Introduction

Scope of application

Compliance program

Protection of whistleblowers

Audit and sanctions

Rules arising from the Sapin II Law

EU law

French law

Rules derived from competition law

Sapin II Law/Competition

Scope ratione personae

Scope ratione materiae

Scope

Development of plan

Measures included in plan

Inclusion in management report

Vigilance plan

Injunctions

Civil liability

Sanctions

Duty of vigilance (devoir de vigilance)

CSR programs

Reporting

Communication

Reporting and communication

Judicial sanctions

Risk to reputation, strategy and stability

Corporate Social Responsability (CSR)

Middlenext Code

IFA Corpus

AFEP - MEDEF Code

Types

Principles of governance

Principles incorporating CSR values

Principles

Comply or explain

Binding force

Private codes of conduct

Compliance

Compliance encompasses all the processes which ensure that an undertaking and its employees not only respect applicable legal standards, but also take into account broader objectives, drawing on ethical values which, while not necessarily binding in nature, respond to the public's social expectations.

The French translation of the English term “compliance”, which is “conformité”, does not really capture the concept. In effect, conformité  refers to an undertaking's strict compliance with the regulations to which it is subject. Compliance law goes further, requiring undertakings to take account of the general context in which their activities take place, both in France and abroad. Undertakings are asked to go beyond the sole pursuit of profit, and to invest “more” in human capital, the environment and relations with stakeholders  - and not just shareholders. To achieve these objectives, which are sometimes described as “monumental” , compliance law requires undertakings to set up national mechanisms to prevent and detect risks, and, if necessary, to sanction its members, to avoid their recurrence.

Compliance law today encompasses a whole range of rules that illustrate the gradual approach adopted by the legislator. At one end of the spectrum are the requirements to set up a compliance program imposed by the Sapin II Law  and competition law . These rules are still largely concerned with conformité alone - the main aim is to ensure that companies comply with the prohibition of bribery, corruption and influence peddling offenses, or anticompetitive practices - even though they require undertakings  to be creative by putting in place specific tools, rules and organization to anticipate, detect and remedy violations of the legal rule. In the middle are private codes (codes privés), a body of rules of purely voluntary application, which historically pursued good governance objectives, but which have progressively seen more societal aims added. At the other end of the scale, we find the law on due diligence called the duty of vigilance  and the disparate texts relating to corporate social responsibility (CSR), the cornerstone  of compliance and the requirement for undertakings to go beyond their own corporate goals and to take account of the negative social and environmental externalities of their activities by delegating to them the task of defining the precise rules that will enable them to operate in a socially responsible manner.

European Commission Green Paper of 18 July 2001, Promoting a European framework for Corporate Social Responsibility, COM(2001) 366 final.

FRISON-ROCHE (under the dir. of), Les buts monumentaux de la compliance , Dalloz, 2022. [The monumental goals of compliance]

Law 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernization of the economy, OJ of 10 December 2016, known as the Sapin II Law.

Competition Authority (Autorité de la concurrence) framework document of 24 May 2022 on competition compliance programs; EU Commission, Brochure "Compliance matters! 2012.

Law No 2017-399 of 27 March 2017 on the duty of vigilance of parent companies and contracting companies, OJ of 28 March 2017.

Definitions

Compliance emerged in the United States during the Great Depression of 1929. Severely affecting the banking and financial sectors, the crisis revealed the inadequacy of existing prudential systems, and confirmed the need for undertakings with the potential to trigger stock market crashes to internalize preventive tools combining self-monitoring and external control measures. In parallel, the US legislature instituted a system of criminal liability for corporate bodies, making them accountable for all offences committed by their agents in the course of their duties and for their benefit. The proliferation of rules in this area, and the severity of US case law, have gradually led to the development of national preventive programs by undertakings in all sectors, anxious to protect themselves against the risk of criminal liability. However, the courts did not immediately agree to take these efforts into account. It was not until the adoption of the Federal Sentencing Guidelines  in 1991 by the United States Sentencing Commission that the American criminal court was invited to balance incentives and sanctions.

The growth of this practice had considerable impact in France. In effect, aware of the competitive disadvantage suffered by US corporations as a result of increasingly restrictive regulations, the United States has developed an extraterritorial application of its rules, enabling it to prosecute on its own soil foreign individuals or legal entities suspected of having committed offenses even when the acts had been committed outside US territory. In 2014, a French company operating in the transport sector was fined $772 million under the USForeign Corrupt Practices Act. This colossal sum represented around 11% of the undertaking's transport sales. In 2013, another French company, operating in the energy sector, was fined $398 million, again for corruption. Finally, in 2014 and 2015, two French banks were fined a record $8.974 billion and $787 million respectively for non-compliance with international economic sanctions imposed by the United States . Faced with this risk, French undertakings have short-sightedly opted to submit to American standards and voluntarily set up private codes or compliance programs, by adopting national standards based, in particular, on the international texts and benchmarks of the UN, the OECD and other international institutions.

At the same time, under growing pressure from shareholders, employees and customers, as well as from public authorities and NGOs, undertakings have come to realize that their role cannot be limited to the pursuit of profit, but must encompass social, humanitarian and environmental concerns. By asserting their commitment to corporate social responsibility (CSR), and voluntarily entering into commitments that go beyond the regulatory and conventional requirements to which they are subject, they have gradually adopted an open mode of governance that reconciles the interests of the various stakeholders, from management to employees to outsiders, within a global approach to quality and sustainable development.

United States Sentencing Commission, Guidelines Manual. §3E1.1 (Nov. 1991).

Information report by the French National Assembly's Foreign Affairs Committee and Finance Committee on the extraterritoriality of US legislation, “Lellouche-Berger” Report 2016 (Rapport d'information de la Commission des affaires étrangères et de la Commission des finances de l'assemblée Nationale sur l'extraterritorialité de la législation américaine)

Origins and development

Initially, the French government sought to regain control over private initiatives in order to correct their shortcomings and extend their scope, using traditional techniques. Legislative intervention first addressed CSR concerns, by requiring listed companies to draw up a declaration of extra-financial performance in favor of sustainable development  and then by adopting protective rules on health, safety and working conditions for employees, requiring employers to take preventive measures  and identify risks , on penalty of incurring liability.

Then, as a signatory to various international commitments, notably on climate change and global sustainability policies, the French government found itself faced with the difficulty of enforcing them. Budgetary considerations, the fear of upsetting the business community and the need, given the objectives pursued, to adapt their application to the specific features of different sectors and companies have led it to offload this responsibility onto the latter, by assigning them general objectives and requiring them to put in place the tools needed to meet them. This privatization of regulation represents a paradigm shift for businesses. Henceforth, within a relatively weak regulatory framework , they are expected to define for themselves the mechanisms for preventing, detecting and punishing the risks that the law requires them to avoid, and to bear the colossal burden of the human and financial resources required to achieve what are described as “monumental”  goals. In addition, they have to contend with a discouraging reality given that the opinions of their own in-house counsel, who play an essential role in detecting and alerting them to deviant behavior within the company, currently enjoy no protection whatsoever, unlike lawyer-client correspondence, which is protected by legal privilege . Ultimately, this delegation of powers leaves them in a highly uncertain legal position: if they go too far, they run the risk of being subjected to public criticism for not fulfilling their obligations; if they don't do enough, they run the risk of incurring relatively uncertain sanctions, such as compliance injunctions or civil liability under the Vigilance Law.

Law 2001-420 of 15 May 2001 on new economic regulations, JORF of 16 May 2001, known as the NRE Law, and Law 2010-788 of 12 July 2010 on national commitments to the environment, JORF of 13 July 2010, known as the Grenelle II Law.

For this reason, a bill has been tabled in the Senate by Senator Louis Vogel, Sénat 2023-2024, PPL No. 126.

Labor Code, Art. L. 4121-1 and L. 4121-2, resulting from Law 91-1414 of 31 December 1991.

The Sapin II Law devotes only Article 17 to the compliance program, jnd the Vigilance Law gave rise to only one article in the Commercial Code to cover the vigilance plan, Article L. 225-102-4.

FRISON-ROCHE (under the direction of), Les buts monumentaux de la compliance, Dalloz, 2022 [The monumental goals of compliance].

Legislative techniques

Whether or not the rules of compliance are binding is another question. First of all, CSR obligations and private codes of conduct are essentially based on the “complain or explain” mechanism, which requires companies that choose to comply to do so, or to explain why they are failing to do so. Beyond that, there is no real sanction for non-compliance with these rules, unless the action is founded on ordinary civil law.

The situation is different in areas where the legislature intends to introduce regulations. In effect, the Sapin II Law imposes heavy fines on undertakings that fail to meet their obligations in the fight against corruption and influence peddling. In addition, in terms of due diligence (the duty of vigilance), a procedure is in place for issuing injunctions and holding companies civilly liable. Although the scope of this procedure is defined, it is so ill-defined that no ruling has yet been made to determine the range of penalties that may be incurred. In such a context, damage to an undertaking's brand image ("name and shame"), both in its relations with the general public and with its business partners, is perhaps more of a concern.

Compliance

1. Definitions

2. Origins and development

3. Legislative techniques

4. Normative value