Anti-corruption monitoring: turning media signals into Sapin II compliance evidence

France's Sapin II law requires companies above 500 employees and 100 million euros in revenue to run a full anti-corruption program, built around an up to date risk map and continuous third party screening. Yet a large share of programs audited by the French Anti-Corruption Agency (AFA) show a risk map judged incomplete or too static. The breaking point is rarely the will to comply: it is the ability to catch, at the right moment, the media signal that reveals a risk at a supplier, a sales agent or an acquisition target. This article explains how structured anti-corruption monitoring turns a raw news stream into evidence that holds up before an auditor.

The 30 second takeaway

• Anti-corruption monitoring is not about reading the press: it is about linking each media signal to a precise Sapin II obligation (risk map, third party screening, accounting controls).
• Recent AFA decisions confirm that the lack of an audit trail weighs as heavily as a missing procedure.
• A tooled program cuts the delay between an adverse article and its inclusion in the compliance file from weeks to hours.

What Sapin II really requires for third party monitoring

Article 17 of the December 2016 law structures the program around 8 pillars. Three of them depend directly on reliable, continuous external information: the risk map, third party screening procedures and accounting controls. On these three pillars, the most common failure is not the absence of a written policy, but the inability to prove that monitoring actually worked over time.

In practice, an auditor does not simply check that a policy exists. They ask for proof that a supplier ranked high risk was genuinely monitored, that press alerts about it were logged, qualified and, where relevant, escalated. Anti-corruption monitoring then becomes the documentary backbone of the program: without it, the risk map stays a snapshot frozen at the date it was written.

Press monitoring, the blind spot of anti-corruption programs

Most compliance teams use transactional screening tools (sanctions lists, PEP, company databases). But these bases are structurally late: a company rarely appears on an official list before a judicial investigation opens. In nearly every corruption case, the first public signal is a media one. An investigative report, a prosecutor statement, an NGO report or a regional business article precede a database entry by months.

Setting up automated compliance monitoring across the perimeter of high risk third parties closes that time gap. The point is not to watch everyone, but to focus detection on the third parties flagged as sensitive by the risk map: sales intermediaries, suppliers in exposed jurisdictions, joint venture partners. A well calibrated watch does not generate noise: it produces a limited number of qualified alerts, each tied to a third party and a risk level.

Methodology: linking each signal to an obligation

Robust anti-corruption monitoring rests on a four step pipeline. First, defining the perimeter: the list of third parties from the risk map, enriched with their directors and beneficial owners. Then multilingual collection, because a corruption fact involving a subsidiary is often first covered by local press. Then qualification: each article is tied to a third party, a risk type (bribery of a public official, conflict of interest, influence peddling) and a severity level. Finally, documented escalation to the compliance officer.

Traceability as evidence

The decisive habit is to timestamp every step. A signal detected on Tuesday, qualified on Wednesday and escalated on Thursday tells a defensible story. For firms that outsource part of this load, intelligence for compliance firms brings the documentary rigor the AFA expects while easing the operational burden on internal teams. Compliance evidence is not manufactured after the fact: it is built continuously, signal by signal.

From collection to evidence: the role of OSINT technology

Volume makes manual monitoring an illusion. A portfolio of a few hundred third parties, multiplied by name variants, subsidiaries and languages, generates a stream no one can read in full. This is where proprietary OSINT technology comes in: it does not just surface articles containing a name, it disambiguates entities, discards homonyms and ranks signals by severity and source reliability.

A strong system must also reason in entities, not keywords. Detecting that a supplier's director is named in an investigation, even when the company name does not appear in the article, is exactly the kind of correlation a human misses under volume pressure and that a semantic analysis engine restores systematically.

Industrializing monitoring without overloading teams

The risk of a poorly designed watch is well known: alert fatigue. Too many unqualified notifications, and teams end up ignoring the stream, which destroys the evidentiary value of the program. The right approach sets severity thresholds, routes automatically to the right officer and reserves human intervention for the signals that deserve it. The table below contrasts an artisanal watch with industrialized monitoring on the NewsCore platform.

Dimension	Manual watch	Tooled monitoring
Detection delay	Several weeks	A few hours
Language coverage	Limited to one language	Multilingual by default
Traceability	Fragmented (emails, files)	Timestamped and centralized
Homonym risk	High	Disambiguated by entity

Frequently asked questions

Is anti-corruption monitoring mandatory under Sapin II?

The law does not name a monitoring tool, but it requires third party screening and an up to date risk map. In practice, proving continuous monitoring of high risk third parties without a structured watch is very hard during an AFA audit.

Should every supplier be monitored?

No. The risk based approach recommends focusing enhanced monitoring on third parties ranked high risk by the map: intermediaries, exposed jurisdictions, sensitive sectors. Undifferentiated monitoring dilutes the effort and buries the important signals.

How do you avoid alert fatigue?

By calibrating severity thresholds, disambiguating entities to remove false positives and routing each alert to the right officer. A watch that produces few but always relevant alerts is far more effective than a massive unqualified stream.

Anti-corruption monitoring is not an extra reporting layer: it is the mechanism that keeps your risk map alive and your program defensible. To go further on compliance screening automation, read our dedicated guide on KYC and sanctions screening, the natural complement to robust anti-corruption monitoring.

Ludovic Desgranges, CEO NewsCore