Systematic Information Reporting (COSI) refers to the automatic reporting to Tracfin of certain transactions as soon as they exceed a threshold set by the Monetary and Financial Code, without the need for any suspicion. It applies to cash transactions and fund transfers. It never replaces the suspicious activity report, which remains mandatory whenever a transaction appears suspicious.
What is COSI, and what is it used for?
COSI, or systematic reporting of information, is based onArticle L.561-15-1 of the Monetary and Financial Code. It requires the relevant professionals to report certain transactions to Tracfin as soon as a regulatory threshold is exceeded, regardless of any risk assessment or suspicion.
It provides the financial intelligence unit with raw data, which the unit cross-references with its other sources to detect patterns of money laundering or terrorist financing. Unlike a suspicious activity report, a COSI does not require any prior analysis.
Which professionals are required to submit COSI reports?
The regulation primarily applies to credit institutions, payment institutions, and electronic money institutions that fall within the scope of the applicable provisions. Certain institutions established in another European Union or European Economic Area member state and conducting business in France through agents or distributors may also be affected, depending on their status and the transactions they carry out. Non-financial professions, such as notaries, real estate agents, certified public accountants, and wealth management advisors, are not subject to the COSI, although they remain subject to suspicion reporting obligations set forth in Article L.561-15 of the Monetary and Financial Code.
Which transactions trigger a COSI, and at what threshold?
The reporting requirement applies to two categories of transactions, based on the thresholds set forth in Articles R.561-31-1 and R.561-31-2 of the Monetary and Financial Code.
| Family of operations | What is intended | Threshold |
| Species | Cash deposits or withdrawals from a savings or checking account | More than €10,000 in deposits or more than €10,000 in withdrawals, cumulatively over a calendar month for a single account |
| Fund Transfers | Fund transfers made from a cash deposit or using electronic money | €1,000 per transaction or €2,000 in total per customer per calendar month |
The threshold is assessed on a per-transaction basis or cumulatively over a calendar month. The information is reported to Tracfin no later than 30 days after the end of the relevant month: the month of payment for a funds transfer, or the month in which the threshold is exceeded for cash.
How does a COSI differ from a suspicious activity report?
COSI and the suspicious activity report are based on two distinct approaches: an objective threshold on the one hand, and a risk analysis on the other.
| Criterion | COSI | Report of a Suspicion |
| What triggers it | A threshold crossed, without assessment | A suspicion regarding a transaction or funds |
| Legal Basis | Art. L.561-15-1 CMF | Art. L.561-15 CMF |
| Preliminary Analysis | None | Analysis documented by the registrant |
| Deadline | No later than 30 days after the end of the month in question | Before performing the operation, with some exceptions |
| Channel | Tracfin's ERMES Online Service | Tracfin's ERMES Online Service |
Processing the COSI and the suspicious activity report through two separate channels helps avoid some of the common errors in a suspicious activity report.
Can a single transaction give rise to both a COSI and a suspicious activity report?
Yes. A transaction that exceeds the regulatory threshold and appears suspicious requires both reports. For example, a cash transfer of €3,500 made by a customer whose profile does not justify this method of payment triggers the COSI because the threshold has been exceeded. It may also warrant a suspicious activity report if the analysis reveals signs of money laundering.
Article L.561-18 of the Monetary and Financial Code prohibits the disclosure of the existence and content of a report filed with Tracfin. It does not expressly mention COSI; as a precaution, do not disclose to the client any reports submitted to Tracfin.
How should COSI production be organized within your system?
The production of COSIs is part of the overall system for transaction monitoring (KYT) and requires careful organization. The compliance officer configures the thresholds and monthly aggregates in the monitoring tool, then performs a completeness check at the end of each month.
Each COSI submitted must be logged with the date, submission reference, relevant transaction, customer, and amount. In the event of rejection by Tracfin or if an anomaly is detected in the submitted file, the correction must be documented and retained in the audit trail. COSIs are submitted by individuals authorized by Tracfin, most often the reporting entity and the Tracfin liaison.
What completeness checks should be implemented each month?
The completeness check compares the transactions detected by theAP Monitoring transaction monitoring tool with the COSIs that were actually transmitted. It focuses on three points:
- the inclusion in the transmission file of all transactions that exceed the monthly threshold;
- the accuracy of the monthly totals;
- compliance with the 30-day deadline.
Any deviation must be analyzed, corrected, and documented. The audit trail retains evidence of each verification.
What do the ACPR and Tracfin check regarding COSIs?
The audits focus on three areas:the completeness of the reports, to verify that all transactions exceeding the threshold have been reported; compliance with the 30-day deadline; and the quality of the data submitted, including customer identification, amount, date, and reference number.
The ACPR verifies that the institution has implemented a procedure for detecting, aggregating, and reporting data. It also ensures that the institution maintains an audit trail of its submissions. Failure to report or incomplete reporting constitutes a breach of reporting obligations under the “ AML-CFT ” and exposes the institution to the penalties provided for in the Monetary and Financial Code.
Where should I start?
There are three steps you can take to quickly define the obligation:
- Check whether your category of taxable entity is among the businesses subject to the COSI, including credit institutions, payment institutions, and electronic money institutions;
- track the cash flows and fund transfers processed each month;
- Test the settings for thresholds and monthly totals using data from a previous month.
The test results must be documented and compared with the actual operations performed. If any discrepancies are found, correct them before going live.
Frequently Asked Questions About COSI
What is a COSI Tracfin?
COSI, or systematic reporting of information, refers to the reporting of certain transactions to Tracfin as soon as they exceed a regulatory threshold, without the need for any suspicion. It was introduced in Article L.561-15-1 of the Monetary and Financial Code and applies to cash transactions as well as fund transfers.
Does COSI replace the suspicious activity report?
No. The COSI is automatic and based on a threshold, whereas a suspicious activity report is based on an analysis of a transaction. A transaction that exceeds the threshold and appears suspicious triggers both reports. Submitting a COSI never exempts you from filing a suspicious activity report with Tracfin.
Which professionals are subject to COSI?
Certain categories of financial institutions are subject to this requirement, including credit institutions, payment institutions, and electronic money institutions, with respect to cash transactions and fund transfers. Notaries, real estate agents, and wealth management advisors are not subject to this requirement.
What is the deadline for submitting a COSI?
Information must be submitted to Tracfin no later than thirty days following the month of payment for wire transfers, and following the month in which the threshold was reached for cash transactions. Conduct a monthly review to reconcile the detected transactions with the COSI reports submitted in order to demonstrate the completeness of the reports in the event of an audit.
How can you identify transactions that trigger a COSI?
Detection relies on configuring thresholds and monthly totals in your operations monitoring tool. Each alert must be tracked until it is sent, including the date and transmission reference. Test the configuration using data from a past month before putting it into production.
