Customer due diligence under the Wwft, step by step
Customer due diligence — CDD, or KYC — is the obligation in article 3 of the Wwft to establish who your client is, who ultimately owns or controls that client, what the relationship is for and how risky it is, before you take the client on. It runs in seven steps: identify, verify, establish the ultimate beneficial owners, establish the purpose and nature of the relationship, set the risk classification, screen for politically exposed persons and sanctions, and then monitor. The risk classification decides which of the three regimes applies — simplified, standard or enhanced — and how much evidence the file has to carry. If the due diligence cannot be completed, article 5 leaves no discretion: you do not onboard, and you exit an existing client.
Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.
When customer due diligence applies, and when it has to be done
The Wwft — the Wet ter voorkoming van witwassen en financieren van terrorisme, the Dutch anti-money laundering act — puts the customer due diligence obligation in article 3. Everything else follows from it: if you do not know your client, you cannot judge your client's transactions, or decide whether one is unusual enough to report.
The obligation lands on you if you carry on one of the activities listed in article 1a from an establishment in the Netherlands: a Dutch branch or subsidiary of a foreign bank, payment institution, crypto service provider, trust office, accountancy or tax practice, law firm or estate agency is in scope, and group policy written elsewhere does not displace the Dutch rules.
Article 3(5) sets out the triggers: before entering into a business relationship; before an occasional transaction of EUR 15,000 or more, including linked transactions; on any indication of money laundering or terrorist financing; and whenever you doubt the accuracy of client data obtained earlier. That last trigger is the one most often missed — stale data is a reason to reopen a file, not to leave it alone.
Article 4 fixes the timing: due diligence comes before the relationship is entered into or the transaction executed. Verification may be completed while the relationship is being established only where interrupting the service would be disruptive and the risk is demonstrably low — a narrow, documented exception. The seven steps below map onto the components of article 3(2).
- Identify the client, and anyone acting on the client's behalf.
- Verify that identity against reliable, independent sources.
- Establish the ownership and control structure and the ultimate beneficial owners.
- Establish the purpose and intended nature of the business relationship.
- Determine the risk classification, and therefore which regime applies.
- Screen for politically exposed persons and against the sanctions lists.
- Monitor the relationship and keep the file current.
From 10 July 2027 these rules come directly from Regulation (EU) 2024/1624, the EU anti-money laundering regulation, which keeps the steps but is stricter about what you record.
Steps 1 and 2: identify the client and verify the identity
Identification is establishing what the client says its identity is. Verification is testing that claim against something you did not get from the client. Files fail Dutch reviews far more often on the second than on the first.
For a natural person you establish name, date of birth and address. For a legal entity: legal form, statutory name, any trade name, registered office and the registration number in the Dutch trade register held by the Kamer van Koophandel (KVK) or its foreign equivalent. Article 3(2) also requires you to establish and verify whether the person in front of you may act for the client. A reliable, independent source is one outside the client's control that a third party can check afterwards.
| Client type | What you establish | Acceptable verification |
|---|---|---|
| Natural person, in person | Name, date of birth, address | A valid identity document; record its type, number and the date of the check |
| Natural person, remote | The same data | A notified electronic identity means, an NFC chip read, or a tested flow with liveness and document authentication |
| Dutch legal entity | Legal form, name, seat, registration number | A current KVK extract, with the deed of incorporation where the structure is not obvious |
| Foreign legal entity | The same data | The equivalent official register, plus a certificate of good standing or notarised documents where the register is thin |
| Representative | Identity and authority | Identity document plus power of attorney, board resolution or the register's list of signatories |
Record which document you relied on. "Identity confirmed" is not reconstructable; "passport, number and chip checked on 4 March by J. de Vries" is.
Step 3: establish the ultimate beneficial owners
The ultimate beneficial owner — uiteindelijk belanghebbende, UBO — is the natural person who ultimately owns or controls the client; the Uitvoeringsbesluit Wwft 2018 sets out the categories per legal form. The familiar indication is an interest of more than 25 per cent of the shares, voting rights or ownership interest, but ownership and control are separate routes: someone holding no shares can still be a UBO because they in fact determine what happens. Where no UBO can be identified after every reasonable means is exhausted, the senior managing officials are recorded as the fallback, with the reason.
Two rules bite hardest on foreign structures. First, you take reasonable measures to verify the UBO rather than recording what the client tells you. Second, you may not rely exclusively on the UBO register. The Dutch register is held by the KVK; general public access closed after the Court of Justice judgment of November 2022, and Wwft institutions retain access. It is a check on your findings, not a substitute for them, and a difference between the two must be reported to the KVK.
With multi-layer or cross-border structures this is the hardest part of the file. Work it mechanically.
- Draw the structure upwards until every branch ends in a natural person.
- Collect evidence per layer: register extracts, shareholder registers, articles, trust deeds.
- Calculate interests through the chain, not at each single level.
- Test control routes separately: voting agreements, veto rights, the power to appoint or dismiss the board.
- Resolve in writing any difference between your outcome, the register and the client's account, then date the chart and name who prepared and reviewed it.
A deliberately opaque structure is itself a risk signal that belongs in step 5.
Steps 4 and 5: purpose of the relationship and risk classification
Article 3(2) requires you to establish the purpose and intended nature of the business relationship. "Payment services" is not an answer. Record what the client will use you for, which products, the expected volumes, values and frequency, the expected counterparties and countries, and the origin of the funds. This is the baseline against which later transactions are judged; a vague baseline makes monitoring meaningless, because nothing can deviate from it.
The risk classification combines four dimensions — client characteristics, product or service, delivery channel and geography — and places the client in a band such as low, medium or high, using the same bands as your institution-wide risk assessment under article 2c. It determines which regime applies, how much evidence you gather, who approves the relationship and how often you review it.
| Regime | When it applies | What it means in practice |
|---|---|---|
| Simplified (article 6 Wwft) | Demonstrably low risk | Lighter measures, never no measures. You still identify, verify and monitor, and you record the reasoning for the lower intensity |
| Standard (article 3 Wwft) | Ordinary risk | The full set of steps 1 to 7, evidenced in the file |
| Enhanced (articles 8 and 9 Wwft) | Higher risk: politically exposed persons, high-risk third countries designated by the European Commission, complex structures, unusual transaction patterns | Source of wealth and funds, senior management approval, more intensive monitoring |
Simplified due diligence is the regime firms new to the Dutch market most often apply wrongly: it is a conclusion reached after assessing risk, not a starting position.
Step 6: politically exposed persons and sanctions screening
Establish whether the client, the UBOs, or their immediate family members and known close associates are politically exposed persons. A PEP is someone entrusted with a prominent public function, and the Dutch regime covers domestic as well as foreign PEPs. Where a PEP is involved, article 8 requires senior management approval to enter into or continue the relationship, measures to establish the source of the wealth and of the funds, and intensified monitoring. PEP status is not in itself a reason to refuse a client; the requirement is to understand and control the risk, and record that you did.
Sanctions screening sits in the same working process but rests on different law. It follows from the Sanctiewet 1977 and directly applicable EU regulations, not from the Wwft, and it has no risk-based lower limit: no client is too low-risk to screen. Screen the client, UBOs and representatives, and for transactions the counterparties and intermediary banks. Rescreen the portfolio whenever the lists change, and remember that an entity owned 50 per cent or more, or controlled, by a listed party is caught even where it appears on no list. Every hit, and every dismissal of one as a false positive, needs a written assessment with a name and a date on it.
Step 7: monitor the relationship and keep the file current
Due diligence is not an onboarding event. Article 3(2) requires continuous monitoring of the relationship and of the transactions carried out during it, so that they remain consistent with what you know about the client, the risk profile and, where necessary, the origin of the funds. Three things run in parallel.
- Transaction monitoring against the pattern recorded in step 4, with alerts a person assesses and closes with reasons.
- Periodic review at a frequency driven by the risk classification. The Wwft prescribes no fixed intervals, so your policy sets and justifies them; a common design is annual for high risk, every two to three years for medium, event-driven for low.
- Event-driven review on triggers: a new or changed UBO, a restructuring, adverse media, a sanctions list change, or transactions that do not fit the profile.
A review that only confirms the documents are still on file is not a review. The question is whether the classification is still correct — and if it changed, the file shows the new rating, the reason and the date.
What the file has to show
Article 33 of the Wwft requires you to record the data obtained during due diligence and keep it retrievable for five years after the end of the relationship or the execution of the occasional transaction. The test Dutch supervisors apply is reconstructability: can an outsider follow, from the file alone, what you established, on what evidence, when, and who decided?
- Identity data of the client and of anyone acting for it, with the type, number and date of the verification document.
- The ownership and control structure, the UBOs identified, and the measures taken to verify them.
- The purpose and intended nature of the relationship, concrete enough to deviate from.
- The risk classification, the factors behind it, and the regime applied.
- For enhanced due diligence: source of wealth and funds, and the senior management approval, with names and dates.
- Screening results, review history, trigger events and every change of rating.
Where you outsource part of the process or rely on a group entity abroad, the responsibility stays with you and the records must be available to the Dutch supervisor on request.
When you must refuse or exit the client
Article 5 of the Wwft is unambiguous. If you cannot complete the due diligence — the identity cannot be verified, the UBO cannot be established, the purpose stays unexplained, or the client will not cooperate — you may not enter into the relationship, you may not carry out the transaction, and an existing relationship must be terminated. There is no discretion to onboard and finish the file later.
That is not the end of the analysis. You also assess whether the circumstances make this an unusual transaction, to be reported to FIU-Netherlands without delay under article 16; failure to complete due diligence is often an indicator in its own right. Record both decisions separately, observe the prohibition on tipping off — never tell the client a report has been or will be made — and complete the file before the relationship closes, since the retention period runs from the exit date.
Most deficiencies found in Dutch file reviews are variations on a short list.
- Copying the UBO register into the file without independent assessment.
- Risk classifications set at onboarding and never revisited.
- Purpose and nature of the relationship completed as an empty formality.
- Enhanced due diligence applied in name, without the additional measures being recorded.
- Files without a date, a source and a named assessor, and so not reconstructable for a supervisor.
Frequently asked questions
When must customer due diligence be completed?
As a rule before the business relationship is entered into or the transaction is carried out, as article 4 of the Wwft requires. Due diligence is also triggered by an occasional transaction of EUR 15,000 or more, by any indication of money laundering or terrorist financing, and by doubt about the accuracy of client data obtained earlier. Verification may only be completed during the establishment of the relationship where interrupting the service would be disruptive and the risk is demonstrably low, and that decision has to be documented.
Can I rely on the Dutch UBO register?
No, not exclusively. You must take your own reasonable measures to establish and verify the ultimate beneficial owners and then assess whether the register is consistent with your findings. The register at the Kamer van Koophandel is a check on your work, not a substitute for it, and where your findings differ from the register you have a duty to report the discrepancy.
What counts as a reliable and independent source?
A source outside the client's control that a third party can check afterwards. For natural persons that is typically a valid identity document or a reliable means of remote identification; for legal entities an extract from the trade register, supported by the deed of incorporation where the structure is not obvious; for foreign entities the equivalent official register or comparable notarised documents. Record which document you used, its number and the date of the check, not merely that the identity was verified.
What is the difference between simplified, standard and enhanced due diligence?
Simplified due diligence under article 6 of the Wwft applies where the risk is demonstrably low and allows lighter measures, but never no measures, and the reasoning must be recorded. Standard due diligence is the full set of steps under article 3. Enhanced due diligence under articles 8 and 9 applies to higher risk situations such as politically exposed persons, high-risk third countries and complex structures, and requires additional measures including source of wealth and source of funds, senior management approval and more intensive monitoring.
Is a politically exposed person a reason to refuse a client?
No. PEP status triggers enhanced due diligence, not automatic refusal. You need senior management approval to enter into or continue the relationship, measures to establish the source of the wealth and of the funds, and intensified monitoring. Treating every PEP as an automatic exit is itself a supervisory concern, because the obligation is to understand and control the risk rather than to avoid a client category.
What do I do if the due diligence cannot be completed?
Under article 5 of the Wwft you may not enter into the business relationship or carry out the transaction, and an existing relationship must be terminated. You then assess separately whether the circumstances amount to an unusual transaction that must be reported to FIU-Netherlands without delay under article 16. Both decisions belong in the file, and you must not tell the client that a report has been made.
How long must customer due diligence records be kept?
Article 33 of the Wwft requires the data obtained during due diligence to be recorded and retained in retrievable form for five years after the end of the business relationship or the execution of the occasional transaction. The period for an exited client runs from the exit date, so the file has to be complete before the relationship closes.
Sources
- Wwft — Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (wetten.overheid.nl)
- Uitvoeringsbesluit Wwft 2018 — implementing decree, UBO categories (wetten.overheid.nl)
- UBO register — Kamer van Koophandel (KVK)
- Regulation (EU) 2024/1624 (AMLR) — EUR-Lex
Read next
Facing this in practice? In a free thirty-minute call we look at your situation with you and say plainly whether we can help. Book a call or ring +31 6 11 32 53 62.