Crypto Fraud and Foreign Banks: French Law May Apply (Cass. 1re civ., 11 March 2026, No. 24-19.439)

What were the facts behind the judgment of 11 March 2026?

The case pitted a French investor against two banks: a French originating bank and a Polish bank that received the funds. In 2018, the investor, approached to place money in cryptocurrencies through a company presented as a broker, made several transfers from his account opened in France to an account opened in the name of the investment company in the books of a bank established in Poland.

Once the transfers had been executed, the funds disappeared and the investor was never able to recover them. He then sued the French bank and the Polish bank jointly for liability, accusing both of failing in their monitoring and vigilance obligations.

The Polish bank, unsurprisingly, raised two objections: a plea of lack of jurisdiction, disputing that the French courts could hear an action brought against a Polish bank, and a plea of inadmissibility based on limitation, arguing that Polish law applied to the dispute.

By a judgment of 3 July 2024, the Paris Court of Appeal (cour d’appel de Paris) dismissed the plea of lack of jurisdiction (the French courts remained competent by reason of the connection with the action against the French bank) but declared the claims inadmissible on the ground that Polish law applied to the dispute and that the action was time-barred under that law.

The investor appealed on points of law on the question of the applicable law. The Polish bank lodged a conditional cross-appeal on the question of jurisdiction.

Can the foreign bank be sued before the French courts?

What does Article 8(1) of the Brussels I bis Regulation say?

The text allows a claimant to sue a defendant domiciled in another Member State before the court of the domicile of a co-defendant, provided that the actions are sufficiently connected. The rule, which derogates from the principle that everyone is judged at their place of domicile, is to be strictly interpreted.

The Court of Justice of the European Union has made clear that a mere divergence in the outcome of the disputes is not enough to conclude that judgments are irreconcilable: that divergence must also arise in the context of the same situation of fact and law (ECJ, 13 July 2006, Roche Nederland, C-539/03; ECJ, 11 October 2007, Freeport, C-98/06). But that same situation of law may exist even if the claims have different legal bases and are governed by different laws (CJEU, 21 May 2015, CDC Hydrogen Peroxide, C-352/13).

Why does the Court of Cassation dismiss the Polish bank’s cross-appeal?

The Polish bank argued that the complaints made against the French bank and the Polish bank were distinct: the former was criticised as the originating bank that had failed to detect the suspicious transaction on the French side; the latter as the receiving bank that had opened an account for a fraudulent company in Poland. In its view, the absence of the “same situation of fact and law” precluded any connection.

The First Civil Chamber rejects this argument. The court of appeal had found, in the exercise of its sovereign assessment, that the two banks had “contributed to the occurrence of the same damage”, namely the loss of the funds invested. The claims relate to the same facts and pursue identical ends: they raise the same questions on the existence of the loss, its causes, and the possible liability of each bank.

Above all, the Court of Cassation endorses a decisive line of reasoning: a foreign bank that opens in its books an account for a company receiving transfers from France that may be fraudulent could expect to be sued before the French courts. Foreseeability of the forum, a central requirement of European private international law, is satisfied.

Procedural consequence: it matters little that the actions may be governed by different laws. The connection remains and requires the French court to examine both liabilities together.

[ Investor resident in France ]
            │
            │  transfers from his account
            ▼
[ French originating bank ] ── monitoring / vigilance obligation
            │
            │  execution of the orders
            ▼
[ Foreign receiving bank ] ── account opened in the name of a fraudulent company
            │
            ▼
[ Misappropriated funds – financial loss felt in France ]

Why does the Court of Cassation overturn the court of appeal on the applicable law?

What principle does Article 4(1) of the Rome II Regulation lay down?

Article 4(1) of Regulation (EC) No. 864/2007, known as “Rome II”, provides that the law applicable to a non-contractual obligation arising out of a tort is the law of the country in which the damage occurs, irrespective of the country in which the event giving rise to the damage occurred and irrespective of the countries in which the indirect consequences of that event occur.

This rule refers to the place where the damage materialises, to be distinguished from the place of the event giving rise to the damage (the wrongful act) and from indirect consequences (the long-term repercussions of the initial damage). Determining that place is not straightforward where the loss is purely financial, for example where the misappropriated funds pass through several jurisdictions.

What does the Universal Music / Löber case law say?

The Court of Justice of the European Union, ruling initially on Article 5 of the Brussels I Regulation (now Art. 7 of Brussels I bis), accepted that the courts of the claimant’s domicile may have jurisdiction as the place where the damage materialises where the damage occurs directly in the bank account of that claimant held with a bank established within the jurisdiction of those courts (CJEU, 16 June 2016, Universal Music International Holding, C-12/15; CJEU, 12 September 2018, Löber, C-304/17).

But that jurisdiction applies only if other specific circumstances also contribute to attributing jurisdiction to the court of the place where the purely financial loss materialises. The CJEU has, in this context, identified several indicators:

• the investor was cold-called in the State of their habitual residence;
• the contract was concluded in that State or on a website targeting investors in that State;
• the investor’s direct counterparty was a company established in that State.

The First Civil Chamber, in the judgment of 11 March 2026, expressly transposes these indicators to the stage of determining the applicable law under Rome II. Recital 7 of the Rome II Regulation moreover states that its scope must be consistent with that of the Brussels Regulation. Continuity in the case law is thus ensured.

What exactly was wrong with the appeal judgment?

The court of appeal had held that the mere circumstance that “the effects of the misappropriation of the funds were felt in France”, because they were invested by means of a transfer order from an account opened in France, was insufficient to justify applying French law, in the absence of other connecting factors showing closer links.

The Court of Cassation does not disapprove, in principle, of this requirement for additional elements. But it criticises the court of appeal for having ruled without examining the circumstances in which the investment transaction was concluded and the circumstances that led the investor to make it. For lack of this concrete examination, the court of appeal did not enable the Court of Cassation to exercise its review and left its decision without a legal basis.

The scope of this quashing is considerable: the court of appeal to which the case is remitted will have to examine whether, in this case, the investor was cold-called in France, whether the contract with the investment company was concluded on a website targeting French investors, or whether his direct counterparty was established in France. A positive answer would lead to the application of French law, and therefore, in all likelihood, to a more favourable limitation and liability regime.

What criteria link the loss to France?

The judgment offers a useful analytical framework for practitioners. In terms of evidence, the following elements must be systematically established and documented in the victim’s file:

One finding should guide the evidential strategy: the court of appeal to which the case is remitted can no longer content itself with noting that the funds arrived abroad in order to infer that the damage occurred there. It must examine the overall scheme of the fraudulent transaction and the indicators of location. This is precisely the kind of detailed analysis that the victim must feed through the evidence they produce.

Why is the place where vigilance obligations are performed irrelevant?

The most subtle contribution of the judgment, and probably the most important for future disputes, appears at point 18. There the Court of Cassation states:

“The place where the bank was to perform its monitoring and vigilance obligations with regard to its own customer holding an account in its books is a circumstance relating to the event giving rise to the damage and is, therefore, irrelevant.”

The stakes are fundamental. Foreign banks usually defend themselves by arguing that their vigilance obligations (identity checks on the account holder, monitoring of incoming flows, suspicious activity reports) are performed on their territory and under their national law. They infer from this that the law of the place where these obligations are performed (and therefore their own law) must apply.

The First Civil Chamber firmly rejects this reasoning. The place where banking obligations are performed relates to the event giving rise to the damage, a category that Article 4(1) of Rome II expressly declares irrelevant. Only the place where the damage occurs counts.

For victims, this is a central argument: it becomes pointless for the foreign bank to try to move the debate into its own legal system by stressing the particularities of its compliance arrangements. The analysis must remain centred on the place where the loss materialises and on the Universal Music / Löber set of indicators.

What are the practical implications for victims of crypto fraud?

So-called “investment” frauds, whether involving cryptocurrencies, forex placements, diamonds or investment wines, almost always share the same architecture: online or telephone cold-calling in France, an attractive and apparently professional website, and a foreign IBAN to which the victim is invited to transfer their savings. Once the funds reach abroad, they are quickly dispersed through mule accounts or converted into crypto-assets.

The judgment of 11 March 2026 consolidates two essential gains.

Access to the French court is secured

By suing simultaneously their French originating bank and the foreign receiving bank, the victim can, thanks to the connection of claims under Brussels I bis, have both actions heard together in France. This strategy spares the victim from having to bring a second action in the country of the receiving bank, with the costs, delays and uncertainty that this entails.

French law is no longer out of reach

Above all, the judgment breaks a short-circuit line of reasoning that was all the rage in trial court case law: “the funds arrived abroad, so the damage is foreign, so foreign law applies, so the action is time-barred”. The court to which the case is remitted will have to examine the connecting factors in detail, and if the victim was indeed targeted from France, it is French law that will govern the foreign bank’s liability.

The limitation issue is central: the five-year French limitation period (Art. 2224 of the Civil Code (code civil)), with a floating starting point at the time the damage became known, is generally more favourable to the victim than foreign limitation periods, which are sometimes two or three years.

On which grounds of liability should one rely in practice?

The ground of appeal argued before the Court of Cassation relied, as its basis, on Directive No. 2005/60/EC of 26 October 2005 on the prevention of money laundering and terrorist financing (AML/CFT).

On this point, a word of caution is needed. By a judgment of 4 March 2026 (Cass. com., No. 24-19.588), the Commercial Chamber of the Court of Cassation held that AML/CFT obligations “have the sole purpose” of combating money laundering and do not, on their own, create a right to compensation for customers or third parties. The AML/CFT directive is therefore not, in practice, a lever for compensating the victim.

This does not leave the victim without arguments: one simply has to choose the right grounds.

In practice, disputes over the liability of the receiving bank in an international fraud scheme will usefully be built around the following grounds: tortious liability for breaches of the monitoring obligations arising from the PSD2 RTS Regulation and Directive (EU) 2015/2366; apparent anomalies in identifying the beneficial owner of the receiving account; failure to monitor incoming flows manifestly disproportionate to the declared activity of the company holding the account.

A criminal complaint and a report to Tracfin (the French financial intelligence unit) may remain useful from a factual and evidential standpoint, but do not in themselves constitute a civil basis for compensation. These steps should remain the environment of the case, not its driver.

What is the significance for banking law practice?

The judgment of 11 March 2026 sends a clear signal: the First Civil Chamber intends to align its reading of Rome II with the liberal reading it traditionally adopts on jurisdiction. The protection of the investor, where he has been cold-called and deceived from France, does not stop at the point where the funds cross the border.

For practitioners, two reflexes should now structure litigation strategy:

1. Sue the French bank and the foreign bank jointly, from the outset of the action, in order to trigger the connection mechanism and establish French jurisdiction.
2. Document from the start the indicators linking the case to France: archiving of the cold-calling, screenshots of the website, identification of the counterparty, the IBANs initially used. This evidence is the fuel for the application of French law.

The decision thus contributes, bit by bit, to rebalancing the relationship of power between victims of international fraud and the banking players that host, sometimes without sufficient care, the terminal accounts of fraudulent schemes.

Conclusion

Judgment No. 24-19.439 of 11 March 2026 does not invent a new rule: it imposes discipline on the trial courts. Determining the law applicable to the liability of a foreign bank, in a cross-border investment fraud scheme, cannot be the result of a shortcut. It requires a concrete examination of the circumstances in which the transaction was concluded and of the circumstances of the victim’s cold-calling. The indicators identified by the CJEU in Universal Music and Löber (cold-calling, place of conclusion, counterparty established in France) become the mandatory framework for this analysis.

For victims, the judgment opens a realistic procedural route: a joint action against the French bank and the foreign bank before the French court, with potential application of French law and therefore of a more protective evidential and limitation regime. It remains to mobilise the right grounds of liability (PSD2 RTS rules rather than AML/CFT) in order to turn this procedural route into an effective judgment.

FAQ: Your Questions on the Liability of the Receiving Bank