⚖️ Responding to authorities: requisitions, garnishments, and foreign requests

Who can request what, and on what legal basis

An authority request to an account-holding institution is an order from a government agency or a court to hand over information the institution holds. In France, these requests come mainly from criminal justice authorities, the tax authority, customs, TRACFIN (France’s financial intelligence unit), and financial sector supervisors. Each channel rests on its own legal text, which sets what data may be disclosed, the response deadline, and the penalty for noncompliance. A request must therefore be assessed before it is executed. A judicial requisition, a tax authority document request, and a supervisory request look much alike. Yet they are not equally binding, do not cover the same data, and carry different penalties when the response is missing or inaccurate. French institutions’ request volumes are not published, and no consolidated statistics give even an order of magnitude.

A judicial requisition is an order by a criminal justice authority requiring a third party to hand over information that helps establish the truth. It is the most common channel. Its legal basis is Article 60-1 of the Code of Criminal Procedure in investigations of offenses in progress or just committed (flagrance), Article 77-1-1 in preliminary investigations, and Article 99-3 during a judicial investigation. It may be issued by the public prosecutor, a judicial police officer, or the investigating judge, and it also covers information drawn from data processing systems. Professional secrecy cannot be invoked against it without a legitimate reason; practical impossibility and secrecy protected by law are among those reasons. Failing to respond without undue delay is punishable by a fine of €3,750.

Banking secrecy is an institution’s duty to keep the information it holds on its customers confidential. Article L. 511-33 of the Monetary and Financial Code lists the parties to whom this secrecy does not apply, and the list is short. It includes the Autorité de contrôle prudentiel et de résolution (ACPR, France’s banking supervisor), the Banque de France (France’s central bank), the overseas note-issuing institutes, the judicial authority acting in criminal proceedings, and parliamentary committees of inquiry. Civil courts are not on it. Because the list is exhaustive, secrecy still applies to a request made in a commercial dispute or divorce proceedings, even when it arrives on letterhead that looks just as official.

Connection data covers traffic data, location data, and data identifying the source of a connection. Since 2022, it has been subject to a stricter requisition regime than other categories of information. Article 60-1-2 of the Code of Criminal Procedure, introduced by Law No. 2022-299 of March 2, 2022, sets conditions for requisitions on this data, on pain of nullity. They require a serious crime, an offense punishable by at least three years in prison, or an offense punishable by at least one year and committed by electronic communication when the requisition seeks only to identify the suspect. A payment provider keeps the IP addresses used to log in to its app. A requisition for those logs therefore falls under Article 60-1-2 and must meet one of these offense thresholds.

The right of communication (droit de communication) is a government agency’s power to obtain documents held by a third party. Customs exercises it under Article 65 of the Customs Code, which grants it to officers ranked contrôleur or above, for papers and documents of any kind. It can be exercised on site or by correspondence, including electronic correspondence, whatever the medium. It requires no prior suspicion against the person concerned. The tax authority has its own right of communication, set out in Articles L. 81 et seq. of the Tax Procedure Code. A refusal triggers the fine under Article 1734 of the General Tax Code, which the 2018 finance act raised from €5,000 to €10,000 per request. The same fine applies to destroying documents before the end of their retention period.

TRACFIN has two distinct powers, with different effects on funds. Its right of communication under Articles L. 561-25 and L. 561-26 of the Monetary and Financial Code lets it obtain the records an obliged entity keeps. Its right to block a transaction (droit d’opposition) under Article L. 561-24 goes further: it prevents the transaction from being executed for 10 business days from the date the notice is issued. The president of the Paris Judicial Court can extend that period or order the funds to be placed in escrow. The transaction remains suspended throughout, and the account holder cannot be told why.

Garnishment: immediate allocation, a regulated freeze, unequal fees

Garnishment is the procedure by which a creditor has funds that a third party holds for its debtor applied to its claim. It targets funds, whereas requisitions and rights of communication target information. Two procedures dominate in France. They differ in who the creditor is, what instrument starts them, and their timelines. Administrative third-party garnishment is used to recover public debts and is served without any prior court involvement. The saisie-attribution, a creditor’s attachment of funds, serves a private creditor holding an enforceable title, such as a court judgment, and is carried out by a commissaire de justice (a court enforcement officer). In both cases, the account-holding institution is the garnishee, with obligations, deadlines, and fee rules that differ between the two.

Administrative third-party garnishment is the enforced collection procedure available to the public collection officer (comptable public), governed by Article L. 262 of the Tax Procedure Code. The third party holding the funds immediately declares, by any means, what it owes the debtor, then pays the funds over within 30 days of receiving the notice. The notice is served on both the debtor and the third party, and the debtor’s copy must state the deadlines and avenues of appeal, on pain of nullity. The text now also covers crypto-asset service providers. They must sell the garnished assets and then remit the proceeds within deadlines set by decree, and their fees are subject to the same 10% cap, with the limit set by decree.

Failure to pay over the funds puts the third-party holder’s own assets on the line. Guidance published in the BOFiP, the tax authority’s official doctrine, notes that the collection officer then pursues the defaulting third party after obtaining a judgment from the enforcement judge, because the garnishment notice is not an enforceable title against it. A third party that fails to declare without a legitimate reason, or declares inaccurately, can be ordered to pay the debtor’s entire debt, plus damages where appropriate. The debtor, for its part, remains liable for its own debt until the collection officer has been paid. The two liabilities therefore coexist.

The saisie-attribution is the procedure available to a private creditor holding an enforceable title, governed by the Code of Civil Enforcement Procedures. Its timeline is tighter than that of administrative garnishment. Article L. 211-3 requires the garnishee to declare to the commissaire de justice, on the spot, the extent of its obligations and to provide supporting documents. The garnishment must then be served on the debtor within eight days, or it lapses, under Article R. 211-3. The debtor has one month from that service to challenge it; under Article R. 211-11, a late challenge is inadmissible.

The balance freeze is the period of unavailability that follows the garnishment, during which certain adjustments can still be posted to the account. Article L. 162-1 of the Code of Civil Enforcement Procedures sets this period at 15 business days. During that time, the funds left in the account are unavailable and the balance can still change. Checks or bills deposited before the garnishment are credited, and checks returned unpaid are debited, provided their earlier date is established. Discounted bills of exchange that go unpaid are reversed within the month following the garnishment. The amount ultimately allocated to the creditor therefore reflects these adjustments, not the balance recorded on day one.

The protected minimum balance (solde bancaire insaisissable) is a subsistence amount that remains available to an individual debtor despite the garnishment. Article L. 162-2 of the same code sets it equal to the flat-rate amount of the RSA, France’s minimum income benefit, for a single person. That amount is €651.69 as of April 1, 2026, according to the page published on service-public.gouv.fr. The bank leaves it available automatically, with no request needed from the account holder, and takes it first from demand deposit balances. It notifies the debtor without delay, along with the commissaire de justice or the collection officer handling recovery.

Bank fees for a garnishment fall under two separate regimes, depending on the procedure. Article L. 262 of the Tax Procedure Code caps fees for an administrative garnishment at 10% of the amount owed to the Treasury, up to a limit set by decree. Decree No. 2018-1118 of December 10, 2018, set that limit at €100 including VAT, effective January 1, 2019. Its title defines its scope: it covers only fees charged after a garnishment served by a public collection officer. No equivalent rule caps fees charged for a saisie-attribution.

The registers: what FICOBA knows, what it doesn’t, and how fast it updates

The national register of bank and similar accounts, known as FICOBA, lists the accounts opened in France and their holders. It is managed by the DGFiP and fed by the account-holding institutions themselves. An authority trying to find where a person holds an account queries this register before writing to any institution. Every search therefore starts from the accuracy of the reports received. When an account is missing, the search shifts to requisitions sent in bulk to institutions that don’t hold it.

The reporting obligation comes from Article 1649 A of the General Tax Code. It applies to public administrations, institutions subject to administrative supervision, and anyone who routinely accepts securities, instruments, or cash on deposit. Article 164 FB of Annex IV places the obligation on whoever actually manages the account or safe deposit box. Openings, changes, and closures of accounts of any kind must be reported, as well as safe deposit box rentals. The deadline has been shortened. Since May 1, 2025, Article 164 FC of the same annex has required reporting within seven days of the event, down from one month previously. A change of civil status or address falls under the same obligation as an opening.

What FICOBA records determines what a query can return. The register holds the institution’s identification, the account number and IBAN, the account’s nature and type, and then data on holders, authorized agents, and beneficial owners. The CNIL, France’s data protection authority, states in its public fact sheet that the register contains no information on transactions or balances. An authority that wants to see an account’s activity must therefore take a second step, through a requisition or a right of communication. The search thus runs in two stages, on two legal bases, with two different counterparties.

The information is kept for 10 full years after the account’s closure is recorded. Failures are penalized line by line. Section IV of Article 1736 of the General Tax Code sets a fine of €1,500 for each unreported opening or closure, then €150 for each omission or error, with those €150 fines capped at €10,000 for information due at the same time. An incomplete customer database therefore has two consequences: the fine under that article, and slower responses to authorities.

FICOVIE is the register of capitalization and life insurance contracts, separate from FICOBA. It is based on Article 1649 ter of the General Tax Code, created by the 2013 amending finance act, and has been operational since January 1, 2016. Institutions established in France report the opening and termination of these contracts within 60 days of the event, under Article 370 C of Annex II to the same code. Unlike FICOBA, this register includes amounts: it records cumulative premiums and surrender value from €7,500. A FICOBA query locates the account and the institution that holds it, while a FICOVIE query also reveals the sums involved.

Access to FICOBA is limited to persons authorized by law. According to the CNIL, only they consult the register, including public finance officers, judges, judicial police officers, notaries, and certain social security agencies. A judge can also grant access in an inheritance dispute or divorce proceedings. The direct access channel has changed. Since January 6, 2025, individuals who want a list of their own accounts request it on impots.gouv.fr rather than from the CNIL.

Informing the customer: when silence is a criminal law obligation

Informing the customer covers what the institution tells the account holder about an authority request that concerns them, and when. The legal basis of the request dictates this, regardless of the institution’s internal policy. Three regimes coexist in French law, and they require opposite behavior. The first prohibits any disclosure, on pain of criminal penalties. The second, by contrast, requires the debtor to be informed within a set time, and the third leaves room for judgment, exercised by the compliance function.

Silence is mandatory when the request comes from a criminal investigation. Article 434-7-2 of the Criminal Code punishes disclosure of information from an ongoing investigation or judicial inquiry by a person who learned of it through their job and under the Code of Criminal Procedure. The penalty is three years in prison and a €45,000 fine. It rises to five years and €75,000 when the disclosure is made to a person who may be involved and is meant to obstruct the investigation. It reaches seven years and €100,000 for the offenses listed in Article 706-73 of the Code of Criminal Procedure. An employee who receives a requisition learns of it through their job and is therefore covered by this offense.

The prohibition is broader still for suspicious activity. Article L. 561-18 of the Monetary and Financial Code makes the existence, content, and follow-up of a report to TRACFIN confidential. Article L. 574-1 punishes disclosure with a €22,500 fine, and it reaches beyond the report itself, since it also covers TRACFIN’s blocking power and right of communication. When a transaction is blocked for 10 business days, the customer must therefore be told without being given the reason. The constraint falls first on frontline customer service, which has to announce that funds are unavailable without being able to say why or on whose authority.

For garnishments, the law requires the debtor to be informed instead of forbidding it. Administrative garnishment is served on the debtor with the deadlines and avenues of appeal, on pain of nullity. A saisie-attribution is served on the debtor within eight days, or the measure lapses. The protected minimum balance is made available automatically, then reported without delay to the debtor as well as to the commissaire de justice or collection officer. The bank physically relays this information without being its source, and failing to act has procedural consequences.

The third regime comes from data protection law. The GDPR gives data subjects a right to information and a right of access, which Article 23 allows national law to restrict where needed to prevent and detect criminal offenses. An access request from a customer the day after a requisition therefore falls under that restriction, not under ordinary access request handling. The handling of that request is itself logged, since the institution must be able to show the reasons for refusal to the data protection authority.

Requests from abroad and the conflicts they create

A third-country authority has no direct power to issue requisitions in France. The principle is set out in Article 48 of the GDPR, which makes recognition of a decision by a third-country court or authority conditional on an international agreement, such as a mutual legal assistance treaty. The European Data Protection Board and the European Data Protection Supervisor confirmed this reading in their joint response of July 10, 2019, to the European Parliament’s LIBE Committee. However well reasoned, a request emailed by a foreign prosecutor therefore has no legal force in France. It can be executed only if an international agreement supports it or a French legal instrument takes it over.

The European Investigation Order is the instrument an authority in one EU member state uses to have an investigative measure carried out in another. Created by Directive 2014/41/EU of April 3, 2014, it was transposed into French law by Ordinance No. 2016-1636 of December 1, 2016, as Articles 694-15 et seq. of the Code of Criminal Procedure. The executing authority decides on recognition within 30 days of receipt, extendable by 30 days, then carries out the measure within 90 days of that decision. The French institution then receives a French requisition, issued under the Code of Criminal Procedure. By the time the foreign request reaches it, it has already been converted into a French legal instrument.

Regulation (EU) 2023/1543 changes this pattern for some providers. Applicable from August 18, 2026, it creates a European Production Order and a European Preservation Order, sent directly to the provider without going through an authority in the executing state. The recipient must hand over the data within 10 days, or eight hours in an emergency. The preservation order requires the data to be kept for 60 days, extendable by 30. Penalties set by member states can reach 2% of the provider’s worldwide annual revenue.

Directive (EU) 2023/1544 completes the framework by specifying who receives the orders. It requires in-scope providers to designate an establishment or a legal representative in the EU to receive them, with transposition due by February 18, 2026. An in-scope provider notifies its contact details and the official languages it accepts to the central authority of the member state where that contact point is located. Getting this designation right determines whether deadlines can be met. An order sent to the wrong recipient eats into the 10 days or eight hours the regulation allows, at the expense of the provider that must respond.

The CLOUD Act is a US law governing US authorities’ access to data held outside the country. Signed on March 23, 2018, it added 18 U.S.C. § 2713 to the Stored Communications Act, requiring a provider subject to US law to produce data in its possession, custody, or control, wherever it is stored. Under 18 U.S.C. § 2523, the US can enter into executive agreements with foreign governments; the first, with the UK, took effect on October 3, 2022. The law applies to providers of electronic communication services and remote computing services, not to banks.

A European payment provider’s exposure is therefore indirect and runs through its infrastructure providers. Application logs or backups hosted by an operator subject to US law can be demanded from that operator, without the European customer necessarily being told. The contractual response takes the form of notification clauses, encryption with customer-held keys, and data localization commitments. None of these clauses shields the operator from US law, which still applies to it. They shift the point of control to the European customer, who is either informed of the request or the sole holder of the keys, without removing the obligation on its provider.

Under French law, responding directly to a foreign authority is prohibited. Law No. 68-678 of July 26, 1968, known as the blocking statute, bans the disclosure to a foreign public authority of economic, commercial, industrial, financial, or technical documents. It covers documents intended as evidence in foreign proceedings, outside the channels set by treaty. Article 3 of the law makes the offense punishable by six months in prison and an €18,000 fine. A 2019 report to the Prime Minister by Raphaël Gauvain, a member of the National Assembly, identified only one conviction, upheld by the Criminal Chamber of the Cour de cassation, France’s highest court, on December 12, 2007. The report saw this as a symptom of a law that had gone unenforced.

Decree No. 2022-207 of February 18, 2022, gave the blocking statute an enforcement procedure. Since April 1, 2022, a company that receives a foreign request refers it to the Strategic Information and Economic Security Service (SISSE). The SISSE issues an opinion within one month on whether the blocking statute applies and which categories of documents may be disclosed. A ministerial order of March 7, 2022, sets out the practical details. The opinion can be relied on in both directions: before the foreign authority demanding the documents, and before a French court that might fault the company for complying.

• A single intake point. Requisitions, garnishments, and foreign requests arrive by mail, by fax, electronically, and sometimes at a branch. Without a single point of entry, 10-day or eight-hour deadlines are missed before anyone knows they are running.
• A written assessment before any data is extracted. The legal basis cited, the signing authority, the data categories, and the period covered are logged in a register, because they define the lawful scope of the response.
• An approved customer communication script. Silence for criminal and suspicion cases, required disclosure for garnishments, and neutral wording for a transaction on hold, with no invented reason.
• A clock for each channel. Thirty days to pay over after an administrative garnishment, eight days to serve a saisie-attribution, 15 business days of unavailability, and one month for the SISSE opinion.
• A map of where data is hosted. Knowing which payment data sits with a provider subject to an extraterritorial law is the only way to assess an exposure that the contract does not remove.
• FICOBA records reconciled with actual accounts. The gap between active and reported accounts is the metric that prevents both the fine and unnecessary requisitions.