Internal fraud investigation in the Netherlands: rules and steps

An internal fraud investigation in the Netherlands must comply with three sets of rules at once: criminal law, which defines the offence; supervisory law, which can oblige regulated firms to report; and employment and data protection law, which limits how an employer may gather evidence about its staff. Evidence gathered in breach of the GDPR or without the works council’s consent can weaken a dismissal case, and a failed dismissal weakens a criminal file built on the same material.

An employer may investigate a concrete suspicion of fraud, but the investigation must be proportionate, use the least intrusive means, and give the employee a real opportunity to respond before any decision.

Which offences count as fraud under Dutch law?

There is no single offence called fraud in the Dutch Criminal Code (Wetboek van Strafrecht, Sr). What is charged depends on the conduct, and the maximum sentences differ.

• Forgery of invoices, contracts or records (Article 225 Sr).
• Embezzlement of goods or money lawfully in your possession (Article 321 Sr, maximum three years), and by an employee in the course of employment (Article 322 Sr, maximum four years).
• Deception by a false name, false capacity, tricks or a web of lies (Article 326 Sr, maximum four years).
• Private bribery (Article 328ter Sr).
• False annual accounts published by directors or supervisory board members (Article 336 Sr, maximum six years).
• Money laundering (Articles 420bis to 420quater Sr); habitual money laundering carries up to eight years (Article 420ter Sr).

A suspicion described loosely as “fraud” in an internal report may legally be forgery, where the document rather than the loss is central. Our guides to fraud under Dutch law and bankruptcy fraud explain the offences in more detail, as do our articles on online fraud and phishing and identity fraud.

Do you have to report the fraud to a supervisor?

That depends on your sector. Institutions under the Money Laundering and Terrorist Financing Prevention Act (Wwft) must report unusual transactions to FIU-Nederland without delay (Article 16 Wwft), and that duty is not suspended by an internal investigation.

Regulated financial firms under the Financial Supervision Act (Wet op het financieel toezicht, Wft) are supervised by De Nederlandsche Bank (DNB) and the Dutch Authority for the Financial Markets (AFM), which expect to be informed of serious integrity incidents. Criminal investigation of financial fraud is often carried out by the Fiscal Information and Investigation Service (FIOD) under the direction of the Public Prosecution Service. The difference between reporting and suspicion is explained in our article on money laundering and unusual transactions.

How do you start an internal investigation lawfully?

Start from a written suspicion and a written investigation plan that defines which systems, which people and which period will be examined. Record every step, because a court will later ask why each measure was necessary at that moment.

Under Article 27(1)(l) of the Works Councils Act (WOR), any arrangement for systems that monitor the attendance, behaviour or performance of staff requires the works council’s consent. Introducing monitoring software in the middle of an investigation without that consent puts the evidence at risk. Under the GDPR, a private employer will normally rely on legitimate interest, documented in a balancing test; for systematic or large-scale monitoring, a data protection impact assessment comes first.

May you read an employee’s email?

Only if the suspicion is concrete, the search is limited in time and search terms, and staff were informed in advance through a policy that business systems may be inspected. Blanket screening of private correspondence, hidden cameras in the ordinary workplace and open-ended searches across years of mail usually fail the proportionality test.

The employee keeps the right of access to their personal data in the investigation report under the GDPR, subject to the rights of others named in it. If you hire an external investigator, you remain responsible for how the investigation is carried out.

Why must you hear the employee?

The employee must be confronted with the findings and be given a genuine chance to respond before a decision is taken. This follows from the duty to act as a good employer (Article 7:611 of the Dutch Civil Code, BW). Courts treat a refusal to hear the employee as a sign that the outcome was decided in advance.

Can you dismiss an employee for fraud?

Yes, fraud can be an urgent reason for summary dismissal (ontslag op staande voet) under Article 7:678 BW. Under Article 7:677 BW the dismissal must be given without delay once the facts are sufficiently clear, with immediate notice of the reason.

Employers lose these cases most often on the “without delay” requirement, because weeks pass while the investigation runs. Some time for a careful investigation is allowed, but suspend the employee in the meantime and keep the investigation moving. In a complex case, a request to the subdistrict court (kantonrechter) to dissolve the contract on the ground of culpable conduct (Article 7:669(3) BW) is often the safer route.

If the employee acted seriously culpably, no transition payment is due (Article 7:673 BW), and the employer can claim damages. Both require evidence that holds up in court. See our articles on summary dismissal and our guide to Dutch employment law.

How are whistleblowers protected?

Under Article 2 of the Whistleblowers Protection Act (Wet bescherming klokkenluiders), in force since 18 February 2023, employers with at least 50 employees must have an internal procedure for reporting suspected wrongdoing. The reporter may also go directly to a competent external authority.

A reporter may not suffer detriment because of the report. Article 17da of the Act lists examples, including dismissal, suspension, demotion, a negative appraisal and transfer. In proceedings, if the reporter shows that the detriment followed the report, the employer must prove that it had nothing to do with it. Disciplinary action against an employee who raised a concern therefore needs its own documented justification.

When do the criminal and regulatory tracks take over?

A company can be prosecuted itself, and those who ordered or actually directed the conduct can be prosecuted alongside it (Article 51 Sr). Investigators can search premises, seize records and data, and freeze bank balances.

The Public Prosecution Service can separately claim the estimated proceeds of the offence (confiscation, Article 36e Sr). Against seizure of money or goods, an interested party can file a complaint (klaagschrift) with the court under Article 552a of the Code of Criminal Procedure (Sv); see our article on your rights when money is seized. Large Dutch banks have concluded criminal settlements with the Public Prosecution Service over failing compliance systems, which shows that the system, not only the individual transaction, is assessed. For individuals, see money laundering penalties and what to do when suspected of money laundering.

What should you do in the first week?

Secure the data first, preserving the original and its metadata, before managers start working in the live system. Limit the group of people who know, and decide early whether a report to a supervisor or FIU-Nederland is legally required.

Do not confront the employee before the evidence is secured, and do not promise confidentiality you cannot keep. Consider carefully whether to file a criminal complaint: once the file is with the investigating authorities, you no longer control what happens to the information. Our overview of compliance obligations for companies covers prevention.

What should you check as an employer?

• Is there a written suspicion and an investigation plan with defined scope and period?
• Does monitoring have works council consent under Article 27 WOR, and is the GDPR balancing test documented?
• Does a reporting duty to FIU-Nederland or a supervisor apply?
• Has the employee been heard on the findings before any decision?
• Is summary dismissal given without delay, or is dissolution by the subdistrict court the safer route?
• Is the suspected employee a whistleblower who is protected against detriment?

What should you check as an employee under investigation?

• Which specific facts are you accused of, and on which evidence?
• Were your emails or systems examined in line with a known policy and with works council consent?
• Have you been given access to your personal data in the investigation report?
• Did the employer dismiss you without delay and state the reason immediately?
• Have you noted the two-month deadline for challenging a summary dismissal, and is your defence coordinated with any criminal investigation?

What can we do for you with an internal fraud investigation?

Our criminal lawyers and employment lawyers advise companies, directors and employees.

• We draft the investigation plan and check it against the GDPR and the WOR.
• We assess whether a report to FIU-Nederland, DNB or the AFM is required.
• We prepare and attend the hearing of the employee.
• We conduct summary dismissal or dissolution proceedings, or defend the employee against them.
• We assist the company or the individual in a criminal investigation and file complaints against seizure.

Summary

• Dutch law has no single fraud offence: forgery, embezzlement, deception, bribery and money laundering each have their own article and penalty.
• Investigate proportionately, with a written plan, GDPR basis and works council consent for monitoring (Article 27 WOR).
• Hear the employee before any decision; summary dismissal must follow without delay (Article 7:677 BW).
• Whistleblowers are protected against detriment under the Whistleblowers Protection Act.
• Reporting duties under the Wwft are not suspended by an internal investigation.

Frequently asked questions