AML & KYC in Netherlands: 2026 Update

The Netherlands operates one of Europe';s most rigorous anti-money laundering and know-your-customer frameworks. The core legislation - the Wet ter voorkoming van witwassen en financieren van terrorisme, known as Wwft - transposes EU anti-money laundering directives into Dutch law and imposes detailed obligations on a broad range of businesses. For international founders, financial institutions and professional service providers operating in the Netherlands, understanding these obligations is not optional: non-compliance carries significant financial penalties, reputational damage and, in serious cases, criminal liability. This guide covers the current AML and KYC rules in the Netherlands, recent legislative updates, supervisory expectations, practical compliance steps and the most common mistakes made by foreign-owned entities.

The Wwft is the primary statute governing AML and KYC in the Netherlands. It applies to a wide range of "institutions" - a term that covers banks, payment service providers, insurance companies, accountants, tax advisers, notaries, lawyers, real estate agents, trust and company service providers, and dealers in high-value goods. Any entity that falls within the Wwft';s scope must implement a risk-based compliance programme.

The risk-based approach means that the intensity of due diligence must be proportionate to the assessed risk of money laundering or terrorist financing. Institutions must conduct a business-wide risk assessment, document their findings and update that assessment regularly. The Dutch Financial Intelligence Unit - known as FIU-Nederland - receives suspicious transaction reports and analyses financial intelligence on behalf of the state.

Customer due diligence is the operational heart of KYC in the Netherlands. Institutions must identify and verify the identity of every client before entering into a business relationship or executing a transaction above the applicable threshold. For legal entities, this means identifying the ultimate beneficial owner - any natural person who directly or indirectly holds more than 25% of the shares, voting rights or ownership interest. The UBO register, maintained by the Dutch Chamber of Commerce (Kamer van Koophandel), is a mandatory reference point for this exercise, though institutions cannot rely on it exclusively.

Enhanced due diligence applies in higher-risk situations. These include clients or transactions involving politically exposed persons (PEPs), correspondent banking relationships, non-face-to-face onboarding, and business relationships with parties from jurisdictions identified as high-risk by the European Commission or FATF. In these cases, institutions must obtain additional information, apply additional verification measures and secure senior management approval before proceeding.

Simplified due diligence remains available for lower-risk situations, such as certain regulated financial products or clients that are themselves supervised institutions in comparable jurisdictions. However, the Wwft makes clear that simplified due diligence does not mean no due diligence: institutions must still verify the basis for the lower-risk classification.

AML and KYC supervision in the Netherlands is divided among several competent authorities, each responsible for a specific sector. Understanding which supervisor oversees a given business is essential, because supervisory expectations and enforcement styles differ.

De Nederlandsche Bank (DNB) supervises banks, payment institutions, electronic money institutions, insurers, pension funds and trust offices. The Autoriteit Financiële Markten (AFM) supervises investment firms, financial advisers and certain other financial service providers. The Bureau Financieel Toezicht (BFT) supervises notaries, bailiffs and accountants. The Nederlandse Orde van Belastingadviseurs and the Nederlandse Beroepsorganisatie van Accountants share oversight of tax advisers and accountants in certain contexts. Real estate agents and dealers in high-value goods fall under the supervision of the Bureau Economische Handhaving (BEH), part of the Dutch Tax and Customs Administration.

Each supervisor has the power to conduct on-site inspections, request documentation, issue binding instructions, impose administrative fines and, in serious cases, withdraw licences or authorisations. DNB and AFM have both demonstrated a willingness to impose substantial fines on institutions that fail to maintain adequate AML programmes. Fines can reach several million euros for systemic failures, and enforcement actions are typically published, creating significant reputational exposure.

A common mistake made by foreign-owned entities is assuming that group-level compliance programmes designed for another jurisdiction automatically satisfy Dutch requirements. In practice, Dutch supervisors assess compliance against Dutch and EU standards, not the standards of the parent company';s home country. Institutions must localise their policies, procedures and training to reflect the specific requirements of the Wwft and applicable supervisory guidance.

The Dutch AML and KYC landscape has evolved significantly in recent years, driven primarily by successive EU anti-money laundering directives and by domestic enforcement experience. Several developments are directly relevant to businesses operating in the Netherlands today.

The EU';s Anti-Money Laundering Regulation (AMLR) and the establishment of the new EU Anti-Money Laundering Authority (AMLA) represent the most significant structural change to the European framework in a generation. AMLA will directly supervise the highest-risk cross-border financial institutions across the EU, including certain entities operating in the Netherlands. Dutch institutions that fall within AMLA';s direct supervisory perimeter will face a dual layer of oversight - from AMLA at EU level and from their Dutch sectoral supervisor at national level. Institutions should begin assessing whether they are likely to fall within AMLA';s scope and what additional compliance infrastructure that will require.

The Wwft has been amended on multiple occasions to implement the Fourth, Fifth and Sixth EU Anti-Money Laundering Directives. Recent amendments have expanded the definition of predicate offences for money laundering, tightened requirements around PEP identification and extended the scope of the UBO register to include certain trusts and similar legal arrangements. The UBO register itself has been subject to legal challenge regarding public access, following a Court of Justice of the EU ruling on privacy grounds. Current Dutch rules restrict public access to UBO information while maintaining full access for competent authorities and obliged entities conducting due diligence.

The Dutch government has also strengthened requirements around the monitoring of existing business relationships. Institutions are now expected to conduct periodic reviews of their client base, with the frequency and depth of review calibrated to the risk profile of each client. Static onboarding checks are no longer sufficient: ongoing monitoring of transactions and client behaviour is a core supervisory expectation.

FIU-Nederland has published updated typologies and red flag indicators to assist institutions in identifying suspicious activity. These cover sectors including real estate, virtual assets, professional services and trade-based money laundering. Institutions are expected to incorporate these typologies into their transaction monitoring systems and staff training programmes.

If you are assessing whether your current compliance framework meets Dutch supervisory expectations, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

Building a compliant AML and KYC programme in the Netherlands requires more than drafting a policy document. Dutch supervisors expect institutions to demonstrate that their programme is embedded in day-to-day operations and is genuinely effective at identifying and mitigating risk.

The starting point is a documented business-wide risk assessment. This assessment must identify the money laundering and terrorist financing risks specific to the institution';s business model, client base, products, services, delivery channels and geographic exposure. It must be reviewed and updated whenever there is a material change to the business and at least annually. Many institutions underestimate the depth of analysis required: a generic risk assessment that does not reflect the institution';s actual risk profile will not satisfy Dutch supervisors.

Client onboarding procedures must be designed to collect and verify the information required under the Wwft before the business relationship begins. For corporate clients, this means obtaining and verifying constitutional documents, ownership structures and UBO information. Verification must be based on reliable, independent sources - not solely on documents provided by the client. In practice, this often means using commercial databases, official registers and, where necessary, direct verification with issuing authorities.

Transaction monitoring is a mandatory component of an effective AML programme. Institutions must have systems and controls in place to detect transactions that are inconsistent with the client';s known profile, that involve unusual amounts or patterns, or that exhibit characteristics associated with known money laundering typologies. The sophistication of the monitoring system must be proportionate to the institution';s size and risk profile, but even smaller institutions cannot rely on purely manual monitoring for high volumes of transactions.

Suspicious transaction reporting to FIU-Nederland is a legal obligation, not a discretionary decision. The Wwft requires institutions to report any transaction where they know, suspect or have reasonable grounds to suspect that it is related to money laundering or terrorist financing. The threshold for reporting is deliberately low: institutions should report when in doubt. Failure to report is a criminal offence under Dutch law. Institutions must also be aware of the tipping-off prohibition: they cannot inform the client or any third party that a report has been made or is being considered.

Staff training is a specific requirement under the Wwft. All relevant employees must receive training on AML and KYC obligations, on the institution';s internal procedures and on how to recognise and escalate suspicious activity. Training must be documented and repeated at appropriate intervals. A common mistake is treating training as a one-time onboarding exercise rather than an ongoing programme that reflects current typologies and regulatory developments.

Record-keeping obligations require institutions to retain client identification documents, due diligence records and transaction records for at least five years after the end of the business relationship or the execution of the transaction. Records must be available to supervisors on request and must be stored in a manner that allows timely retrieval.

The Wwft applies differently across sectors, and institutions should not assume that guidance issued for one sector applies equally to another. Several sectors merit specific attention.

Trust and company service providers (TCSPs) face particularly intensive scrutiny in the Netherlands. DNB supervises TCSPs and has conducted multiple thematic reviews of the sector, consistently finding deficiencies in UBO identification, risk assessment and transaction monitoring. TCSPs that provide registered office addresses, directorship services or corporate administration to international clients must apply enhanced due diligence to their client base and must be able to demonstrate a genuine understanding of the ultimate beneficial ownership of every client entity.

The real estate sector has been identified as a high-risk area for money laundering in the Netherlands. Real estate agents involved in the purchase or sale of immovable property above the applicable threshold are subject to the Wwft and must conduct customer due diligence on both buyers and sellers. A non-obvious requirement is that the obligation applies to the agent, not only to the notary who executes the transfer deed. Both parties in the transaction chain have independent obligations.

Virtual asset service providers (VASPs) operating in the Netherlands must register with DNB and comply with AML and KYC requirements equivalent to those applicable to traditional financial institutions. The Dutch implementation of the EU';s Transfer of Funds Regulation - which now extends to crypto-asset transfers - requires VASPs to collect and transmit originator and beneficiary information for transfers above the applicable threshold. This is a significant operational requirement for businesses in the digital asset space.

Professional service providers - including lawyers, notaries, accountants and tax advisers - are subject to the Wwft when they assist clients with specific activities, such as the formation of companies, the management of client funds or the execution of real estate transactions. These professionals must apply the same risk-based due diligence framework as financial institutions, which can create tension with professional secrecy obligations. Dutch law provides limited exemptions for lawyers acting in their core legal advisory capacity, but the boundaries of this exemption are narrowly interpreted.

Consider two practical scenarios. A Dutch-registered subsidiary of a non-EU group provides treasury management services to affiliated entities. Even though the clients are related parties, the subsidiary is a regulated institution and must apply the Wwft to its intra-group transactions, including UBO verification and transaction monitoring. Assuming that group relationships eliminate the need for due diligence is a common and costly mistake. In a second scenario, a foreign real estate developer sells residential units in the Netherlands through a local agent. The agent must conduct customer due diligence on the developer as the seller, verify the source of funds for the transaction and report any suspicious indicators to FIU-Nederland, regardless of the developer';s reputation or the size of the transaction.

What happens if a business fails to report a suspicious transaction to FIU-Nederland?

Failure to file a suspicious transaction report when required under the Wwft is a criminal offence in the Netherlands. It can result in prosecution of the institution and, in some cases, of individual officers or employees. Supervisors may also impose administrative fines and, for regulated entities, take enforcement action that affects the institution';s licence or authorisation. In practice, Dutch supervisors take a dim view of systematic failures to report, particularly where internal records show that red flags were identified but not escalated. Institutions should err on the side of reporting when in doubt, given that the legal threshold for the reporting obligation is deliberately low.

How long does it take to build a compliant AML programme, and what does it cost?

The timeline and cost depend heavily on the size and complexity of the institution. A smaller professional services firm may be able to implement a basic but compliant programme within two to three months, with professional fees in the low to mid thousands of euros for policy drafting, risk assessment support and staff training. A regulated financial institution with a large client base and complex transaction flows will require a more substantial investment - potentially several months of project work and professional fees in the higher tens of thousands of euros - to implement robust transaction monitoring, client review processes and governance structures. Ongoing compliance costs, including annual training, periodic client reviews and system maintenance, should be budgeted separately.

Can a foreign institution rely on due diligence conducted by a third party or group entity?

Dutch law permits institutions to rely on third-party due diligence in certain circumstances, provided the third party is itself subject to equivalent AML obligations and supervision in a comparable jurisdiction. However, the institution that relies on third-party due diligence remains fully responsible for compliance with the Wwft. If the third party';s due diligence is inadequate, the relying institution bears the regulatory consequences. In practice, Dutch supervisors scrutinise third-party reliance arrangements carefully and expect institutions to have contractual arrangements in place, to obtain copies of the relevant due diligence information promptly and to satisfy themselves that the third party';s standards are genuinely equivalent to Dutch requirements.

AML and KYC compliance in the Netherlands is a substantive, ongoing obligation that requires genuine operational commitment. The Wwft imposes detailed requirements on a broad range of businesses, Dutch supervisors enforce those requirements actively, and the EU regulatory framework continues to evolve. Institutions that treat compliance as a box-ticking exercise rather than a risk management discipline face significant legal and reputational exposure.

VLO Law Firms advises international clients on AML and KYC matters in the Netherlands. We can assist with Wwft compliance assessments, policy and procedure development, UBO and KYC documentation, supervisory correspondence and training programmes. To request a consultation, contact: info@vlolawfirm.com