from (i) direct access to the management body and (ii) formal escalation rights, including the ability to raise concerns and issue warnings without prejudice to the responsibilities of the management body.

Mergers and acquisitions

The Ordinance introduces a new notification and approval regime for material M&A transactions involving French credit institutions and financing companies:

• Material acquisitions and disposals of direct or indirect holdings require prior written notification to the ACPR or ECB, followed by a prudential assessment focused on sound management and risk profile. Intra-group acquisitions are exempt from the substantive assessment obligation;
• Material asset and liability transfers (by sale or any other transaction type, including intragroup) require prior notification, with materiality thresholds to be defined by decree;
• Mergers and demergers require prior notification and, for non-intragroup transactions, a positive assessment before completion (which amounts in practice to a prior approval). Joint decision procedures apply in cross-border situations, with EBA referral as backstop in the absence of an agreed position.

As provided for under CRD6, all these obligations are subject to a proportionality assessment. Further details on the notification regime, including the thresholds pursuant to which a holding is considered material will be determined by decree, yet to be adopted.

Integration of ESG, climate and crypto-asset risks

Credit institutions and financing companies (excluding TCBs) are required to:

• establish prudential transition plans setting out quantifiable targets to identify, monitor and mitigate financial risks from ESG factors over the short, medium and long term, the long term being defined as a minimum horizon of ten years. These plans must be consistent with CSRD-based transition plans;
• conduct ESG scenario stress tests, beginning with climate-related factors; and
• integrate ESG risks into governance, risk appetite frameworks, remuneration policy and board training, including as regards variable remuneration.

The ACPR’s powers are enhanced to include the assessment of institutions’ ESG strategies and transition plans, with authority to require risk reduction measures including enhanced targets and actions.

Crypto-asset exposures and service provision are added to the list of risks covered by the internal control framework, and the ACPR may require dedicated crypto-asset stress tests.

Timing

The Ordinance enters into force on 10 April 2026 with respect to most of its provisions, except for the market access and TCB prudential provisions, which will enter into force on 11 January 2027, in line with the timeline provided for in CRD6. Client rights under contracts concluded before 11 July 2026 are grandfathered. Existing TCBs must submit compliance evidence to the ACPR by 10 November 2026.

The Ordinance further specifies that the new requirements pertaining to mergers and acquisitions apply to deals submitted to the relevant corporate body from 10 April 2026 (and therefore not to ongoing projects for which corporate authorisations have already been obtained).