AML / LCB-FT
How platform capabilities map to French and EU anti-money-laundering obligations
This page is a factual mapping between platform capabilities and regulatory requirements, provided for information. It is not legal advice, and using the platform does not by itself make an institution compliant: qualifying alerts, assessing risk and deciding on business relationships remain the obligated entity's responsibility.
French AML/CFT law (LCB-FT, lutte contre le blanchiment de capitaux et le financement du terrorisme) sits in the Code monétaire et financier (CMF). The EU AML package (AMLR, AMLD6, AMLA) starts applying from 2027 and will progressively harmonize these obligations across member states.
Customer identity verification
Article R.561-5-1 CMF allows remote identity verification through a high-assurance electronic identification means. The France Identité / EUDI Wallet channel is built for this path: the customer presents a state-signed identity (PID) verified cryptographically, including age proof without disclosing the birth date.
Article R.561-5-2 CMF applies when the customer has no such means: the institution must combine at least two of six alternative measures. Platform mapping:
| Measure (R.561-5-2) | Platform support |
|---|---|
| 1° Copy of an official identity document | Document capture with OCR extraction and consistency controls, 2D-DOC cryptographic checks, and NFC chip reading for foreign documents authenticated against state certificates (CSCA). Chip reading of French titles is restricted (see note below) |
| 2° Verification and certification of the copy by an independent third party | Verifiables acts as the third party, with verification backed by cryptographic evidence (chip signature, 2D-DOC) rather than visual inspection alone |
| 3° First payment from an account in the customer's name at an EU/EEA-regulated institution | Institution-side measure; its outcome can be recorded alongside the verification file |
| 4° Confirmation of identity by a regulated intermediary | Out of scope |
| 5° ANSSI-certified remote identity verification service (PVID) | Not claimed. The biometric channel below is an anti-fraud layer, not a PVID substitute |
| 6° Qualified electronic signature or seal, or qualified registered mail | Supported through QTSP partner integration in the onboarding flow |
French titles and NFC. Chip reading of French identity documents for remote verification is not currently open to private-sector services: ANSSI and the DLPAJ restrict it, and the planned opening targets certified PVID providers only. The platform reads chips of foreign passports and eID cards; French documents are covered through the France Identité path (R.561-5-1) and 2D-DOC cryptographic checks.
The face match and liveness channel (face-to-document comparison using the chip portrait, plus checks aimed at the presentation and injection attack families that ISO/IEC 30107-3 describes; the module is not certified against that standard) strengthens measures 1° and 2° against identity theft with a genuine stolen document. It does not count as one of the two measures, and it naturally drops out of the journey when the customer presents a wallet.
Politically exposed persons
Article L.561-10 CMF requires specific vigilance toward politically exposed persons, without restriction of nationality or jurisdiction, including family members and known close associates (RCA).
The screening API covers French PEPs built from official public sources (Répertoire national des élus, HATVP, government composition, JORF appointments). This scope covers prominent public functions exercised in France only: it reinforces a declarative PEP questionnaire, it does not replace one. International PEP and RCA coverage is a planned extension.
Asset freezes
Screening against the DG Trésor national freeze register (articles L.562-2 and L.562-3 CMF) and OFAC lists, with sanctions updates applied within 24 hours of publication (in practice under 4).
The DG Trésor guidelines recommend that obligated entities keep a timestamped trace of the searches performed per counterparty. Every screening is immutably logged with the exact list versions in force; GET /v1/screening/screenings/:id replays it identically and the audit export produces inspection-ready evidence.
A 503 from the screening API is never a clear: no screening is deemed performed, and we recommend blocking onboarding rather than proceeding without a completed screening.
Ongoing vigilance
Two mechanisms keep files current between periodic reviews:
- Continuous screening: registered subjects are re-screened on every list update; new matches trigger signed webhooks.
- Company monitoring: watched companies emit events from official registers (INPI RNE, BODACC: management changes, collective proceedings, deregistrations), turning legal-entity remediation into an event-driven flow.
Record keeping and data protection
Article L.561-12 CMF requires keeping identity and transaction records for 5 years from the end of the business relationship. Screening evidence is retained 5 years by default. Because the platform cannot know when a given business relationship ends, longer retention is configurable contractually; the replay endpoint works identically over the whole retention window.
Data minimization is built in: the caller-supplied reference must not contain personal data, verification events store no personally identifiable information, and only the data needed for matching (name, birth date, nationality, identifiers) is submitted.
Division of responsibilities
Verifiables provides consolidated data, the matching engine, cryptographic verification and the audit trail. The obligated entity qualifies matches, assesses risk, and decides to onboard, refuse or freeze.