This survey was conducted using live BGP data from RIPE Stat, PeeringDB, and BGPKIT Monocle on 2026-02-08. Institutions were identified by searching PeeringDB and RIPE registries for ASNs registered to known French financial entities. Not all institutions maintain their own AS — many (BPCE, La Banque Postale, Credit Mutuel/CIC, Caisse d'Epargne, CNP Assurances, Euronext) appear to rely on third-party hosting or parent-company infrastructure and do not have publicly visible ASNs.
Resilience scores are computed from 4 dimensions: transit diversity (30%), peering breadth (25%), IXP presence (20%), and path redundancy (25%). Scores are capped at 5.0 if a single transit provider or always-on DDoS proxy is detected.
| Institution | Type | ASN | IPv4 | IPv6 | RPKI | Upstreams | IXPs | Resilience |
|---|---|---|---|---|---|---|---|---|
| BNP Paribas | Bank | AS25215 | 54 | 0 | NOT FOUND | 3 | 4 | |
| Societe Generale | Bank | AS3299 | 25 | 0 | NOT FOUND | 3 | 2 | |
| Credit Agricole | Bank | AS9159 | 11 | 0 | NOT FOUND | 1 | 0 | |
| AXA (Global) | Insurer | AS12696 | 115 | 0 | NOT FOUND | 2 | 1 | |
| AXA Technology | Insurer | AS15836 | 11 | 1 | VALID | 1 | 4 | |
| AXA Group Operations | Insurer | AS34746 | 1 | 0 | NOT FOUND | 1 | 1 | |
| Worldline | Payment | AS8677 | 196 | 0 | VALID | 0* | 0 | |
| Worldline (NL) | Payment | AS49537 | 1 | 0 | VALID | 2 | 0 | |
| Ingenico | Payment | AS206409 | 2 | 0 | VALID | 2 | 0 | |
| Boursorama (SocGen) | Fintech | AS20675 | 2 | 0 | VALID | 0* | 0 | |
| MAIF | Insurer | AS199233 | 7 | 1 | PARTIAL | 2 | 0 | |
| Groupama (AS50209) | Insurer | AS50209 | 1 | 0 | VALID | 1 | 0 | |
| Groupama (AS58029) | Insurer | AS58029 | 6 | 0 | VALID | 0* | 0 | |
| Natixis (US) | Bank | AS11813 | 1 | 0 | NOT FOUND | 1 | 0 | |
| Natixis (US CIB) | Bank | AS36336 | 3 | 0 | NOT FOUND | 3 | 0 |
* 0 upstreams detected = data incomplete or private peering not visible to route collectors. Worldline AS8677 routes through AS47957 (equensWorldline).
| Institution | RPKI Status | Sample Prefix |
|---|---|---|
| BNP Paribas | NOT FOUND | 159.50.128.0/17 |
| Societe Generale | NOT FOUND | 194.119.40.0/24 |
| Credit Agricole | NOT FOUND | 158.192.0.0/16 |
| AXA (Global) | NOT FOUND | 171.18.70.0/24 |
| AXA Group Ops | NOT FOUND | 85.159.152.0/21 |
| Natixis (US) | NOT FOUND | 198.51.212.0/24 |
| Natixis CIB | NOT FOUND | 63.118.94.0/24 |
| Institution | RPKI Status | Sample Prefix |
|---|---|---|
| Worldline | VALID | 160.92.187.0/24 |
| Worldline NL | VALID | 194.169.214.0/24 |
| Ingenico | VALID | 89.107.13.0/24 |
| Boursorama | VALID | 193.41.83.0/24 |
| MAIF | PARTIAL | 194.2.131.0/24 |
| Groupama (50209) | VALID | 193.104.173.0/24 |
| Groupama (58029) | VALID | 192.166.156.0/24 |
| AXA Technology | VALID | 217.26.160.0/20 |
| Institution | Transit Providers | # Upstreams | Risk |
|---|---|---|---|
| BNP Paribas | AS6461 (Zayo), AS1299 (Arelion), AS3356 (Lumen) | 3 | Good |
| Societe Generale | AS3215 (Orange), AS35625 (Radware), AS198949 | 3 | DDoS Proxy |
| Credit Agricole | AS3215 (Orange) only | 1 | SINGLE |
| AXA (Global) | AS3215 (Orange), AS6453 (Tata) | 2 | Limited |
| AXA Technology | AS174 (Cogent) only | 1 | SINGLE |
| AXA Group Ops | AS3356 (Lumen) only | 1 | SINGLE |
| Worldline (AS8677) | Via AS47957 (equensWorldline) - private | 0* | Opaque |
| Worldline NL | AS174 (Cogent), AS1299 (Arelion) | 2 | Limited |
| Ingenico | AS34984, AS15924 | 2 | Limited |
| Boursorama | Via AS32787 (Prolexic/Akamai) - DDoS proxy | 0* | Opaque |
| MAIF | AS3215 (Orange), AS15557 (Bouygues/Ldcomnet) | 2 | Limited |
| Groupama (50209) | AS8953 (Colt) only | 1 | SINGLE |
| Groupama (58029) | Via AS32787 (Prolexic/Akamai) - DDoS proxy | 0* | Opaque |
| Natixis (US) | AS46887 only | 1 | SINGLE |
| Natixis CIB (US) | AS174 (Cogent), AS701 (Verizon), AS7018 (AT&T) | 3 | Good |
| Institution | IXPs | Total Capacity | IXP Names |
|---|---|---|---|
| BNP Paribas (AS25215) | 4 | 80 Gbps | France-IX Paris, Equinix Frankfurt, DE-CIX Munich, Equinix Paris |
| Societe Generale (AS3299) | 2 | 20 Gbps | France-IX Paris (x2) |
| AXA Technology (AS15836) | 4 | 40 Gbps | MD-IX (x2), KIVIX (x2) |
| AXA (AS12696) | 1 | 1 Gbps | France-IX Paris |
| AXA Group Ops (AS34746) | 1 | 100 Mbps | LINX LON1 |
| Credit Agricole | 0 | - | None |
| Worldline (both ASNs) | 0 | - | None |
| All Others (7 ASNs) | 0 | - | None |
| Institution | IPv4 Prefixes | IPv6 Prefixes | IPv6 Status |
|---|---|---|---|
| MAIF (AS199233) | 7 | 1 | Deployed |
| AXA Technology (AS15836) | 11 | 1 | Deployed |
| BNP Paribas (AS25215) | 54 | 0 | Not Deployed |
| Societe Generale (AS3299) | 25 | 0 | Not Deployed |
| Credit Agricole (AS9159) | 11 | 0 | Not Deployed |
| AXA Global (AS12696) | 115 | 0 | Not Deployed |
| Worldline (AS8677) | 196 | 0 | Not Deployed |
| All other surveyed ASNs: IPv6 Not Deployed | |||
The following major French financial institutions do not appear to operate their own publicly visible Autonomous Systems. They likely rely on parent-company infrastructure, managed hosting, cloud providers, or ISP-provided connectivity. This is common but means their BGP routing posture cannot be independently assessed.
| Institution | Type | Notes |
|---|---|---|
| BPCE / Banque Populaire | Bank | 2nd largest French banking group. No public ASN found. |
| Credit Mutuel / CIC | Bank | Major mutual banking group. CIC search returned unrelated ASNs. |
| La Banque Postale | Bank | Subsidiary of La Poste group. Likely uses La Poste infrastructure. |
| Caisse d'Epargne | Bank | Part of BPCE group. No separate ASN. |
| HSBC France | Bank | Uses HSBC global infrastructure. Multiple HSBC ASNs exist globally. |
| CNP Assurances | Insurer | Largest personal insurer in France. No public ASN found. |
| Covea (MAAF, MMA, GMF) | Insurer | Major mutual insurance group. No public ASN found. |
| Euronext | Exchange | Pan-European stock exchange. Likely uses private/dedicated infrastructure. |
| Qonto | Fintech | Business neobank. Likely cloud-hosted (no own ASN). |
| Lydia | Fintech | Payment app. Likely cloud-hosted (no own ASN). |
| Banque de France | Central Bank | Central bank. No public ASN found (likely private/RENATER). |
| Caisse des Depots | Public Bank | State financial institution. No public ASN found. |
Affected: Credit Agricole (AS9159), AXA Technology (AS15836), AXA Group Ops (AS34746), Groupama (AS50209), Natixis US (AS11813). These 5 ASNs rely on a single transit provider. If that provider experiences an outage, all connectivity is lost. Each should add at least one additional transit provider immediately.
Affected: BNP Paribas, Societe Generale, Credit Agricole, AXA Global, AXA Group Ops, Natixis (both ASNs). 47% of surveyed ASNs have no ROA coverage. Without RPKI, these prefixes are vulnerable to BGP hijacking. Given the financial nature of these networks, RPKI deployment should be prioritized.
Affected: 10 of 16 ASNs have zero IXP presence. Joining IXPs (especially France-IX Paris) improves latency, provides alternative paths during transit failures, and reduces costs. BNP Paribas (4 IXPs) demonstrates the benchmark.
Affected: Most surveyed ASNs have minimal peering (0-3 peers). Only AXA Global (51 peers) and AXA Group Ops (99 peers) have substantial peering. Broader peering improves DDoS resilience and routing efficiency.
Affected: 14 of 16 ASNs have zero IPv6 prefixes. Only MAIF and AXA Technology have deployed IPv6. With growing IPv6 adoption, financial institutions risk accessibility issues for IPv6-only or IPv6-preferred clients.
Affected: Worldline (AS8677), Boursorama (AS20675), Groupama (AS58029) route through DDoS proxy or private transit (Akamai Prolexic, equensWorldline). While DDoS protection is valuable, ensure backup direct paths exist and that the proxy itself doesn't become a single point of failure.
12 major financial institutions (BPCE, Credit Mutuel, La Banque Postale, etc.) have no visible ASN. While this may be by design (using parent infrastructure), it means their routing resilience depends entirely on third parties. These institutions should verify their providers' BGP security posture.
| Metric | Banks (6 ASNs) | Insurers (5 ASNs) | Payment/Fintech (5 ASNs) |
|---|---|---|---|
| Avg Resilience Score | 3.8 | 2.5 | 1.9 |
| RPKI Deployment | 17% (1/6) | 80% (4/5) | 80% (4/5) |
| IPv6 Deployed | 0% (0/6) | 20% (1/5) | 0% (0/5)* AXA Tech has IPv6 |
| Avg IXP Count | 1.0 | 1.2 | 0.0 |
| Single Transit Risk | 2/6 (33%) | 1/5 (20%) | 0/5 (0%)* |
| Total Prefixes | 119 | 131 | 203 |