The statement said: "The weaknesses brought to light, in particular the deficiencies in hierarchical controls, carried on over a long period, throughout 2007, without being detected or rectified by the internal control systems."
It also said that Societe Generale's IT systems contained "significant weaknesses", and highlighted the lack of a gross trading limit for Kerviel.
But the regulator did say that the bank had been swift to attempt to correct these problems once they were revealed.
Societe Generale has not commented on the ruling.
The bank announced the losses on January 24, two days before Kerviel handed himself in to police.
He was released from prison in March after an appeal against his detention, but he remains under formal investigation for breach of trust, illegally accessing computers and falsifying documents.
Investigators are now trying to find out if he had assistance inside or outside the bank.
An internal investigation at Societe Generale stated that Kerviel bypassed risk controls at the bank to build up a trading position worth 49 billion euros - more than the banks own stock market value.
Following the scandal, Daniel Bouton, Societe Generale's executive chairman, split his position, transferring some of his powers to Frederic Oudea.
Jean-Pierre Mustier, the head of the bank's investment banking unit, was also replaced.
After the losses became public, the bank was under threat of takeover and had to raise 5.5 billion euros to secure its finances, also weakened by subprime losses.
Kerviel, the only person to be charged over the largest rogue trading scandal in banking history, has said the bank must have been aware of his trading activities.