Anti-corruption training under France's Sapin II law

Anti-corruption training under the French Sapin II law is a legal obligation. Article 17 of the law of December 9, 2016 requires large companies to put in place a training program for managers and the staff most exposed. For it to be really useful, it must prepare people for real conversations: refusing a gift, turning away an intermediary, reporting a doubt.

This article recalls what the text says, who must be trained and on what. It then offers a method for moving from training that people endure to practice that they retain. Sapin II is a French law: it applies to companies meeting its criteria in France, and this article does not transpose it to any other country.

What the Sapin II law requires regarding training

Article 17 of Law No. 2016-1691 of December 9, 2016 applies to chairs, chief executives and managing directors. Their company has at least 500 employees and revenue above 100 million euros. The assessment can be made at group level, on a consolidated basis.

These executives must implement several measures: a code of conduct, an internal whistleblowing system, a risk map, third-party assessment, accounting controls and training. The French Anti-Corruption Agency (AFA) recalls that the text requires “a training program for managers and the staff most exposed to the risks of corruption and influence peddling”.

The law sets no duration, frequency or format. It is the AFA that sets out its expectations, in recommendations published in the Journal officiel in January 2021. They do not create an obligation in themselves, but they serve as a reference during an audit.

Who must be trained: managers and exposed staff

The AFA asks for all managers to be trained, then the other employees deemed most exposed. This exposure is deduced from the corruption risk map, not from an organization chart.

The recommendations cite for example staff in contact with certain third parties, such as sales staff and buyers. They also cite those who run the anti-corruption system. They also recommend awareness-raising for all staff.

• Sales staff and account managers: gifts, invitations, requests for something in return.
• Buyers and bid managers: pressure from a supplier, an imposed intermediary.
• Finance and accounting: unusual payments, poorly justified entertainment expenses.
• Executives and managers: decisions under pressure, setting an example, receiving alerts.

The content must follow these profiles. A single module for everyone amounts to training everybody on what concerns nobody.

What the training must contain

The AFA's recommendations call for content suited to the nature of the risks, the roles performed and the geographical areas. It must be updated along with the risk map. The common core covers the code of conduct, the anti-corruption system and internal whistleblowing.

The AFA also insists on testing knowledge. Training takes place from onboarding, then regularly, throughout the period of activity.

Five situations to cover first

1. A gift or an invitation offered by a customer, a supplier or a bidder for a contract.
2. An intermediary or consultant whose compensation seems unrelated to the service provided.
3. A public official or decision-maker who hints that a “gesture” would help a file along.
4. A colleague or supervisor who asks you to bypass a purchasing procedure.
5. A doubt to flag through the whistleblowing system, or with the compliance contact.

Why an online module is not always enough

Knowing that a gift is forbidden above a threshold says nothing about how to refuse it. Facing you is a pleasant person, sometimes a longstanding customer, and a gesture that seems harmless. Refusing is a social act before it is a legal act.

A multiple-choice quiz tests recognition of the right answer. It does not test the ability to say it out loud, without causing offense, with the right wording and at the right moment. That is a different skill, and it is learned by doing it.

The risk is also the gap between proof and practice. A 100% completion rate shows that the modules were opened. It does not show that exposed staff would react correctly. We develop this point in the article on the difference between completion and competence.

Training through practice scenarios: a four-step method

Role play suits anti-corruption well, because the risky situations are conversations. The trainer starts from the risk map and chooses three or four real situations from the company.

1. Frame the scenario. Who is speaking, to whom, with what at stake? Imagine a buyer who receives, the day before a contract is awarded, an invitation from a supplier to a sporting event.
2. Play the scene out loud. The learner answers live, without notes, facing someone who insists politely.
3. Debrief. What did the learner say, word for word? Did they mention the rule, suggest an alternative, announce that they would inform their compliance contact?
4. Play again. A second attempt, with the debrief's action plan in mind, anchors the wording.

Exact phrases to make your own

A good phrase is short, warm and free of endless justification. A few examples to adapt to your policy:

• “Thank you, that's very kind, but our policy doesn't allow me to accept. I'd rather tell you frankly.”
• “I can't approve this payment without a contract and a detailed invoice. I'm passing the file to our compliance contact.”
• “I understand the urgency, but this decision goes through the purchasing procedure. I can't make an exception.”
• “I'd prefer this discussion stayed within the proper framework. I'm going to inform my manager.”

These phrases are starting points. The trainer adjusts them to the company's vocabulary, then has people say them until they come out effortlessly.

How a trainer prepares this role play with Face Up

Face Up lets the trainer write their own scenarios from their real cases, with the help of a design assistant. The learner speaks, by voice or on video, with a persona played by an AI: the friendly supplier, the longstanding customer, the colleague in a hurry.

After the session, they receive a debrief: objectives met or not, strengths, points to improve, an action plan. They find quotes of what they said. They can play again straight away. The principle is detailed on the page for Face Up role plays.

The trainer stays in control of the substance. They choose the situations from the risk map, set the expectations, and read the debriefs to spot the cases that cause difficulty in the company.

Common mistakes in anti-corruption training

• Generic content. Cases that resemble no situation experienced by the teams do not transfer.
• A single session at hiring. The AFA expects regular training, not a one-off catch-up.
• No assessment. Without a knowledge check, it is impossible to know what has been acquired.
• Silence on whistleblowing. Knowing where to report, and what happens next, is part of the system.
• Forgetting executives. Senior managers are covered by the law and set the tone.

What to keep as evidence in the event of an audit?

The AFA checks that the system is real. A company must be able to show who was trained, on what content, on what date and with what assessment. Debriefed sessions provide a more telling record than a certificate. They show what the person said, and their progress at the second attempt.

Our article on proof of training in front of the auditor details what to keep. For the code of conduct and everyday dilemmas, see also code of conduct and ethics training.

Frequently asked questions

Do all companies have to train their employees in anti-corruption?

The obligation in Article 17 applies to companies that exceed the thresholds of 500 employees and 100 million euros in revenue. Others are not bound by this text. Corruption nevertheless remains a criminal offense, and many business partners require proof of training.

What training duration does the law require?

None. The law speaks of a training program and the AFA recommends that it be suited to the risks, regular and assessed. The duration therefore depends on the exposure of each audience.

Can e-learning be enough?

It can cover basic knowledge. For the most exposed staff, the AFA asks for training suited to their risks. Practicing concrete situations meets this better than uniform content.

What happens in the event of a failure?

The AFA's sanctions committee can penalize a company or its executives when the system is not compliant. The applicable text is Article 17 of the law, which can be consulted on Légifrance.

To turn anti-corruption training into practice, start from your risk map and put your exposed teams in realistic situations. Our overview of mandatory training shows how to combine these hours with other obligations. If you want to see a role play on a case from your company, book a demo.