AML/CFT compliance
From first gap analysis to a mature compliance programme: we make sure your institution demonstrably complies with the Dutch AML Act (Wwft) — and is ready for the EU AML Regulation that applies from 10 July 2027.
AML/CFT compliance in the Netherlands means demonstrating that you know your money laundering and terrorist financing risks, that you investigate clients in proportion to those risks, that you monitor transactions, and that you report unusual transactions to FIU-the-Netherlands without delay. The Wwft prescribes no fixed model. It requires a risk-based approach that fits your institution — and that you can explain to your supervisor.
What makes the Dutch regime different
Foreign firms entering the Dutch market usually have an AML framework already. Three features of the Dutch regime regularly catch them out.
The reporting standard is 'unusual', not 'suspicious'. You are not asked to form a suspicion. You report transactions that meet subjective or objective indicators, and FIU-the-Netherlands decides what is suspicious. Groups that import a suspicion-based playbook systematically under-report — and that shows up in supervisory reviews.
The business-wide risk assessment carries real weight. Article 2b Wwft requires institutions to identify and assess their risks and keep that assessment current. DNB expects to see the assessment visibly driving policy, client acceptance thresholds and monitoring scenarios — not sitting in a separate document nobody refers to.
Supervision is fragmented by sector. Which supervisor you face, and what they emphasise, depends on what you do.
| Sector | Supervisor | Typical focus |
|---|---|---|
| Banks, payment and e-money institutions | DNB | Transaction monitoring, alert quality, risk assessment, high-risk onboarding |
| Crypto-asset service providers (CASPs) | DNB / AFM | MiCAR licensing, travel rule, source of funds |
| Trust offices | DNB | Complex structures, UBO identification, enhanced due diligence |
| Investment firms and funds | AFM | Client acceptance, PEP policy, source of wealth |
| Accountants and tax advisors | BFT | Gatekeeper role, propensity to report, file quality |
| Civil-law notaries | BFT | Real estate transactions, unusual structures |
| Lawyers | Local deans of the bar | Scope of the Wwft alongside legal privilege |
| Estate agents, appraisers, dealers in high-value goods | Bureau Toezicht Wwft | Cash thresholds, due diligence on occasional transactions |
What we do
- Gap analysis & AML audit: where you stand against the law and supervisory expectations, in a report with findings, risk weighting and a remediation plan that names owners and deadlines.
- Business-wide risk assessment (SIRA): building or refreshing your systematic integrity risk analysis under Article 2b Wwft, including scenarios, controls, residual risk and board sign-off.
- Policies & procedures: AML policy, CDD procedures, client acceptance and exit policy, PEP and UBO work instructions — written as decision rules, not as restated legislation.
- Customer due diligence (CDD/KYC): design of simplified, standard and enhanced due diligence under Article 3 Wwft, risk classification, trigger events and periodic review.
- Transaction monitoring: scenarios and thresholds, alert handling, second-line quality assurance, and the reporting process to FIU-the-Netherlands under Article 16 Wwft.
- File remediation: clearing CDD backlogs with sampling-based quality assurance and an audit trail that holds up.
- Supervisory support: responding to information requests, examinations and remediation programmes from DNB, the AFM, the BFT or Bureau Toezicht Wwft.
- Interim capacity: where you need hands rather than advice, we can place a compliance officer or MLRO. See interim MLRO & secondment.
How an engagement runs
| Phase | What happens | Duration | What you get |
|---|---|---|---|
| 1. Intro call | Thirty minutes, free. We test whether your question fits us and whether we add anything. | Same week | An honest answer, including 'go elsewhere' |
| 2. Scope and quote | Entities, systems and product lines in scope; fixed fee or day rate. | 2–5 business days | Proposal with scope, planning and deliverables |
| 3. Fieldwork | Document review, first- and second-line interviews, file sampling, system walkthrough. | 2–4 weeks | Interim feedback on serious findings |
| 4. Reporting | Findings, risk weighting, remediation plan with owners and deadlines. | 1 week | Report plus a session with the board |
| 5. Implementation (optional) | Executing the plan, or coaching your own team through it. | As agreed | Working procedures, trained people, handover file |
What it costs
An AML gap analysis for a small or mid-sized institution typically runs between €6,500 and €12,500, depending on the number of entities, systems and files in scope. Advisory and implementation work is charged at a day rate with an agreed cap. All amounts exclude VAT.
What we do not do
We do not sell software and take no vendor commission. We do not give legal advice on criminal liability — that is a lawyer's work. And we do not deliver a template report with your name on the cover: if we do not understand your business well enough to say something useful, we say so.
Is an information request or examination already running?
Then the clock matters. Call us directly — you get Mitchell or Tarik on the line, no intermediary, and within the call you will know whether and how we can help.
Further reading
Frequently asked questions
Who supervises AML/CFT compliance in the Netherlands?
It depends on your sector. De Nederlandsche Bank (DNB) supervises banks, payment and e-money institutions, trust offices and crypto-asset service providers. The AFM supervises investment firms and funds. The BFT supervises accountants, tax advisors and civil-law notaries. Lawyers are supervised by the local deans of the bar. Estate agents, appraisers and dealers in high-value goods fall under Bureau Toezicht Wwft, part of the Tax Administration.
We are already AML-compliant in another EU country. Is that enough?
Not automatically. Until the AMLR applies in July 2027, AML obligations are still set by national law, and the Dutch Wwft has its own definitions, thresholds and reporting regime. The biggest practical differences are the Dutch 'unusual transaction' standard — which is broader than the suspicious transaction standard used in most member states — and the objective indicators that force a report regardless of your own judgement.
What is the difference between 'unusual' and 'suspicious' transactions?
The Netherlands does not use a suspicion threshold. Institutions report unusual transactions to FIU-the-Netherlands, which then decides whether a transaction is suspicious and passes it to law enforcement. The bar for reporting is therefore lower than in jurisdictions that use a suspicion test, and under-reporting is a common finding in Dutch supervisory examinations of foreign-owned firms.
How long does an AML gap analysis take?
Typically three to five weeks for a small or mid-sized institution: one to two weeks of document review and interviews, one week of file testing, one week of reporting and debrief. Larger or multi-entity groups take longer in proportion to the number of systems and product lines in scope.
Can you help during a DNB or AFM examination?
Yes. We help draft and pressure-test responses to information requests, prepare people for interviews, and build remediation plans that are realistic and demonstrable. Where the matter becomes legal, we work alongside your counsel rather than replacing them.
Do you sell or resell compliance software?
No. We have no vendor relationships and receive no commission, so a recommendation to replace or keep a system never comes from a revenue interest. We do help with tool selection, calibration and testing.
What that looks like in practice
Want a concrete starting point? Book a free thirty-minute call. If a supervisory request is already running and time is short, call +31 6 11 32 53 62 directly.