Introducing the French Anti-Corruption Guidelines (4/4)
When it comes to third parties, the Guidelines deal mostly with due diligence. Surprisingly, other significant aspects of third party risk mitigation are ignored, or touched on only very lightly. In particular, don’t look in the Guidelines for recommendations on model anti-corruption contractual clauses: the topic is barely addressed. One should however note that AFA recommends that organizations, when confronted with a chain of contracts, ensure (contractually, most likely) that its “rank one” third parties perform an integrity evaluation of their own third parties.
In this context, three aspects of the Guidelines are, in my opinion, particularly noteworthy:
- AFA makes it very clear that the due diligence process should rest on an inventory of ALL third parties. AFA goes beyond the requirements of article 17 of the Sapin 2 law, by recommending a mapping of ALL third parties (i.e. not limited to clients, “rank one” suppliers and intermediaries). AFA also notes in this respect that the use of specific IT tools – such as a database or an information system – would facilitate the creation of this inventory. A 2015 survey of compliance programs at large French companies that I conducted together with EY Partner Antoinette Gutierrez-Crespin showed that in this respect a significant number of respondents were, in their own words, “nowhere”. So this is certainly one area where the Sapin 2 Law and the AFA may be expected to make a difference.
- AFA further recommends that, in their mapping of third parties, organizations identify the beneficial owners. They should, according to AFA, identify at least the first and last names, and the date of birth of their third parties’ beneficial owners, i.e. any individual or legal entity that directly or indirectly owns more than 25% of the capital or voting rights or, failing that, the person who exercises control over the governing body in the case of companies and collective investment undertakings. Article 139 of Sapin 2 Law facilitates this task for certain French companies (“sociétés commerciales, sociétés civiles, G.I .E., associations immatriculées au RCS, organismes de placement collectif”) that are now required to provide information on their own beneficial owners to the Commercial Court Registry.
- Let’s finally highlight the fact that due diligence files of third parties should, in AFA’s view, be retained for five years after the termination of the business relationship. This duration corresponds to the statute of limitation for most business, contract and tort disputes in France pursuant to Article 2224 of the Civil Code and Article L. 110-4 of the Commercial Code.
