French payment and e-money institutions can use AI agents in compliance to review payee name verification outcomes, test how strong customer authentication exemptions are applied, draft AML alert files and classify ICT incidents for DORA. The ACPR supervises these firms and expects people to decide on suspicious activity reports, incident notifications, refunds and anything sent to supervisors.
What does payments compliance in France involve?
French payment institutions, e-money institutions and banks' payment arms are authorised and supervised by the ACPR, within the EU framework set by the EBA. A compliance team in this market deals with dense, harmonised EU rules applied by a demanding national supervisor.
Authentication. PSD2 strong customer authentication applies to most electronic payments, with exemptions for low-value, trusted or low-risk transactions. Firms using exemptions must monitor fraud and apply them only within the conditions set.
Payee verification. The EU Instant Payments Regulation requires payment service providers to verify the payee's name against the account before a transfer. Compliance must make sure customers see the result and that mismatches are handled as the rules require.
AML. Payment firms carry customer due diligence, transaction monitoring and suspicious transaction reporting to the national financial intelligence unit, consistent with FATF standards. The EU AML Authority is being established in Frankfurt and will shape supervision across the Union.
Operational resilience. DORA has applied since 17 January 2025, requiring ICT risk management, incident classification and reporting, resilience testing and oversight of ICT third parties.
Safeguarding and complaints. Customer funds must be safeguarded, and complaints answered within set periods.
Where can AI agents help?
Depth sets how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
| Use | What the agent does | Depth |
|---|---|---|
| Payee verification review | Samples transfers where the payee name did not match, and checks the customer was shown the result and the warning before confirming | 1 |
| SCA exemption testing | Reviews transactions processed under an exemption and checks each met the conditions, listing those that did not | 1 |
| AML alert files | For each monitoring alert, drafts the customer profile, transaction pattern and counterparties for the analyst | 2 |
| DORA incident classification | Reads incident tickets and drafts the classification against the criteria, with the evidence for each | 2 |
| Agentic payment oversight | Checks that payments started by customers' AI agents carried proper authentication and stayed in the customer's limits | 1 |
The payee verification review is among the most market-specific uses, because the obligation is new to many French firms and its implementation varies across channels. Agent-initiated payments are covered in what is agentic payments.
What stays with people?
Suspicious transaction reports. The decision to report to the financial intelligence unit, and the content, belong to the AML officer. The customer must not be alerted.
Incident classification and notification. The agent drafts. Whether an incident is major under DORA, and the notification to the ACPR, is a decision made against a deadline by responsible officers.
Refunds and reimbursements. Whether a customer is refunded for an unauthorised or misdirected payment depends on the facts and on the rules on liability. A person decides.
Stopping payments. Instant payments settle in seconds. Blocking or recalling one affects a customer directly; see what is instant payments for why speed changes the risk.
Statements to the ACPR and the CNIL. Drafted at most by the agent.
Which rules apply in France?
ACPR. Authorises and supervises payment and e-money institutions and banks for prudential, conduct and AML purposes. Its expectations on governance and internal control apply to any process an agent supports.
EBA. Sets EU-level guidelines and technical standards, including on strong customer authentication, fraud reporting and ICT risk.
PSD2 and the Instant Payments Regulation. Strong customer authentication with defined exemptions, and verification of the payee's name for transfers.
DORA (Regulation (EU) 2022/2554). ICT risk management, incident reporting, resilience testing and ICT third-party risk. An agent's provider is an ICT third party and belongs in the register.
EU AI Act (Regulation (EU) 2024/1689). In force since 1 August 2024, with obligations phasing in. A compliance agent reading transactions is unlikely to be high-risk, but Article 4 AI literacy and Article 26 deployer duties set expectations, and creditworthiness assessment for individuals is high-risk under Annex III if the firm also lends.
GDPR and the CNIL. Article 5 principles, Article 30 records of processing and Article 35 impact assessments apply to transaction monitoring at scale. Article 22 restricts decisions based solely on automated processing with significant effects, such as blocking an account.
FATF and the EU AML framework shape due diligence, monitoring and reporting duties.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How to start in the first 90 days
Month one. Add the agent's provider to your DORA third-party register and complete the impact assessment. Choose payee verification review as the first use: the rule is precise and the data is in your payment logs.
Month two. Replay the agent against a sample of past transfers with a name mismatch, across app, web and any partner channels. Look for channels where the customer was not shown the result.
Month three. Run weekly, with the compliance officer reviewing every failure. Add SCA exemption testing. French insurers share the ACPR but face different risks; see compliance agents in French insurance.
Where Pryme fits
In Pryme, every fact reaching a compliance agent carries its provenance class, so a customer's own statement in a scam claim is weighed differently from a signed payment record, and an external claim can never authorise a payment. Attest certifies each agent on your own transactions. Every verdict is filed, which supports DORA and ACPR reviews. The guide to AI compliance agents covers the principle.
Questions people ask
Can an AI agent decide whether an ICT incident is major under DORA?
It can draft the classification with evidence against each criterion. The decision and any notification stay with responsible officers.
Does payee verification apply to payments started by a customer's AI agent?
The obligation sits with the payment service provider for the transfer, regardless of what started it. Make sure the result reaches whoever, or whatever, confirms the payment, and that the customer's authority covers it.
Is transaction monitoring by an agent an automated decision under the GDPR?
Monitoring that produces alerts for people to review is not a decision based solely on automated processing. Blocking an account automatically could be, so keep that with a person.