Banking liability: vigilance, warnings and advice

Three months later, a company discovered that its bank had executed a series of international transfers to a Hungarian account without batting an eyelid. A retired couple in Marseille learn that the bank that had just granted them two home loans is now criticising them for defaulting on their repayments, without ever having alerted them to a level of indebtedness that they clearly could not sustain. A business owner in difficulty sees his bank break a long-standing authorised overdraft overnight, precipitating the suspension of payments. In each of these situations, the reflex is the same: call the bank to account, invoke its liability, hope for compensation. But on what exact basis? And within what limits?

Banking liability is one of the densest areas of business law, because it is built on the borderline between three permanent tensions. Tension between customer freedom and protection of the weakest. Tension between the banker's freedom to manage and his duty to supervise. Tension between ordinary liability law and the special regimes stemming from European payment services law and the fight against money laundering. This guide sets out the current map - texts, case law, key points - as at April 2026, incorporating the rulings of the first quarter of the year, which have redistributed a number of balances.

What is the bank's responsibility to its customers based on?

In French law, there is no «statute» for bankers« liability that would be codified in a single text. What is known as »banking liability' for convenience is in fact the application of contractual liability under ordinary law to a specific profession, enriched over time by legal obligations - vigilance, warnings, advice - and governed by special regimes which, for certain transactions, replace ordinary law.

The dominant foundation is the’article 1231-1 of the Civil Code, This is the general principle of contractual liability: a debtor who fails to perform his or her obligation properly is liable to pay damages, unless he or she can prove an unrelated cause. Most bank-customer disputes arise out of contracts - account agreements, loan agreements, securities custody agreements, group insurance contracts - and the bank is required to perform its obligations with the diligence of a normally prudent professional.

Where there is no contract between the victim and the bank - in the case of an injured third party, a guarantor who is not a signatory to the main contract, or a beneficiary of a transfer who has been deceived - the basis of the claim shifts to the bank's liability.’article 1240 of the Civil Code (formerly article 1382), which governs liability in tort under ordinary law.

On the basis of this general framework, three pre-existing obligations structure banking matters. Vigilance, which requires the banker to detect apparent anomalies in the transactions it handles. Warning, which requires the credit institution to alert uninformed borrowers when the loan they are applying for presents a clear risk of excessive debt. Advice, which is rarer and more intense, arises only in special circumstances and involves the bank actively guiding its customer towards a suitable solution. Confusing the two is one of the most common mistakes in litigation - and one of the most costly.

In addition to these obligations under ordinary law, there are special regimes that may waive or limit them. The regime for unauthorised payment transactions, which stems from the European Payment Services Directive (PSD2) transposed into articles L. 133-1 et seq. of the French Monetary and Financial Code, is a closed regime: when it applies, contractual liability under ordinary law recedes. The Commercial Chamber reiterated this in a ruling of 4 March 2026 (no. 25-11.959): article 1231-1 of the Civil Code does not apply to the execution by the payment service provider of an order in accordance with the unique identifier provided by the user. There is one exception to this rule, which the Court specifically identified in the same judgment and which will be discussed in more detail below.

The system for combating money laundering and the financing of terrorism (LCB-FT), codified in articles L. 561-1 et seq. of the same code, is another separate system. It imposes on bankers a battery of enhanced due diligence obligations. But - and this is a major contribution of 2026 - these obligations do not give customers any individual right to compensation if they invoke them. We will come back to this later.

The duty of vigilance: detection without interference

The duty of vigilance is the oldest and most disputed obligation. Its canonical formulation is constant: the banker must detect apparent anomalies in the transactions he handles on behalf of his customer. The difficulty lies in the fact that he must do this without crossing the line of non-interference, which prohibits him from interfering in the management of his customers' affairs.

The Court of Cassation has reaffirmed the principle of non-interference in very broad terms. In a judgment of 14 January 2026 (no. 24-19.102, published in the Bulletin), the Commercial Chamber ruled that the bank does not have to investigate the origin and size of funds deposited in its accounts, or even to question its customer about the existence of large-scale movements, as long as these transactions appear to be regular and no indication of falsification can be detected. In other words, vigilance does not become systematic suspicion.

This crest line is tested mainly by litigation concerning fraudulent transfers. The case law oscillates, not because of indecision, but because each case is assessed on its own merits. Three recent decisions provide the best illustration of this.

In a ruling dated 2 October 2024 (no. 23-13.282, published in the Bulletin), the Commercial Chamber approved the quashing of a judgment that had exonerated the bank. The facts: a company, the victim of a chairman fraud, had seen its accountant execute several transfers to an account outside the SEPA zone, on the instructions of a swindler posing as the director. The Court ruled that on receipt of orders with apparent anomalies - unusual circumstances in which they were made, destination outside the SEPA zone, significant amount - the bank is obliged to check their regularity with the manager, the only person contractually authorised to validate them. Vigilance is therefore active: it can mean picking up the phone.

The counterpart is found in the judgment of 12 June 2025 (no. 24-10.168, published in the Bulletin). This time, the Court approved the rejection of the claim against the bank. The transfers at issue were admittedly international and for large amounts, but they remained within the agreed daily limits, the account had sufficient credit, and the destination - an account opened in a Hungarian bank, an EU member state - did not call for special attention. The Court concluded that there was no apparent anomaly. The focus has now shifted to a more stringent review of the trial judge's reasoning: in order to find that the bank was at fault, it is still necessary to characterise in concrete terms what it was about the transaction that should have raised a red flag.

Lastly, on 25 March 2026 (no. 24-18.093, published in the Bulletin), the Commercial Chamber took a further step by recalling that the banker does not have to judge the appropriateness of his customer's transactions. Large international transfers do not in themselves constitute an anomaly if they are in accordance with the customer's wishes and the account is in credit. The list of anomaly indicators is made up of a combination of circumstances: the international nature alone is not enough, the amount alone is not enough, and repetition alone is not enough. There must be a combination of factors that make the transaction «easily detectable» as abnormal.

The three judgments of 19 November 2025 (nos. 24-17.056, 24-17.780 and 24-18.534, section bench, published) consolidate this doctrine. In them, the Court reiterated, three times on the same day, that the duty of vigilance is not a general duty of control. It only requires the detection of what is obvious to a normally diligent professional. Any decision that finds the bank at fault must be based on this precise standard.

The practical lesson of these rulings, when preparing a case on the client's side, is simple: it is not enough to allege that the bank «should have seen». You have to reconstruct what a normally diligent professional would have seen, by accurately identifying the combined indicators - display of a spoofed number, destination in a high-risk country, inconsistency with the usual pattern of movements, unusual repetition, amount disproportionate to the balance usually held. For a more detailed analysis of the specific litigation surrounding fraudulent credit transfers, other fraudulent techniques and the protection afforded by article L. 133-18, see our guide to bank fraud.

Civilian vigilance and LCB-FT vigilance: two obligations that are no longer confused

A major contribution in 2026 definitively separates two obligations that litigation had long sought to confuse. In a sectional judgment of 4 March 2026 (no. 24-19.588, published in the Bulletin), the Commercial Chamber ruled that the customer due diligence obligation imposed on financial undertakings by articles L. 561-4-1 to L. 561-14-2 of the Monetary and Financial Code has the following effect only purpose of combating money laundering and the financing of terrorism. The victim of fraud cannot claim damages from the bank on the basis of non-compliance with these provisions.

This is an important solution. Prior to this ruling, plaintiffs were happy to combine the two bases, arguing that a failure to conduct AML/CFT due diligence was in itself a civil fault. The Court closes this avenue. LCB-FT vigilance is a tool of public order, placed under the control of the Autorité de contrôle prudentiel et de résolution (ACPR) and the Direction générale du Trésor. Failure to comply can result in administrative and disciplinary sanctions - for detailed information on this supervision, see our guide to the ACPR.’ACPR -It does not, however, give rise to an individual action for damages.

The practical consequence is that the bank's civil liability towards its customers remains entirely based on the duty of vigilance under ordinary law - that of the apparent anomaly. In litigation, care must be taken not to refer to articles L. 561 in support of a claim for damages: the risk is that the claim will be dismissed immediately on the basis of the judgment of 4 March 2026.

The duty to warn: alerting uninformed borrowers

Unlike vigilance, the duty to warn is a purely judicial creation - no article of the Civil Code or the Monetary and Financial Code sets it out in its own terms. It emerged in the early 2000s, was enshrined in a mixed chamber ruling in 2007, and today remains the main basis for liability claims against lending banks.

This seminal ruling, handed down on the same day as a second ruling on co-borrowers (no. 06-11.673), sets out four cardinal rules that subsequent rulings have continued to refine.

First rule: the borrower must be warned uninformed, and only to him. The assessment of whether a borrower is a "sophisticated" borrower is made on a case-by-case basis, with regard to each borrower individually. Neither age, nor socio-professional category, nor the mere fact that the borrower is the head of a company, is sufficient to characterise a sophisticated client. In the case of co-borrowers, the Court of Appeal must examine the situation of each separately; it is not permissible to presume that one spouse automatically shares the informed profile of the other.

The second rule is that a warning should only be issued in respect of a specific risk - excessive indebtedness, or a loan that is clearly unsuited to the customer's financial capabilities. The banker does not have to play the prophet: he must warn when, in the light of the information in his possession or that he should have obtained, the credit he is about to grant gives rise to a disproportionate risk. Case law clearly distinguishes this duty to warn from the duty to advise - the bank does not have to tell the customer what to do, simply to alert him to the danger of what it is going to allow him to do.

Third rule: the burden of proof lies with the bank. It is up to the bank, not the borrower, to demonstrate that it has fulfilled its obligation. In practice, this means that the bank must keep a written record - in the credit file, in the dialogue sheet, in a document specifically signed by the customer - of the information it has provided on the risks.

Fourth rule: the penalty is assessed in terms of «loss of opportunity». If the breach is established, the damages do not cover all the material loss suffered: they correspond to the probability that the customer, duly alerted, would have given up the credit or taken it out on different terms. In practice, this probability is estimated at 30, 50 or 70 % depending on the circumstances - rarely 100 %.

There are two other limitations. First, a simple breach of the duty to warn does not constitute fraud: it does not allow the loan contract to be annulled (Cass. com., 9 February 2016, no. 14-23.210). The borrower remains bound by his contractual obligations, and only obtains damages that may offset part of his debt. Next, the limitation period for the action is five years, starting on the day of the first payment incident - the moment when the customer can objectively measure the breach (Civ. 1re, 5 January 2022, no. 20-18.893). This sliding starting point is favourable to borrowers: it often postpones the foreclosure for several years after the loan was taken out.

The caution applied to the deposit

Case law extended the duty to warn to uninformed guarantors in a ruling dated 23 September 2014 (Cass. com., no. 13-18.827). The bank must alert the guarantor to the risk of indebtedness that its own commitment creates for the guarantor, in light of the guarantor's financial capacity. The ruling of 26 January 2016 (Cass. com., no. 14-23.462) stipulated that the guarantor must demonstrate the existence of this excessive risk - it is not presumed that this is the case. This block is now governed by the reform of the law on suretyship resulting from Order no. 2021-1192 of 15 September 2021; for a full description of the system, see our guide to the law on suretyship. surety bond.

A decision of the First Civil Chamber of 21 January 2026 (no. 24-10.652, published in the Bulletin) also points out that there is no obligation on a professional guarantor to verify spontaneously, before fulfilling his or her commitment, the legality of the forfeiture of the term pronounced by the lender or the calculation of the overall effective rate. The guarantor performs what it has undertaken to do; any irregularities in the principal loan remain the responsibility of the debtor or the court to which it is referred.

Limits set by recent case law

Case law 2026 has specified two important limits to the duty to warn. The first concerns investment transfers. In a ruling dated 25 March 2026 (no. 25-10.353, published in the Bulletin), the Commercial Chamber held that a bank that receives a transfer order to make an investment is acting as a payment service provider. As it is bound not to interfere, it has no duty to advise or warn about the risks of the planned investment. This solution closes a loophole that victims of investment fraud (cryptoassets, fictitious investments, online trading) were happy to use: a bank that executes a compliant and technically regular order cannot be condemned on the sole grounds that the underlying investment turned out to be fraudulent.

The second limitation concerns the statute of limitations and the burden of proof. The lower courts, encouraged by the Cour de cassation, now expect the claimant to articulate precisely the breach (what should the bank have said, and when?), the uninformed nature (demonstrated by concrete evidence of the borrower's financial situation and economic culture at the time of the loan), and the loss (calculation of the loss of opportunity). A case that is insufficiently substantiated from any of these three angles will fail.

The duty to advise: an exception, not a principle

The final obligation in this trio is the duty to advise, which is both the most intense and the most limited. It does not arise automatically from the banking relationship. The banker is not, in principle, the customer's asset management adviser, and he does not become one simply by granting a loan or opening an account.

The duty to advise only arises in three circumstances. First, the bank takes the initiative and actively proposes a transaction to the customer - an investment, a debt restructuring or a hedging operation. Taking the initiative triggers a duty of guidance that goes beyond a simple warning. Second case: the bank is entrusted with a specific mission by the customer, formalised by a mandate (discretionary management, financial investment advice governed by article L. 533-13 of the CMF). Third case: the product offered is of a technical nature or involves a particular risk - complex speculative transaction, structured product - justifying a personalised explanation (Cass. com., 7 July 2009, no. 08-18.194, for complex financial products).

Apart from these three situations, there is no general duty to provide credit advice. A bank that simply responds to a credit application has no duty to act as a financial adviser or to steer the customer towards alternative arrangements. Confusing advice with a warning is a classic mistake that a methodical defence will know how to exploit.

The aforementioned ruling of 25 March 2026 (no. 25-10.353) extends this line by applying it to investment transfers: by executing a simple payment order, the bank is under no obligation to advise or warn about the underlying transaction. The 2026 case law therefore clearly closes the door to a creeping extension of the duty to advise to all payment transactions.

Companies in difficulty: abusive support and breach of credit

Bank liability has a formidable symmetry when it comes to companies in difficulty. Providing support for too long can be harmful to other creditors (abusive support). Breaking off support too abruptly can be harmful to the business itself (abusive termination of support). French law tightened up one of these two aspects - abusive support - in 2005, and left the other - abusive termination - subject to a precise procedural rule.

Abusive support and Article L. 650-1 of the French Commercial Code

Prior to 2005, liability for abusive credit support was the mainstay of litigation between ailing companies and their banks. The Cour de cassation (French Supreme Court) had built up a system of precedent under which the bank incurred liability when it had granted or maintained credit to a company whose situation was irremediably compromised, to the detriment of other creditors deprived of their chances of recovering their debts.

The Safeguard Act of 26 July 2005 reversed this construction by introducing the’Article L. 650-1 of the French Commercial Code. The text now lays down a principle of non-liability: creditors cannot be held liable for losses suffered as a result of loans granted. The article then sets out three limited exceptions - and only three: fraud, gross interference in the management of the debtor, and manifest disproportionality of the guarantees given in return for the assistance.

The reform has considerably reduced litigation. The Court of Cassation has interpreted the three exceptions strictly: fraud presupposes intent to harm or complicity with the director; interference requires that the creditor has taken part in the effective management of the company; and the disproportionality of the guarantees is assessed objectively at the time they are set up. The classic argument - «the bank knew the situation was compromised and continued to lend» - is no longer sufficient. To situate this regime in the wider context of insolvency proceedings, see our guide to insolvency proceedings.

Abusive termination of the arrangement and Article L. 313-12 CMF

The other side of the coin is the sudden termination of a permanent contract. L’article L. 313-12 of the French Monetary and Financial Code requires bankers to give written notice when they terminate a loan other than an occasional loan granted to a company. The minimum notice period is set at sixty working days by an order dated 26 September 2005. There are two exceptions to this rule: serious misconduct on the part of the beneficiary, and an irremediably compromised situation on the part of the borrower.

The penalty for wrongful termination is the award of damages corresponding to the loss resulting from the company's inability to find an alternative solution within the timeframe it should have. Typically, this damage takes the form of a cash shortage which, in the most serious cases, can precipitate the cessation of payments. A manager who claims that this is the case must demonstrate, with supporting documents, that an alternative solution could have been found with proper notice, and that the sudden termination prevented it from being activated.

The two exceptions to notice are to be interpreted strictly. Seriously reprehensible behaviour« refers to fraudulent conduct or conduct deliberately hostile to the lender's interests - not a simple overdraft or delay in filing a balance sheet. The term »irretrievably compromised situation« implies an objective state of proven cessation of payments, the reality of which is often disputed in litigation.

Unauthorised payment transactions: the special PSD2 regime

When the dispute concerns a payment transaction - credit transfer, direct debit, card payment - the terrain changes. The European Payment Services Directive (PSD2), transposed into Articles L. 133-1 et seq. of the French Monetary and Financial Code, has created a special closed regime that replaces the ordinary law of contractual liability for these transactions.

The cardinal principle is laid down by’Article L. 133-18 of the Monetary and Financial Code In the event of an unauthorised payment transaction, the payment service provider must reimburse the payer immediately, and at the latest by the end of the first working day following receipt of the dispute. The account must be restored to the state in which it would have been had the transaction not taken place - including charges, incidental costs and debit interest.

This protective regime can only be set aside by the bank in three cases: a suspicion of fraud on the part of the payer notified to the Banque de France (a rare occurrence), gross negligence on the part of the payer within the meaning of the’article L. 133-19 IV, or the time limit for notification has expired. The last two exceptions currently account for most of the litigation.

Two rulings in 2026 clarify the contours of this. The first is the Veracash ruling, already visible in the 2025 case law. In a judgment of 14 January 2026 (no. 22-14.822, sectional judgment, published in the Bulletin), the Commercial Chamber transposed the CJEU judgment of 1 August 2025 (C-665/23) into domestic law and held that the obligation to report an unauthorised transaction «without delay» arises from the time the payer actually becomes aware of the transaction, and not from the time the debit is made. Late reporting due to gross negligence - even within the absolute time limit of thirteen months set by article L. 133-24 - deprives the payer of his right to reimbursement. The trial judge must therefore look at the date of knowledge, not just the date of the debit. The judgment of 4 February 2026 (no. 22-22.609, published in the Bulletin) draws the procedural consequence from this: a cardholder who does not prove the date on which he reported the fraudulent use will have his claim rejected.

The second ruling concerns the relationship between the DSP2 regime and ordinary law. In a decision dated 4 March 2026 (no. 25-11.959, published in the Bulletin), the Commercial Chamber ruled that, as a general rule, the contractual liability provided for in article 1231-1 of the French Civil Code does not apply to the execution by the payment service provider of an order that complies with the unique identifier provided by the user. Article L. 133-21 of the CMF closes the door to ordinary law. However, the Court has identified an exception: where the payment service provider does not simply execute the order, but drafts it itself before carrying out the transaction with the user's approval, the ordinary law reverts to its previous status. This exception is designed for cases where the bank advisor in the branch enters the order on behalf of an elderly, vulnerable or computer-illiterate customer.

The PSD2 regime alone merits a separate development, which the guide devoted to the bank fraud In this section, we will look in detail at gross negligence, strong authentication, the double burden of proof, time limits, and practical steps to be taken. We will limit ourselves here to outlining its relationship with banking liability under ordinary law.

Banking secrecy and content of the file

One final aspect of banking liability deserves a brief mention: breach of professional secrecy. Article L. 511-33 of the French Monetary and Financial Code requires bankers to maintain professional secrecy with regard to information about their customers. This secrecy is protected by a dual sanction: the criminal sanction of article 226-13 of the Criminal Code (one year's imprisonment and a fine of €15,000), and the civil sanction of damages to the injured customer, on the basis of article 1231-1 or 1240 of the Civil Code depending on the case.

On the other hand, banking secrecy has a number of limitations: it cannot be enforced against the customer himself or against his beneficiaries; it yields to certain authorities (judicial, tax, customs, Tracfin, ACPR, AMF, Banque de France, auditors); and it can be lifted with the customer's authorisation. In practice, there is less litigation concerning breaches of banking secrecy than concerning other obligations - but it does arise from time to time, particularly when a bank discloses information about a customer's financial situation to a third party (employer, ex-spouse, third-party creditor).

Holding your bank liable: method and points to watch out for

Building a banking liability action requires a rigorous method. In order, you must identify the obligation breached, characterise the breach using tangible evidence, demonstrate the loss and its causal link with the fault, and choose the appropriate legal basis. The order in which these steps are carried out is not irrelevant: a claim that is poorly framed in terms of its basis often leads to rejection, even when it could have succeeded on other grounds.

First point of reference: identify the exact nature of the obligation at stake. Vigilance? Warning? Advice? Breach of credit? Banking secrecy? Unauthorised payment? Each obligation has its own rules, evidence, time limits and penalties. The following table summarises our approach.

Second point of reference: reconstructing the chain of evidence. When it comes to vigilance, proof is provided by the production of bank documents (account history, transfer orders, technical logs), sometimes supplemented by legal expertise when computer systems are involved. As regards warnings, the onus is on the bank: it must be asked, by summons if necessary, to produce its dialogue sheet, its solvency assessment, and the documents given to the borrower - and exploit their inadequacy or absence. In the case of wrongful termination, it is necessary to prove that the credit facility exists, that it is for an indefinite period, that it is not occasional, and that there is no regular notice period.

Third point: quantify the loss. Under ordinary law, the bank compensates actual loss. In the case of warnings, the loss is a loss of opportunity, which must be precisely quantified (probability that the borrower, duly warned, would have given up or contracted differently; calculation of the loss of earnings or of the overindebtedness avoided). A case that simply alleges general moral prejudice or a round sum is rarely successful.

Fourth point: act within the time limits. The general limitation period is five years (article 2224 of the Civil Code). For the duty to warn, the starting point is the first payment incident (Civ. 1re, 5 Jan. 2022, no. 20-18.893). In the case of unauthorised payment transactions, there are two cumulative time limits: the obligation to report the transaction «without delay» from the time of knowledge, and the absolute time limit of thirteen months from the debit (article L. 133-24 CMF). The combination of the two, since the Veracash ruling, is demanding.

Fifth point: choose the appropriate procedural route. First, make a written complaint to customer services - this interrupts the statute of limitations and forces the bank to take a position. Then refer the matter to the banking ombudsman if the response is slow or unsatisfactory: the procedure is free of charge, suspends the statute of limitations and is completed within ninety days. Lastly, you can take your case to court, either in summary proceedings if the matter is urgent and cannot be contested (see L. 133-18 in particular), or on the merits in other cases.

Banking liability is a matter of balance. It does not allow customers to replay their economic choices under the guise of a banker's failure, but it does firmly sanction professionals who neglect their most basic obligations. The rulings handed down in the first quarter of 2026 are tightening the screws in both directions: more stringent requirements for characterising apparent anomalies, greater clarity on the limits of the duty to warn, and greater severity towards payers who are slow to report. This is a right where the preparation of the case counts as much as the principle invoked. Solent Avocats assists individuals and businesses with the preliminary analysis and conduct of proceedings, in order to examine a specific situation and to place this liability in the context of all areas of banking law. The page of interventions in banking and finance law describes how it works, and the guide to banking law puts it all into context.