Security of payment means: preparing for the Banque de France review
A payment institution or an electronic money institution obtains its authorisation from the ACPR (Autorité de contrôle prudentiel et de résolution, the French Prudential Supervision and Resolution Authority) only after the Banque de France has given its opinion on the security of its payment means. The review covers governance, the information system, strong customer authentication and service providers; it continues after authorisation through the monitoring of commitments, fraud reporting and inspections.
ORWL Avocats prepares the application, handles exchanges with the Banque de France and the ACPR, and secures your providers’ contracts.
Why does the Banque de France review your application?
Under the French Monetary and Financial Code (CMF), the Banque de France ensures the security of non-cash means of payment and the relevance of the standards that apply to them. The consequence for applicants is direct: the ACPR grants authorisation as a payment institution or an electronic money institution only after obtaining the opinion of the Banque de France (Articles L. 141-4, L. 522-6 and L. 526-7 CMF).
The Banque de France thus gives the ACPR an opinion on the technical, IT and organisational measures that protect your customers’ payments. Its teams conduct the review in coordination with the ACPR, which examines the rest of the application.
The review applies to:
- payment institutions and electronic money institutions (EMIs) applying for authorisation;
- payment institutions limited to e-money token (EMT) services, which apply through the streamlined application (agrément allégé), including crypto-asset service providers (CASPs) that add this status to their MiCA authorisation;
- authorised institutions applying to extend their authorisation to new services.
Payment institutions holding a simplified authorisation (agrément simplifié, the French regime for small payment institutions) and agents of payment service providers are outside the review.
Stages of the Banque de France review
This phase is a major part of the authorisation process. It has no timetable of its own: it runs for as long as the review of the payment or e-money institution authorisation application.
Where some points remain open, the ACPR may grant authorisation subject to a commitment to comply, as soon as possible, with the Banque de France’s payment security requirements. The work therefore does not end with the decision.
What does the Banque de France look for in your application?
The Banque de France reads the whole set-up: policies, risk maps, procedures, the description of strong customer authentication (SCA), the business continuity plan and service provider contracts. It checks that these documents describe a set-up that is real, specific to the institution and aligned with the rules:
- the PSD2 requirements on operational and security risk management (Article 95);
- the PSD2 requirements on strong customer authentication (Article 97) and the related regulatory technical standards (Delegated Regulation (EU) 2018/389);
- the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02);
- since 17 January 2025, the Digital Operational Resilience Act (DORA).
| Area | Frequent points of attention | Expected deliverables |
|---|---|---|
| Business and flows | Consistency between the flows described and the services requested; fraud risks specific to the customer journey | Description of payment flows, customer journey diagrams |
| Security governance | Clearly defined responsibilities, independence of the security function, permanent and periodic control | Security policy, organisation chart, control procedures |
| Information system | Self-standing set-up, architecture, access rights, separation of environments | Architecture file, risk map, access management policy |
| Strong customer authentication | Factors used, dynamic linking, exemptions and their justification | Description of strong customer authentication, analysis of exemptions |
| Keys and encryption | Generation, storage and renewal of keys; protection of sensitive data | Encryption and key management policy |
| Business continuity | Scenarios, recovery times, tests | Business continuity plan, test results |
| Service providers | Outsourcing of critical or important functions, audit rights, exit strategy, compliance of standard-form contracts | Outsourcing policy, service provider contracts, remediation plan |
| Fraud and incidents | Transaction monitoring, handling of disputes, incident management | Incident management procedure, transaction monitoring system |
The most frequent remarks
- A self-standing set-up. The Banque de France checks that the institution controls its information system and can operate on its own, even when it relies on its group or on a provider. The question arises in particular for the French subsidiary of a group whose IT is shared.
- Strong customer authentication. It examines the scope covered, the factors used, dynamic linking and the justification for each exemption.
- Keys and encryption. It asks who generates, stores and renews the keys, and how sensitive data is protected.
- Governance. It checks the allocation of responsibilities, the position of the chief information security officer (CISO), permanent and periodic control (the two levels of the French internal control framework) and the information given to senior management.
The standard-form contracts of major providers (hosting, cloud, authentication, payment solutions) do not always comply with DORA or the EBA Guidelines, and the institution often lacks the leverage to renegotiate them. The application then sets out a remediation plan: gaps identified, compensating measures, timetable. This plan may become a commitment given at the time of authorisation.
After authorisation: how does the Banque de France monitor you?
Once it has given its opinion, the Banque de France remains the institution’s point of contact on the security of its payment means.
- Monitoring of commitments. Where authorisation comes with commitments, its teams check their implementation, document by document.
- Fraud reporting. Every six months, the institution sends the Banque de France statistical data on fraud, under the EBA Guidelines issued for Article 96(6) PSD2.
- Annual risk assessment. At least once a year, the institution submits an updated assessment of its operational and security risks and of the adequacy of its mitigation measures (Article 95(2) PSD2).
- Internal control report. The annual internal control report includes an annex on the security of payment means, which reports in particular changes to the offering or to the anti-fraud set-up.
- Off-site and on-site inspections. The Banque de France may inspect the institution and its providers, ask questions and request interviews. An inspection ends with a follow-up letter (lettre de suite) that sets out the measures expected.
If a means of payment offers insufficient security, the Banque de France may recommend corrective measures to its issuer. If these recommendations have no effect, it may, after hearing the issuer, issue a negative opinion published in the Journal officiel, the French Official Journal.
ORWL Avocats assists the institution with this monitoring: plan for meeting commitments, answers to questions, preparation of on-site inspections, responses to follow-up letters.
E-money token services
Three authorities, three separate scopes
A payment institution whose business covers e-money tokens falls under three reviews. The French Monetary and Financial Code extends the Banque de France’s remit to EMTs and to asset-referenced tokens used as a means of exchange. The Banque de France assesses the security of the institution’s payment means and monitors certain points specific to EMTs. The ACPR grants authorisation and supervises digital operational resilience under DORA. Where the institution is also a CASP, the AMF (Autorité des marchés financiers, the French financial markets regulator) alone supervises the custody and transfer of crypto-assets under MiCA: the Banque de France has no role in that scope.
ORWL Avocats also qualifies your flows and organises dual status as a CASP and a payment institution: crypto-assets and payments.
Payment security and DORA: two separate reviews
Since 17 January 2025, the Digital Operational Resilience Act (DORA) has applied to payment institutions and EMIs. Directive (EU) 2022/2556 amended PSD2 accordingly: ICT risk management now falls under Chapter II of DORA. Since 20 May 2025 at the latest, the EBA Guidelines on ICT and security risk management (EBA/GL/2019/04) cover only the relationship with payment service users.
Two reviews therefore coexist:
- the Banque de France reviews the security of payment means;
- the ACPR supervises compliance with DORA: ICT risk management, incidents, resilience testing, ICT third-party service providers.
Major ICT-related incidents, including payment-related operational or security incidents, are reported under DORA. Both files rest on the same documents: security policy, continuity plan, provider contracts. The firm makes sure they say the same thing.
ORWL Avocats also assists payment institutions with their DORA compliance: register of information, ICT provider contracts, incident management, governance.
PSD3 and PSR
What changes for payment security
The package that will replace PSD2, a directive (PSD3) and a regulation (PSR), has not been adopted as at October 2026. The Council published the compromise texts on 23 April 2026; application in 2028 is likely. Under these texts:
- strong customer authentication must be available free of charge to older people, persons with disabilities and people without a smartphone;
- dynamic linking will extend to payment orders placed remotely;
- a consumer manipulated by a fraudster posing as their provider will be entitled, under conditions, to a refund of the transactions they authorised;
- transaction monitoring will become an obligation, and a failure to monitor will make the provider liable;
- an outsourcing agreement will bind the payment service provider to the technical provider that supplies or verifies the strong authentication elements;
- verification of the payee will extend to all credit transfers.
The PSR will apply directly, without transposition. Institutions will have to review their policies, contracts and complaints procedures; ORWL Avocats is already carrying out these gap analyses with its clients.
How does ORWL Avocats assist you?
- Drafting and reviewing your policies. Security policy, incident management procedure, outsourcing policy, description of strong customer authentication: the firm drafts or reviews them with your teams, against the rules and the regulator’s expectations.
- Handling the dialogue with the Banque de France and the ACPR. Answers to written questions, preparation of meetings, plan for meeting commitments, responses to follow-up letters.
- Securing your providers’ contracts. Analysis against the EBA Guidelines and DORA, negotiation, remediation plan for standard-form contracts.
The technical audit remains a matter for your teams or a cybersecurity consultancy. ORWL Avocats translates its findings into the form and language the regulator expects.
Why work with ORWL Avocats?
Since 2018, ORWL Avocats has represented payment fintechs, CASPs adding payment institution status and stablecoin players before the ACPR, the Banque de France and the AMF. The firm is ranked by Chambers FinTech and by Leaders League.
A cybersecurity consultancy assesses your systems. A lawyer brings something else: command of the regulatory exercise, a precise legal analysis of your obligations and knowledge of the issues facing the sector. Your exchanges with the lawyer are covered by legal professional privilege, and the lawyer answers for the analysis. The two contributions complement each other.
A partner leads each matter, from filing the application to the fulfilment of commitments.
Regulatory expertise at ORWL Avocats
ORWL Avocats is recognised for its expertise in payment and e-money institutions and in crypto-asset businesses. The firm also assists these institutions in obtaining their authorisation, qualifying their crypto flows, their DORA compliance and, for CASPs, their MiCA compliance.
