{"id":10319,"date":"2026-09-23T21:05:20","date_gmt":"2026-09-23T19:05:20","guid":{"rendered":"https:\/\/lerins.com\/?p=10319"},"modified":"2026-10-05T16:45:09","modified_gmt":"2026-10-05T14:45:09","slug":"analysis-business-litigation-case-law-review-september-2026","status":"publish","type":"post","link":"https:\/\/lerins.com\/en\/analysis-business-litigation-case-law-review-september-2026\/","title":{"rendered":"ANALYSIS | BUSINESS LITIGATION \u2013 Case Law Review \u2013 September 2026"},"content":{"rendered":"

ANTI-CORRUPTION<\/strong><\/h2>\n

The AFA Sanctions Commission hands down its very first financial penalty<\/strong><\/h3>\n
***<\/h6>\n
French Anti-Corruption Agency (AFA) Sanctions Commission, Decision No. 25-01, 9 July 2026, Company V. and Mr S.<\/em><\/strong><\/h6>\n
***<\/h6>\n

Ten years after the Sapin II Law, the AFA went straight to a financial penalty without first issuing a formal notice to comply, against a company and its director.<\/p>\n

Following an inspection conducted between June 2024 and July 2025, the Agency had identified seven breaches of the obligations under Article 17: an incomplete risk map, a code of conduct and disciplinary rules not enforceable in a foreign subsidiary, and inadequate third-party due diligence, accounting controls, training and internal control arrangements.<\/p>\n

Notably, the AFA referred the matter directly to the Sanctions Commission for a penalty, without first issuing a formal notice to comply, as it had done in its two previous cases.<\/p>\n

The company, which had taken corrective action between the inspection and the hearing, argued that it was now essentially compliant and sought to be discharged from the proceedings.<\/p>\n

The Commission rejected this argument: breaches are assessed as at the date of the inspection, not the date of its ruling otherwise the law would be deprived of its effect and would create unfair competition between companies that invest early in compliance and those that do not.<\/p>\n

On the allocation of liability, the director, \u00a0the group’s founder and principal shareholder, was held personally liable given his decision-making role and the length of time the legislation had been in force.<\/p>\n

Outcome: a \u20ac350,000 penalty for the company and \u20ac60,000 for its director, with anonymised publication given the sensitivity of the sector.<\/p>\n

For legal and compliance departments, the message is clear: remedial action taken after an inspection does not erase the breaches found, \u00a0it only mitigates the penalty. The timeline for rolling out an anti-corruption programme, including in foreign subsidiaries, therefore becomes a matter of evidence in its own right.<\/p>\n

\n


\nCONTRACT LAW<\/strong><\/h2>\n

Rescission of a contract during insolvency proceedings: fixing the restitution claim falls outside the jurisdiction of the trial court<\/strong><\/h3>\n
***<\/h6>\n
Cour de cassation, Commercial Chamber, 1 July 2026, No. 24-22.541, published in the Bulletin<\/em><\/strong><\/h6>\n
***<\/h6>\n

In 2017, a company entered into a finance lease agreement for software, with the hardware supplied by a third party.<\/p>\n

Citing breaches by the supplier, the lessee stopped paying rent, and the lease was terminated in 2019.<\/p>\n

The lessor sued the lessee for payment; the lessee, in turn, joined the supplier to the proceedings to seek rescission of the equipment sale contract and, as a knock-on effect, the lapse of the lease.<\/p>\n

While proceedings were ongoing, however, the supplier was placed into judicial insolvency proceedings.<\/p>\n

The Versailles Court of Appeal, having pronounced the rescission, went on to itself fix the lessor’s restitution claim in the supplier’s insolvency liabilities, at around \u20ac90,000.<\/p>\n

The Cour de cassation overturned this reasoning.<\/p>\n

It held that a restitution claim arising from the rescission \u2014 pronounced after the opening of insolvency proceedings, \u00a0of a contract entered into beforehand, for a breach other than non-payment of a sum of money, cannot benefit from the preferential treatment under Article L. 622-17 of the French Commercial Code: it was not incurred for the purposes of the proceedings, nor in consideration for services rendered during the observation period.<\/p>\n

Yet the admission of such a claim to the insolvency liabilities falls within the exclusive jurisdiction of the insolvency judge (juge-commissaire), not the trial court hearing the rescission claim.<\/p>\n

By fixing the amount of the claim itself in the insolvency liabilities, the Court of Appeal therefore exceeded its powers.<\/p>\n

Ruling on the merits without remittal, the Cour de cassation confined itself to holding that the restitution claim amounted to the sum determined by the lower courts, without ordering that it be admitted to the insolvency liabilities, that step must still take its course before the insolvency judge.<\/p>\n

In practice, this ruling calls for a clear distinction between two separate procedural stages where a contracting party becomes subject to insolvency proceedings: the action to rescind the contract, which remains within the jurisdiction of the trial court, and the admission of the resulting restitution claim, which must go through the claims verification process before the insolvency judge.<\/p>\n

Failing this, the decision is liable to be quashed, even if only in part.<\/p>\n

 <\/p>\n

\n

<\/h2>\n

Burden of proof<\/strong><\/h2>\n

Fraudulent transfers : strong authentication is not, on its own, proof of the payer’s consent<\/strong><\/h3>\n
***<\/h6>\n
Cour de cassation, Commercial Chamber, 1 July 2026, No. 25-13.134, published in the Bulletin<\/em><\/strong><\/h6>\n
***<\/h6>\n

The facts. <\/strong>A company held a business account with Cr\u00e9dit Lyonnais. To manage the account, it had signed up to an online banking agreement based on strong customer authentication: a username, a password and a physical device generating one-time codes (a \u201ctoken\u201d), entrusted to its accountant, the only employee authorised to operate the account.<\/p>\n

On 23 November 2020, three transfers were made from the account, totalling \u20ac168,338. The company maintained that it had played no part in the transactions and filed a criminal complaint. It commissioned an IT forensic report which established that, at the precise time of the transfers, neither the accountant’s nor the director’s computer was connected to the banking interface, which, in its view, showed that it could not have authorised the transactions.<\/p>\n

It also relied on a parallel criminal investigation which revealed that a bank employee had, in a separate case, misappropriated customer codes to arrange fraudulent transfers to accounts opened under false documents, \u00a0evidence, in its view, of a security failure attributable to the bank itself.<\/p>\n

The company sued the bank for restitution of the funds.<\/p>\n

The Cr\u00e9teil Commercial Court dismissed the claim in 2022, a decision upheld by the Paris Court of Appeal on 22 January 2025: the judges found that the IT records produced by the bank established the regular use of the accountant’s username, access code and token, and concluded that the transaction had been authenticated without any technical failure and that the company’s consent was presumed to have been given, in accordance with the form agreed in the contract.<\/p>\n

The Court of Appeal dismissed the argument based on the lack of any connection from the usual computers, finding that another computer could have been used with the same credentials, and likewise dismissed any link to the dishonest bank employee, who was no longer employed there at the relevant time and, according to the investigation, had no connection with the case.<\/p>\n

The Commercial Chamber overturned this reasoning, citing Articles L. 133-6, L. 133-7 and L. 133-23 of the French Monetary and Financial Code.<\/p>\n

It recalled a distinction the Court of Appeal had overlooked: proof that a transaction was duly authenticated does not relieve the bank of the additional burden of showing that the customer actually consented to it. The legislation says so explicitly: the recorded use of the payment instrument is not, on its own, sufficient to establish the payer’s authorisation.<\/p>\n

By inferring consent from the mere use of the contractual token, when the company denied having authorised the transactions and maintained that its security credentials had been misappropriated without its knowledge, the Court of Appeal reversed the burden of proof. The case was remitted to the Versailles Court of Appeal.<\/p>\n

This decision, published in the Bulletin, deprives banks of an argument they had raised almost systematically against victims of transfer fraud: the mere fact that the security device functioned properly is no longer, on its own, proof of consent. Banks will now have to produce further evidence of the customer’s genuine intent, or show gross negligence on the customer’s part\u00a0 which likewise cannot be presumed.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

ANTI-CORRUPTION The AFA Sanctions Commission hands down its very first financial penalty *** French Anti-Corruption Agency (AFA) Sanctions Commission, Decision No. 25-01, 9 July 2026, Company V. and Mr S. *** Ten years after the Sapin II Law, the AFA went straight to a financial penalty without first issuing a formal notice to comply, against […]<\/p>\n","protected":false},"author":4,"featured_media":10409,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[83],"tags":[57],"class_list":["post-10319","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-flash-news-2","tag-dispute-resolution"],"acf":[],"_links":{"self":[{"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/posts\/10319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/comments?post=10319"}],"version-history":[{"count":7,"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/posts\/10319\/revisions"}],"predecessor-version":[{"id":10444,"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/posts\/10319\/revisions\/10444"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/media\/10409"}],"wp:attachment":[{"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/media?parent=10319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/categories?post=10319"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lerins.com\/en\/wp-json\/wp\/v2\/tags?post=10319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}