A payment institution that had outgrown its own AML framework

By Mitchell Zandwijken · 10 September 2026 · Wwft, risk assessment, monitoring

Example case — not an existing client. This case was written to show how we work. The situation is assembled from patterns we encounter at comparable institutions; the organisation, the figures and the outcomes are illustrative and do not trace back to any client of ZandKade Compliance. The amounts match our published rates.

A payment institution grew from 900 to over 9,000 corporate clients in two years, while its policy, risk assessment and monitoring scenarios still dated from the year of its licence application. When DNB sent a first information request, nobody could explain why the institution did what it did. In fourteen weeks we rebuilt the risk assessment, aligned acceptance and due diligence policy to it, recalibrated and justified the monitoring scenarios, and took the MLRO out of the operational reporting line.

Type of institution: Licensed payment institution, around 40 FTE
Client base: Over 9,000 corporate clients, no consumers
Supervisor: De Nederlandsche Bank
Trigger: First information request after two years of rapid growth
Duration: 14 weeks, in four phases
Client's own effort: Around 40 hours across the MLRO, operations and IT
Investment: Gap analysis € 9,500 excluding VAT; implementation support on a day rate with an agreed cap

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

Contents

The situation
What we found
Our approach in four phases
What was delivered
The outcome
What you can take from this
Duration and investment
Questions that come up

The situation

The institution had been licensed as a small firm with a single, manageable product: payouts on behalf of Dutch web shops. Two years later it ran three product lines, one of which was bulk payouts to self-employed workers in five countries, and the client base had grown tenfold. The policy had not been touched in those two years. That is not negligence in bad faith — it is what happens when a compliance function designed around one product has to keep pace with a commercial team growing three times as fast.

The immediate trigger was an information request from DNB: policy documents, the risk assessment, an overview of reports filed, and a sample from the client base. The request itself was routine. The discomfort came from realising the institution could only answer it with documents that no longer described its own practice.

If you are entering the Dutch market from abroad, note the framing: Dutch AML supervision is risk-based, which means the law rarely prescribes one correct method. It requires you to know your risks, choose measures to match, and be able to justify that choice. A supervisor does not test whether you ticked a box; it tests whether your reasoning holds.

What we found

We start every engagement with a baseline: reading documentation, looking at systems, and speaking to the people who actually do the work. That last part almost always produces the real picture.

The risk assessment did not mention the newest product line. Payouts to self-employed workers abroad — by then a third of volume — did not appear in it at all. Which meant no control had been designed for it either.
Client risk classification had two categories. Standard and high. Anything not obviously high risk became standard. At nine thousand clients that is not a risk-based approach; it is one approach for everyone.
Sixty per cent of high-risk files had no recent review. The policy required an annual reassessment. Nothing in the process checked whether it happened.
Monitoring scenarios were still on vendor defaults. Nobody could explain why a threshold sat at a particular amount. The answer to where it came from was the one we hear most often: that is how it was delivered.
Three of twelve reports were late. Dutch law requires you to report to the FIU without delay once the unusual nature of a transaction becomes known. Between signal and report there were nine working days on average, with outliers of three weeks.
The MLRO reported to the COO. The same person responsible for onboarding turnaround times assessed the compliance officer who sometimes had to stop that onboarding.

That last finding is the most important and the cheapest to fix. An MLRO whose appraisal is written by the person whose work he blocks is formally present and effectively absent.

Our approach in four phases

Weeks 1 to 3 — baseline. Documentation, system settings and a sample of 60 client files across all three product lines. Conversations with onboarding, the monitoring analysts, the MLRO and two board members. Output: a findings report with the gaps ordered by risk, not by chapter.
Weeks 4 to 7 — risk assessment and policy. The risk assessment rebuilt from the actual product lines, client segments, channels and countries. Four risk classes derived from it instead of two, each with a concrete level of due diligence. Acceptance policy and enhanced due diligence policy aligned to that.
Weeks 8 to 11 — monitoring and file remediation. Every monitoring scenario reviewed against one question: which risk from the assessment does this cover, and why is the threshold here? Scenarios covering no identified risk were removed; two new ones were added for the new product line. Alongside that, a plan for the overdue reviews, sequenced by risk rather than alphabetically.
Weeks 12 to 14 — governance, training and accountability. The MLRO's job description and reporting line revised, a reporting procedure with deadline tracking put in place, a role-based training plan drawn up, and a board report built so the board can see monthly whether the framework works.

What was delivered

A risk assessment covering all three product lines, with a named control and an owner per risk.
Acceptance and due diligence policy with four risk classes and a written level of investigation for each.
A recalibration record per monitoring scenario: which risk, which threshold, what justification, what test results.
A reporting procedure with a clock that starts at the signal, making "without delay" measurable rather than aspirational.
A remediation plan for the overdue reviews, phased over six months and ranked by risk.
A job description for the MLRO with a direct reporting line to the board and a written right of escalation.
A training plan with different content for onboarding, analysts, commercial staff and the board.

The outcome

Alert volume fell by close to forty per cent while the number of genuine signals stayed the same. That is not a cut in detection but the removal of noise: scenarios firing on every monthly payment were replaced by scenarios firing on deviation from expected behaviour. Analysts gained the time to investigate what remained.

Time between signal and report went from nine working days to two. Not by working harder, but by changing one thing: the clock now starts at the signal and is visible to the MLRO.

The DNB request could be answered by pointing at one coherent set of documents. More important than the documents themselves: every follow-up question about a choice had a justification available. That is what supervision comes down to — not whether you do something, but whether you can explain why you do it that way.

What you can take from this

Growth is an integrity risk in itself. A framework that worked at a thousand clients fails at ten thousand not because it was bad, but because it was designed for something else. Tie risk assessment updates to product changes, not to an annual calendar entry.
Two risk classes are not a risk-based approach. If almost everyone lands in the same class, you are doing the same thing everywhere — precisely what the law does not ask for.
Justification weighs more than completeness. An institution with four scenarios it can explain is in a stronger position than one with forty that came out of the box.
MLRO independence is a structural question, not a matter of character. Whoever assesses the MLRO determines, in practice, how much weight that person's opinion carries.

Duration and investment

The baseline and the accompanying gap report were a fixed-price engagement: € 9,500 excluding VAT, within the range published on our AML/CFT service page. Implementation support afterwards ran on a day rate with a cap agreed in advance, so the board could release budget without an open end.

The fourteen-week duration was set not by our pace but by two things on the client's side: IT availability for the scenario changes, and the decision on the MLRO's reporting line. The latter is almost always the slowest part, because it is not a compliance decision but a board decision.

Questions that come up in this kind of engagement

How do I know whether our framework has fallen behind our growth?

Three questions usually settle it. Does your newest product appear in the risk assessment? Can anyone explain why a monitoring threshold sits at its current value? And do you meet your own standard for periodic reviews? If any answer is no, the set-up is lagging behind the practice.

Should we clear the file backlog first, or revise the policy first?

Policy first, for a practical reason: if you remediate files against a standard you then change, you do the work twice. You do start immediately on the files that fall short under any conceivable standard — those do not depend on the outcome.

What if the supervisor asks questions while we are still working?

That is the rule rather than the exception, and it is not a problem provided you give an honest picture. An institution that says where it stands and submits a dated remediation plan is in a stronger position than one that gives a reassuring answer which collapses at the first file sample.

Do you also sell the software we monitor with?

No. We sell no software and receive no commission from vendors. Advice to replace a system therefore never stems from an interest on our side — and in this case the advice was to keep the existing system and configure it differently.