The US Securities and Exchange Commission (SEC or the Commission) announced on October 20, 2026 that it will resume processing new and pending registration applications from asset management companies supervised by France’s Autorité des Marchés Financiers (AMF), including management companies for undertakings for collective investment in transferable securities (UCITS) and alternative investment funds (AIFs), following the October 19, 2026 supervisory memorandum of understanding (MOU) with the AMF.[5]
The MOU sets forth French assurance that applicable secrecy and blocking laws will not prevent cooperation and access to records as contemplated by the MOU.[6] In return for being permitted to register with the SEC, French asset managers may face closer scrutiny, including direct records requests from the SEC, coordinated oversight by the SEC and the AMF, and the potential for in-person SEC examinations on French soil.
ACCESS TO FRENCH MANAGERS’ RECORDS
Each regulator represents that, at execution, no domestic secrecy, blocking, privacy, or other legal barriers should prevent the assistance the MOU contemplates. France’s AMF goes further. It confirms in the MOU that Covered Firms may supply information directly to the SEC, orally or in writing, or give the SEC direct access, including to books and records. It also confirms that the MOU meets the cooperation and reciprocity requirements of Articles L.632-7 and L.632-17 of the French Monetary and Financial Code; Article L.632-17 derogates from general provisions, including France’s blocking statute.
The SEC makes reciprocal representations for AMF access.[7] These representations extend only to assistance under the MOU; they are not a general waiver of French privacy or blocking laws. Existing regulatory powers and firms’ direct-production obligations to their own regulators are preserved.[8]
WHO IS IN SCOPE
US “Covered Firms” include investment advisers, fund managers, investment funds, and investment companies.[9] The French list is narrower and names only UCITS and AIF management companies. Markets in Financial Instruments Directive (MiFID)-authorized investment firms (as well as registered financial investment advisers) are not named. Because both lists are illustrative (“include”) and the general definition reaches any firm regulated by either authority that conducts investment, securities, or asset management business, the MOU may reach those firms as well; the SEC’s announcement, however, refers only to AMF-supervised asset management companies.
“Covered Activities” reach the firm’s advisory business, expressly including conflicts management and fiduciary duties, to the extent governed by laws within the requesting regulator’s jurisdiction.[10] There is a discrepancy between the definition of Covered Activities in the English and French versions of the MOU that could pose interpretive questions. The French version references all services, professional activities, and management activities (including the management of conflicts of interest and fiduciary duties). The reference to management activities has been omitted from the English version.
“Books and Records” include electronic materials and may include personal data.[11] SEC registration remains available only to a firm that advises others as to securities within the meaning of Section 202(a)(11) of the Investment Advisers Act of 1940 (the Advisers Act), and the MOU does not change that threshold. A French firm’s path is clearest if it holds an AMF authorization as a UCITS management company or AIFM; a firm that holds only another authorization, such as a MiFID II investment-firm license or a Markets in Crypto-Assets Regulation (MiCA) cryptoasset service provider authorization, should confirm with SEC staff that the MOU supports its application.[12]
The MOU does not specifically address the position of French management companies operating through branches established in other EU member states under the European passporting regime. However, as regards SEC on-site inspections, it appears that branches established in other EU member states are not covered, since the MOU refers only to inspections of “Covered Firms located in the territory of the other Authority” (i.e., in France only).[13]
Accordingly, an inspection conducted by the SEC at the premises of a branch in Luxembourg, Milan, or Frankfurt should fall outside the procedural framework established by the MOU. The SEC’s own authority to examine a registered adviser, including its branches, does not depend on the MOU, however, and an SEC visit to an EU branch would likely require coordination with the host member state regulator.
DAY-TO-DAY SUPERVISION
Cooperation covers registration and exemption matters, ownership changes, financial condition, liquidity, risk management and controls, regulatory filings, and examination findings. The MOU contemplates that most cooperation will occur through ongoing informal staff consultation, supplemented by written requests, notice of material adverse events and sanctions, and expedited contact, including oral requests confirmed in writing, during emergencies. Response commitments are qualified by practicability and reasonable efforts, with no fixed deadlines.[14]
Either regulator may visit Covered Firms in the other’s territory and obtain records directly. The visiting regulator is expected to contact the local regulator before notifying the firm and coordinate the purpose, scope, and timing, taking account of the local regulator’s work and reports. Note an important asymmetry: the AMF will accompany SEC staff in France, without unreasonably delaying the visit; the SEC may accompany the AMF in the United States.[15]
A Covered Firm should prepare for the possibility of a coordinated examination involving both regulators for an examination conducted in France. A Covered Firm located in the United States could be examined by the AMF without simultaneous presence of SEC staff. The MOU is not limited to French applicants. A French UCITS management company or alternative investment fund manager (AIFM) affiliated with a US adviser is itself a Covered Firm, so the SEC may invoke these procedures when its examination of the US adviser extends to French affiliates.
Either regulator may use information from its counterpart for enforcement purposes after notifying it and proceeding under the International Organization of Securities Commissions’ Multilateral Memorandum of Understanding Concerning Consultation and Cooperation and the Exchange of Information or another enforcement arrangement. For information obtained directly from a Covered Firm, a regulator must notify the other regulator and send an assistance request under MOU framework. Other uses require the other regulator’s prior written consent, with consultation if consent is refused, and both regulators’ enforcement powers are expressly preserved.[16]
DATA, PRIVILEGE, AND CONFIDENTIALITY
Confidentiality is qualified, not absolute. Inter-authority information generally stays confidential to the extent law permits, and the MOU addresses compelled disclosure, preservation of privileges, need-to-know access, and breach notification. Subject to certain notice requirements and legal restrictions, a regulator that receives information under the MOU framework is permitted to share the information with another “Governmental Entity,” which generally includes other relevant financial services regulators in each country.[17] Personal-data processing remains subject to applicable law and the 2019 European Economic Area (EEA)/non-EEA Administrative Arrangement.[18]
The General Data Protection Regulation (GDPR) permits transfers of personal data outside the EEA without further safeguards only to countries that the European Commission has found to protect personal data adequately (an adequacy decision). The European Commission has made no such finding for the United States as a whole: its 2023 decision on the EU-US Data Privacy Framework covers only US organizations that self-certify under that framework, not transfers to the SEC, and the 2019 Administrative Arrangement governs transfers between regulators, not a firm’s own production.
A firm that produces personal data directly to the SEC therefore should identify and document the GDPR transfer basis on which it relies (for example, a derogation under GDPR Article 49, which European data protection authorities construe narrowly), confirm that data-subject notices cover the transfer, and screen for special-category data.[19]
WHAT CHANGES AND WHAT DOESN’T
|
Issue |
Bottom Line |
|
SEC Registration |
Processing resumes for AMF-supervised asset management companies. Applicants must still meet all US requirements.[20] |
|
Substantive Rules |
No change. The MOU is not substituted compliance, mutual recognition or an exemption.[21] |
|
Firm Rights |
None. No person may use the MOU to obtain, suppress or exclude information, or to challenge an exchange.[22] |
|
Onward Sharing |
Permitted to specified “Governmental Entities” (for the SEC, the US Departments of the Treasury and Justice, the Federal Reserve Board, the Commodity Futures Trading Commission, and the Financial Stability Oversight Council; for the AMF, the French Ministry of Finance, the Autorité de contrôle prudentiel et de résolution, the European Securities and Markets Authority, and the European Systemic Risk Board) after notice and adequate use and confidentiality assurances, including that the recipient will not use the information in an enforcement proceeding.[23] |
|
Duration |
Effective on signing; terminable on 30 days’ written notice, with pending assistance and use/confidentiality protections surviving.[24] |
GOING FORWARD
The MOU took effect on signing. French asset managers and US advisers with French affiliates should consider the following steps:
- Revisit pending applications: French managers with SEC applications on hold should reassess status and timing
- Map your entities: Identify which affiliates are Covered Firms—a France-authorized UCITS ManCo or AIFM, an SEC-registered adviser, or a registered fund
- Prepare for direct requests and joint exams: Plan for records requests and coordinated on-site visits
- Build review into responses: Add privilege, confidentiality, and personal data review to your regulatory response protocols before a request lands
