The ERMES platform offers two levels of authentication: simple authentication by username and password for occasional reporters, and strong authentication via a level two or three RGS certificate on a physical device for regular reporters and TRACFIN correspondents.

Identifying reporting procedures relies on the distinction between internal and external reporting. Internal reporting begins with the recognition of a situation requiring a report, such as a direct observation or an alert generated by monitoring tools. For example, an advisor may detect regular cash deposits disproportionate to the profile of a retired client.

The report must be made prior to the execution of the suspicious transaction. Three exceptions allow for a post-execution report: impossibility of deferring execution, the risk that a delay would harm ongoing investigations, or discovery of the suspicious nature after the transaction has been completed. The reference date for assessing the deadline is the date on which the transactions could have appeared suspicious.

The mandatory content of the report includes several specific elements: full identification of the reporting party with contact details and reporting ID number, identification of the client and beneficial owner, precise description of the suspicious transactions, analysis of the suspicion, and supporting documents limited to fifteen documents for a total volume of thirty-nine megabytes.

The reporting obligation arises when the professional knows, suspects, or has reasonable grounds to suspect that the sums or transactions concerned originate from an offence punishable by more than one year of imprisonment or are linked to terrorist financing. No monetary threshold is required: suspicion alone is sufficient.

Strict confidentiality is required under Articles L.561-18 and L.561-19 of the CMF. The professional may under no circumstances disclose to the client the existence or content of the report, nor inform them of any subsequent action. Breach of this prohibition is punishable by a fine of twenty-two thousand five hundred euros.

Submissions must be made via the ERMES platform, which is accessible at all times at the TRACFIN portal address. This secure platform offers two levels of authentication: simple authentication and strong authentication via an RGS certificate.

Internal reporting and external reporting are two distinct procedures. Internal reporting concerns the escalation of alerts within the institution, while external reporting concerns the transmission of information to TRACFIN. Each procedure has its own requirements and formalities.