A client taking out a mortgage at the beginning of 2024 is negotiating under very different conditions than a year earlier. The European Central Bank’s key rates have begun to decline after months of tightening, reshaping the margins of French banks and their loan offers.
At the same time, several European regulatory texts have come into effect or been adopted, imposing heavy operational requirements on institutions regarding cybersecurity, artificial intelligence, and anti-money laundering.
Credit Scoring and AI Act: What the European AI Regulation Changes for Banks
When a bank uses an algorithm to decide whether an individual gets a loan, this is referred to as automated credit scoring. Until now, the regulation of these tools remained vague. The Regulation (EU) 2024/1689, known as the AI Act, adopted in 2024 and implemented in phases until 2026, explicitly classifies personal credit scoring among high-risk uses.
In practical terms, institutions using these models must document their functioning, ensure human oversight over decisions, and establish dedicated internal governance. For compliance teams, this represents a task of mapping existing algorithms and then conducting regular audits.
You can check the banking page of News Finance to follow the evolution of these obligations over the months, as the implementation schedule spans several phases.
The stakes are not only legal. A poorly documented scoring model exposes the bank to a market entry refusal by regulatory authorities. Feedback varies on the actual maturity of French banks in facing these requirements, but regulatory pressure is now formalized.
DORA and Banking Cybersecurity: IT Vendor Management in the Spotlight
Before DORA, each bank managed its IT risks according to its own standards. The Regulation (EU) 2022/2554 (DORA), applicable from January 17, 2025, has shifted the focus. We are no longer just talking about firewalls or internal penetration tests.
The text requires financial institutions to formally oversee their critical IT service providers. Three concrete obligations stand out:
- Formalize exit plans for each strategic technology provider, to be able to migrate in case of failure or contractual breach.
- Systematically document ICT (Information and Communication Technology) incidents and report them to the relevant authorities within specified timeframes.
- Regularly test digital operational resilience, including across subcontracting chains.
For a retail bank that outsources its cloud infrastructure or payment system, DORA transforms the vendor relationship. Contracts must include audit, reversibility, and incident notification clauses. IT procurement departments now work hand in hand with compliance.
Key Rates and Bank Credit: The Concrete Effect of Disinflation in 2024
The European Central Bank began a cycle of lowering its key rates in 2024, accompanying a gradual disinflation without recession. For French banks, this turnaround has had direct consequences on their credit activity.
Net interest margins, which had inflated during the period of high rates, have gradually normalized. Banks have had to adjust their mortgage rate grids and restart loan production after a very slow year in 2023.
The drop in rates has restored purchasing power for borrowers, but not uniformly. The profiles with the best personal contributions have seen their conditions improve faster than first-time buyers, for whom debt criteria remain strict.
On the savings side, the collection on regulated savings accounts has remained strong, even though the remuneration of these products has begun to reflect the new monetary context. Banks have also pushed more for unit-linked life insurance products, taking advantage of a favorable stock market environment for part of the year.
Anti-Money Laundering: The Creation of the AMLA and the Future Harmonized Framework
The other major regulatory project adopted in 2024 concerns anti-money laundering at the European level. The legislative package voted by the European Parliament and the Council creates a unique framework (single rulebook AML) and, above all, a new supervisory authority: the AMLA, based in Frankfurt.
Implementation will be gradual, starting in 2027, with a ramp-up to direct supervision of certain cross-border banking groups. For French banks accustomed to the national framework led by the ACPR and Tracfin, this means an additional layer of control and harmonization of KYC (Know Your Customer) procedures.
Institutions operating in multiple EU countries will need to align their systems with common standards, which represents an investment in information systems and team training.
What Changes for Compliance Teams Right Now
Even though the AMLA will not be fully operational until 2027-2028, banks have an interest in anticipating. The texts adopted in 2024 already define detailed obligations. Waiting for the deadline exposes to rushed and costly compliance efforts.
The year 2024 marked an operational turning point for the French banking sector, less by a spectacular event than by the accumulation of European regulatory frameworks that are changing the daily lives of risk, compliance, and IT teams. The normalization of rates has breathed new life into credit, but the banks that will emerge strengthened from this period are those that have simultaneously addressed the AI Act, DORA, and anti-money laundering projects without waiting for the ultimate deadlines.
