AML/CFT compliance in the Netherlands: a guide for foreign firms

By Mitchell Zandwijken · 19 August 2026 · updated 10 September 2026 · Guide for foreign firms

The Dutch anti-money laundering regime rests on the Wwft, is enforced by five different supervisors, and departs from most of the Union in one decisive respect: you report unusual transactions to FIU-the-Netherlands, not suspicious ones. If you carry on a listed activity from an establishment in the Netherlands you are an obliged entity here, whatever your group holds elsewhere, and a European passport does not move anti-money laundering supervision back to your home state. Foreign firms most often come unstuck on three things: the reporting threshold, the weight Dutch supervisors give to the business-wide risk assessment under article 2b Wwft, and the assumption that one supervisory relationship covers everything. From 10 July 2027 the directly applicable EU anti-money laundering regulation replaces much of the Wwft, which is a reason to build properly now rather than to wait.

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

Contents

The Wwft, and who it binds
Who supervises you
Three things that surprise foreign firms
The core obligations, in brief
Sanctions: a separate regime
The enforcement climate
What to build in the first ninety days
What changes on 10 July 2027

The Wwft, and who it binds

The Dutch regime rests on the Wwft — the Wet ter voorkoming van witwassen en financieren van terrorisme, the act on the prevention of money laundering and terrorist financing. It implements the European anti-money laundering directives, and until July 2027 it is the instrument your Dutch supervisor will hold you to, whatever your group framework is called.

The Wwft binds firms by activity, not by label. Article 1a lists the activities that make you an institution, an obliged entity, and if you carry on one of them from an establishment in the Netherlands you are in scope. A branch of a foreign bank, the Dutch subsidiary of a foreign payment institution and a locally registered crypto-asset service provider are all caught, and a European passport does not move anti-money laundering supervision back to your home state.

The obliged-entity population is much wider than the banking sector:

banks and other credit institutions, including branches of foreign banks;
payment and electronic money institutions, and payment service agents;
crypto-asset service providers;
investment firms, investment funds and their managers;
life insurers and the intermediaries who sell life policies;
trust offices, also subject to a separate act, the Wtt 2018;
accountants, tax advisers and administrative offices;
civil-law notaries and lawyers, for defined services such as property and company transactions;
estate agents, property valuers and letting intermediaries;
dealers in goods taking cash of EUR 10,000 or more, and pawnshops.

Two consequences follow that foreign firms discover late. The obligations attach to the Dutch establishment, so group policy has to be localised rather than translated. And scope is a legal question answered on facts — the services you provide, not the permission you hold — so answer it in writing before a supervisor asks you to.

Who supervises you

There is no single Dutch anti-money laundering supervisor. Five bodies divide the obliged-entity population between them, each with its own guidance and inspection style, and which one you answer to follows from what you do.

Supervisor	Sectors covered	What it emphasises
DNB (De Nederlandsche Bank)	Banks and bank branches, payment and electronic money institutions, trust offices, crypto-asset service providers, insurers	The business-wide risk assessment, demonstrable effectiveness of transaction monitoring, governance, and remediation
AFM (Autoriteit Financiële Markten)	Investment firms, fund managers, financial service providers and intermediaries	Client acceptance files, the fit between client risk profile and service, and integrity risk in distribution
BFT (Bureau Financieel Toezicht)	Civil-law notaries, accountants, tax advisers, administrative offices	File-based reviews of engagements, the gatekeeper role in property and corporate transactions, reporting behaviour
Deans of the bar (dekens)	Lawyers, for services within the Wwft	Supervision within legal professional privilege, through the local bar, focused on scope and the limits of the exemption
Bureau Toezicht Wwft (Tax Administration)	Estate agents, property valuers, dealers in goods, pawnshops and remaining non-financial categories	Thematic inspections, cash transactions, and whether firms report at all

FIU-the-Netherlands sits outside this table. It is not a supervisor: it receives unusual transaction reports, analyses them and decides which are declared suspicious, after which they become available to investigative and intelligence services. Criminal enforcement sits elsewhere again, with the Public Prosecution Service.

If your group holds more than one Dutch permission you may deal with two supervisors at once, on overlapping subject matter and to different timetables, so decide early who owns each relationship.

Three things that surprise foreign firms

Most of the regime will look familiar to anyone who has run a framework elsewhere in the Union. Three features will not, and they are where imported frameworks fail.

You report the unusual, not the suspicious. Almost every other member state has you file once suspicion has formed. The Wwft has you report an unusual transaction to FIU-the-Netherlands without delay — a lower threshold, reached when an objective indicator applies or when you have grounds to suppose a link to money laundering or terrorist financing. Whether something is suspicious is the FIU's judgement, not yours. Groups that leave the suspicion trigger in place under-report here, and an absence of reports is visible to a supervisor. The threshold, the indicators and the tipping-off prohibition are set out in reporting unusual transactions to FIU-the-Netherlands.

The business-wide risk assessment carries real weight. Article 2b of the Wwft requires you to identify and assess the risks of your own business — by client type, product, service, delivery channel, transaction type and country — and to keep that assessment current and available to the supervisor. In Dutch practice it is the SIRA, the systematic integrity risk analysis, and DNB treats it as the foundation on which every other control is judged: if your risk classifications, monitoring rules and enhanced due diligence triggers cannot be traced back to it, the conclusion is not that the analysis is thin but that the controls are unjustified. A group document with the Netherlands added as a country row will not carry that weight, which is where an AML/CFT framework review starts.

The supervisory landscape is fragmented, and sanctions sit on top of it. Five Wwft supervisors, a separate financial intelligence unit, professional bodies with their own rules, and, for financial institutions, a second regime under the Sanctions Act 1977. There is no single point of contact and no consolidated rulebook, so read your own supervisor's guidance rather than the sector's best-known. The obligations under the Dutch Sanctions Act show how that second regime, with a different logic, applies to the same client base.

The core obligations, in brief

A handful of obligations do most of the work. They are cumulative, and supervisors examine them as a chain running from the risk assessment down to the individual file.

Obligation	Where	What it means in practice
Business-wide risk assessment	Article 2b	A documented, current analysis of your own risks, from which policies and controls are derived
Policies and governance	Articles 2c and 2d	Written policy proportionate to the risks, a day-to-day policymaker responsible for compliance, and compliance and audit functions where size and nature require them
Customer due diligence	Articles 3 to 11	Identify and verify the client, establish the UBOs and control structure and the purpose of the relationship, classify the risk, screen for PEPs and sanctions — before onboarding
Transaction monitoring	Article 3(2)(d)	Continuous monitoring against the expected pattern for that client, with alert handling and documented outcomes
Reporting unusual transactions	Article 16	Report to FIU-the-Netherlands without delay once the unusual character is known, and never tell the client
Record keeping	Article 33	Retain due diligence data, transaction records and reports in retrievable form for five years after the relationship ends
Training	Article 35	Periodic training so staff recognise unusual transactions and apply due diligence, with content and attendance recorded

Customer due diligence is where most supervisory findings originate. The sequence runs from identification and verification, through the ultimate beneficial owners and the purpose of the relationship, to the risk classification that decides whether the simplified, standard or enhanced regime applies. If it cannot be completed, article 5 leaves no discretion: you do not onboard, and an existing relationship is terminated. The full sequence is in our article on the seven steps of customer due diligence, with the concepts behind it in what KYC means, what a UBO is and what a PEP is.

Monitoring and reporting are one chain: a model whose alerts nobody closes with a reasoned conclusion will not produce reports either. The typologies you are expected to recognise are covered in recognising money laundering, and the file-level check in how to run a Wwft check.

Record keeping and training are treated as administrative more often than they should be. Article 33 is what makes your work reconstructable two years later, and in a Dutch inspection an undocumented decision is one that was never taken. Article 35 is what makes the front line capable of noticing anything at all; generic training in the wrong language is discounted.

Sanctions: a separate regime, with a different logic

Sanctions compliance is not part of the Wwft and does not follow its risk-based approach. The prohibitions come from directly applicable EU regulations binding everyone in the Union, financial or not: freezing the funds and economic resources of listed persons, not making funds available to them, and observing trade and service restrictions. The national framework is the Sanctions Act 1977 (Sanctiewet 1977), under which those measures are given effect and enforced here.

Financial institutions carry an additional layer: the regulation on supervision under the Sanctions Act requires an administrative organisation and internal control framework aimed at sanctions compliance, and requires hits to be reported to DNB or the AFM. A breach is a criminal offence rather than a supervisory shortcoming: there is no de minimis amount, no exempt client category, and no room for a risk appetite that tolerates a few misses.

Foreign groups usually recognise the prohibitions and underestimate the Dutch overlay: list selection, screening moments, indirect ownership above fifty per cent, and the duty to freeze and report immediately rather than after internal review. Those mechanics are set out in obligations under the Dutch Sanctions Act 1977.

The enforcement climate

The Netherlands has seen major enforcement actions against financial institutions, including criminal settlements and mandatory remediation programmes running for years. The supervisory toolkit runs from a norm-transferring conversation, through a formal instruction (aanwijzing) and an incremental penalty payment (last onder dwangsom), to administrative fines in the millions. Serious breaches can be prosecuted as economic offences, and individual policymakers reassessed for fitness and propriety.

What makes the difference is rarely the presence of a policy but reconstructability: whether an outsider can follow, from the file alone, what you established, on what evidence, and who decided. Findings cluster around the same shortcomings: risk classifications set at onboarding and never revisited, monitoring rules inherited from a group model and never calibrated to the Dutch portfolio, alerts closed without a reasoned conclusion, and a reporting threshold that is still suspicion in substance. Remediation later is far more expensive than building the controls at entry, and it consumes the same senior people who are meant to be running the business.

What to build in the first ninety days

This sequence produces a defensible framework. It is deliberately ordered: each step is the input for the next, and skipping the first two makes the rest arbitrary.

Establish scope in writing. Which Wwft activities the Dutch establishment carries on, which supervisor follows from that, and whether the Sanctions Act regime applies too, with the reasoning recorded.
Write the business-wide risk assessment. Article 2b, about the Dutch business: clients, products, channels, transaction types and countries, with residual risk stated.
Appoint the people. Name the day-to-day policymaker responsible for Wwft compliance and the person who files reports, and be clear about what is done locally and what is relied on from the group.
Localise the policy. Rewrite the group framework against the Wwft: the unusual standard, the Dutch indicators, the article 5 refusal rule, escalation and retention. Translation is not localisation.
Rebuild the client acceptance file. Set out the due diligence steps, the evidence each requires, the risk classification model and the enhanced due diligence triggers, and test them on real files.
Calibrate monitoring to the Dutch portfolio. Start from the group scenarios, set thresholds against actual Dutch transaction data, and record why each rule exists.
Register with FIU-the-Netherlands. Arrange portal access, agree who reports and in what timeframe, and confirm the escalation works before you need it.
Implement sanctions screening. Choose lists, define screening moments for clients and transactions, and set the procedure for a confirmed hit: freeze, do not tip off, report.
Train the local team in the language they work in, on Dutch indicators, the unusual standard, tipping off and escalation, and record who attended.
Fix the review cycle. Set dates now for the annual risk assessment update, periodic file reviews, monitoring effectiveness testing and management reporting.

Where in-house capacity is the constraint, an interim MLRO or compliance-as-a-service covers the function while the permanent structure is recruited; how we work describes the usual phasing.

What changes on 10 July 2027

The European anti-money laundering package replaces the directive-based system with a single, directly applicable regulation. From 10 July 2027 the AMLR — Regulation (EU) 2024/1624 — applies in every member state, and much of what the Wwft now says will come from Brussels instead. AMLD6 covers registers, national supervision and financial intelligence units, and a new European supervisor, AMLA, sits above the national ones.

Instrument	What it covers	Key date
AMLR — Regulation (EU) 2024/1624	Directly applicable obligations for obliged entities: due diligence, beneficial ownership, reporting, internal policies	Applies from 10 July 2027
AMLD6 — Directive (EU) 2024/1640	Registers, national supervision, financial intelligence units, risk assessments	Transposition largely by 10 July 2027
AMLA Regulation — (EU) 2024/1620	The new EU anti-money laundering authority in Frankfurt	Operational since 2025; direct supervision of selected institutions from 2028

For a firm entering the market now, this is no reason to wait. The AMLR keeps the same building blocks and is more prescriptive about each, particularly about what has to be recorded. A framework built to satisfy the Wwft properly is the one you will map onto the regulation; a loose one you will build twice. Scope widens too: crypto-asset service providers under the full regime, traders in luxury goods, an EU-wide cash payment limit of EUR 10,000, and a later start in 2029 for sectors such as professional football clubs and agents.

What does change is where the rules come from and how much room the Netherlands has to differ. National discretion narrows and technical standards increasingly come from AMLA rather than DNB or the AFM, so Dutch policies will need recalibration article by article. The timeline is set out in our article on the EU AML package, and an AMLR gap analysis is the usual way to size the task. The glossary of AML and sanctions terms defines the vocabulary you will meet in supervisory correspondence.

Frequently asked questions

Does the Wwft apply to my Dutch branch if my group is supervised elsewhere in the EU?

Yes, if the branch carries on one of the activities listed in article 1a of the Wwft. Anti-money laundering supervision of an establishment in the Netherlands is exercised by the Dutch supervisor, and a European passport does not move that back to the home state. Group policy still applies, but it has to be localised to the Dutch rules, including the unusual-transaction reporting standard and the Dutch retention period.

Which supervisor will I deal with?

It follows from your activity. DNB supervises banks, payment and electronic money institutions, trust offices, crypto-asset service providers and life insurers. The AFM supervises investment firms, fund managers and financial intermediaries. The BFT supervises notaries, accountants, tax advisers and administrative offices. Lawyers are supervised by the deans of the local bar, and estate agents, dealers in goods and pawnshops by Bureau Toezicht Wwft, part of the Tax Administration. If you hold more than one Dutch permission you may deal with two supervisors at once.

Why does the Netherlands ask for unusual rather than suspicious transactions?

Because Dutch law separates the two judgements. You report what is unusual, which is reached when an objective indicator applies or when you have grounds to suppose a link to money laundering or terrorist financing. FIU-the-Netherlands then analyses the report and decides what is suspicious. The threshold is deliberately lower than the suspicion standard used in most member states, and reporting in good faith carries a statutory indemnity.

What is the SIRA and do I need one?

The SIRA is the systematic integrity risk analysis, the Dutch name for the business-wide risk assessment required by article 2b of the Wwft. Every obliged entity needs one, and it must cover the risks of its own business by client type, product, service, delivery channel, transaction type and country. Supervisors, DNB in particular, use it as the benchmark for judging whether your policies, risk classifications and monitoring rules are justified, so a generic group document with the Netherlands added as a row is not sufficient.

How long do I have to keep customer due diligence records?

Five years. Article 33 of the Wwft requires due diligence data, transaction records and reports to be retained in a retrievable form for five years after the business relationship ends or the occasional transaction is executed. The records must be available to the Dutch supervisor on request, which in practice means they need to be retrievable from the Netherlands even where the systems sit elsewhere in the group.

Is sanctions compliance covered by the Wwft?

No. Sanctions are a separate regime with a different logic. The prohibitions come from directly applicable EU regulations and are given effect nationally through the Sanctions Act 1977. For financial institutions supervised by DNB or the AFM there is an additional obligation to maintain an administrative organisation and internal control framework aimed at sanctions compliance and to report hits. Unlike the risk-based Wwft, sanctions rules have no threshold amount and no exempt client category, and a breach is a criminal offence.

Should I wait for the AMLR before building a Dutch framework?

No. The AMLR applies from 10 July 2027 and keeps the same building blocks as the Wwft while being more prescriptive about each, especially about documentation. A framework built to satisfy the Wwft properly is the framework you will map onto the regulation, and the obligations in the meantime are enforceable now. Waiting means running unsupervised risk for the intervening period and then building the same controls under time pressure.