Introduction: the refusal with no reason
You apply for a €9,000 car loan. You have a permanent contract, you have never missed a payment, your savings cover three months' salary. Three days later, a polite email arrives: "After reviewing your file, we are unable to respond favourably to your request." No reason. No named contact. No explanation when you call, other than the standard formula: "It's the system."
That system has a name: scoring. A score, calculated by an algorithm, from dozens of variables drawn from your banking history, your declared data, public files and sometimes external sources. This score is never volunteered to you. Yet it decides your access to credit, the price of your insurance, your card limit, how long your transfer takes to clear, and in some cases whether your account is closed outright.
The good news: unlike other countries, France regulates these practices strictly. The GDPR, the French Data Protection Act (loi Informatique et Libertés) and the Monetary and Financial Code give you concrete rights — provided you know they exist and how to activate them. This guide takes stock of what is recorded about you, what is legal, and what you can genuinely do.
What your bank really knows about you
The data you provide
The foundation is declarative: identity, address, family situation, occupation, income, assets. Since anti-money-laundering obligations came into force (European AML/CFT directives, transposed into articles L. 561-1 et seq. of the Monetary and Financial Code), banks must also periodically update their "know your customer" records — hence those questionnaire campaigns asking about the origin of your funds or your country of tax residence. These obligations are real and enforceable: refusing to answer can legally lead to your account being closed.
The data you generate without thinking about it
This is the richest layer, and the most invisible. Every transaction on your account leaves an exploitable trace:
- The wording of transfers and direct debits: name of the beneficiary, the employer, the health insurer, the landlord, the phone operator. A single statement makes it possible to reconstruct your workplace, your home, your usual pharmacy, your subscriptions, your family situation.
- The geolocation of card payments: merchant, town, time of day. Over twelve months, this maps out your journeys, your habits, your holidays.
- Regularities and disruptions: a salary that stops, a rent that goes up, a recurring overdraft at the end of the month. Risk models are far more sensitive to breaks in rhythm than to absolute amounts.
- In-app behaviour: connection frequency, checking your balance several times a day, cancelled transfer attempts. Several institutions incorporate these signals into their financial-fragility detection models.
The official files
Three files managed by the Banque de France carry considerable weight and are consulted systematically:
| File | What it contains | Registration period |
|---|---|---|
| FICP (national register of consumer credit repayment incidents) | Unpaid credit instalments, over-indebtedness cases | 5 years for an incident, up to 7 years for an over-indebtedness plan |
| FCC (central cheque register) | Bounced cheques, withdrawal of bank card | 5 years, removable as soon as the situation is regularised |
| FNCI (national register of irregular cheques) | Stolen cheques, closed accounts | Variable |
A crucial point, often overlooked: these files can be consulted free of charge by you. The Banque de France provides an access procedure online and in branch, on presentation of proof of identity. Before any significant credit application, checking whether you are listed avoids nasty surprises — an erroneous entry after a settled dispute is far from rare.
Scoring: how it actually works
A statistical model, not a judgement
A credit score is the output of a model trained on hundreds of thousands of past files. It estimates a probability of default from variables historically correlated with that default: length of banking relationship, income stability, debt-to-income ratio, number of outstanding loans, incident history, sometimes type of employment contract or sector of activity.
The algorithm "understands" nothing about your situation. It applies correlations. That is precisely why the law regulates its use: a statistical correlation that holds at population level can be profoundly unjust when applied to an individual.
What is prohibited in France
Contrary to a persistent belief, there is no universal American-style "credit score" in France, of the FICO type, consultable by any creditor. The creation of a positive file listing all outstanding loans held by every French citizen was struck down by the Constitutional Council in 2014 (decision on the Hamon Act), on the grounds of a disproportionate infringement of the right to privacy. Each institution therefore calculates its own score, on its own data.
Also prohibited as decision variables are:
- actual or presumed ethnic origin, religion, political opinions, sexual orientation, health (so-called sensitive data, article 9 of the GDPR);
- place of residence used as a discriminating criterion — the practice known as redlining, sanctioned as discrimination by the Defender of Rights;
- pregnancy or family situation used to restrict access to credit.
The rule that changes everything: article 22 of the GDPR
This is the most powerful and most underused tool. Article 22 of the GDPR provides that you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
A credit refusal falls squarely within this scope. Where the decision remains automated (which the law permits in a contractual context), you retain three explicit rights:
- To obtain human intervention on the part of the data controller.
- To express your point of view and provide elements the model did not take into account.
- To contest the decision and obtain an explanation of the underlying logic.
The CNIL has repeatedly stressed that the explanation must be intelligible: the institution is not required to hand over its model's code, but it must indicate the categories of data used and the general weight of the criteria. "It's the algorithm" is not an acceptable answer.
Insurance: the other front
The insurance sector practises even finer profiling, because it is structurally built on the assessment of individual risk.
Tariff segmentation
Two drivers with identical declared profiles can be quoted premiums 40% apart, on the basis of behavioural variables: the town where the vehicle is parked, declared annual mileage, how long the licence has been held, payment method, subscription channel. Some "pay how you drive" offers go further by installing a telematics box or an app that measures acceleration, braking and driving times. The promised discount is real; so is the trade-off: you hand over a permanent logbook of your movements.
Before signing up to this kind of contract, read the data retention clause and check what happens to the history if you cancel. The CNIL has published several recommendations on these devices, insisting that consent must necessarily be optional and reversible.
The right to be forgotten in borrower's insurance
A major and little-known advance: the Lemoine Act of 28 February 2022 abolished the health questionnaire for mortgage loans below €200,000 per insured person, where repayment ends before the borrower's 60th birthday. It also shortened the right-to-be-forgotten period for cancer to five years after the end of the treatment protocol.
In practical terms: in these situations, the insurer has no right to ask you about your state of health, nor to collect any medical data whatsoever. Any question asked outside this framework is illegal and can be reported to the CNIL or the ACPR.
Seven concrete measures to take back control
1. Exercise your right of access, properly
The right of access (article 15 of the GDPR) is exercised by a simple letter or form addressed to the institution's data protection officer (DPO), whose contact details must appear in the privacy policy. A response is due within one month.
Ask explicitly, in a single letter, for:
- a copy of all data concerning you;
- the existence of any automated profiling and the logic behind it;
- the recipients or categories of recipients of the data;
- the retention periods applied.
Sending it by registered post with acknowledgement of receipt gives you a certain date, useful if you later refer the matter to the CNIL. An administrative correspondence log book, in which you record dispatch dates, registered-post numbers and deadlines, turns these scattered steps into a solid case file.
2. Check your Banque de France files before any application
Do it systematically before a mortgage, a change of bank or a rental application with a guarantor. An old regularisation that was poorly recorded can be corrected in a few weeks — but not in three days.
3. Compartmentalise your financial flows
The principle is the same as for digital identities: don't concentrate everything in one place. A main account for income and fixed charges, a secondary account at another institution for day-to-day spending and online purchases, a systematic-authorisation or prepaid card for one-off payments to merchants you don't know. No single institution then has a complete view.
An RFID-blocking wallet also limits opportunistic reading of contactless cards in crowded public transport — a marginal risk, but the accessory costs next to nothing.
4. Refuse marketing consents right at the outset
Onboarding forms almost always contain boxes relating to the use of data for prospecting purposes or sharing with subsidiaries or partners. These consents are separate from the contract: refusing them cannot legally justify a refusal to open an account. They are revocable at any time, including years later.
5. Pay in cash where it makes sense
Cash remains the only untraceable means of payment, and its acceptance is still mandatory in France for everyday transactions, up to €1,000 between a business and a resident individual. This is not a matter of concealment, but of proportionality: your pharmacy, your bookshop or your charitable donation have no business appearing in a marketing database.
6. Document and archive
Banking disputes are won on the evidence. Keep letters, screenshots, replies. A portable document scanner or a simple scanning app lets you archive statements and correspondence in an encrypted folder, outside the cloud of the institution concerned. An encrypted external hard drive does this job very well for archives you would rather not route through a third-party service.
7. Know how to escalate
The order is as follows:
- Customer service, in writing.
- The institution's complaints department, whose contact details must appear in the general terms and conditions.
- The banking or insurance ombudsman, free of charge, who can be contacted after two months without a satisfactory reply.
- The CNIL for anything relating to personal data, profiling or refusal to honour your rights.
- The ACPR (the French prudential supervision and resolution authority) for commercial practices.
- The Banque de France for the right to a bank account: if you are refused an account, it can designate an institution required to provide you with basic banking services (article L. 312-1 of the Monetary and Financial Code).
The special case of account closure
"Banking de-risking" — unilateral closure with no explicit reason — has grown alongside tougher AML/CFT obligations. Banks have the right to terminate a deposit account agreement, subject to at least two months' notice for a private individual. They are not required to give reasons, except where the account was opened under the right-to-an-account scheme.
What remains protected:
- The notice period must be respected and notified in writing.
- The funds belong to you and must be returned.
- The right to an account remains: no one in France can be deprived of a deposit account and basic banking services.
If the closure appears linked to an automated risk profile, article 22 of the GDPR once again becomes the angle of attack: ask in writing whether the decision resulted from automated processing and demand human intervention.
Where to draw the line
The point is not to live outside the financial system — that is impossible, and would in any case be the surest way to attract attention. The point is to restore proportionality:
A bank needs to know whether you can repay. It does not need to know which pharmacist you go to, which charity you donate to, or what time you check your balance.
The practical levers come down to three reflexes: compartmentalise what can be compartmentalised, check the files that concern you regularly, write rather than phone, every time. A plain-language book on personal data law, kept within reach, saves you starting from scratch with every dispute — the GDPR is more readable than it looks once you know its structure.
And when you need to ask a sensitive question of an organisation, obtain information without opening a file in your name, or pass on information without your personal number becoming the entry key to yet another database, contact channels dissociated from your identity retain their full usefulness. The principle is constant: give the necessary information, never the available information.
Key takeaways
- There is no national credit score in France; each institution calculates its own, on its own data.
- The Banque de France's FICP, FCC and FNCI files can be consulted free of charge by the people concerned.
- Article 22 of the GDPR grants a right to human intervention and to an explanation in the event of an unfavourable automated decision.
- The 2022 Lemoine Act abolished the health questionnaire for many mortgage loans.
- The right to an account guarantees minimum access to banking services, including after a unilateral closure.
- Splitting your flows across several institutions remains the most effective and the simplest measure.
