The Dutch Sanctions Act 1977 and your obligations

By Mitchell Zandwijken · 4 September 2026 · Sanctions, screening, freezing

The Sanctions Act 1977 is the Dutch framework act under which EU and UN sanctions are given effect and enforced in the Netherlands, and breaching a sanctions measure is a criminal offence rather than a supervisory failing. The prohibitions themselves come from directly applicable EU regulations and bind everyone in the Union, financial or not; the duty to build an internal control framework and to report hits binds financial institutions supervised by DNB or the AFM. Unlike the risk-based anti-money laundering regime, sanctions compliance is rule-based: there is no threshold amount and no exempt client category. For a foreign group operating in or through the Netherlands, the prohibitions will be familiar — the Dutch supervisory and criminal overlay usually is not.

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

Contents

Four instruments, one set of obligations
Who is bound by what
Rule-based, with no de minimis
The more-than-50 per cent rule
Screening moments and list selection
On a confirmed hit
Sectoral measures and circumvention
Where firms get caught out

Four instruments, one set of obligations

Sanctions reach a firm in the Netherlands through three layers. UN sanctions are implemented into EU law. EU sanctions regulations then apply directly to everyone inside the Union — no national transposition needed, binding banks and trading companies alike. On top of that sits national regulation: the Sanctions Act 1977 (Sanctiewet 1977) as a framework act, the sanctions orders made under it, and the national terrorism list.

If you are a foreign group with a Dutch branch, subsidiary or payment flow, you face two kinds of instrument at once: the prohibitions come from Brussels, while the supervisory architecture, the reporting line and the criminal liability come from The Hague. Four instruments do most of the work.

Instrument	What it does	Who it binds
EU sanctions regulations	Directly applicable prohibitions: freezing of funds and economic resources, the ban on making funds or resources available, trade, service and technology restrictions	Everyone inside the EU, and EU nationals and EU-incorporated entities outside it
Sanctions Act 1977 (Sanctiewet 1977)	The national statutory basis for giving effect to and enforcing international sanctions in the Netherlands	Everyone in the Netherlands
Regulation on Supervision under the Sanctions Act 1977 (Regeling toezicht Sanctiewet 1977)	Requires an administrative organisation and internal control framework aimed at compliance with sanctions rules, and the reporting of hits	Financial institutions supervised by DNB and the AFM
Economic Offences Act (Wet op de economische delicten)	Makes breach of a sanctions measure a criminal offence	Everyone

Breach of a sanctions measure is an economic offence in the Netherlands and can be prosecuted criminally — a materially different exposure from an administrative fine under the anti-money laundering regime, and one your board should understand as such.

Who is bound by what

The prohibitions bind everyone. The freeze obligation and the ban on making funds or economic resources available to a designated party flow from the EU regulations, and apply to a freight forwarder, a machine builder, a law firm, a software vendor and a bank equally. There is no licensing threshold and no sectoral carve-out.

The internal-control duty binds a narrower group. The explicit obligation to organise your administrative organisation and internal control (in Dutch, AO/IC) so that sanctions rules are complied with, and to report hits to your supervisor, comes from the Regulation on Supervision under the Sanctions Act 1977. That regulation is addressed to financial institutions under the supervision of De Nederlandsche Bank (DNB) or the Netherlands Authority for the Financial Markets (AFM) — banks, payment and electronic money institutions, insurers, investment firms and fund managers, trust offices and crypto-asset service providers among them.

For a non-financial company the absence of that explicit duty is cold comfort. The prohibition still applies in full, and a firm with no screening cannot prevent a breach or show afterwards that it acted with due care. The supervised-institution framework is best read as a description of what adequate control looks like, which a firm outside it is expected to match by its own route.

Note the reach in the other direction as well: EU regulations follow EU nationals and EU-incorporated entities outside the Union, so a Dutch subsidiary of a non-EU group pulls more of its parent's activity into scope than group compliance functions tend to expect.

Rule-based, with no de minimis

If you have built your financial-crime function around the anti-money laundering regime, that mental model will not transfer. The Dutch AML act, the Wwft, and the EU directives behind it are risk-based: you calibrate the depth of your due diligence to the risk and document why the calibration was reasonable. Reasonableness is a defence.

Sanctions do not work that way. Sanctions compliance is rule-based and, in substance, an obligation of result. There is no threshold amount below which the freeze obligation does not bite, no client category out of scope, and no low-risk determination that excuses a missed designation. A single breach is a breach.

Two consequences follow. Sanctions screening has to be designed, tested and evidenced as a control in its own right, not bolted onto the customer due diligence workflow. And tuning decisions must be defensible in a way AML calibration rarely needs to be: if you raise a fuzzy-matching threshold and a designation slips through, the fact that the risk looked low is no answer.

Ownership and control: the more-than-50 per cent rule

Name screening alone will not keep you compliant, because designations propagate through corporate structures. An entity that is owned, directly or indirectly, as to more than 50 per cent by a designated party is itself treated as caught by the asset freeze, even though it appears on no list under its own name. Ownership can be aggregated: two designated persons holding 30 and 25 per cent respectively bring the entity into scope between them.

The control limb is broader still and has no percentage attached. Where a designated party can in fact determine the entity's decisions — through a shareholders' agreement, a golden share, board appointment rights, veto powers or a dominant creditor position — the entity falls within the freeze regardless of the shareholding on paper.

Making this operational requires three things most firms lack at the outset: ownership data going up the chain rather than one layer, a documented decision on how deep you look and when, and a record of the conclusion that can be re-examined when the structure or the list changes.

The test also has to be reassessed when circumstances change rather than fixed at onboarding: the designation of a shareholder brings the whole structure into scope on the day it is published, and a divestment that drops a holding to just under the threshold around that date deserves scrutiny rather than relief.

Screening moments and choosing your lists

Screening is not one control but several, applied at different moments. Get the moments wrong and the quality of your matching engine is irrelevant.

Map your exposure first. Which countries, currencies, counterparties, goods and payment corridors touch you? Without that picture you calibrate in the dark.
Choose your lists deliberately, and write down why. The EU consolidated list, UN designations and the Dutch national terrorism list are mandatory. The US OFAC lists and the UK consolidated list are not automatically binding on an EU firm, but become unavoidable once you clear US dollars, use a US correspondent bank, hold US-origin technology or deal with UK counterparties.
Screen at acceptance. Against the full relationship circle — not just the contracting party but its beneficial owners, directors, authorised representatives and, where relevant, the beneficiaries of the arrangement.
Screen the whole book on every list change. Lists change frequently, sometimes several times a month and occasionally overnight. A rescreen of the entire portfolio after every relevant update is the only defensible standard. Quarterly batch screening is demonstrably too late.
Screen transactions where they apply. For payments: the counterparty, the intermediary and correspondent banks, and the free-text fields. For goods flows: consignees, end users, vessels and the route.
Calibrate the matching, and keep the evidence. Fuzzy matching set too wide drowns your team in false positives; too narrow and it misses genuine hits. Use secondary identifiers — date of birth, country, registration number — to discriminate rather than to loosen the threshold, and retain the test set you tuned against.
Test the control periodically. At least annually, and after any change of tooling, data source or client population. An independent check that the screening does what you believe it does is the most useful evidence you can put in front of a supervisor.

What to do on a confirmed hit, and who you tell

On a confirmed match the EU regulations impose two immediate obligations: freeze the funds and economic resources of the designated party without delay, and make nothing available to that party, directly or indirectly. Economic resources are broader than money — goods, receivables, leased assets and access to services all count.

Stop the action. No payment, no delivery, no service, and no finishing off what is already in train.
Verify the match. Compare name, date of birth, address, passport or registration number against the listing entry, and record the comparison.
Freeze. Funds and economic resources both. Do not settle with the client first and report afterwards; the freeze takes precedence.
Report without delay. Financial institutions report a freeze or a confirmed correspondence with a sanctions list to their supervisor — DNB for banks, payment institutions, insurers, trust offices and crypto-asset service providers, the AFM for investment firms, fund managers and other institutions under its supervision. Other companies report to the competent authority for the regulation concerned.
Document. Who decided what, when, and on what basis. This file is what shows, months later, that you acted correctly.
Evaluate. How did this party get in — a gap in acceptance, in matching, or in list management?

Dismissing an alert as a false positive is itself a decision that has to be recorded with its reasoning. An undocumented discount is indistinguishable, after the fact, from no review at all.

Beyond asset freezes: sectoral measures and circumvention

Designations and freezes are only part of the picture. Particularly since the Russia packages, EU sanctions include broad sectoral measures: export bans on dual-use items and advanced technology, import bans, prohibitions on providing specified services, and price caps.

The consequence for compliance design is significant: a transaction can be prohibited even though no party to it appears on any list. Name screening will not detect an export of a controlled item to a prohibited destination, or a prohibited service supplied to a counterparty in good standing. Those controls sit in your product, contract and logistics processes, not in your matching tool.

Anti-circumvention deserves its own place in the risk assessment. The recurring patterns are transshipment through third countries, newly incorporated intermediaries next door, front persons, sudden changes of end user, unexplained routing and goods a counterparty has no plausible use for. Participation in circumvention is prohibited in its own right, and having reason to suspect it is enough — wilful blindness is not a defence.

Where firms get caught out

The same failures repeat across sectors and sizes.

Screening only at onboarding, and not on list changes or at transaction level.
Leaving beneficial owners, representatives and beneficiaries outside the screened population.
Failing to operationalise the ownership and control test — no ownership data, no assessment, no record.
Discounting hits as false positives without a documented review.
No escalation path, so freezing and reporting happen too late, or not at all outside office hours.
Treating the tool as the control, rather than the tool plus the people, the data and the tuning evidence.

A workable minimum for a firm operating in or through the Netherlands looks like this.

A sanctions risk assessment covering countries, clients, products, counterparties and payment flows, including circumvention risk.
Documented list selection, with reasoning on OFAC and UK lists.
Screening at acceptance, on every list update across the whole book, and per transaction.
A defined approach to ownership and control, with a stated depth of enquiry.
A freeze-and-report protocol with named decision-makers and an out-of-hours route.
Periodic independent testing against a controlled test set, retained.
Clear allocation of responsibility at board level.

Proportionality applies to the design of the framework, not to the obligation. A twelve-person firm does not need a bank's control environment, but it does need to show that it screens, that it looks through structures, and that it knows what it would do when a match comes back confirmed on a Friday afternoon.

Frequently asked questions

Does the Dutch Sanctions Act 1977 apply to non-financial companies?

The EU sanctions regulations apply directly to everyone in the Union, including trading, logistics, manufacturing and professional services firms. The specific obligations on administrative organisation, internal control and reporting under the Regulation on Supervision under the Sanctions Act 1977 are addressed to financial institutions supervised by DNB and the AFM. But the prohibition on making funds or economic resources available to a designated party applies to every business, and breaching it is an economic offence under the Economic Offences Act.

What is the more-than-50 per cent rule in sanctions screening?

An entity that is owned, directly or indirectly, as to more than 50 per cent by a designated party is treated as caught by the asset freeze itself, even if it does not appear on any list. Holdings by several designated parties are added together. The same result follows from control, with no percentage attached: whoever can in fact determine the entity's decisions brings it within the scope of the measure. That is why name screening alone is not enough and you need insight into ownership and control structures.

Who do I report a sanctions hit to in the Netherlands?

Financial institutions report a freeze or a confirmed correspondence with a sanctions list without delay to their supervisor: De Nederlandsche Bank for banks, payment institutions, insurers, trust offices and crypto-asset service providers, and the Netherlands Authority for the Financial Markets for investment firms, fund managers and other institutions under its supervision. Companies outside financial supervision report to the competent authority for the regulation concerned. Freeze first and report afterwards, and record every step with the time and the decision-maker.

How often do we have to screen our entire client book?

On every change to the sanctions lists that are relevant to you, which can be several times a month. In practice that means an automated rescreen of the full population after each list update, in addition to screening at acceptance and screening per transaction where that applies. A quarterly screening cycle is demonstrably too late.

How is sanctions compliance different from anti-money laundering compliance?

The anti-money laundering regime is risk-based: you weigh how much due diligence a client requires and you document why that judgement was reasonable. Sanctions have no risk weighting and no threshold amount. A designated party is prohibited, full stop. That makes sanctions a rule-based obligation with zero tolerance, which you have to design and test as a separate control rather than as part of your customer due diligence workflow.

Can a transaction be prohibited if nobody involved is on a sanctions list?

Yes. EU sanctions include sectoral measures alongside designations: export bans on dual-use and advanced technology items, import bans, prohibitions on providing specified services, and price caps. A transaction can therefore be prohibited because of the goods, the service, the destination or the price, even though no party appears on any list. Participation in circumvention is separately prohibited, and having reason to suspect circumvention is enough to trigger the prohibition.

What happens if we get it wrong?

Breach of a sanctions measure is an economic offence in the Netherlands under the Economic Offences Act and can be prosecuted criminally, against the company and in principle against the individuals who directed the conduct. Supervised institutions face administrative measures from DNB or the AFM in addition. The practical exposure also includes frozen counterparty relationships, correspondent banking consequences and reputational damage that outlasts the underlying case.