Money laundering is the process of giving criminal proceeds the appearance of a lawful origin, and in the Netherlands it is punishable under Articles 420bis and following of the Dutch Criminal Code. For most businesses, however, the exposure is not criminal but regulatory: the Money Laundering and Terrorist Financing (Prevention) Act, the Wwft, imposes duties of client due diligence and of reporting unusual transactions on a wide range of institutions, and supervisors enforce those duties irrespective of whether any laundering has occurred.
Why prevention is a regulatory question before it is a criminal one
Money laundering is the process of giving criminal proceeds the appearance of a lawful origin. In the Netherlands it is punishable under Articles 420bis and following of the Dutch Criminal Code: concealing or disguising the nature, origin or location of an asset, but also acquiring, holding or using property while knowing, or having reasonable grounds to suspect, that it derives from crime.For most businesses and professionals, however, the first encounter with the subject is not the criminal court but supervision. The Money Laundering and Terrorist Financing (Prevention) Act, the Wwft, imposes preventive duties on a defined group of institutions and gatekeepers. Fall short of those duties and the exposure is regulatory before it is criminal: a formal instruction, an order subject to a penalty payment, an administrative fine, and the reputational consequences that follow publication.This guide covers the preventive side. For the criminal consequences of laundering itself, see our guide on
money laundering penalties.
Three layers that need to be kept apart
Discussions about money laundering routinely collapse three different questions into one. They are worth separating before anything else.The first is criminal liability for laundering, under Articles 420bis and following of the Criminal Code. That is about whether a person committed an offence, and it is decided by a criminal court.The second is the set of preventive duties under the Wwft. These apply to institutions, not to everyone, and they do not require you to prove that anything criminal has happened. The duty to report attaches to a transaction that is unusual within the meaning of the statutory indicators.The third is the consequence of not complying: supervisory measures and administrative fines in the first place, with civil and, in defined cases, criminal exposure alongside.An unusual transaction is not, by definition, money laundering. A reported transaction is not an accusation. Keeping the three layers apart is what allows an institution to comply without treating its clients as suspects.
Who falls under the Wwft
Article 1a of the Wwft designates the institutions and professionals within scope. In broad terms:Financial sector: banks, investment firms, electronic money institutions, payment service providers, exchange institutions and insurers within the categories the Act describes.Crypto sector: crypto-asset service providers.Legal and financial professionals: civil-law notaries, lawyers, accountants, tax advisers and trust offices, in respect of designated services.Real estate and trade: estate agents, appraisers, casinos, remote gambling providers and professional dealers in goods within the categories the Act describes, including art dealers, jewellers, car dealerships and boat brokers.
Dealers in goods
Whether a trader is covered, and for which duties, depends on the statutory category the trader falls into, the nature of the trade and the transaction concerned. Accepting a large cash payment can bring a trader within scope, but it does not follow that every retailer becomes subject to the full set of Wwft obligations the moment a payment reaches a given figure. The right question is which category of Article 1a fits the activity, and which duties attach to that category.
Lawyers and notaries
The line does not run between litigation and commercial work as such. The Wwft applies to lawyers only in respect of the services designated in the Act. Determining a client’s legal position, and representation in or in connection with legal proceedings, fall outside the reporting duty; legal professional privilege operates alongside that exclusion but is a separate concept and should not be used as shorthand for it.General legal advice is therefore not automatically outside the Wwft. What matters is whether the activity is one of the designated services, which is a question about the work actually performed rather than about the label on the file. Acting as an intermediary in a transaction, or structuring one, is not covered by the exclusion.If you are unsure whether your activities trigger compliance duties, our guide on the Dutch Money Laundering Act sets out the statutory scope in more detail.
The three pillars of prevention
Compliance rests on three connected pillars: a documented risk assessment, client due diligence proportionate to that assessment, and monitoring that compares what a client actually does with what the file says the client would do.
Risk assessment
The Wwft operates on a risk-based approach. Before designing controls, an institution documents its own risk assessment, in the financial sector usually referred to as the systematic integrity risk analysis. The assessment covers at least the countries and geographies involved, the products and services offered, the delivery channels used, and the types of client and the complexity of their structures.Supervisors read the risk assessment first and judge the rest of the file against it. An institution that records no material risk at all is telling its supervisor something about its risk identification rather than about its risk.
Client due diligence
Articles 3 to 8 of the Wwft govern client due diligence. The substantive requirement is to identify the client and verify that identity, to identify the ultimate beneficial owner and take reasonable measures to verify who that is, to establish the purpose and intended nature of the relationship, and to monitor the relationship on a continuing basis.Under Article 3(5), due diligence is required when entering into a business relationship, for an occasional transaction of €15,000 or more, where there are indications of money laundering or terrorist financing, where there is doubt about the accuracy of data previously obtained, where the risk profile of an existing client changes, where increased country risk is involved, and for money transfers of €1,000 or more.These amounts belong to the situations described in that provision. They are not general Wwft thresholds that apply to every duty or every category of institution, and they are not reporting thresholds. Reporting thresholds are set separately, in the indicator list discussed below.
Ultimate beneficial ownership
A Chamber of Commerce extract is an administrative starting point, not an answer. The task is to map the ownership and control chain, following layered holdings, foreign entities, foundations, trusts and voting arrangements, until you can state in one paragraph who actually owns or controls the client and how you verified it.The figure of more than 25 per cent, familiar from the implementing rules, is an indicator of ownership or control, not a definition of beneficial ownership. Control can sit elsewhere: in voting agreements, in a right to appoint directors, in economic entitlement without formal shareholding. Where, after exhausting all reasonable means, no natural person can be identified as owner or controller, the statutory fallback applies and the senior managing officials are recorded. That fallback is a last resort, and both the search and the reason for falling back on it have to be documented.Our note on
due diligence in practice covers what tends to be left out of these files.
Ongoing monitoring
Onboarding records what a client said it would do. Monitoring shows what it did. The comparison is what surfaces unusual behaviour: an account opened for local trade that starts receiving payments from unrelated jurisdictions, turnover that doubles in a quarter with no change in staff or premises, deposits that no longer match a declared source of income.
The UBO register
Identifying the ultimate beneficial owner as part of client due diligence is one thing; the register is another, and the two are regularly confused. The register is a filing obligation resting on the entity itself, and what it is has changed fundamentally since it was set up.
The filing obligation
Dutch legal entities and partnerships — the BV, the NV, foundations, associations, the VOF, the CV and the maatschap — must file their ultimate beneficial owners with the Chamber of Commerce. The obligation rests on the entity and the filing is made by the board, which also has to keep it current: a change in shareholding or in control has to be reported. Failing to file, or filing incorrectly, is an economic offence and is enforced administratively, so this is not a formality that can wait for the next annual filing.
The register is not public
This is the point on which most published guidance, including older material of our own, is out of date. When the register was introduced, part of the data was to be open to anyone. On 22 November 2022 the Court of Justice of the European Union held, in the joined cases C-37/20 and C-601/20, that general public access is an unjustified interference with private life and the protection of personal data. The Dutch register was closed to the public that same week and it has not reopened.Access now runs in layers. Institutions with obligations under the Wwft — banks, insurers, accountants, lawyers, civil-law notaries and the other gatekeepers — can consult what they need for their client due diligence, and an organisation can see its own entry. Competent authorities, FIU-Nederland, De Nederlandsche Bank, the AFM, the tax administration, the police and the public prosecution service have access to the full record, including full dates of birth, addresses and the underlying documents. The Act restricting access to the UBO registers, in force since 16 July 2025, gives this layered access its statutory basis.A third route is being built: access on the ground of a legitimate interest, which Directive (EU) 2024/1640 requires member states to provide. Journalists and civil-society organisations investigating money laundering and terrorist financing are the intended users. The Dutch implementing decree was put before parliament in April 2026 and the practical route is being opened during 2026. Until it is operational, no one obtains access on that ground.
The duty to report a discrepancy
Article 10c of the Wwft closes the circle between the register and the client due diligence described above. An institution that consults the register for a client and finds that what stands there does not match what its own investigation shows must report that discrepancy to the Chamber of Commerce. The duty is not discretionary, and noting the difference in the client file does not discharge it. In practice this is the mechanism by which the register is kept accurate, because the entity’s own filing is rarely what gets corrected first.
Enhanced due diligence
Article 8 requires enhanced measures where the risk of money laundering or terrorist financing is higher. The extent of those measures follows the risk you have established: enhanced due diligence is a different set of questions, not simply a longer form, and it should be proportionate rather than uniform.Situations that call for enhanced measures include politically exposed persons and their family members and close associates, relationships and transactions connected to high-risk third countries, and cross-border correspondent relationships with institutions outside the European Economic Area.In substance, enhanced due diligence means establishing the source of the funds used in the transaction and, where relevant, the source of the client’s wealth, on the basis of verifiable and independent information. For politically exposed persons and for cross-border correspondent relationships the Act ties the decision to approval at senior management level. Outside those defined situations, requiring approval at that level is a sensible internal control rather than a general statutory rule, and firms should be clear in their own procedures about which of the two they are applying.
Recognising an unusual transaction
Dutch law does not ask you to establish criminal conduct before reporting. The statutory test is whether a transaction is unusual, not whether it is suspicious. The distinction is set out in our analysis of
money laundering versus unusual transactions.The indicator list in the Wwft Implementation Decree contains two kinds of trigger.
Objective indicators
An objective indicator applies to a defined category of institution and to a defined type of transaction. Where the indicator applies, the transaction is unusual and must be reported, whatever the client’s explanation and however ordinary the underlying business looks. The list is category-specific, so the first question is whether the indicator is one that applies to you.Tax advisers, accountants, lawyers, civil-law notaries, trust offices, appraisers and estate agents: a cash payment of €10,000 or more, including bearer cheques and prepaid cards.Banks: exchange of €10,000 or more in cash between currencies or denominations; a cash deposit of €10,000 or more onto a credit card or prepaid card; use of a credit card or prepaid card for €15,000 or more; money transfers of €2,000 or more.Exchange institutions: cash exchange of €10,000 or more between currencies or denominations.Electronic money institutions: the same card and transfer figures as banks.Casinos: deposits of coins, notes or valuables of €10,000 or more; a giro payment of €15,000 or more; a cash payment of €10,000 or more, including foreign currency.Remote gambling providers: a giro payment of €15,000 or more.Crypto-asset service providers: exchange of virtual currency for fiat currency of €10,000 or more.Breaking a payment into smaller instalments to stay below a figure does not take the matter outside the regime. Connected transactions are assessed together, and deliberate structuring is itself a reason to look harder.
The subjective indicator and the red flags behind it
Alongside the objective list sits a single subjective indicator: a transaction in respect of which the institution has reason to assume that it may be connected with money laundering or terrorist financing. This is the indicator that does most of the work, and it calls for judgement rather than arithmetic.Patterns that regularly justify a closer look:Indifference to price, cost, delay or unfavourable commercial terms.Payments received from, or routed through, a third party with no visible role in the transaction.A corporate structure more complex than the business justifies, particularly where a layer sits in a jurisdiction unconnected to the trade.Rapid resale of property, vehicles or art at a price that does not follow the market.Loans between related parties without security, schedule or commercial rationale.Reluctance to produce identification or ownership documentation, or documents supplied only after repeated requests and then in poor copies.An unexplained shift in payment method, in particular towards cash, cryptoassets or a new intermediary.No single signal establishes anything, and there is no rule that a given number of signals triggers a report. What counts is the combination, the context, whether the client’s explanation is plausible and can be verified, and whether your assessment is recorded. Where, after that assessment, there is reason to assume a connection with money laundering or terrorist financing, the subjective indicator is met and the transaction is reported.
Reporting to FIU-Nederland
Article 16 of the Wwft requires an institution to report an unusual transaction to the Financial Intelligence Unit without undue delay, as soon as the unusual character of the transaction becomes known.Without undue delay is not the same as after a completed internal investigation. Once the statutory test is met, the report goes out; anything further you want to establish can be established afterwards. Late reporting caused by long internal review chains is among the most common findings in enforcement files, and the usual remedy is a short, fixed escalation deadline written into the procedure.What happens next is not the institution’s decision. FIU-Nederland analyses reported transactions, can declare a transaction suspicious, and makes the relevant data available to the investigative and security services. Whether anything criminal occurred is assessed there and, if it comes to that, in court.
What protection a report gives
Article 20 of the Wwft protects an institution that reports in good faith against liability for damage suffered as a result of the report, provided it could reasonably assume that it was complying with the Act. That protection is tied to the report and to those statutory conditions. It is not a general indemnity for everything done around the report, and it does not cure a defective client file.
The prohibition on disclosure
Article 23 prohibits informing the client or a third party that a report has been made or is intended. The prohibition does not stop you from declining an instruction or ending a relationship. It requires that you do so without conveying information from which the report, or the intention to report, could be inferred, which in practice means a neutral commercial explanation and no more.
Retention, training and internal control
Article 33 requires client data, verification records and transaction data to be retained for five years after the transaction or after the end of the business relationship. Retention is not archiving for its own sake: if you cannot reconstruct why you accepted a client four years ago, you cannot defend that decision now.Article 35 requires that employees are trained, periodically, to recognise unusual transactions and to conduct client due diligence properly. Training built on your own case material tends to survive supervisory scrutiny better than generic scenarios.On governance, it is worth distinguishing three things. Article 2c requires policies, procedures and measures to limit and control the risks, approved at the level of day-to-day management and tested systematically. Article 2d requires an institution whose day-to-day policy is determined by two or more persons to designate one of them as responsible for compliance, and requires an independent and effective compliance function; an independent audit function applies to the extent that it is proportionate to the nature and size of the institution. Beyond that statutory minimum sit supervisory expectations, which go further for larger and higher-risk institutions, and beyond those sit choices that are simply good practice. A compliance file is easier to defend when it says which of the three a given control belongs to.Our anti-money laundering compliance page describes how we set this up for clients.
Supervision and enforcement
Wwft supervision is divided by sector. The allocation below reflects the main division and is not exhaustive; which supervisor is competent can depend on the precise activity, and the division is periodically adjusted, so it should be checked against current guidance.De Nederlandsche Bank: banks, payment service providers, electronic money institutions, insurers and trust offices.Netherlands Authority for the Financial Markets: investment firms, collective investment undertakings and financial advisers.Bureau Financieel Toezicht: civil-law notaries, accountants, tax advisers and independent legal service providers within its remit.Belastingdienst, Bureau Toezicht Wwft: dealers in goods, estate agents, appraisers, pawnbrokers and domiciliation providers.The president of the local bar: lawyers.The instruments run from a warning and a formal instruction through orders subject to a penalty payment to administrative fines, with a criminal route available for defined breaches. The Wwft works with statutory fine categories, and the maximum in a given case depends on the provision breached, the category that applies and, in the highest category, on turnover-related maxima that do not apply to every institution. Any figure quoted for a maximum fine should therefore be traced to the provision that produces it rather than treated as a single headline number.If your organisation faces an enforcement inquiry, the first steps matter. We set them out in
what to do when you are suspected of money laundering. For representation, see
money laundering defence.
What changes with the EU anti-money laundering package
The European anti-money laundering package was published in the Official Journal on 19 June 2024. It works through three instruments that operate differently, and the difference matters for planning.Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation, is directly applicable and does not require national implementation. It applies from 10 July 2027, with a later date for certain sectors. It moves the core obligations, including client due diligence and beneficial ownership, into a single European rulebook.Directive (EU) 2024/1640, the sixth anti-money laundering directive, does require national implementation. It deals with supervisory powers, financial intelligence units and beneficial ownership registers, and the shape it takes in the Netherlands will depend on the implementing legislation.Regulation (EU) 2024/1620 establishes the Anti-Money Laundering Authority, AMLA, seated in Frankfurt. AMLA will supervise a selected group of high-risk cross-border institutions directly and coordinate national supervisors; its powers phase in rather than arriving in one step.The package also introduces an EU-wide limit on large cash payments, with member states free to set a lower national limit.It is often said that the package removes national differences. That is too strong. The Regulation does narrow the room for national variation on the points it covers, but the Directive still has to be implemented nationally, the Regulation itself leaves options open in places, and national supervisory practice will not become uniform on the date of application. What can be said is that the room for a purely Dutch reading of a European rule gets smaller.Until the application dates, the Wwft continues to apply in full. In practical terms the areas most likely to need work per sector are client due diligence procedures, the beneficial ownership file, internal policy documentation, the reporting route, and the way supervisory information requests are handled.
Compliance checklist
Maintain a dated risk assessment and review it at set intervals.Record, for every client, who the beneficial owner is and how that was verified, including the reason if the statutory fallback was used.Screen against politically exposed person and sanctions lists at onboarding and at set intervals.Set a fixed internal escalation deadline so that reports go out without undue delay, and measure against it.Keep the objective indicators that apply to your category where the people handling payments can see them.Do not inform a client that a report has been made or is intended, and keep any termination neutral.Retain client and transaction records for five years.Train staff periodically, using your own case material.Record the assessment behind a decision not to report, as well as the decisions to report.
Frequently asked questions
Is a cash payment of €10,000 always unusual?Not automatically. It is unusual, and must be reported, where the objective indicator for cash payments applies to your category of institution and to the transaction concerned. For the professions listed in the Implementation Decree, including notaries, accountants, tax advisers, estate agents and dealers in goods within the relevant category, that indicator does apply, and the report then follows regardless of how ordinary the transaction looks.Do I need to be certain that money laundering is occurring before reporting?No. The test is whether the transaction is unusual within the meaning of the indicators, not whether you are convinced that something criminal has happened. FIU-Nederland analyses the report and decides whether to declare the transaction suspicious.Can a client hold my firm liable for a report?Article 20 of the Wwft protects an institution that reports in good faith against liability for damage resulting from the report, provided it could reasonably assume it was complying with the Act. The protection attaches to the report and its conditions rather than to everything surrounding it.Does the Wwft apply to lawyers?It applies in respect of the services designated in the Act. Determining a client’s legal position and representation in or in connection with proceedings fall outside the reporting duty; acting as an intermediary in a transaction or structuring one does not. Legal professional privilege is a separate concept and does not by itself determine whether the Wwft applies.How long must compliance files be retained?Five years after the transaction or after the end of the business relationship, under Article 33 Wwft.What is the difference between an unusual and a suspicious transaction?Institutions report unusual transactions. FIU-Nederland analyses them, can declare a transaction suspicious and makes the data available to the investigative and security services.
Sources
Wet ter voorkoming van witwassen en financieren van terrorisme, wetten.overheid.nl (BWBR0024282), in particular Articles 1a, 2c, 2d, 3, 8, 16, 20, 23, 33 and 35
Wetboek van Strafrecht, Articles 420bis and following, wetten.overheid.nl (BWBR0001854)
Uitvoeringsbesluit Wwft 2018, indicator list, wetten.overheid.nl (BWBR0041193)
Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and Regulation (EU) 2024/1620, Official Journal of 19 June 2024
FIU-Nederland, fiu-nederland.nl
Bureau Financieel Toezicht, bureauft.nlLaw as at 23 August 2026. Statements about European rules that apply from 2027 describe the position as adopted; national implementation is still under way. This article is general information and does not constitute legal advice for a specific case.
