AMF Fines Bourse Direct €850,000 Over Reporting and Market Abuse Failures
France's financial markets regulator, the Autorité des marchés financiers (AMF), has imposed total fines of €850,000 on investment services provider Bourse Direct and its chief executive, Catherine Nini, following a finding that the firm failed to meet its transaction reporting obligations and ran an ineffective market abuse detection system. The decision, dated 23 June 2026, covers conduct spanning January 2021 to November 2023. For compliance officers and accounting firms advising regulated entities across the EU, the ruling sets out precisely where automated and manual controls are expected to work together.
What the AMF Enforcement Commission Found
The Commission des sanctions, which operates with full decision-making autonomy and includes both judges and industry professionals, examined Bourse Direct's obligations under French and EU securities law. Its findings fell into two distinct areas.
Transaction Reporting Gaps
Bourse Direct failed to report to the AMF transactions originating from its own trading desk, as well as transactions executed on behalf of clients of a partner bank. The unreported volume represented approximately 0.58% of all transactions during the review period. On its own that percentage may sound modest, but regulators treat completeness of transaction reporting as a binary obligation: a firm either reports every transaction in scope or it does not.
The Commission also found that a significant proportion of the reports that Bourse Direct did submit contained incorrect trading venue identification codes. Erroneous codes undermine the regulator's ability to reconstruct trading activity across venues and markets, directly impairing post-trade surveillance at the market-wide level. This type of data quality failure is a recurring theme in AMF and ESMA supervisory findings alike.
Market Abuse Surveillance Weaknesses
The second strand of the decision focused on the firm's market abuse surveillance framework. The Commission identified three connected failures.
First, the system could not generate alerts in scenarios where a client holding inside information appeared to be liquidating positions to avoid a loss, a pattern that sits at the heart of classical insider dealing detection. Second, the framework did not adequately incorporate live financial and economic news or the specific risk profiles associated with sensitive clients. Third, and perhaps most telling from a governance perspective, Bourse Direct had itself identified the need to update the system but had not acted on that identification within a reasonable timeframe. The firm had effectively documented its own compliance gap without remedying it.
Individual Accountability: The CEO's Fine
The Commission concluded that the firm's failures were attributable to its senior leader. Catherine Nini received a personal fine of €50,000, with the company facing the larger €800,000 penalty. This individual accountability element is not new in AMF practice, but it reinforces a regulatory direction that has become increasingly prominent across the EU: senior manager responsibility is not a formality. Compliance shortcomings that persist over a multi-year period will be traced back to the individuals who held ultimate responsibility for correcting them.
Accounting firms and auditors advising investment service providers should note that this framing has direct implications for how they document management sign-off on compliance programme reviews. Independent reconciliation practices regulators now expect from firms go hand in hand with the governance trail that decisions like this one demand.
Regulatory Context and Wider EU Implications
Transaction reporting under MiFIR and market abuse obligations under MAR are not France-specific rules. They apply across the EU, and the AMF's findings reflect standards that ESMA has consistently signalled as supervisory priorities. The specific failures identified here, missing reports, venue code errors, and static surveillance systems, feature in ESMA's own annual data quality assessments of national reporting regimes.
The timing is also notable. With MiCA now in force for crypto-asset service providers and regulators actively assessing whether CASP transaction reporting meets the same rigour expected of traditional investment firms, how EU enforcement actions are reshaping compliance programmes for both traditional and digital asset entities deserves close attention.
Practical Steps for Compliance Teams
Audit Your Reporting Perimeter
The Bourse Direct case shows that reporting gaps can arise at the boundaries of a firm's business model, specifically where the firm executes on behalf of third-party clients under a white-label or correspondent arrangement. Any firm operating in more than one capacity needs a clear mapping of which transaction flows fall within its reporting obligation and which are the responsibility of another entity. That mapping should be tested against actual flows, not just assumed from contractual arrangements.
Validate Data Quality Continuously
Submitting reports containing systematic venue code errors is treated by the AMF as a substantive breach, not a minor technical issue. Firms should implement automated validation at the point of submission rather than relying on periodic reconciliation. Reference data management, keeping venue codes, instrument identifiers, and counterparty LEIs current, needs to be part of a standing operational process.
Keep Surveillance Systems Current
A market abuse system that cannot alert on insider dealing patterns around negative corporate events is not fit for purpose. Firms should review whether their surveillance scenarios cover the full spectrum of MAR-relevant behaviours, including front-running, layering, and the specific insider-liquidation pattern highlighted in this decision. Scenario libraries need to be updated when business models change, when new client types are onboarded, or when the firm's own review process flags a gap.
FAQ
The AMF found that Bourse Direct failed to report transactions from its own trading desk and transactions executed for a partner bank's clients, accounting for approximately 0.58% of total transactions during the review period. It also submitted a significant number of reports with incorrect trading venue identification codes, which impairs the regulator's ability to monitor market activity accurately.
The Commission identified three core weaknesses: the system could not flag scenarios where a client with inside information might sell securities to avoid a loss; it did not sufficiently incorporate current financial news or flag sensitive client profiles; and the firm had recognised the need to update the system but had not done so, meaning documented deficiencies were left unaddressed.
The AMF's Commission des sanctions can impose personal fines on individuals who hold managerial responsibility for a firm's compliance failures. In this case, the CEO received a €50,000 personal sanction because the Commission concluded that the firm's breaches were attributable to her management decisions. This approach is consistent with broader EU regulatory expectations around senior manager accountability.
Yes. The transaction reporting obligations derive from MiFIR, which applies directly across all EU member states, and the market abuse requirements stem from MAR, which is also an EU-wide regulation. The specific findings in this AMF decision reflect standards enforced by regulators throughout the EU, including via ESMA's supervisory coordination role.
Three priority actions stand out: first, verify that all transaction flows, including those executed for third-party clients under white-label or correspondent arrangements, fall within the correct reporting perimeter; second, run automated validation checks on venue identification codes and other reference data in existing reports; third, assess whether the firm's market abuse surveillance scenarios cover the insider-liquidation pattern highlighted in this case and update them if not.