Law No. 2025-1058 of 6 November 2025 aimed at strengthening the fight against bank fraud, Article L. 521-6-1 of the Monetary and Financial Code (code monétaire et financier), Orders of 24 April 2026, applicable from 7 May 2026.
🔑 Key Takeaways
- The FNC-RF (national file of accounts flagged for fraud risk, fichier national des comptes signalés pour risques de fraude) has, since May 2026, centralised the IBANs that banks consider suspicious. It is managed by the Banque de France.
- The file works by IBAN, without recording the account holder’s identity: the IBAN of an honest merchant can be flagged by mistake. This is the false positive.
- Direct consequence: the banks of its customers reject or suspend incoming transfers, drying up its cash flow without it being informed.
- Perverse effect: for fear of action by their own customers, some banks prefer to reject the payment, a transfer of risk onto the merchant, who has no contractual relationship with them.
- Article L. 521-6-1, IV, provides that listing does not entail “a prohibition on carrying out payment transactions“: automatic rejection is contrary to the text.
- The merchant’s weapon: an hour-to-hour interim procedure (référé d’heure à heure) before the President of the Commercial Court to put an end to the block subject to a daily penalty and to obtain an interim payment on account of compensation (Articles 872, 873 and 485 of the Code of Civil Procedure).
Table of Contents ▼
What Is the FNC-RF and How Does It Work?
Transfer fraud is soaring. According to the Banque de France’s Observatory for the Security of Payment Means, in the first half of 2025 the credit transfer became the payment method generating the most misappropriated funds (37% of the total, against 29% a year earlier), ahead of bank cards (34%) and cheques (20%). Worse still, banks immediately reimburse only a small share of the sums stolen by transfer without strong authentication.
Faced with this finding, the legislature created, by Law No. 2025-1058 of 6 November 2025, a new tool: the national file of accounts flagged for fraud risk (FNC-RF), applicable from 7 May 2026 and managed by the Banque de France, like the FICP, the FCC or the FNCI.
The FNC-RF is a national file listing the payment and deposit accounts that payment service providers (banks, payment institutions, electronic money institutions) consider likely to be fraudulent. Its purpose: to spot as quickly as possible the IBANs used in fraud schemes and to prevent the same fraudulent account from being used repeatedly.
Why Was This File Created?
Until now, no consolidated view existed: an account identified as fraudulent by one bank could continue to receive funds through another. The FNC-RF closes this gap by offering a common database to all payment service providers (PSPs), which can both consult it and feed it.
In practice, when a customer initiates a transfer to a merchant, the payer’s bank can check whether the beneficiary’s IBAN, that of the merchant, appears in the file. In the event of a match, an alert is triggered and the transaction may be suspended pending checks.
│
▼
The customer’s bank queries the FNC-RF (local copy, updated daily)
│
Merchant’s IBAN listed?
│
┌────┴─────┐
NO YES
│ │
▼ ▼
Transfer ALERT → the customer’s bank decides:
received information, checks… or REJECTION
(the merchant never receives the funds)
How Is the File Fed?
Article L. 521-6-1, I and II, of the Monetary and Financial Code and one of the Orders of 24 April 2026 specify the information transmitted: the IBAN of the suspected account, the BIC of the bank holding it, the date of detection, the category and type of fraud, the channel and source (optional), and the existence, if any, of a complaint for identity theft.
Three characteristics deserve attention:
- The account holder’s identity is not recorded. For the Banque de France, it is not necessary for the processing. The file therefore works by IBAN, not by person or by company.
- The bank makes its report “under its sole responsibility” and must make “corrective reports without delay” as soon as the grounds for suspecting fraud disappear.
- The information is kept for thirteen months from the report (or from the last corrective report).
Listing is, according to the Banque de France, mandatory: banks must list the references of suspected accounts every day, failing which they face the sanctions of Article L. 612-39 of the Monetary and Financial Code imposed by the ACPR (the French banking and insurance supervisor). The costs may never be charged to the customer.
How Is the File Consulted?
On this point, the law is sparing. Article L. 521-6-1, IV, lays down an essential guarantee: the listing of an account “does not entail a prohibition on carrying out payment transactions involving that account” and cannot on its own justify termination of the account agreement. The bank holding the account must, on the contrary, carry out “without delay all the due diligence aimed at assessing whether it is fraudulent”.
Above all, there is no obligation to consult the file for every transfer: the Banque de France rules it out and recommends a local copy synchronised at least daily. Each bank remains free to set its own rules for handling alerts. It is precisely this freedom that opens the door to false positives, and to over-blocking.
Why Can an Honest Merchant Become a “False Positive”?
A false positive is a perfectly legitimate account that the file flags (or that a bank treats) as fraudulent. For a merchant, this means that its business IBAN is marked as suspicious even though it has committed no fraud, with rejected receipts as the result.
The system suffers from several blind spots that hit first and foremost the professionals who receive transfers.
Listing Without the Business’s Knowledge
No text provides for informing the holder whose account is listed. Unlike the FICP or the FCC, the FNC-RF does not provide for any notification. The merchant discovers its listing after the fact: customers report that their transfer was refused, cash flow tightens, and the origin of the block remains invisible for a long time.
Reasoning by IBAN, Without Identity Checks
Because the holder’s identity is not recorded, the file operates on the IBAN alone. Yet a merchant can be wrongly flagged in many ways: a dissatisfied or bad-faith customer reports a payment to their bank as fraudulent; a keying error targets the wrong IBAN; an internal algorithm classes atypical activity (sales peaks, multiple receipts of small amounts) as suspicious. The risk of confusion is structural.
A Report Made “Under the Sole Responsibility” of the Bank
Listing rests on the bank’s internal systems, according to opaque criteria, without prior review by a third party or by the person concerned. A mere suspicion may suffice. Correction then depends on the goodwill of the reporting bank: if the bank does not file a corrective report, the business remains listed for up to thirteen months, an eternity for cash flow.
The Central Blind Spot: No Specific Remedy
This is the major gap. Where the FICP and the FCC provide rules on removal and information, the Law of 6 November 2025 established no specific remedy mechanism for the false positive. The merchant wrongly listed must therefore rely on ordinary law, which first requires discovering that it is listed and identifying which bank reported it.
Why Do Banks Prefer to Reject the Transfer? The Perverse Effect of Risk Transfer
This is the heart of the problem for merchants, and it stems from the banks’ risk calculation.
The Payer’s Bank’s Calculation
When a transfer is executed and then disputed as fraudulent, it is the payer’s bank that is exposed to having to reimburse its own customer in the case of an unauthorised transaction. Faced with an FNC-RF alert, some banks then make a simple trade-off: it is less risky for them to reject the transfer, even if this penalises a merchant with whom they have no contract, than to execute it and risk a claim, or even legal action, by their paying customer.
A mechanism by which a bank shifts the financial risk of a transaction onto a third party. Here, rather than bearing the risk towards its customer, the payer’s bank places it on the beneficiary merchant, who does not receive the funds and has no contractual leverage over the bank.
A Perverse and Dangerous Effect for All Merchants
This precautionary reflex, individually “rational” for each bank, produces a collectively toxic effect:
- Any business can be cut off from its receipts overnight, on the basis of a mere unverified suspicion, without having done anything.
- The merchant bears harm it did not cause: lost sales, drained cash flow, inability to pay suppliers and salaries, damage to its reputation among customers who think they are dealing with a fraudster.
- The injured third party has no contractual link with the rejecting bank: it is harder for it to obtain explanations and to take action, even though it suffers most of the damage.
- At the scale of a sector, the generalisation of precautionary rejection threatens confidence in the transfer as a professional payment method and particularly weakens very small and small and medium-sized businesses, the self-employed and young companies, for whom cash flow blocked for a few weeks can be fatal.
In other words, a tool designed to protect victims of fraud can, if misused, create a new category of victims: honest merchants. The legislature anticipated this by providing, in IV of Article L. 521-6-1, that listing entails no prohibition on making payments. It remains for banks to respect that line.
Is Rejecting a Transfer Because of the FNC-RF Lawful?
The practice of rejecting “as a precaution” runs head-on against a cardinal principle of banking law.
By virtue of the duty of non-interference (devoir de non-immixtion), the bank is not to act as judge of the appropriateness or regularity of the transactions its customer asks it to execute. It must execute valid orders without interfering in the management of the customer’s affairs.
The Text Prohibits Automatic Blocking
Article L. 521-6-1, IV, is unambiguous: listing “does not entail a prohibition on carrying out payment transactions”. The legislature intended the FNC-RF to be a tool of alert and vigilance, not a blocking tool. A bank that flatly rejects a customer’s transfer to a merchant, solely because the IBAN appears in the file, acts contrary to the law.
A Fault Towards the Paying Customer… and Towards the Merchant
By refusing to execute a valid transfer order, the payer’s bank breaches its obligation of proper execution of payment transactions (Article L. 133-22 of the Monetary and Financial Code) and interferes in its customer’s affairs, in breach of the duty of non-interference. But the heaviest damage is suffered by the beneficiary merchant, a third party to that relationship: deprived of a payment that is due to it, it may seek to hold the bank liable in tort (responsabilité délictuelle).
Vigilance ≠ Blocking
The FNC-RF complements the Verification of Payee service (VoP), mandatory since 9 October 2025 under Regulation (EU) No. 260/2012 as amended by Regulation (EU) 2024/886, which checks the match between the beneficiary’s name and IBAN. These mechanisms are intended to inform and alert the customer, not to replace the customer’s decision or to condemn a merchant without examination. The bank must warn and verify, but cannot turn a mere listing into a prohibition on paying.
What Remedies Are Available to a Merchant Wrongly Listed?
For a merchant, the stakes are not theoretical: it must put an end to the block within days and recover cash flow without waiting for a trial that will last months. The appropriate weapon exists: the interim procedure before the President of the Commercial Court (référé), if necessary hour-to-hour.
An urgent procedure which, with the judge’s authorisation, allows the opponent to be summoned to a hearing fixed at very short notice, including on public holidays or days off (Article 485 of the Code of Civil Procedure). It is the tool of choice when each day of blocking aggravates the harm.
The Right Judge: The President of the Commercial Court
The bank is a trader and the dispute relates to the professional’s commercial activity: it is the President of the Commercial Court who has jurisdiction to rule in interim proceedings (Articles 872 and 873 of the Code of Civil Procedure). In cases of extreme urgency, authorisation is sought to summon hour-to-hour (Article 485, second paragraph) in order to be heard within a few days, sometimes within a few hours.
First Request: Putting an End to the Disturbance (Immediate Unblocking)
Article 873, first paragraph, of the Code of Civil Procedure allows the President, even where there is a serious dispute, to order “such protective measures or measures to restore the previous situation as are required, either to prevent imminent damage or to put an end to a manifestly unlawful disturbance”. Yet the automatic rejection of a transfer, contrary to IV of Article L. 521-6-1, is precisely a manifestly unlawful disturbance and imminent damage (drained cash flow). The merchant can therefore ask the judge to order the bank:
- to execute the rejected transfers and lift the block;
- and/or to file without delay a corrective report in order to remove the IBAN from the file;
- all subject to a daily penalty (astreinte) (Article L. 131-1 of the Code of Civil Enforcement Procedures), that is, a sum for each day of delay, to compel the bank to comply quickly.
Second Request: An Interim Payment on Account of Compensation (Référé-Provision)
This is the decisive contribution for cash flow. Article 873, second paragraph, authorises the President, “in cases where the existence of the obligation is not seriously contestable”, to grant an interim payment to the creditor. The merchant can thus obtain, without waiting for the trial on the merits, an advance on compensation for its harm (lost sales, overdraft charges, penalties incurred towards third parties, damage to its image). The condition: an obligation that is not seriously contestable, that is, a manifest fault by the bank (rejection contrary to the text) and quantified and documented harm.
Building a Solid Evidence File
The success of the interim application depends on the quality of the documents: statements showing the rejected transfers, reasons given by the banks, exchanges with the institution and with customers, and a precise quantification of the harm. The more manifest the unlawfulness and the better documented the harm, the more unblocking under a daily penalty and the interim payment are within reach. It is useful, beforehand, to require the bank to justify its due diligence: IV requires it to carry out “all the due diligence aimed at assessing the fraudulent nature” of the account; a purely automatic block, without genuine verification, directly supports the demonstration of fault.
In Addition to the Interim Procedure
- Prior formal notice to the reporting bank to file the corrective report (Article L. 521-6-1, II): sometimes sufficient, and always useful for the interim file.
- Report to the ACPR: failure to comply with the Orders of 24 April 2026 exposes the bank to the sanctions of Article L. 612-39 of the Monetary and Financial Code. A regulatory pressure lever, without individual compensation.
- Action on the merits for definitive compensation, beyond the interim payment: contractual liability against one’s own bank (Article 1231-1 of the Civil Code) or liability in tort against the third-party bank that rejects (Article 1240 of the Civil Code).
Conclusion
The FNC-RF is a useful tool against fraud, but its architecture (listing by IBAN, without information or organised remedy, and with freedom left to banks) places a real risk on honest businesses. The reflex of some banks, which reject as a precaution so as not to risk a lawsuit from their customer, creates a dangerous transfer of risk onto merchants, a perverse effect that can hit any business. The law has nevertheless drawn a clear line: listing is not a prohibition on paying. Any bank that turns an alert into an automatic block risks being held liable.
If your customers see their transfers refused and you suspect a listing in the FNC-RF, do not suffer in silence: the listing can be corrected and the harm compensated, urgently if necessary before the President of the Commercial Court. The firm LE BOT Avocat, dedicated to banking law and to defending professionals against banks, can analyse your situation and take the appropriate steps.
