How to run a Wwft check: from intake to a recorded decision

By Mitchell Zandwijken · 4 September 2026 · Wwft check, onboarding

A Wwft check is the review you carry out before you provide a service: who the client is, whether that identity holds up, who the ultimate beneficial owner is, what this client wants from you, and what risk that brings. The law calls it customer due diligence, and it is not one lookup in one database but a sequence of steps that ends in a written judgement. It is an obligation of result: if the check is not finished, the service may not go ahead. For smaller firms the hard part is rarely the law itself — it is knowing which sources count, when the risk classification forces enhanced measures, and what has to sit in the file afterwards.

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

A Wwft check is not one lookup

People talk about doing a Wwft check as if it were one search in one database. It is not. The Wwft — the Dutch act against money laundering and terrorist financing — calls it cliëntenonderzoek, customer due diligence, and article 3 sets out what it has to produce: who the client is, whether that identity holds up, who the ultimate beneficial owner is, what the client wants from you, whether anyone involved appears on a sanctions list or holds a prominent public function, and what risk all of that adds up to. Run in order, it looks like this.

1. Decide whether you are an obliged entity for this specific service. For lawyers, accountants and tax advisers that depends on the activity, not on the firm as a whole.
2. Identify the client and, where the client is an entity, the individual who acts on its behalf.
3. Verify that identity against reliable and independent sources.
4. Establish and verify the UBO. Look through the structure until you reach a natural person. See what is a UBO.
5. Screen against sanctions lists and for PEP status, including UBOs and representatives.
6. Record the purpose and intended nature of the relationship, concretely enough to recognise a deviation later.
7. Set the risk classification and decide which level of due diligence follows from it: simplified, standard or enhanced.

Two features catch smaller firms out. First, this is an obligation of result, not of effort. Article 5 of the Wwft is blunt: where customer due diligence cannot produce the required result, you do not enter into the relationship, you do not carry out the transaction, and where the relationship already exists you end it. Second, ending the relationship is a separate decision from reporting. If the refusal to cooperate is itself a reason to suspect money laundering, an unusual transaction report to FIU-Nederland is due under article 16, and that second decision is routinely forgotten once the first has been taken. See reporting unusual transactions.

You do not run the check only at onboarding. These moments trigger one.

• Before entering into a business relationship, and before the service begins.
• On an occasional transaction above the applicable threshold, or a series of demonstrably connected transactions.
• On any suspicion of money laundering or terrorist financing — irrespective of amount or threshold.
• On doubt about data obtained earlier, for example after a change in the ownership structure or a screening hit.
• At the periodic review, at the frequency that belongs to the client's risk classification.

Are you an obliged entity, and who supervises you

The Wwft covers a far wider group than banks. Article 1a runs from payment and crypto service providers through to civil-law notaries, accountants, tax advisers, estate agents, valuers, trust offices and dealers in goods who accept large cash payments. Which category you fall into also determines your supervisor, and supervisors differ in what they ask and how they inspect.

For the professional categories the scope is narrower than the profession itself: a tax adviser filing a routine income tax return is in a different position from the same adviser structuring a share transfer. Decide this per engagement and write the answer down — a file that never states why the Wwft applied cannot be defended two years later.

What to collect, per type of client

The difference between a natural person and a legal entity is not one of degree. With an individual you verify one identity. With an entity you verify an identity, a representative, a structure and one or more UBOs — four separate things, and the last two are where files are thin.

The trap: an extract is a snapshot. For a client you serve over several years, structure data ages far faster than identity data — and it is the structural changes that matter. An expired passport is a minor problem; a shareholder replaced eighteen months ago who never reached your file is a real one.

Which sources count as reliable and independent

The Wwft requires verification against sources that are reliable and independent of the client. That phrase excludes more than firms assume: a document the client produced, or could have produced, is not independent.

• A valid identity document, checked against the person in front of you or through a verified digital identification process.
• A recent Trade Register extract that you retrieved yourself from the KVK, not a PDF emailed to you by the client.
• The UBO register at the KVK, as a supporting source only. A register entry does not discharge your own obligation to establish the UBO, and where your analysis differs from the register you must report the discrepancy.
• Official foreign registers, with a documented view on whether that register is reliable in the country concerned.
• Notarial deeds, articles of association and shareholders' registers, read together rather than one at a time.
• Sanctions lists from the EU and the United Nations, and national lists where applicable.

Adverse media searches and commercial databases supplement verification rather than replace it. Record which source you used and on which date; an undated screening report is evidence of nothing.

PEP and sanctions screening

These are two different obligations and they are regularly conflated. Sanctions screening flows from the Sanctiewet 1977, not the Wwft, and it is absolute: you may not make funds or economic resources available to a listed person, there is no risk-based discretion, and a match requires you to freeze and notify. PEP screening flows from the Wwft and is risk-based: a politically exposed person is not a prohibited client, but the relationship attracts enhanced due diligence.

The Uitvoeringsbesluit Wwft 2018 sets out which functions count as prominent public functions, and the definition extends to immediate family members and known close associates. Two practical points: screen the whole set — client, representative and every UBO — not just the contracting party, and repeat it on a fixed frequency, because names get added to lists and clients acquire public functions.

Where the hit is on a PEP, the Wwft requires senior management approval before the relationship starts or continues, measures to establish the source of the wealth and funds involved, and enhanced ongoing monitoring.

When the risk classification forces enhanced measures

The risk classification is not an administrative label. It sets the level of due diligence you owe, and article 8 of the Wwft makes enhanced due diligence mandatory in defined situations rather than leaving it to your judgement.

Simplified due diligence is the option most often misapplied at small firms. It is not permission to skip the check; it is permission to scale the verification on the basis of a documented low-risk assessment, while identification, screening and monitoring remain.

What you record, and how long you keep it

The most common finding in supervisory inspections is not that documents are missing. It is that there is no conclusion in the file. A folder holding a register extract, a passport copy and a screening report does not answer the question the law actually asks: what do you make of this, and why is this person allowed to be your client?

Write it down. Three sentences usually do: what the client does, why the money you expect fits that, and what risk you assign. Add the date and the name of the person who reached the conclusion.

Article 33 of the Wwft sets the retention period at five years after the end of the business relationship, or five years after the occasional transaction was carried out. You retain the data and documents you used, plus the record of your assessment, in a retrievable form.

Two rules pull against each other here. The Wwft wants you to demonstrate what you checked; the GDPR wants you to keep no more than necessary. For Wwft verification the Dutch citizen service number (BSN) and the passport photograph are generally not required. Keeping a copy of the document is permitted for that purpose, but record the choice you made and why, and align it with your privacy policy.

The mistakes that recur at smaller firms

None of these are exotic. They are the findings that come back file after file at firms with no dedicated compliance function.

• Starting work before the check is finished. The engagement letter is signed, the file is opened, and identification is scheduled for next week. Article 5 does not allow that sequence.
• Stopping the UBO analysis at a legal entity. If the UBO field in your file contains a B.V. or a holding company, the work is unfinished by definition.
• Screening only the contracting party. UBOs and authorised representatives go through the same screening.
• Treating the KVK extract as the whole structure. It does not show voting arrangements or de facto control.
• No date, no name, no conclusion. A file that cannot say who assessed what, and when, cannot be defended.
• Never revisiting the file. The periodic review interval is part of the risk classification, not an optional extra.
• Forgetting the second decision. Declining a client for lack of cooperation does not answer the separate question of whether that lack of cooperation should be reported to FIU-Nederland.

If a check takes too long, the cause is usually the process rather than the law: the same data requested three times, an approval step nobody owns, or a decision rule that lives in one person's head. Time the steps once on a real file and the bottleneck is usually obvious within the hour.

Frequently asked questions

What is a Wwft check?

A Wwft check is the review an obliged entity carries out before it provides a service: establishing who the client is, verifying that identity, finding the ultimate beneficial owner, recording the purpose and intended nature of the service, screening for PEP status and against sanctions lists, and setting a risk classification on that basis. In the law itself it is called customer due diligence, or clientenonderzoek; Wwft check is simply the term used in practice.

Is a Wwft check mandatory?

For institutions covered by the Wwft it is, and it is not a formality: without completed customer due diligence you may not provide the service. That is an obligation of result rather than of effort. If you cannot establish the UBO, or the source of the funds stays unclear, the outcome is that you do not enter into the relationship, or that you end it if it already exists.

Which documents do I need for a Wwft check?

For a natural person: a valid identity document. For a company: a recent extract from the Trade Register, insight into the ownership and control structure through an organisation chart, shareholders' register or articles of association, identification of the UBOs, and identification of the person acting on the company's behalf. Where the risk is elevated, evidence of the source of wealth and the source of funds is added to that.

How long does a Wwft check take?

For a straightforward private client with digital verification, anywhere from a few minutes to a day. For a company with a layered or foreign structure, several days to several weeks, mainly because requesting documents from the client and from foreign registers takes time. In practice the elapsed time is rarely determined by your own process but by how quickly the client delivers.

Do I have to keep a copy of the passport?

You must record which document you used and which data you took from it. Keeping a copy is permitted for that purpose, but keep no more than you need: for Wwft verification the Dutch citizen service number and the passport photograph are generally not required. Align the way you store it with your privacy policy and observe the statutory retention period of five years after the relationship ends.

Which supervisor checks my Wwft compliance?

That depends on your sector. De Nederlandsche Bank supervises banks, payment institutions, crypto service providers and trust offices. The Autoriteit Financiele Markten supervises investment firms and certain financial service providers. Bureau Financieel Toezicht supervises notaries, accountants, tax advisers and administration offices. Bureau Toezicht Wwft, part of the Tax Administration, supervises estate agents, valuers and dealers in goods, and lawyers are supervised by the dean of their local bar association.

What do I do if the client will not cooperate?

Then you cannot complete the customer due diligence, and you may not provide the service. If the relationship already exists, you end it. Separately, assess whether the absence of cooperation is itself a reason to file an unusual transaction report with FIU-Nederland. Those are two independent decisions, and in practice the second one is often overlooked once the first has been taken.

Sources

• Wwft — Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (wetten.overheid.nl)
• Uitvoeringsbesluit Wwft 2018 — implementing decree (wetten.overheid.nl)
• Uitvoeringsregeling Wwft — implementing regulation (wetten.overheid.nl)
• UBO register — Kamer van Koophandel (KVK)
• Wwft — Open Boek Toezicht, De Nederlandsche Bank
• Bureau Financieel Toezicht (BFT)
• Autoriteit Persoonsgegevens — Dutch Data Protection Authority

Read next

• Customer due diligence: the steps
• What is a UBO?
• What is a PEP?
• AML/CFT compliance
• Compliance as a service

Facing this in practice? In a free thirty-minute call we look at your situation with you and say plainly whether we can help. Book a call or ring +31 6 11 32 53 62.