KYC and AML-CFT: the guide to digitalized onboarding

What is the legal framework for KYC and AML-CFT?

The French AML-CFT system, derived from Directive (EU) 2015/849, is set out in Articles L561-1 et seq. of the Monetary and Financial Code. Remote onboarding is permitted subject to additional due diligence measures. Advanced electronic signature (AES) allows for collecting consent and documenting each procedure.

To move from theory to practice, discover the Certyneo electronic signature solution and its offer dedicated to your sector — eIDAS compliant, no installation required.

• Identification at onboarding: art. L561-5 of the Monetary and Financial Code
• Ongoing due diligence during the relationship: art. L561-6 of the Monetary and Financial Code
• Beneficial owner: collection and verification (beneficial ownership register)
• Document retention: 5 years after the end of the relationship (art. L561-12 CMF)
• Supervision of the framework by the ACPR, attached to the Banque de France: art. L612-1 of the French Monetary and Financial Code

What documents make up a KYC file?

What does a compliant remote onboarding look like?

1. 1

   Collect KYC documents

   Gather the customer knowledge form, identity document, proof of address and, for a legal entity, the beneficial owner declaration and Kbis.

2. 2

   Verify identity (art. L561-5)

   Article L561-5 requires verifying identity on presentation of a reliable written document. At a distance, additional measures apply (additional document, first transaction from an account in the customer's name, or electronic identification means).

3. 3

   Obtain signed consent

   The customer signs the onboarding file with strong identification (OTP SMS) and qualified timestamping, which proves the exact date of document collection and consent.

4. 4

   Archive and update due diligence

   The signed file and its audit trail are kept for 5 years after the end of the relationship (art. L561-12). Each update to customer knowledge (art. L561-6) is signed and timestamped.

Frequently asked questions — KYC & AML/CFT

Can remote onboarding be carried out in compliance with AML/CFT regulations?

Yes. Remote onboarding is permitted provided that additional due diligence measures are implemented (art. L561-10 of the Monetary and Financial Code and associated regulatory provisions). Certyneo enables the file to be signed with strong identification (dual-channel OTP) and qualified timestamping that traces each step.

Does electronic signature replace the identity verification required by article L561-5?

No, it complements it. Article L561-5 requires verifying identity on a reliable document; electronic signature does not replace this documentary verification, but it timestamps the document collection, authenticates the customer via OTP and seals the file with an enforceable audit trail.

How to prove the ongoing due diligence required by article L561-6?

Article L561-6 requires updating customer knowledge throughout the relationship. Certyneo preserves each signed version of the file with its audit trail, which makes it possible to demonstrate to ACPR the dates and content of each due diligence update.

How long must the KYC file be kept?

Five years from the end of the business relationship (art. L561-12 of the Monetary and Financial Code). Certyneo automatically archives the signed file and its eIDAS audit trail, accessible in one click for any ACPR inspection.

Is the audit trail enforceable against ACPR and usable for a TRACFIN declaration?

Yes. The Certyneo audit trail (identity verified by OTP, qualified timestamp, SHA-256 hash) documents each AML/KYC diligence. It is exportable as a certified PDF, enforceable against ACPR to demonstrate compliance of the customer onboarding device, and usable to support a suspicious activity report to TRACFIN.

What is the role of the Banque de France and the ACPR in KYC supervision?

The Banque de France does not perform KYC on behalf of institutions: the ACPR, an authority attached to the Banque de France, supervises the compliance of banks' and insurers' KYC and AML frameworks and sanctions breaches. The Banque de France also manages the files consulted during onboarding (FICP, FCC), and TRACFIN receives suspicious-activity reports. A KYC file signed electronically, with a timestamped audit trail, makes it much easier to demonstrate compliance during an inspection.

Related guides and solutions

Explore the related resources from our electronic signature hub.

• Banking & insurance e-signature guide
• DSP2 & Strong Authentication (SCA) Guide
• Online identity verification
• eIDAS guide — SES, AES, QES
• E-signature guide