FRANCE Law and Practice Contributed by: Estelle Rigal-Alexandre, Marie Frisch and Mohamed Bouzenada, Soulier Bunch
In these contexts, firms must ensure that their use of blockchain-based solutions complies with applicable rules relating to outsourcing, including due diligence on service providers, contractual safeguards and ongoing monitoring of operational risks. Data Protection The interaction between blockchain technologies and data protection law, including Regulation (EU) 2016/679 (GDPR), has been significantly clarified by recent guidance from the European Data Protection Board (EDPB) in its 2025 guidelines on the process- ing of personal data through blockchain technologies. These guidelines emphasise that compliance cannot be disregarded based on technical constraints. In par- ticular, the EDPB stresses that “technical impossibil- ity” cannot justify non-compliance with data protec- tion obligations. From a structural perspective, the guidelines highlight several key challenges arising from the characteristics of blockchain systems, including their immutability, decentralisation and global accessibility. These fea- tures may conflict with core GDPR principles, in par- ticular the rights to erasure and rectification, as well as data minimisation and storage limitation principles. To address these tensions, the EDPB recommends that blockchain-based solutions be designed in accordance with the principles of privacy by design and by default. As a rule, organisations are encour- aged to avoid storing personal data directly on-chain and to rely instead on off-chain storage combined with cryptographic references. Where on-chain pro- cessing is unavoidable, additional safeguards such as encryption, hashing or advanced privacy-enhancing techniques should be implemented, although such measures do not necessarily remove the qualification of the data as personal data. The roles and responsibilities of the various actors involved in a blockchain network need to be clearly defined, in particular to determine who qualifies as a data controller or processor under the GDPR. This issue is especially complex in decentralised or per- missionless environments, where governance and decision-making may be distributed across multiple participants.
Finally, the EDPB considers that blockchain-based processing will, in many cases, require the prior con- duct of a data protection impact assessment (DPIA), given the potentially high risks for data subjects, in particular in relation to international data flows, trace- ability of transactions and long-term data persistence. Overall, while the EDPB guidelines confirm that block- chain and data protection are not inherently incompat- ible, they also make clear that compliance requires careful architectural choices and ongoing governance, and that data protection must be embedded at the design stage rather than addressed retrospectively. Anti-Money Laundering Considerations Recent enforcement actions illustrate the practical challenges associated with the use of blockchain in illicit activities, including large-scale fraud and laun- dering operations involving multiple jurisdictions and the use of decentralised infrastructures. In line with the Anti-Money Laundering Regulation (AMLR), crypto-asset service providers (CASPs) must apply customer due diligence for all occasional transactions in crypto-assets equal to or exceeding EUR1,000. Enhanced due diligence requirements also apply in specific scenarios, including: • cross-border correspondent relationships between CASPs; and • transactions involving self-hosted wallets. A 2023 report from the French Court of Auditors had highlighted significant shortcomings in the supervi- sory and enforcement frameworks applicable to AML/ CFT in the crypto-asset sector, particularly regarding the detection of unregistered providers. The October 2024 Ordinance partly responds to these concerns by strengthening oversight and compliance expecta- tions. Further, France took an additional step in June 2025 by introducing into the French Criminal Code a pre- sumption of criminal origin for any transaction car- ried out using crypto-assets that include integrated anonymisation features or that rely on any account or technology that deliberately obscures the source or destination of crypto-asset flows.
249 CHAMBERS.COM
Powered by FlippingBook