AI agents for compliance teams in retail banking in France

French retail banks' compliance teams can use AI agents to check that financially fragile customers are identified and their fees capped, test the handling of inactive accounts, review credit files and draft compliance reports for the board. The ACPR supervises conduct, and credit scoring of individuals is high-risk under the EU AI Act, so fee decisions, credit outcomes and board conclusions stay with people.

What do retail banking compliance teams in France spend their time on?

French retail banks are supervised by the ACPR, with the largest groups also under ECB banking supervision. Beyond the EU-wide rules shared with other markets, French banking law adds consumer protections that create specific, recurring compliance work.

Financial fragility. Banks must identify customers in financial fragility, using criteria such as repeated payment incidents, and offer them suitable services. Certain fees for these customers are capped. Identification must be consistent, and caps must actually be applied in billing.

Account access and inclusion. People refused a bank account have a right to obtain one through a designated process, with a basic set of services.

Inactive accounts. Banks must identify inactive accounts and dormant safe-deposit holdings, attempt to contact holders or heirs, and after set periods transfer the funds to a public body. Each step must be documented.

Credit. Consumer and mortgage credit require creditworthiness assessment, pre-contractual information and respect for cooling-off rights. Scoring models used for individuals are high-risk under the EU AI Act.

Governance. Compliance reports regularly to the executive and the board, including on conduct risk and remediation.

Where can AI agents help?

The depth of each use sets how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.

1. Fragility identification and fee cap testing (depth 1). The agent applies the bank's fragility criteria to account histories, lists customers who meet them but are not flagged, and checks that billed fees for flagged customers stay within the caps. This is the most France-specific use, and failures cause direct financial harm to the customers least able to bear it.
2. Inactive account testing (depth 1). The agent checks inactive accounts against each required step: identification, contact attempts, searches for deceased holders and transfer on time. It lists accounts where a step is missing or late.
3. Credit file review (depth 1). The agent samples consumer credit files for creditworthiness evidence, required pre-contractual information and handling of cooling-off requests.
4. Board compliance report drafting (depth 2). The agent compiles testing results, complaints, incidents, remediation progress and regulatory changes into the draft report. Whether an agent can go further is discussed in can an AI agent produce board compliance reports.
5. Committee papers (depth 2). The agent assembles the monthly compliance committee pack. The guide on preparing compliance committee papers with an AI agent sets out the steps.

What stays with people?

Fee refunds and remediation. If testing shows caps were exceeded, deciding the scope of refunds and making them stays with people. A compliance agent does not move money.

Flagging customers as fragile. The agent identifies candidates. The bank's process decides, because the flag changes what the customer is offered and charged.

Contacting heirs and transferring funds. Steps on inactive accounts involve sensitive contact and irreversible transfers, decided by people.

Credit decisions. A compliance agent reviews files; it never scores or decides on credit. Creditworthiness assessment for individuals is high-risk under the EU AI Act, with human oversight required.

The board report's conclusions. The head of compliance decides what the board must hear and signs the report.

Which rules apply in France?

ACPR. Supervises French banks for prudential, conduct and AML matters. It expects banks to govern systems used in customer processes and to explain their outcomes. ECB banking supervision covers the largest groups' prudential matters, and the EBA sets EU guidelines, including on loan origination and internal governance.

EU AI Act (Regulation (EU) 2024/1689). In force since 1 August 2024, with obligations phasing in. Annex III lists creditworthiness assessment and credit scoring of natural persons as high-risk. Banks using such systems as deployers carry Article 26 obligations, including human oversight and monitoring, and some must carry out an Article 27 fundamental rights impact assessment. Article 4 AI literacy and Article 50 transparency apply widely. A compliance agent reading files is not itself high-risk, but it may test systems that are.

GDPR and the CNIL. Article 5 principles, Article 30 records and Article 35 impact assessments apply. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, which includes many credit and account decisions.

DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025: ICT risk, incident reporting, testing and third-party risk, including an agent's provider.

PSD2, the Instant Payments Regulation and the EU AML framework, consistent with FATF standards, apply to payment and AML processes.

National banking law on fragility, account access and inactive accounts applies to the work the agent tests.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How to start in the first 90 days

Month one. Add the agent's provider to the DORA register and complete the impact assessment. Start with fee cap testing for flagged customers, which uses billing data and a precise rule.

Month two. Replay the agent against the previous two quarters of billing. Every overcharge your own controls found should appear; investigate any additional ones as possible live issues.

Month three. Extend to fragility identification, then inactive account testing. Use the agent to draft the next quarterly board report, reviewed in full by the head of compliance. Australian banks face a different regulator mix and code-based hardship rules; see compliance agents in Australian retail banking. The guide to AI compliance agents explains the second-line role.