Banking secrecy is a fundamental obligation, the basis of trust between a financial institution and its customer. This principle, protected by French law, is not absolute. The Monetary and Financial Code itself provides for specific situations in which the sharing of confidential information with a third party is authorised without the customer's consent, so as not to paralyse complex economic operations. What's more, case law has had to arbitrate conflicts where professional secrecy clashes with other fundamental rights, such as the right to evidence. Understanding these legal and judicial derogations is essential for professionals in the sector and for their clients. Our banking law firm can provide you with assistance on these issues.
Banking secrecy: foundations and scope of a protected principle
Definition and legal basis: Article L. 511-33 of the Monetary and Financial Code
Bank-client confidentiality is enshrined in article L. 511-33 of the French Monetary and Financial Code. It imposes a strict obligation of confidentiality on all persons involved in the management, administration or employment of a credit institution or finance company. This obligation covers all confidential information relating to customers: account balances, transactions (including simple transfers), assets and personal circumstances. The aim of this legal principle is to guarantee confidence, which is essential to the financial system, and to protect customers' privacy. It is a criminal offence to breach it. For a complete analysis of its mechanisms, it is useful to refer to the foundations of the banking secrecy.
The notion of 'shared secrecy': a doctrinal construction within a framework
Faced with operational realities, the notion of "shared secrecy" has emerged. The concept is based on the idea that a professional may communicate confidential information to another professional (a third party), who is himself bound to secrecy, when this transmission is essential to the completion of a transaction and serves the client's interests. Although this theory has not been enshrined as a general principle, its development largely inspired the reform of the 2008 Law on the Modernisation of the Economy (LME). The latter amended the code to include a limited list of exceptions, thereby legalising a "general principle" of the law. circulation of banking information within well-defined frameworks, in particular to facilitate economic activity.
Legal exceptions to banking secrecy: practical analysis of 7 cases (art. L.511-33 CMF)
Article L. 511-33 of the French Monetary and Financial Code lists seven categories of transactions for which credit institutions may share confidential information without obtaining the customer's prior consent. These derogations are interpreted strictly and their implementation is subject to conditions of necessity and confidentiality, with each occasion for sharing having to be justified.
1° Complex credit transactions (syndicated loans, Dailly assignments)
The first exception relates to structured finance where several institutions work together, such as syndicated loans. In such a banking consortium, a "pool" of banks grants a single loan to a company, often for very large amounts. Sharing information between the participating banks is essential to assess and monitor the overall risk at the right level. Shared secrecy" allows the loan officer and the other members of the pool to exchange the data necessary for the proper execution of the financing, with each participant itself being a third party bound by professional secrecy. This logic also applies to the assignment of trade receivables (Dailly Act), which should see a new dynamic.
2° to 7°: analysis of other cases of legal sharing (guarantees, assignments, outsourcing, etc.)
The other legal exceptions correspond to precise operational logics:
- Hedging of credit risk : a bank may share information with a third-party insurer or guarantor to cover the risk of a loan. For example, when taking out credit insurance for a personal loan.
- Acquisitions of equity interests or controlling interests : in the case of a merger-acquisition involving a financial institution, the information required for due diligence (due diligence) can be communicated to potential buyers.
- Disposal of assets or business : sharing is authorised when assets or a business belonging to the bank are sold, to enable the valuation of what is being sold.
- Assignment or transfer of receivables and contracts : This derogation is crucial for operations such as securitisation or the assignment of receivables to a collection company. The beneficiary of the assignment, the new creditor, must have access to the information in order to manage the contract.
- Essential services contracts : when a bank outsources an important function (IT, transfer card management), it can pass on the necessary information to the service provider, who becomes a "necessary confidant" but remains a third party to the main relationship.
- Intra-group transactions : the circulation of information between entities of the same group (parent company and subsidiaries) is made possible for the study or preparation of transactions, facilitating centralised risk management, a notable development since the financial crisis.
Jurisprudential derogations: when the judge can lift banking secrecy
In addition to the legal list, the courts have had to rule on situations where banking secrecy conflicts with other fundamental principles. Case law has thus created exceptions to banking secrecy, mainly in the name of the right to evidence in legal proceedings. This lifting of banking secrecy remains an exceptional measure.
Conflicting standards: right to evidence versus professional secrecy
Banking secrecy, which protects private interests, is not an absolute right. It may come into conflict with the right to evidence, a guiding principle of civil litigation that guarantees each party the right to prove the facts necessary for the success of its claim. When a litigant needs a bank document to defend his or her rights in a court case, the judge must arbitrate. The Court of Cassation, particularly its Commercial Division (see e.g. Cass. Com., 15 January 2020), has established consistent case law: bank-client confidentiality does not constitute an absolute legitimate impediment to an investigative measure ordered by a judge. This ruling and others confirm that the right to evidence is a guiding principle of legal proceedings. The evolution of case law shows a search for balance, as analysed by Lextenso in its publications on the subject.
The judge's criteria: necessity, proportionality and legitimacy of the request
To order the compulsory disclosure of a document covered by secrecy, the civil court exercises a rigorous control based on three cumulative criteria:
- The need : Production of the document must be essential to the exercise of the right to evidence. The claimant must demonstrate that he or she has no other possibility of proving his or her allegations in the disputed case.
- Proportionality : the infringement of banking secrecy must be proportionate to the aim pursued. The judge balances the interests at stake: the importance of the dispute for the claimant against the seriousness of the breach of the account holder's privacy or business confidentiality.
- Legitimacy: the objective pursued by the applicant must be legitimate. The request must not be based on mere curiosity or a delaying tactic. The separation of powers requires the judge not to interfere without good reason.
Only if these three conditions are met can the judge order the bank to disclose the document, thereby lifting secrecy for the purposes of the proceedings. All decisions are subject to appeal.
Banking secrecy and the supervisory and sanctioning authorities
In the exercise of their public interest missions, several administrative authorities have an almost unlimited right of communication that renders banking secrecy largely unenforceable. This right, which provides systematic access to information, is strictly regulated by law.
Prudential supervision: ACPR and Banque de France
The Autorité de Contrôle Prudentiel et de Résolution (ACPR), part of the Banque de France, is responsible for supervising banks and insurance companies. To guarantee the stability of the financial system and the protection of customers, it has a very extensive right of communication. The institutions subject to its supervision may not invoke professional secrecy to refuse to transmit the documents and information necessary for its supervisory mission.
The fight against money laundering: TRACFIN
As part of the fight against money laundering and terrorist financing, banks are required to report suspicions to TRACFIN (Traitement du renseignement et action contre les circuits financiers clandestins). This legal obligation to report takes precedence over banking secrecy. Failure to comply with this reporting obligation exposes the bank to severe penalties for complicity in money laundering.
Other authorities: tax, customs and AMF authorities
Other authorities also benefit from a specific right of communication. The tax authorities can obtain from banks the information they need to establish the tax base and monitor taxation, in particular to combat tax evasion and avoidance. This right of access has been strengthened under pressure from the European Union to change the practices of certain countries, including the notorious Swiss banking secrecy. Within this framework, international administrative assistance enables the exchange of information in tax matters. The customs authorities have similar prerogatives. Finally, the Autorité des Marchés Financiers (AMF) can require the transmission of information as part of its market surveillance and investor protection role.
Breach of banking secrecy: penalties, remedies and losses for customers
Sharing information outside the law or without valid consent constitutes a breach of banking secrecy. Such a breach exposes the bank to sanctions and opens the way to recourse for customers who consider themselves to have been wronged.
Penalties incurred by the bank
A bank that breaches its obligation of confidentiality is exposed to a threefold liability:
- Criminal : the disclosure of secret information by a person who is in possession of it is an offence punishable under article 226-13 of the French Penal Code. Criminal proceedings may be initiated by the client.
- Civil : the bank incurs civil liability and may be ordered to pay damages to the customer for the loss caused. Liability is assessed on a case-by-case basis.
- Disciplinary : the ACPR may impose disciplinary sanctions on the institution, ranging from a warning to substantial financial penalties. This situation directly engages the banker's liability.
Recourse and procedure for injured customers
Customers who suspect a breach of banking secrecy have several courses of action. The first step is to send a written complaint to the bank's customer service department. If this fails or if there is no response, the customer may refer the matter free of charge to the banking ombudsman, whose opinion, although not binding, may help to resolve the dispute. If mediation is unsuccessful, the customer may take legal action before the civil courts to obtain redress, often with the help of a lawyer or on the advice of a notary.
Concrete losses and compensation: what can the customer expect?
The purpose of compensation is to make good all the loss suffered by the customer. This loss may be of two kinds:
- Material loss : it corresponds to a direct financial loss caused by the disclosure of the information (for example, the loss of a market, a situation of unfair competition for a company).
- Non-material damage : it punishes damage to the customer's privacy, reputation or peace of mind. This damage is often the most significant in cases involving breaches of banking secrecy; its assessment, particularly in the case of damage to personal and family life, is left to the discretion of the trial judges.
Summary: articulation of rules and good practice
The balance between the protection of confidentiality and operational requirements calls for constant vigilance on the part of professionals and good information for customers. You need to know your rights.
Customer consent: the rule without exceptions
It is crucial to remember that legal and jurisprudential derogations remain exceptions. Apart from these specific cases, the principle remains: no information covered by confidentiality may be communicated without the express, specific and prior consent of the customer. A general and permanent authorisation in a contract would be considered invalid.
Interaction with the RGPD: dual protection
Respect for banking secrecy does not exempt us from complying with the obligations of the General Data Protection Regulation (GDPR). Any communication of information that also constitutes personal data must have a legal basis within the meaning of the GDPR, comply with the principles of minimisation and purpose, and be the subject of clear information to the data subject. Far from being in opposition, these two regimes, as explained in numerous notes (Lexbase, Lextenso), offer a double level of protection to customers, thereby respecting their privacy.
The complexity of the rules governing banking secrecy and its exceptions often makes professional analysis essential. If you are faced with a request for information or suspect a breach of your rights, the assistance of a banking lawyer is essential to assess the situation and define the strategy to adopt.
Sources
- Monetary and Financial Code, in particular article L. 511-33
- Criminal Code, in particular article 226-13
- Code of civil procedure
- Civil Code
- Regulation (EU) 2016/679 of 27 April 2016 (RGPD)
- Law no. 2008-776 of 4 August 2008 on the modernisation of the economy (LME)
EN 
FR