AI agents for compliance teams in business banking in France

French business banks can give compliance agents the reading and drafting: checking a Kbis extract against the beneficial ownership register, untangling SCI and holding structures, preparing alert files and drafting reports to the financial intelligence unit. People keep decisions to onboard, exit or report. The ACPR supervises, and GDPR, DORA and the EU AI Act set the frame.

Where does a French business banking compliance team spend its time?

Ownership work comes first. French businesses often sit inside layers of holding companies, and property is frequently held through a société civile immobilière with family shareholders. The analyst checks the Kbis extract, the articles, the beneficial ownership declaration and any shareholder agreements, then explains in the file why the bank is satisfied about who controls the client.

The beneficial ownership register is a source, not proof. Where it disagrees with what the client has told the bank, the analyst has to resolve the discrepancy and, under EU rules, report it. That reconciliation is slow, and it is done in French on documents that vary from region to region.

Monitoring and reporting fill the rest: alerts on professional accounts, declarations of suspicion to France's financial intelligence unit, periodic reviews of higher-risk clients, and annual internal control reporting to the ACPR.

Which compliance tasks suit an AI agent?

Four uses earn their place, each at a depth proven on the bank's own files.

1. Register reconciliation (depth 1). The agent compares the Kbis extract, the beneficial ownership declaration and the client's own statements, then lists every discrepancy with its source. It does not decide whether a discrepancy is material.
2. Holding and SCI mapping (depth 1). The agent draws the chain from operating company to natural persons, marking any link where the evidence is a declaration rather than a register. This is the hardest analyst task and the one where a cited map saves most time.
3. Client file drafting (depth 2). The agent drafts the due diligence summary and the list of missing documents. An analyst checks and sends. Our playbook on running business customer due diligence with an AI agent covers the full sequence.
4. Inputs to the business-wide risk assessment (depth 2). The agent drafts the client, product and geography sections from portfolio data, for the compliance officer to challenge. See how to run the business-wide AML risk assessment with an AI agent.

Alert triage can follow later. Start where the evidence is documentary and the agent's output is easy to check.

What must stay with a person?

The declaration of suspicion stays with the bank's declarant, a named person, and so does the decision not to declare. The French regime protects the confidentiality of declarations strictly, so the agent should have no route to the client at all on a file under review. Any attempt to draft a client message on such a file is refused and filed.

Onboarding decisions stay human too. The question of whether an AI agent can onboard a business customer has a short answer in a French bank: it can prepare, a person accepts. Exiting a professional client is the same, because the bank must give a consistent reason and handle the client's right to a basic account where it applies.

This is the posture we describe in AI compliance agents: second line, never the last word. The agent widens what the team can see; it does not take the decision.

What rules apply in France?

The ACPR supervises banks for AML/CFT and internal control, and the ECB supervises the largest groups prudentially. France transposes EU AML directives, and the EU AML Authority (AMLA) is being established in Frankfurt, which will add a layer of EU-level supervision for some institutions.

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, with obligations phasing in. A compliance agent used for AML is not one of the high-risk uses the Act lists, but the bank is still a deployer: it must ensure AI literacy among staff under Article 4 and meet Article 26 duties where they apply. Keep automatic logs regardless, because the ACPR will want to reconstruct decisions.

GDPR applies to directors, shareholders and signatories, with the CNIL as authority. Article 22 limits decisions based solely on automated processing with significant effects, which is one more reason refusals and exits keep a human decision. Record the agent's processing in your Article 30 records, and run an Article 35 impact assessment where the risk calls for one.

DORA, applying from 17 January 2025, treats the agent's supplier as an ICT third-party provider and the agent as part of your ICT risk management.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How do you start in the first 90 days?

Begin with register reconciliation on a sample of closed files, in French, including SCIs and two-level holding structures. Measure how many discrepancies the agent finds that analysts found, and how many it adds that analysts missed or rightly ignored.

In the second month, add holding and SCI mapping at depth 1 and write the DORA entries: the supplier contract, exit plan and incident route. Agree with the data protection officer how the agent's processing appears in the Article 30 record.

In the third month, consider drafting at depth 2 for standard client files. Our guide on how to deploy an AI agent in a business covers ownership, rollout and monitoring.