Line4

In forceBanks, investment firms, payment and e-money institutions: internal control reports (national)Last checked 11 November 2026

Annual internal control report (RCI)

A regulatory return listed by the French Prudential Supervision and Resolution Authority (Autorité de contrôle prudentiel et de résolution) (ACPR), France.

Each year banking-sector firms send the ACPR their internal control report, with an extract of the minutes of the supervisory body's deliberations. The ACPR publishes indicative templates (canevas) whose items must be covered where relevant, and an ICT risk annex for firms within DORA. Source

Official title: Rapport sur le contrôle interne (articles 258 à 264 de l'arrêté du 3 novembre 2014)

The facts

Who files
Credit institutions, financing companies, central bodies, investment firms, clearing members, account keepers and custodians, payment institutions and account information service providers, e-money institutions, financial holding companies and parents of financing companies, investment holding companies and issuers of asset-referenced tokens (instruction 2025-I-13, article 1). The ICT annex applies to entities within article 2 of DORA. Source
How often
Annual. Source
Deadline
Not stated for the report itself on the pages read. The ICT annex was due exceptionally by 30 June 2025 for 2024 and, from the following year, by 30 April after each financial year end. Source
Format
PDF, Other. Teletransmitted in office format (bureautique) under articles 12 and 13 of instruction 2025-I-13, signed by the effective managers; in 2025 the ICT annex was filed on OneGate under the report 'RCIANXAUTRE'. Source
How it is filed
Filing routes recorded for the ACPR: OneGate (Banque de France reporting portal); ACPR online survey forms; ECB CASPER (registers of information of significant institutions). See how firms file with the ACPR.
Status
In force
Legal basis
Group
Banks, investment firms, payment and e-money institutions: internal control reports (national)

Templates (3)

The tables and forms inside the return. Plain name first, the ACPR's code in brackets.

  • Internal control report template: credit institutions, financing companies and investment firms (Canevas EC-SF-EI)
  • Internal control report template: payment institutions, account information service providers and e-money institutions (Canevas EP-PSIC-EME)
  • ICT risk management annex (Annexe TIC)

2026 versions (published 26 August 2026), in French and English, Word and PDF. The templates are indicative. Credit institutions also send each year an annex on their banking inclusion work with the report; no template for it is published on the page. Source

Validation rules

No published validation rules were found for this return. Source

Public data

No published data from this return was found. No data from this return published by the ACPR was found on the pages checked. Source

Official documents (7)

The ACPR's own files, with the size and SHA-256 fingerprint of each as downloaded on 11 November 2026, so anyone can tell whether a copy is the same version.

Sources

Every page and document this return's facts were read from.

Knowing exactly what is collected, in what format and under which rules is the first step to real-time supervision. Line4 builds SupTech software for financial regulators that runs checks like these as each return arrives.

Line4's text and records here are free to reuse under CC BY 4.0. Please credit: “Source: Line4 regulatory submissions library (CC BY 4.0), https://www.line4.ai”. The regulators' documents, forms, taxonomies, rules and data belong to them: see ACPR's reuse terms. This describes what regulators publish. It is not legal or regulatory advice: always rely on the regulator's own text.

Last checked 11 November 2026.