What is KYC? Know Your Customer under Dutch rules

By Mitchell Zandwijken · 4 September 2026 · KYC, customer due diligence

KYC stands for know your customer: the set of measures by which an institution establishes who it is doing business with, what that customer intends to do, and what risk that brings. In the Netherlands, KYC is the everyday term for what the Wwft calls cliëntenonderzoek — customer due diligence. The aim is not a complete file but a reasoned judgement: does this customer fit what we know, and does that remain true? If you are entering the Dutch market from abroad, the substance will look familiar; the statutory vocabulary, the reporting threshold and the evidence you have to be able to produce will not.

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

Contents

KYC, CDD and the statutory term
The Dutch framework in brief
The six steps
Three levels of due diligence
When you look again
Digital KYC and remote onboarding
Where it goes wrong in practice

KYC, CDD and cliëntenonderzoek: which term to use

Three terms circulate for what is broadly the same thing, and for a firm operating in the Netherlands it matters which one appears where.

Term	Origin	Where to use it
Cliëntenonderzoek (customer due diligence)	The Wwft itself	The statutory term. Use it in policies, procedures and correspondence with a Dutch supervisor. A supervisor reading your framework expects to see the wording of the law reflected back.
CDD	International, customer due diligence	The professional term for the same sequence of steps. Standard in second-line functions and in system design.
KYC	International, broader	The practice term, which also carries the commercial side: knowing the customer, not only satisfying the law.

In conversation the choice makes no difference. In documentation it does. If your Dutch branch or subsidiary runs on a group policy drafted in English, you do not have to rewrite it in Dutch — but you do have to make the mapping explicit. State at the front of the document that what it calls KYC or CDD is the cliëntenonderzoek required by Chapter 2 of the Wwft, and keep a short concordance between your internal terms and the statutory ones. The most common finding against foreign-owned institutions is not that the group standard was too weak; it is that nobody could show which Dutch obligation each group control was meant to discharge.

The Dutch framework in brief

The obligation sits on the institution, not on the group. The Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft) is the Dutch implementation of the EU anti-money-laundering directives, and it applies to banks, payment and electronic money institutions, investment firms and fund managers, insurers, trust offices, crypto-asset service providers, civil-law notaries, lawyers, accountants, tax advisers, estate agents and traders accepting cash payments of €10,000 or more.

Supervision is split by sector. De Nederlandsche Bank supervises banks, payment institutions, trust offices and crypto-asset service providers; the Autoriteit Financiële Markten supervises investment firms and fund managers; the Bureau Financieel Toezicht supervises notaries and accountants; other professions fall to their own designated supervisors. Which one writes to you determines the tone of the conversation, but not the standard: all of them read the same law.

Two features regularly surprise firms arriving from another jurisdiction. First, the Dutch reporting duty is to report unusual transactions to FIU-Nederland, not suspicious ones. The threshold is lower than the suspicion standard used in several other countries, and it combines objective indicators with a subjective one; the assessment of whether something is genuinely suspicious is the FIU's, not yours. Second, the Wwft is drafted around the risk-based approach in the FATF standards: almost nothing is prescribed as a fixed control, and almost everything has to be justified. That shifts the burden from doing the right thing to being able to demonstrate, from the file, why what you did was proportionate.

Regulation (EU) 2024/1624, the AML Regulation, will replace much of this national rulebook with directly applicable European rules from mid-2027. The substance of customer due diligence is largely continuous, but the detail is harmonised: the identification data you must obtain, the timing of verification, group-wide policies and the treatment of high-risk situations. If you are building a Dutch framework now, build it so the terminology and controls can be re-pointed at the Regulation without a redesign — see our AMLR gap analysis.

The six steps

Whatever you call it, the exercise is the same six steps.

Identify. Establish who the customer is: name, date and place of birth and address for a natural person; legal form, registered office and registration for an entity.
Verify. Check that statement against reliable, independent sources. Information supplied by the customer is not verification of itself.
Establish purpose and intended nature. Why does this customer want this product, and what use is to be expected? This is the step most often skipped — and without a recorded expected pattern you cannot later judge whether anything deviates.
Identify and verify the UBO. For legal entities, work through the structure to the natural person who ultimately owns or controls it. See what is a UBO.
Determine the risk profile. On the basis of customer, product, country and delivery channel. Screening for PEP status and against sanctions lists belongs here.
Monitor. Test on an ongoing basis whether transactions fit the profile you established, and keep the file current.

Step three is the hinge. Without a recorded expected use, transaction monitoring is a system looking for deviations from a benchmark that exists nowhere. That is precisely the finding supervisors write up most often. A step-by-step treatment is set out in our guide to the customer due diligence steps.

Three levels of due diligence

The six steps scale with risk. The law recognises three levels, and the file has to show which one you applied and why.

Level	When	What it involves
Simplified	Demonstrably low risk	Lighter verification and less frequent monitoring. The reasoning behind the low-risk classification still has to be in the file — simplified does not mean nothing.
Standard	Normal risk	The six steps above, in full.
Enhanced (EDD)	High risk: a PEP, a high-risk third country, a complex structure, an unusual pattern	Additionally: source of wealth and source of funds, senior management approval, tighter monitoring and a shorter review cycle.

For firms entering the Dutch market, the practical difficulty is rarely the enhanced level. It is the simplified one. A group standard that treats a whole customer category as low risk by default will hold up only if the underlying risk assessment says so for the Dutch book of business, in writing, with the country and product mix that book actually has.

When you look again

KYC is not a one-off act at onboarding. There are two reasons to revisit a file.

Periodic review, at the frequency that belongs to the risk profile: for low risk typically every three to five years, for high risk annually or more often.
Event-driven review, as soon as something happens: a change in ownership or control, a deviating transaction pattern, a screening hit, adverse media, or a report to FIU-Nederland.

In practice it is the periodic cycle that slips. The arithmetic is unforgiving: once a backlog is a year old it grows faster than it can be cleared with the team you have, because each month adds new due reviews on top of the old ones. At that point the choice is between temporary capacity and a reduction in scope you can defend — see KYC remediation. What does not work is quietly extending the review frequency without changing the risk assessment that set it.

Digital KYC and remote onboarding

Digital identity verification, identification by video call and verification through a payment from an account held in the customer's own name are all permitted. The law imposes no paper requirement; it imposes a reliability requirement. Three questions decide whether your method survives scrutiny.

Is the source independent of the customer?
Can you demonstrate that the method detects fraud to a reasonable degree — deepfakes in video verification, for example?
Is the result recorded reproducibly, so that a third party can establish later what was actually checked?

The third question is where remote onboarding usually fails an inspection. A vendor's pass or fail flag is a result, not evidence. Keep what the check saw and what it concluded, in the file, in a form someone outside the vendor's platform can read.

Where it goes wrong in practice

Collecting instead of assessing. A file full of documents without a conclusion is not customer due diligence. The question is not what you obtained, but what you make of it.
Purpose and nature as free text. "Business services" is not an expected pattern and is therefore useless for monitoring.
A risk profile that never changes. If nearly every customer sits at low risk, your model is measuring nothing.
Onboarding and monitoring kept apart. If the analyst assessing an alert cannot see what was agreed at acceptance, every judgement is a guess.
Asking for the same thing three times. Commercially the most expensive mistake: customers drop out, and the first line starts working around the process.
Assuming the group hub discharges the local duty. Outsourcing execution to a shared KYC centre is allowed; outsourcing responsibility is not. The Dutch entity remains accountable, and it must be able to produce the file and explain the decision itself.
A framework that is only in English. Perfectly acceptable in itself, but the terminology has to be traceable to the statutory terms, and the people applying it in the Netherlands have to be able to explain it in the words the supervisor uses.

Frequently asked questions

What does KYC mean?

KYC stands for know your customer: the set of measures by which an institution establishes who it is doing business with, what that customer intends to do and what risk that brings. In the Netherlands, KYC is the practice term for what the Wwft calls clientenonderzoek, or customer due diligence. The terms are used interchangeably in conversation, but customer due diligence is the legal one.

What is the difference between KYC and CDD?

In practice almost nothing; formally there is a difference. CDD, customer due diligence, is the sequence of steps prescribed by law: identify, verify, establish the purpose and intended nature of the relationship, identify the ultimate beneficial owner, determine the risk profile and monitor on an ongoing basis. KYC is the broader, informal term for knowing your customer, including the commercial side of that. If you want to be precise in policies and procedures, use the statutory term and note that it is what your group calls CDD or KYC.

Which steps does KYC involve?

Six. Identifying the customer, verifying that identity against reliable and independent sources, establishing the purpose and intended nature of the relationship, identifying and verifying the ultimate beneficial owner, determining the risk profile, and ongoing monitoring of transactions and of the file itself. Where the risk is high, enhanced measures come on top of those six.

When does KYC have to be done again?

At a periodic review, at the frequency that belongs to the risk profile: for low risk usually every three to five years, for high risk annually or more often. And always on an event: a change in ownership or control, a deviating transaction pattern, a screening hit, adverse media, or a report to FIU-Nederland.

Can KYC be done entirely digitally?

Yes, provided the method used is reliable and you can demonstrate why. Digital identity verification, identification by video call and verification through a payment from an account held in the customer's own name are all common. The requirement is not that it happens on paper, but that the source is independent and reliable and that the process is recorded reproducibly in the file.

Does a group KYC standard satisfy the Dutch requirements?

Not automatically. A group standard may well be stricter than the Wwft, but the Dutch entity has to be able to show which Dutch obligation each group control discharges, apply its own risk assessment to its own book of business, and produce and explain the file itself. Execution can be shared with a group hub; responsibility cannot be transferred.

What does poor KYC cost?

Two things at once. In a supervisory investigation, gaps in the files lead to remediation obligations and, where the shortcomings are serious, to fines that can run into the millions. Commercially it costs at least as much: onboarding that takes weeks because data is missing, and customers who walk away when the same document is requested for the third time.