Skip to content
Message important   Fermer

Fraude auprès de la Direction Générale des Finances publiques – ALERTE ET VIGILANCE

La Direction Générale des Finances publiques (DGFiP) vient d’alerter tous les établissements bancaires français, sur le fait qu’elle a identifié des accès illégitimes au fichier national des comptes bancaires (FICOBA).

A compter de la fin janvier 2026, un acteur malveillant, qui a usurpé les identifiants d’un fonctionnaire disposant d’accès dans le cadre de l’échange d’information entre ministères, a pu consulter une partie de ce fichier qui recense l'ensemble des comptes bancaires ouverts dans les établissements bancaires français et contient des données à caractère personnel : coordonnées bancaires (RIB / IBAN), identité du titulaire, adresse et, dans certains cas, l'identifiant fiscal de l'usager.

Dès la détection de cet incident, des mesures immédiates de restriction d'accès ont été mises en œuvre par la Direction Générale des Finances publiques afin de stopper l’attaque, de limiter l’ampleur des données consultées.

La Direction Générale des Finances publiques a également informé les établissements bancaires français que, dans les prochains jours, les usagers concernés recevront une information individuelle les alertant qu’un accès à leurs données a pu être constaté.


Même dans le cas où vous ne seriez pas concernés, nous tenons donc à vous alerter et rappeler les mesures de vigilance à adopter :

L'administration fiscale ne vous demande jamais vos identifiants ou votre numéro de carte bancaire par message. Même si l'expéditeur semble être un interlocuteur de la DGFiP, contactez directement votre service des impôts via la messagerie sécurisée de votre espace ou par téléphone afin de vérifier l'authenticité du message reçu ;

Pour mémoire, que vous soyez particulier, entrepreneur, entreprise, jamais votre banquier ne vous demandera vos codes, identifiants, mots de passe. Que cela soit par téléphone, à distance ou physiquement. Il n’en a pas besoin. Nous vous rappelons les mesures de sécurité figurant sur les sites internet HSBC concernés : Sécurité – HSBC Continental Europe / HSBC Private Bank France

En cas de suspicion de l’utilisation frauduleuse de vos données personnelles, nous vous recommandons de conserver toutes les preuves (messages, adresse du site web, captures d’écran…). Vous pouvez également vous appuyer sur les ressources du site cybermalveillance.gouv.fr.

Consultez régulièrement vos comptes pour détecter tout incident ou anomalie. Vérifiez les opérations inscrites à votre compte. En cas de doute ou si vous n’êtes pas à l’origine d’une opération prévenez immédiatement votre banque.

SFTR – Securities Financing Transaction Regulation

Background

The EU has introduced SFTR to increase transparency in the Securities Finance markets following policies introduced by the Financial Stability Board in the wake of the Financial Crisis. Although the EU is the first to implement rules in this space, other regulatory bodies are expected to follow. The UK’s FCA will enact an equivalent domestic regulatory regime in the event of the UK leaving the EU.

Overview

SFTR establishes a detailed reporting regime over the following securities financing transactions (SFT):

  • Repurchase Agreements (commonly known as “Repos”)
  • Securities Borrowing & Lending (“SBL”) including Commodities Lending
  • Buy-Sell Back or sell-buy back transactions
  • Margin Lending (in a Prime Finance context)

In-Scope counterparties

SFTR applies to:

  • A counterparty to a securities financing transaction that is established:
    • In the EU, including all its branches irrespective of where they are located
    • In a third country, if the SFT is concluded by an EU branch of that counterparty
  • Management companies of undertakings for the collective investment in transferable securities (UCITS) and UCITS investment companies, in accordance with Directive 2009/65EC
  • Managers of alternative investment funds (AIFMs) authorised in accordance with Directive 2011/61/EU
  • A counterparty engaging in reuse that is established:
    • In the EU, including all its branches irrespective of where they are located
    • In a third country, where either:
      • The reuse is effected by an EU branch of that counterparty or
      • The reuse concerns financial instruments provided under a collateral arrangement by a counterparty established in the EU or a branch in the EU of a counterparty established in a third country

Note that “counterparty” means financial and non-financial counterparties.

Timeline

SFTR obliges counterparties to report details of a SFT to a trade repository.

The reporting obligations phase in over a 9-month period for different types of market participants:

  • 13 April 2020 – Investment and Credit Institutions
  • 13 July 2020 – CCPs and CSDs

UPDATE: due to the ongoing impact of the COVID-19 pandemic, regulatory authorities deferred this initial phase to 13 July 2020 in line with Phase 2

  • 12 October 2020 – Insurance, UCITS, AIFs
  • 11 January 2021 – Non-Financial Companies

What is the impact on the industry?

The Securities Finance industry is investing heavily to meet the demands of the regulation. Key areas of focus are ensuring all parties in the market have a Legal Entity Identifier (LEI) code and that all transactions can be assigned a mutually agreed Unique Trade Identifier (UTI) which both parties recognise and include on their submissions. These data elements are necessary for reporting the processes to create and manage them, SFTs are new to all firms. The regulation stipulates 155 reporting data fields covering trade information, legal agreements, reference and relationship values. Sourcing all of the requirements and managing the data quality is the focus for firms preparing to meet the standards.

The Reporting Obligation

Specific details of any SFT entered into, as well as any modification or termination thereof, must be reported to a trade repository. Trade activity reports must be submitted before the end of day on T+1. Submissions detailing collateral supporting trades must be submitted by the end of the day following settlement of that collateral.

Similar to EMIR, trade reporting is dual-sided (for eligible parties) with a data matching requirement enforced by the Trade Repositories. SFTR does, however, recognise delegated reporting and the ability of financial counterparties to report on behalf of a small non-financial counterparty and UCITS managers and AIFMs to report on behalf of their funds. In addition to comprehensive trade and collateral reporting, in-scope firms must report on Collateral Re-Use, Funding Sources, Margin Data and Cash Reinvestment

Regulators are expected to pay close attention to reporting accuracy and inter-firm matching rates with the potential for penalties being applied to firms who do not meet minimum standards.

The reporting obligation covers all SFTs that are:

  • Concluded on or after the reporting start date detailed above
  • Were concluded before, and remained outstanding on the reporting start date and either:
    • Have a remaining maturity exceeding 180 days after the reporting start date or
    • Have an open maturity and actually remain outstanding for 180 days after the reporting start date

What is the impact for clients?

Large banks and investment firms are generally aware of their obligations and have established programmes of work to ensure they meet them. A range of industry vendors and technology providers have put packages together to assist them in meeting these objectives. Non-Financials have longer to prepare.

Delegated Reporting

SFTR does allow a counterparty, subject to the reporting obligation, to delegate such obligation to a third party.

Non-Financial counterparties are more likely to sign up to Delegated Reporting services with brokerage firms, such as HSBC, in order to ensure they remain compliant. Smaller Non-Financials (Non-Financial Companies with modest balance sheets, turnover and employee thresholds) have lighter obligations since their SFT activity must be reported by the Financial Counterparty they transact with.

Please read and retain the Procedures Manual SFTR (PDF,602 KB) to fully understand how the HSBC SFTR Delegated Reporting Service operates and how it can support you with your reporting requirements.

To request onboading documentation or for futher information on the Service, email the SFTR Onboading Team for HSBC Continental Europe at reg-business-support-hbfr-bmo@hsbc.fr

Our documents

Please find below the form required for any onboarding of in scope products.

Please find below the form and the reporting agreement if you wish to delegate the report of the in scope trades to HSBC.