Internal Banking Fraud: Towards a National Register of Fraudulent Bank Employees? (Bill No. 3032, National Assembly, 7 July 2026)

Bill No. 3032, National Assembly, tabled on 7 July 2026, aimed at strengthening the fight against internal banking fraud through the prevention of serious breaches of integrity

What does Bill No. 3032 provide regarding fraudulent bank employees?

On 7 July 2026, member of parliament Daniel Labaronne (Ensemble pour la République group) tabled at the National Assembly Bill No. 3032 “aimed at strengthening the fight against internal banking fraud through the prevention of serious breaches of integrity”. The information was revealed to the general public by MoneyVox on 10 July 2026, and reported by the trade press, notably Le Monde du Chiffre.

The central idea is simple: to create a national register of persons who have committed, in the course of their professional activity within credit institutions and finance companies, serious breaches of the ethical obligations set by their employer, where those breaches are liable to undermine the financial security of the institution or its customers. The stated aim is to make recruitment safer in the financial sector: to prevent an employee dismissed for embezzling funds at one bank from being rehired, a few months later, by a competing institution that knows nothing of their past.

Why does the legislator speak of a “persistent blind spot”?

The bill’s explanatory memorandum is unusually frank. The member of parliament describes there a “persistent blind spot” in the fight against banking fraud: “The French banking sector is faced with a surge in serious breaches of internal rules (code of ethics, internal regulations, internal procedures) committed by certain employees.” He then quantifies the phenomenon: nearly 500 serious breaches recorded in 2024, for an estimated loss of €40 million, according to data from the main banking networks themselves.

The text also describes a profile that compliance specialists know well: “Some individuals deliberately target sensitive positions in order to commit offences there and leave the company before any detection, working successively in several institutions.” Nomadic fraudsters, in short, who exploit a well-identified flaw: the current background-check tools (the criminal records processing system (traitement d’antécédents judiciaires, TAJ), extract No. 3 of the criminal record, reference checks) do not capture ethical breaches that have not led to a final criminal conviction. Yet a bank that quietly dismisses a dishonest employee, without filing a complaint in order to avoid scandal, leaves the way open for rehiring elsewhere.

Who would be entered in this national register?

The register would cover employees of credit institutions and finance companies who have committed serious breaches of their ethical obligations, as defined by their employer’s internal standards (code of ethics, internal regulations, internal procedures), where those breaches compromise the financial security of the institution or its customers. The explanatory memorandum moreover stresses that the phenomenon extends beyond the banking sector alone: “Comparable phenomena are observed in the insurance sector, social protection bodies, certain companies carrying out control or certification missions, and within administrative departments with privileged access to data or sensitive procedures.”

This text follows directly from Law No. 2025-1058 of 6 November 2025 aimed at strengthening the fight against banking fraud, which notably introduced a shared register of fraudulent IBANs. Having listed fraudsters’ accounts, the legislator is now contemplating listing… the fraudulent employees of the banks themselves. The symptom is revealing: the threat is no longer only outside the walls.

Is internal bank fraud really a growing phenomenon?

This is the question every reader is entitled to ask: does a bill alone justify speaking of a topical phenomenon? The answer lies in the press and in official reports of recent years. News items, trials and warnings from the banking supervisor draw a clear trend: internal compromise is becoming industrialised.

What does the ACPR’s July 2025 report on rebound accounts reveal?

The centrepiece of the file is an official document: the report of the Prudential Supervision and Resolution Authority (Autorité de contrôle prudentiel et de résolution, ACPR) published on 17 July 2025, devoted to preventing the “rebound accounts” used to launder the proceeds of scams. The figures, widely relayed by the press (notably Clubic), are staggering: €661 million of dubious funds passed through these accounts in 2023, with around 60% of the funds heading to accounts in Luxembourg, Lithuania or Germany, and around 70% of these accounts disappearing in less than a year.

And it is precisely this report that the explanatory memorandum of Bill No. 3032 cites: in the context of fraud involving public and social benefits, fake investments or fake online sales, the opening of rebound accounts that allow funds to be transferred beyond the reach of the authorities is facilitated by internal staff. In other words, the banking supervisor itself finds that bank employees are lending a hand to the laundering channels of the scams of which customers are victims.

Which recent cases illustrate fraud by bank employees?

Convictions of bank employees are not a mere textbook hypothesis. A few cases documented by the press are enough to be convinced.

Briançon, June 2026. A former wealth management adviser at a bank in Briançon was convicted by the criminal court (tribunal correctionnel) of abuse of weakness (abus de faiblesse) to the detriment of a 94-year-old, isolated client who had gradually entrusted her with her bank card and her everyday errands. The investigation, triggered by an anonymous letter sent to the branch management, uncovered nearly €59,000 in suspicious withdrawals and spending, including two cheques totalling €18,000 made out to the adviser. Dismissed for gross misconduct (faute grave), she was sentenced to one year’s suspended imprisonment, a €20,000 fine and approximately €51,000 in damages, as reported by Alpes 1 on 12 June 2026.

Béziers. The case is older but it illustrates exactly the flaw that the bill seeks to close. An employee of a Caisse d’Épargne branch in Béziers was sentenced to one year’s imprisonment for having embezzled approximately €670,000 from the accounts of about ten customers over three years, going so far as to open accounts in the names of some customers without their knowledge. A damning detail noted at the hearing by the defence itself: this employee had been hired by the bank while he was subject to a banking ban (interdit bancaire), and it was a competing bank, not the employer, that raised the alarm (hearing report according to Midi Libre). The bank, the sole civil party, reimbursed all the customers.

The Kiabi case, revealed in 2024. Outside the banking sector strictly speaking, but emblematic of the power of internal fraud combined with rebound accounts: the treasurer of the fashion retailer Kiabi was placed under formal investigation (mise en examen) for fraud and money laundering after orchestrating, between July 2023 and July 2024, an embezzlement of approximately €100 million by passing off her fraudulent transfers, directed to rebound accounts, as routine internal transactions (detailed account at Clubic). A single person, a sensitive position, twelve months of impunity: that is what faulty internal control allows.

Paris, March 2026. The trial of eleven defendants before the Paris criminal court, tried for a fake bank adviser fraud involving nearly €740,000 to the detriment of about a hundred victims, was a reminder of the industrial scale of these networks (MoneyVox, March 2026). Yet these networks only work thanks to one raw material: the victims’ personal and banking data. While some of this data comes from external hacking, the question of leaks of internal origin is regularly raised in these cases, as the fraudsters sometimes know the branch, the adviser and the latest transactions of their targets. In the same year, 2024, manipulation fraud alone accounted for €382 million in losses in France, according to figures relayed by the press.

Why do criminal networks infiltrate banks?

The explanatory memorandum of the bill puts it bluntly: “Fraudulent organisations increasingly seek to circumvent security systems not through external attacks, but by integrating accomplices within the very structures they target.” The logic is relentless: as strong authentication, transaction monitoring and anti-phishing systems become widespread, a frontal attack becomes more costly. The weak link then shifts to the human element: an employee in financial difficulty, a poorly supervised temp worker, an adviser with privileged access to data and procedures.

This finding matches a reality that we observe in the banking fraud cases handled by the firm: victims of fake adviser scams describe callers who know their name, their branch, their account numbers, sometimes their latest transactions. This precision does not come out of nowhere. Whether it comes from external hacking or internal leaks, it points to a failure in data protection for which the customer is never responsible.

What does internal fraud change for victim customers?

This is where the subject ceases to be a legislative curiosity and becomes a litigation argument. The official recognition, by the legislator and by the supervisor, of the scale of internal fraud shifts the balance of the debate between banks and their victim customers.

Must the bank reimburse when the fraud comes from the inside?

First scenario: the bank’s employee directly embezzles the customer’s funds, as in the Briançon and Béziers cases. The answer is clear. On the one hand, the transactions carried out by the employee without the customer’s knowledge are unauthorised payment transactions within the meaning of Articles L. 133-18 et seq. of the Monetary and Financial Code (code monétaire et financier): the bank must immediately reimburse the amounts debited without the account holder’s consent. On the other hand, the bank’s civil liability is engaged as principal (commettant) for the acts of its agent (préposé) (Article 1242, paragraph 5, of the Civil Code (code civil)): the employer answers for the damage caused by its employees in the functions in which it employs them. Case law exonerates the principal only in the narrow case of abuse of functions (abus de fonctions), and even then the agent must have acted outside the functions for which he was employed, without authorisation and for purposes foreign to his duties, three cumulative conditions that are strictly assessed. An adviser who uses his professional access, during working hours, on the accounts of his own customers is rarely in that situation.

To these grounds is added the ordinary duty of vigilance: a bank that lets dozens of atypical withdrawals flourish for years on the account of a nonagenarian client with a modest lifestyle (as in the Briançon case) is overlooking apparent anomalies in the operation of the account that a normally diligent institution should have detected. The failure to supervise its own employees, even though internal control is a regulatory obligation for credit institutions, constitutes an additional breach.

Can the bank still invoke your “gross negligence”?

Second scenario, the most frequent: the fraud is carried out by a third party (fake adviser, diverted transfer, phishing), but it was made possible or credible by internal failures: a data leak, a rebound account opened in abnormal conditions, the complicity of an employee. Faced with the reimbursement claim, banks almost systematically raise the customer’s “gross negligence” (négligence grave) (Article L. 133-19 of the Monetary and Financial Code): it is you who supposedly gave away your codes, validated the transaction, believed a caller who was too good to be true.

Yet Article L. 133-23 of the Monetary and Financial Code places the burden of proof on the bank: it is for the bank to show that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency, and it is again for the bank to prove the customer’s gross negligence, which is not presumed. In this evidentiary debate, the official recognition of internal fraud changes the argumentative landscape: how could a bank seriously maintain that the fraud necessarily stems from a fault of the customer, when the legislator finds that criminal networks are integrating accomplices “within the very structures they target”, and when the ACPR writes that the opening of rebound accounts is “facilitated by internal staff”? The “deficiency” referred to in Article L. 133-23 may be human as much as technical.

Let us add that the obligations arising from the regulatory technical standards (RTS) supplementing PSD2 (strong authentication, transaction monitoring, detection of abnormal patterns) provide a further lever, still under-used, for engaging the institution’s liability where its security systems have failed. For how to word your dispute and your complaint without harming yourself, we refer to our practical guide: Banking Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

Is this national register of fraudulent employees legally sound?

One can subscribe to the diagnosis without blindly subscribing to the remedy. In principle, anything that reduces fraud ultimately protects customers, and the firm can only welcome the official recognition of a phenomenon that victims suffer first and foremost. But the proposed mechanism raises serious questions, which parliamentary scrutiny will have to resolve.

First, the criterion for entry. The register would rest on “serious breaches” of ethical obligations set by the employer, that is, private standards (code of ethics, internal regulations), assessed by the employer itself, without a criminal conviction or even necessarily a decided employment tribunal (conseil de prud’hommes) dispute. Entering a person in a national register with the effect of professional exclusion on the sole basis of a bank’s assessment gives the employer a quasi-disciplinary power with sector-wide reach, with an obvious risk of infringing the presumption of innocence and the right to find work again. The safeguards (information of the person concerned, remedies, retention period, oversight by an independent authority) will be decisive, and the opinion of the CNIL (the French data protection authority) unavoidable for data processing of this sensitivity.

Next, the risk of abdication of responsibility. The existing registers managed by the Banque de France (FICP, FCC) show that a register is only a tool: it replaces neither internal controls nor vigilance. The Béziers case is instructive in this respect: the dishonest employee was subject to a banking ban when he was hired, information that was already in a public register, which the employer did not use. The problem was not the absence of a register but the absence of checks. It would be paradoxical for banks to rely on this future register to present themselves as diligent victims of their own employees, when internal fraud first reveals failures in their internal control, failures that customers are entitled to invoke before the court.

Finally, the scope of the text must not be overestimated at this stage: a bill that has been tabled is not an enacted law. The text will have to pass committee and then floor scrutiny, and its inclusion on the agenda is never guaranteed. It nonetheless remains a valuable document: an official, quantified finding, from the parliamentary majority, of the scale of internal fraud in French banks.

What should we take away from this bill?

Bill No. 3032 of 7 July 2026 officially records what press cases and the ACPR’s July 2025 report had already shown: internal banking fraud is a real, quantified and growing phenomenon, with 500 serious breaches and €40 million in losses for 2024 alone, not counting the internal complicity that feeds rebound accounts and fake adviser networks. For banks, it is an embarrassing admission. For fraud victims, it is an argument: the institution that refuses to reimburse by invoking your alleged negligence is the same one that, collectively, has failed to secure its own workforce. The burden of proof lies on the bank; the context, now documented at the highest level, does not argue in its favour.

The firm LE BOT Avocat acts exclusively for clients (individuals, professionals and businesses) in their disputes against banks: fraudulent transfers, fake adviser scams, embezzlement, refusals to reimburse. If you are a victim of banking fraud, every document sent to your bank counts: get support before formulating your claim.

FAQ: Frequently Asked Questions