Crypto-Asset Investment: The Bank, as a Mere PSP, Has No Duty to Warn (Cass. com., 25 March 2026, No. 25-10.353)

French Supreme Court (Cour de cassation), Commercial, Financial and Economic Chamber, 25 March 2026, appeal No. 25-10.353, ruling No. 150 F-B, quashing

Why Was This Ruling Eagerly Awaited?

For five years, crypto-asset investment scams have been hitting an ever wider public: retirees drawn by the promise of double-digit returns, employees wanting to invest a redundancy payment, heirs who want to “make an inheritance grow”. The typical scenario is almost always the same: a fake adviser, a professional-looking platform, a foreign IBAN, and cascading transfers over several weeks. By the time the victim understands, the money has left the European Union, the fraudsters have disappeared, and only one identifiable solvent counterparty remains: the bank that executed the transfers.

Hence the question, put to the courts dozens of times since 2020: could the bank see the danger? Was it required to raise the alarm? Must it pay compensation? The lower courts long wavered. Some courts of appeal (Grenoble, Bourges, Paris) held, in specific circumstances, that the bank had breached a “duty to warn” (devoir de mise en garde) or a “duty of vigilance” (devoir de vigilance). The Commercial Chamber of the French Supreme Court, for its part, has in a few months handed down several rulings that draw a firm line. The ruling of 25 March 2026, published in the Bulletin (collection C, F-B panel), completes its consolidation.

What Were the Facts Behind the Dispute?

On 17 July 2018, a customer of a Crédit mutuel branch instructed her bank to execute three transfers from her account to an account opened with a German institution. The purpose was explicit: to make investments on the crypto-asset market. The funds were indeed transferred. The promised return never materialised; the sums were lost.

The customer sued her bank for liability, alleging a breach of a duty of vigilance and a duty to warn. She argued that the bank, as an informed professional, should have noticed the abnormal and risky nature of the transaction. Her main arguments: the number of transfers, their large amount, the fact that they represented all of her savings, the unusual nature of such transactions in the way her account was run, and the location abroad of the recipient bank.

Why Had the Court of Appeal Ordered the Bank to Pay?

The Court of Appeal of Grenoble, in its ruling of 12 November 2024, had upheld the customer’s claims. To hold the bank liable, it relied on a body of objective indicators: the number of transfers, their high amounts, the fact that they represented all of the available savings, the unusual nature of this type of transaction in the previous operation of the account, and the location in Germany of the recipient institution.

For the Grenoble court, these elements, taken together, should have drawn the bank’s attention, requiring it to warn the customer “against speculative investments”. Having failed to do so, the bank had, according to the court of appeal, breached its duties of diligence and to warn, and owed compensation on the basis of loss of a chance (perte de chance), the chance lost being, in substance, that of not contracting with the platform that was the beneficiary of the transfers.

The Grenoble reasoning reflected an intuition shared by many: between the customer’s order, seen from the outside, and the reality of a fraud orchestrated remotely, there would be a space in which the bank, through its knowledge of the financial circuit and its expertise in atypical transactions, can, and therefore must, raise its voice.

What Solution Does the Supreme Court Lay Down?

The Commercial Chamber quashes the Grenoble ruling without hesitation. It lays down the rule in a general statement of principle, citing Article 1231-1 of the Civil Code:

“It follows from Article 1231-1 of the Civil Code that a bank which receives a transfer order with a view to making an investment acts as a payment service provider and that, since it is bound not to interfere in its customer’s affairs, it owes no duty to advise or to warn as to the risks of the planned investment.”

The statement unfolds in three stages that form a quasi-syllogistic reasoning:

The Duty of Non-Interference in a Nutshell

This principle is not new. It was forged by the Commercial Chamber as early as the 1980s and has been consistently reaffirmed since. It serves a twofold objective: to protect the customer’s financial privacy, and to prevent the bank from becoming, despite itself, a judge in equity of its customer’s choices. Conversely, it also prevents the bank, save in particular cases, from holding back an order, demanding explanations or blocking a transfer solely because it “seems” risky.

Why Exclude the Duty to Warn?

The duty to warn, in French banking law, is a judge-made creation tied to very specific situations: it typically applies to the banker granting credit to an unsophisticated borrower and operates only with regard to a risk of excessive indebtedness at the time the loan is taken out. It is not a general duty to advise on the economic appropriateness of a transaction.

The ruling of 25 March 2026 recalls, implicitly but clearly, that this duty is not meant to extend to payment transactions. A bank that executes a transfer is neither an investment adviser nor a credit provider. In this situation, it receives only an order from the customer, which it is legally bound to execute provided that it is formally in order and the funds are sufficient.

What Does This Line of Case Law Say?

The ruling of 25 March 2026 does not come out of nowhere. It falls into line with an already coherent series of decisions of the Commercial Chamber. Two rulings of 1 October 2025 (appeals No. 22-23.136 and No. 24-17.306) had already refused to find a breach by the bank in very similar situations (transfers to foreign platforms presented as dedicated to investment). A few months later, on 4 February 2026 (appeal No. 24-19.196), the Commercial Chamber reiterated the position. The present ruling, handed down by a published panel and in the Bulletin, gives the principle its definitive weight.

Are There Still Cases Where the Bank Can Be Held Liable?

Yes, and that is essential. The rule laid down is not absolute; it closes one avenue, not all of them. Two grounds remain open to victims.

The Safety Net of the Apparent Anomaly

The banker’s duty of vigilance, even when released from any duty to advise, requires it to detect what a normally diligent professional could not ignore: this is the doctrine of the apparent anomaly (anomalie apparente). Where an order is tainted by a visible defect, material or intellectual (inconsistent entries, doubtful identity of the beneficiary, a manifestly fraudulent set-up), the bank cannot hide behind the duty of non-interference to execute it without further ado.

The boundary is narrow. The Commercial Chamber, in its ruling handed down the same day, 25 March 2026, on appeal No. 24-18.093, clarified that the international nature of the transfers, their large amounts, their number and the short period over which they were executed are not sufficient, taken in isolation, to constitute an apparent anomaly. In other words, the unusual is not the abnormal. The criterion remains demanding: there must be a visible and incontestable element.

The Bank That Knows: A Residual Ground

Several court of appeal rulings (CA Bourges, 12 September 2025, No. 24/00430; CA Paris, 28 May 2025, No. 24/02899; CA Riom, 22 November 2023, No. 22/00710) have held the bank liable in situations where it knew precisely the nature of the planned investment (in particular because the customer had explained the purpose of the transaction to it or because the bank had had access to elements of the file). In such cases, the duty of vigilance may, in theory, revive a duty to warn, not as to the economic appropriateness of the investment, but as to the lack of regulatory authorisation or the risks specific to the instrument.

This avenue is narrow. It requires the victim’s lawyer to establish that the bank knew and that this knowledge went beyond the mere description of the transfer. This is demanding evidentiary work, but not impossible.

What Are the Practical Consequences for Victims?

The ruling sends a clear signal, to several audiences.

For victims of crypto fraud, the “the bank should have warned me” angle is no longer enough. Building a claim for compensation against the bank requires careful positioning: demonstrating either a visible material anomaly in the order itself, or a qualified knowledge by the bank of the exact nature of the transaction.

For banking litigation lawyers, proceedings must now be focused on establishing precise facts: written exchanges with the bank, forms for sensitive transactions, internal technical systems (strong authentication and monitoring under the RTS technical regulation), anomalies in the beneficiaries or the payment references. General arguments (“the customer was retired”, “the sums were unusual”) will not stand alone. Note that the AML/CFT vigilance duty (LCB-FT), the breaches of which often feed appeals, cannot serve directly as a basis for a claim for compensation, the Supreme Court having clearly ruled it out (Cass. com., 4 March 2026, No. 24-19.588).

For banks, the ruling is not a licence for inaction. It establishes protection when they act as a strict PSP on a valid order. But as soon as an element of the file goes beyond the payment transaction (knowledge of the beneficiary platform, a monitoring system triggered, an internal alert ignored), liability may revive.

Our Critical View of the Ruling

The ruling of 25 March 2026 has been presented as the culmination of a consolidated line of case law. For the victims whom our firm defends daily, it nevertheless calls for several reservations. Three lines of criticism seem to us worth raising, not to challenge the formal rigour of the decision, but to question its choices and its scope.

A Syllogism That Sidelines Alternative Characterisations

The construction of the statement is elegant: the bank that executes an investment transfer is a “mere PSP”, so bound by non-interference, and therefore released from any duty to advise or to warn. But this syllogism takes for granted what would deserve discussion: the exclusive characterisation as a PSP.

Does a bank that executes a transfer to a platform that is known, or ought to be known, perform only a payment function? Practice contradicts this ideal model. When a customer tells their adviser, in branch or by message, that they are about to invest in a platform about which the bank has access, through its knowledge of international registers and flow-monitoring tools, to unfavourable information (listing on the AMF blacklist, internal sector alerts, earlier Tracfin reports on the same recipient IBAN), the characterisation as a mere PSP is, at the very least, partial. The Court could, without breaking with the duty of non-interference, have identified an alternative characterisation: that of an informed banker who, without having to advise, is nevertheless under an obligation to pass on information that it holds and that the customer cannot possibly have.

This reasoning would have made it possible to distinguish the situation where the bank is strictly blind (standard order, unknown IBAN, no alert) from the situation where it knows or ought to have known. The solution adopted, by its generality, treats these two situations in the same way, at the cost of an impoverishment of the reasoning.

A Scope That Weighs Exclusively on the Customer

The practical effect of the ruling is to place on the customer the whole evidentiary burden and the economic risk of the transaction. This is legally defensible where the customer is, by hypothesis, an informed investor. It is harder to sustain where the victim is, as in the case decided, a non-professional individual exposed for the first time to the crypto-asset markets and faced with a fake adviser whose true nature they do not suspect.

The informational asymmetry is not marginal: the bank has internal databases, AML/CFT watch lists, flow histories and compliance partners that are entirely beyond the customer’s reach. To refuse, as a matter of principle, any translation of this asymmetry into a duty to inform amounts to endorsing a protection of variable geometry, more favourable to institutions than to their customers. The criterion of “all of the savings”, expressly set aside by the Court, illustrates this: it nevertheless constitutes a signal that no diligent professional can, in good faith, claim not to have seen.

A Solution at Odds with the European Standard

By this ruling, French law sets itself apart from a more demanding European approach. The Payment Services Directive (PSD2) and the EBA’s technical standards require, in particular in the context of strong authentication and anti-fraud measures, heightened vigilance where the transaction departs from the customer profile. The Court of Justice of the European Union, in consumer protection matters (notably from the angle of unfair terms and pre-contractual information), tends to establish broader protection than in domestic French law.

The ruling of 25 March 2026 moves in the opposite direction to this dynamic. It consolidates a very liberal reading of the duty of non-interference, whereas European texts and CJEU case law encourage a more protective reading. It cannot be ruled out that this tension will eventually result in a preliminary reference or in a legislative development (a possible PSD3, under discussion in Brussels, could specify the standard of vigilance in risky payment transactions). For victims, this European perspective remains a lever to explore, in particular where the banker carries out cross-border PSP activities.

How Can You Protect Yourself from Crypto Fraud?

The ruling of 25 March 2026 places increased responsibility on the customer in the decision to invest. A few simple reflexes remain the best protections, and far more effective than a remedy after the event.

First reflex: check the platform’s registration. In France, every digital asset service provider (PSAN) must be registered with the AMF. The list can be consulted online; conversely, the AMF publishes a blacklist of illegal sites. No investment should be entrusted to a player that is absent from the white list or present on the blacklist.

Second reflex: be wary of promises of returns. Monthly double-digit returns without risk do not exist. The stronger the promise, the more likely the scam.

Third reflex: never entrust the management of your account or portfolio to a third party. The “adviser” who asks for access to your banking area or your wallet is a fraudster in almost every case.

Fourth reflex: realise that the bank will not step in to block a transaction authorised by you. This case law confirms it. Protection is won before the “Confirm” click.

What to Take Away and How to Act?

The ruling of 25 March 2026 locks down, for the moment, the avenue of the banker’s duty to warn in payment transactions to investment platforms. Its formal rigour should not, however, obscure the choices it makes: the choice of a one-dimensional characterisation (strict PSP), the choice of a restrictive reading of the duty of vigilance, the choice of a burden of proof borne entirely by the customer. Our firm considers these choices open to challenge: they impoverish the reasoning, ignore an informational asymmetry that is nevertheless central, and depart from the European standard of protection.

For victims, the fight is neither over nor lost: it is shifting. It is now won on more technical ground: an established apparent anomaly, qualified knowledge shown by identified exchanges, breaches of the RTS obligations arising from PSD2 (under-used in practice), irregularity of the unique identifier, reliance on European law. It is also won alongside the civil route, on criminal ground (fraud, money laundering) and through routes for recovery abroad.

If you have lost money in a crypto investment fraud, the right question is no longer just “did my bank see it coming?”. It becomes: “which elements of the file make it possible to establish a precise breach and to mobilise, alongside domestic law, the European levers still available?“. The answer almost always involves a full audit of the chronology of the transaction, the exchanges and the applicable technical systems (strong authentication, RTS monitoring). A lawyer experienced in banking litigation will be able to carry out this analysis and, where appropriate, identify the legal angles that the decision leaves intact.

FAQ: Frequently Asked Questions