On November 21, 2023, the Autorité de contrôle prudentiel et de résolution (ACPR), the agency that supervises regulated financial firms and insurance companies in France, announced its decision to reprimand Mutuelle de Poitiers Assurance (MDPA) and to impose a €600,000 fine on the company. MDPA is a multifaceted insurance company headquartered in Ligugé, France.
The process began with the publication of a report on audits conducted between September 2021 and January 2022, which led to the launching of an investigation by the ACPR on October 19, 2022. This was followed by several exchanges between MDPA and the ACPR, culminating in a hearing on October 26, 2023. The ACPR found failures in the company’s system for identifying designated persons and those against whom asset freezes were in place. Specifically, the system in place until December 2020 required an exact match with official sanctions lists, and did not take into account variations in spelling or name configuration. Even after this was corrected, the system required a positive identification of gender, which is not always included in the official description of a designated person. Moreover, MDPA’s onboarding procedures did not incorporate adequate sanctions screening, allowing the company, for example, to enter into four contracts between the 15th and the 24th of September 2021 with a company headed by a person whose assets should have been frozen. This was exacerbated by the company’s failure to implement routine screenings more frequently than once annually.
The ACPR determined that, as a consequence of these deficiencies in the MDPA’s ability to detect and prevent transactions involving sanctioned persons, the company failed promptly to inform the official responsible for overseeing contracts entered into for the benefit of sanctioned persons.
Additionally, the ACPR found that MDPA had not complied with the requirement that regulated entities maintain a system of internal controls that ensures the implementation of asset freeze measures. As noted in the decision, MDPA did not implement second-level controls until 2021. The ACPR rejected MDPA’s explanation that its system was adapted to company’s business and hence sufficient. Since 2022 the company has established a permanent second level of control.
In assessing a penalty against MDPA, the ACPR stressed the gravity of the company’s failings. At the same time, the ACPR credited MDPA with its ready and voluntary cooperation in the investigation. The ACPR also took into account the moderate size of the company, and the rising costs and diminishing returns to which it is subject.
The public reprimand of MDPA will be published for five years with the name of the company, and thereafter anonymously.