France's banking and insurance supervisor, the Autorité de Contrôle Prudentiel et de Résolution, imposed a formal reprimand and a €600,000 financial penalty on Banque Delubac & Cie on 19 June 2025, following a determination by the ACPR's Sanctions Commission that the bank's anti-money laundering and counter-financing of terrorism controls contained material deficiencies. The regulator confirmed the decision in a press release published on its website, noting that it will appear in the ACPR's public sanctions register for a period of five years.
The Sanctions Commission identified failures across several dimensions of the bank's financial security framework. Banque Delubac's automated transaction monitoring system was found to be incapable of accounting for all of the information necessary to identify atypical client operations, a fundamental weakness in the architecture of any effective AML programme. The bank also failed to process internal alerts within the mandatory deadlines set by French regulatory requirements, and it did not report certain transactions to Tracfin, France's financial intelligence unit, without undue delay as required under applicable law.
MONITORING SYSTEM AND ALERT REPORTING FAILURES IDENTIFIED
The specific deficiencies cited by the Sanctions Commission point to systemic limitations rather than isolated or one-off failings. An automated transaction monitoring system that is structurally unable to incorporate all relevant client data will, by design, be limited in its capacity to detect suspicious activity reliably. That architectural weakness was compounded by the bank's failure to meet alert processing deadlines, which delayed the escalation of potentially suspicious transactions to Tracfin even when internal monitoring did generate alerts. Together, the two failures created gaps in the bank's financial crime prevention chain at consecutive stages of the process.
The formal reprimand, or blâme under French administrative law, is a sanction of considerable seriousness in its own right and is distinct from the monetary penalty. It places on the public record a finding by the regulator that the institution's conduct fell below the standard required by law, carrying reputational implications that extend well beyond the financial cost of the fine. The decision to publish the sanction for five years ensures that existing and prospective counterparties, auditors, international correspondent banks, and other regulators are able to consult the enforcement history of Banque Delubac when assessing the institution.
BANK NOTES €3 MILLION INVESTMENT IN COMPLIANCE MEASURES
In the course of the proceedings, Banque Delubac noted that it had invested €3 million in financial security measures since 2020, a figure intended to demonstrate the resources the institution has directed towards improving its compliance infrastructure over the preceding years. The ACPR's Sanctions Commission did not regard that investment as sufficient to avoid the sanction, concluding that the specific deficiencies identified in the monitoring system and alert-handling processes were material enough in their nature and potential consequences to warrant both the public reprimand and the financial penalty irrespective of wider remediation efforts.
The case is a reminder that the ACPR applies consistent and demanding supervisory standards across the full range of French credit institutions, not exclusively at systemically important banks. Banque Delubac is a private banking institution with a history stretching back to the nineteenth century, and the sanction illustrates that heritage and scale do not confer exemption from the AML/CFT obligations applicable to all regulated entities. Institutions across the French banking sector will be reviewing the technical completeness and operational effectiveness of their own transaction monitoring and alert processing frameworks in light of the commission's findings and the specific deficiencies it has put on the public record.