Money laundering means giving criminal proceeds the appearance of a lawful origin, and in the Netherlands it is a criminal offence under Articles 420bis to 420quater of the Dutch Criminal Code (Sr). For most businesses, however, the real exposure is regulatory: the Money Laundering and Terrorist Financing (Prevention) Act (Wet ter voorkoming van witwassen en financieren van terrorisme, Wwft) requires banks, lawyers, accountants, estate agents, dealers and other institutions to check their clients and report unusual transactions, and supervisors enforce those duties even if no laundering has taken place.
Below we explain the difference between the criminal offence and the preventive duties, who falls under the Wwft, how client due diligence and the UBO register work, how you recognise and report an unusual transaction, how supervisors enforce the rules and what changes with the new EU anti-money laundering package from 2027.
What counts as money laundering under Dutch criminal law?
You launder money if you hide or disguise the true nature, origin or location of an asset, or acquire, hold, transfer or use it, while you know that it comes from a crime. Dutch law also punishes those who should reasonably have suspected the criminal origin.
The Criminal Code distinguishes four offences. Intentional money laundering under Article 420bis Sr carries a maximum prison sentence of six years. Habitual money laundering (gewoontewitwassen) under Article 420ter Sr carries up to eight years. Culpable money laundering (schuldwitwassen) under Article 420quater Sr applies where you did not know, but should reasonably have suspected, that the asset came from crime, and carries up to one year. Finally, simple money laundering (eenvoudig witwassen) under Article 420bis.1 Sr covers merely acquiring or holding an asset that comes directly from your own crime, with a maximum of six months.
The prosecution does not need to prove exactly which crime produced the money. Under Dutch case law, it is enough that it is established that the asset cannot have a lawful origin. If the facts call for an explanation, for example large cash amounts without a known source of income, the suspect is expected to give a concrete and verifiable explanation. If none is given, the court may conclude that the money comes from crime.
Companies can commit these offences too, and so can the directors who ordered or effectively led the conduct (Article 51 Sr). For the penalties and the way courts calculate them, see our article on money laundering penalties.
Why is prevention mainly a regulatory question?
Because the Wwft places duties on institutions that apply whether or not any crime has occurred. A bank or law firm that fails to check a client properly can be fined even if the client turns out to be entirely honest.
It helps to keep three questions apart. The first is criminal liability for money laundering, which a criminal court decides. The second is the set of preventive duties under the Wwft: they apply only to institutions within scope, and the duty to report depends on whether a transaction is unusual under the statutory indicators, not on proof of a crime. The third is the consequence of not complying: supervisory measures and administrative fines in the first place, with civil and, in defined cases, criminal exposure alongside.
An unusual transaction is not by definition money laundering, and a report is not an accusation. Keeping the three layers apart allows an institution to comply with the law without treating its clients as suspects. It also helps the client: a bank that asks questions about the source of your funds is fulfilling its own legal duty, not accusing you of anything.
Who falls under the Wwft?
Article 1a of the Wwft lists the institutions and professionals within scope. They include financial institutions, crypto-asset service providers, legal and financial professionals and several categories of traders.
In broad terms, the following fall under the Act:
- Financial sector: banks, investment firms, electronic money institutions, payment service providers, exchange institutions and insurers within the categories described in the Act.
- Crypto sector: crypto-asset service providers.
- Legal and financial professionals: civil-law notaries, lawyers, accountants, tax advisers and trust offices, in respect of designated services.
- Real estate and trade: estate agents, appraisers, casinos, remote gambling providers and professional dealers in goods within the categories described in the Act, including art dealers, jewellers, car dealers and boat brokers.
Dealers in goods
Whether a trader is covered, and for which duties, depends on the statutory category, the nature of the trade and the transaction. Accepting a large cash payment can bring a trader within scope, but that does not mean every retailer becomes subject to all Wwft obligations as soon as a payment reaches a certain amount.
The right question is which category of Article 1a fits the activity and which duties attach to that category. A car dealer who accepts a cash payment for a vehicle is in a different position from a shop that occasionally receives a large card payment. If you are unsure, record your analysis, because a supervisor will ask how you reached your conclusion.
Lawyers and notaries
The Wwft applies to lawyers only for the services designated in the Act, such as assisting in the purchase of real estate, managing client funds or setting up companies. Determining a client’s legal position and representing a client in or in connection with legal proceedings fall outside the reporting duty.
General legal advice is therefore not automatically outside the Wwft. What matters is whether the work actually performed is a designated service, not the label on the file. Acting as an intermediary in a transaction, or structuring one, is not covered by the exclusion. Legal professional privilege (verschoningsrecht) operates alongside that exclusion, but it is a separate concept and does not by itself determine whether the Wwft applies.
How do you prevent money laundering in practice?
Prevention rests on three connected steps: a documented risk assessment, client due diligence in proportion to that assessment, and ongoing monitoring that compares what a client actually does with what the file says it would do.
Risk assessment
The Wwft works on a risk-based approach. Before you design controls, you record your own risk assessment, which in the financial sector is often called the systematic integrity risk analysis (SIRA). It covers at least the countries involved, the products and services you offer, the channels through which you deliver them and the types of client and the complexity of their structures.
Supervisors read the risk assessment first and judge the rest of the file against it. An institution that records no material risk at all tells its supervisor something about its risk identification rather than about its risk. Review the assessment at fixed intervals and whenever your business changes, for example when you start serving a new market or offering a new product.
Client due diligence
Articles 3 to 8 of the Wwft govern client due diligence (cliëntenonderzoek). You must identify the client and verify its identity, identify the ultimate beneficial owner and take reasonable measures to verify who that is, establish the purpose and intended nature of the relationship, and monitor the relationship on a continuing basis.
Under Article 3(5), due diligence is required when you enter into a business relationship, for an occasional transaction of EUR 15,000 or more, where there are indications of money laundering or terrorist financing, where you doubt the accuracy of data obtained earlier, where the risk profile of an existing client changes, where increased country risk is involved, and for money transfers of EUR 1,000 or more.
These amounts belong to the situations described in that provision. They are not general thresholds for every duty or every institution, and they are not reporting thresholds. Reporting thresholds are set separately, in the indicator list discussed below.
If you cannot complete the due diligence, you may not enter into the relationship or carry out the transaction, and an existing relationship must be ended (Article 5 Wwft). This is why banks sometimes close accounts when a client does not answer their questions. As a client, answering such questions promptly and with documents is usually the quickest way to keep your account.
Ultimate beneficial ownership
A Chamber of Commerce (KvK) extract is a starting point, not an answer. You must map the ownership and control chain, following layered holdings, foreign entities, foundations, trusts and voting arrangements, until you can state in one paragraph who actually owns or controls the client and how you verified it.
The figure of more than 25 percent, familiar from the implementing rules, is an indicator of ownership or control, not a definition. Control can lie elsewhere: in voting agreements, in a right to appoint directors, or in economic entitlement without formal shareholding. Where, after exhausting all reasonable means, no natural person can be identified, the statutory fallback applies and the senior managing officials are recorded as beneficial owners. That fallback is a last resort, and both the search and the reason for using it must be documented. Our note on due diligence in practice covers what tends to be missing from these files.
Ongoing monitoring
Onboarding records what a client said it would do; monitoring shows what it actually does. The comparison reveals unusual behaviour.
Examples are an account opened for local trade that starts receiving payments from unrelated countries, turnover that doubles in a quarter without any change in staff or premises, or deposits that no longer match the declared source of income. Monitoring also includes screening against sanctions lists and lists of politically exposed persons, at onboarding and at regular intervals afterwards.
How does the UBO register work?
Dutch companies and other legal entities must register their ultimate beneficial owners with the Chamber of Commerce. Since a judgment of the EU Court of Justice in 2022, the register is no longer open to the public.
The filing obligation
Dutch legal entities and partnerships, such as the private limited company (BV), the public limited company (NV), foundations, associations, general partnerships (VOF), limited partnerships (CV) and professional partnerships (maatschap), must file their ultimate beneficial owners (UBOs) with the Chamber of Commerce. The obligation rests on the entity itself, and the board must keep the registration up to date: a change in shareholding or control must be reported.
Failing to register, or registering incorrectly, is an economic offence under the Economic Offences Act (Wet op de economische delicten). Identifying the UBO in your own client due diligence and the entity’s filing in the register are two different things, and they are often confused.
Who can access the register?
On 22 November 2022 the Court of Justice of the European Union ruled in joined cases C-37/20 and C-601/20 that general public access to UBO information is an unjustified interference with private life and the protection of personal data. The Dutch register was closed to the public that same week and has not reopened.
Access now works in layers. Institutions with Wwft obligations can consult what they need for their client due diligence, and an organisation can see its own entry. Competent authorities, including FIU-Nederland, De Nederlandsche Bank (DNB), the Dutch Authority for the Financial Markets (AFM), the tax authorities, the police and the Public Prosecution Service (OM), have access to the full record. The Act restricting access to the UBO registers (Wijzigingswet beperking toegang UBO-registers), adopted in July 2025, gives this layered access a statutory basis.
The sixth EU anti-money laundering directive, Directive (EU) 2024/1640, also requires member states to grant access to persons with a legitimate interest, such as journalists and civil-society organisations investigating money laundering. The Dutch rules for that route are still being put in place; until they apply, nobody obtains access on that ground.
The duty to report a discrepancy
Under Article 10c of the Wwft, an institution that consults the register and finds that the entry does not match its own findings must report that discrepancy to the Chamber of Commerce. The duty is not optional, and noting the difference in the client file does not discharge it.
In practice, this is how the register is kept accurate, because the entity’s own filing is rarely what gets corrected first. If you are a director and your bank or notary reports a discrepancy, check your filing straight away and correct it, because an incorrect registration is itself an offence.
When do you need enhanced due diligence?
Whenever the risk of money laundering or terrorist financing is higher. Article 8 of the Wwft then requires additional measures in proportion to the risk you have identified.
Enhanced due diligence is a different set of questions, not simply a longer form. Situations that call for it include politically exposed persons (PEPs) and their family members and close associates, relationships and transactions connected to high-risk third countries designated by the European Commission, and cross-border correspondent relationships with institutions outside the European Economic Area.
In substance, enhanced due diligence means establishing the source of the funds used in the transaction and, where relevant, the source of the client’s wealth, based on verifiable and independent information. For politically exposed persons and for cross-border correspondent relationships, the Act requires approval at senior management level. Outside those situations, requiring approval at that level is a sensible internal control rather than a statutory rule, and your procedures should be clear about which of the two you are applying.
An example: a buyer offers to purchase a commercial property through a newly formed company with a parent in a jurisdiction that has no connection with the buyer’s business. The estate agent and the notary will then ask who ultimately owns the company, where the purchase money comes from and why the structure was chosen. Documents such as annual accounts, a loan agreement or a bank statement from the source account usually answer those questions. If the answers remain vague, the transaction does not go ahead.
How do you recognise an unusual transaction?
Through the indicators in the Wwft Implementing Decree 2018 (Uitvoeringsbesluit Wwft 2018). Dutch law does not ask you to establish criminal conduct: the test is whether a transaction is unusual, not whether it is suspicious.
The distinction is explained in our analysis of money laundering versus unusual transactions. The indicator list contains two kinds of trigger: objective indicators, which apply automatically, and one subjective indicator, which calls for judgement.
Objective indicators
An objective indicator applies to a defined category of institution and a defined type of transaction. If it applies, the transaction is unusual and must be reported, whatever the client’s explanation and however ordinary the business looks. The list is category-specific, so first check which indicators apply to you. The main ones are:
- Tax advisers, accountants, lawyers, civil-law notaries, trust offices, appraisers and estate agents: a cash payment of EUR 10,000 or more, including payments with bearer cheques and prepaid cards.
- Banks: exchanging EUR 10,000 or more in cash between currencies or denominations, a cash deposit of EUR 10,000 or more onto a credit card or prepaid card, use of a credit card or prepaid card for EUR 15,000 or more, and money transfers of EUR 2,000 or more.
- Exchange institutions: a cash exchange of EUR 10,000 or more between currencies or denominations.
- Electronic money institutions: the same card and transfer amounts as banks.
- Casinos: deposits of coins, notes or valuables of EUR 10,000 or more, a bank payment of EUR 15,000 or more, and a cash payment of EUR 10,000 or more, including foreign currency.
- Remote gambling providers: a bank payment of EUR 15,000 or more.
- Crypto-asset service providers: an exchange of crypto-assets for official currency of EUR 10,000 or more.
Splitting a payment into smaller amounts to stay below a threshold does not take it outside the rules. Connected transactions are assessed together, and deliberate splitting is itself a reason to look more closely.
The subjective indicator and the warning signs behind it
Alongside the objective list, there is one subjective indicator: a transaction where the institution has reason to assume that it may be connected with money laundering or terrorist financing. This indicator does most of the work, and it calls for judgement rather than arithmetic.
Patterns that regularly justify a closer look include:
- indifference to price, costs, delay or unfavourable commercial terms;
- payments received from, or routed through, a third party with no visible role in the transaction;
- a corporate structure more complex than the business justifies, particularly with a layer in a country unconnected to the trade;
- rapid resale of property, vehicles or art at a price that does not follow the market;
- loans between related parties without security, a repayment schedule or a commercial reason;
- reluctance to produce identity or ownership documents, or documents supplied only after repeated requests and in poor copies;
- an unexplained shift in payment method, in particular towards cash, crypto-assets or a new intermediary.
No single signal proves anything, and there is no rule that a certain number of signals triggers a report. What counts is the combination, the context, whether the client’s explanation is plausible and can be verified, and whether you have recorded your assessment. If, after that assessment, there is reason to assume a connection with money laundering or terrorist financing, the subjective indicator is met and you must report.
Record the assessment behind a decision not to report as carefully as a decision to report. A supervisor who reviews a file later will want to see why you concluded that the explanation was sufficient.
How do you report to FIU-Nederland?
Under Article 16 of the Wwft, you must report an unusual transaction to the Financial Intelligence Unit (FIU-Nederland) without delay once its unusual character becomes known. Reports are made through the FIU’s online reporting portal.
Without delay does not mean after a complete internal investigation. Once the statutory test is met, the report must go out; anything further can be investigated afterwards. Late reporting caused by long internal review chains is one of the most common findings in enforcement cases, and the usual remedy is a short, fixed escalation deadline written into your procedure.
What happens next is not your decision. FIU-Nederland analyses the report, can declare the transaction suspicious and then makes the data available to the investigation and security services. Whether a crime has been committed is assessed there and, if it comes to that, by a court. More information on the reporting process is available from FIU-Nederland.
What protection does a report give you?
The Wwft protects an institution that reports in good faith. Under Article 19, the information in a report cannot be used as the basis for a criminal investigation or prosecution of the reporting institution for money laundering or terrorist financing. Under Article 20, the institution is not liable for damage the client suffers as a result of the report, provided it could reasonably assume that it was complying with the Act.
This protection is tied to the report and to these statutory conditions. It is not a general indemnity for everything done around the report, and it does not cure a defective client file.
You may not tell the client
Article 23 of the Wwft prohibits informing the client or a third party that a report has been made or is intended. This is often called the tipping-off prohibition.
The prohibition does not stop you from declining an instruction or ending a relationship. It does require you to do so without conveying information from which the report, or the intention to report, could be inferred. In practice that means a neutral commercial explanation and nothing more.
What must you record and organise internally?
You must keep client and transaction records for five years, train your staff and have policies and procedures that match your risks. The larger and riskier the institution, the more a supervisor expects.
Article 33 of the Wwft requires client data, verification records and transaction data to be kept for five years after the transaction or after the end of the business relationship. This is not archiving for its own sake: if you cannot reconstruct why you accepted a client four years ago, you cannot defend that decision now.
Article 35 requires employees to be trained periodically to recognise unusual transactions and to carry out client due diligence properly. Training built on your own cases tends to stand up to supervisory scrutiny better than generic scenarios.
On governance, three levels should be distinguished. Article 2c requires policies, procedures and measures to limit and control the risks, approved at the level of day-to-day management and tested systematically. Article 2d requires an institution whose day-to-day policy is determined by two or more persons to designate one of them as responsible for compliance, and requires an independent compliance function and, where proportionate to the nature and size of the institution, an independent audit function. Beyond that statutory minimum lie supervisory expectations, which are higher for larger and higher-risk institutions, and beyond those lie choices that are simply good practice. A compliance file is easier to defend if it states which of the three a given control belongs to.
Who supervises compliance and what are the sanctions?
Supervision is divided by sector, and supervisors can impose instructions, orders subject to a penalty and administrative fines. Serious breaches can also be prosecuted as economic offences.
The main division is as follows. It is not exhaustive, and it is adjusted from time to time, so check it against current guidance:
- De Nederlandsche Bank: banks, payment service providers, electronic money institutions, insurers and trust offices.
- Dutch Authority for the Financial Markets: investment firms, collective investment undertakings and financial service providers within its remit.
- Financial Supervision Office (Bureau Financieel Toezicht, BFT): civil-law notaries, accountants, tax advisers and independent legal service providers within its remit.
- Tax and Customs Administration, Wwft Supervision Office (Belastingdienst/Bureau Toezicht Wwft): dealers in goods, estate agents, appraisers, pawnbrokers and domicile providers.
- The dean of the local bar association (deken): lawyers.
The instruments range from a warning and a formal instruction to orders subject to a penalty and administrative fines, with a criminal route for defined breaches. The Wwft works with statutory fine categories. The maximum in a given case depends on the provision breached, the category that applies and, in the highest category, on turnover-based maxima that do not apply to every institution. Any figure quoted for a maximum fine should therefore be traced to the provision that produces it, rather than treated as a single headline number. Supervisors also publish many fines, which often weighs more heavily than the amount itself.
In practice, an enforcement case often starts with a request for information or an on-site inspection. Answer such requests completely and on time, because refusing to cooperate is itself a breach. Keep a copy of everything you provide, and take legal advice before you respond to an intended fine: you can give your view on the intended decision, and a fine can be challenged by objection and appeal. If you or your organisation are suspected of money laundering in a criminal investigation, the first steps matter; we set them out in what to do when you are suspected of money laundering. For representation in criminal proceedings, see money laundering defence.
What changes with the EU anti-money laundering package?
From 10 July 2027, most client due diligence rules will come from a directly applicable EU regulation instead of the Wwft. A new EU authority will supervise the highest-risk institutions, and an EU-wide limit on cash payments will apply.
The package was published in the Official Journal of the EU on 19 June 2024 and consists of three instruments:
- Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation (AMLR), applies directly without national implementation from 10 July 2027, with a later date for certain sectors. It moves the core obligations, including client due diligence and beneficial ownership, into a single European rulebook. The text is available on EUR-Lex.
- Directive (EU) 2024/1640, the sixth anti-money laundering directive, must be implemented in national law. It deals with supervisory powers, financial intelligence units and beneficial ownership registers.
- Regulation (EU) 2024/1620 establishes the Anti-Money Laundering Authority (AMLA) in Frankfurt. AMLA will directly supervise a selected group of high-risk cross-border financial institutions and coordinate national supervisors; its powers are phased in.
The AMLR also introduces an EU-wide ban on cash payments of EUR 10,000 or more for traders in goods and services, and member states may set a lower national limit.
It is often said that the package removes national differences. That goes too far. The Regulation narrows the room for national variation on the points it covers, but the Directive still has to be implemented, the Regulation leaves options open in places, and supervisory practice will not become uniform overnight. What can be said is that the room for a purely Dutch reading of a European rule is getting smaller. Until the application dates, the Wwft continues to apply in full. The areas most likely to need work are client due diligence procedures, the beneficial ownership file, internal policies, the reporting route and the way you handle supervisory requests.
Compliance checklist
- Keep a dated risk assessment and review it at set intervals.
- Record for every client who the beneficial owner is and how you verified it, including the reason if you used the statutory fallback.
- Screen against PEP and sanctions lists at onboarding and periodically afterwards.
- Set a fixed internal escalation deadline so that reports go out without delay, and monitor it.
- Keep the objective indicators that apply to you visible to the people who handle payments.
- Never tell a client that a report has been made or is intended, and keep any termination neutral.
- Keep client and transaction records for five years and train staff periodically with your own cases.
In summary
- Money laundering is a crime under Articles 420bis to 420quater Sr, including culpable laundering where you should have suspected the criminal origin.
- The Wwft requires institutions within scope to carry out client due diligence and report unusual transactions, whether or not a crime has occurred.
- Reports go to FIU-Nederland without delay; the client may not be told, and a good-faith report is protected.
- The UBO register is no longer public; institutions must report discrepancies to the Chamber of Commerce.
- From 10 July 2027 the EU AMLR largely replaces the due diligence rules of the Wwft and bans cash payments of EUR 10,000 or more.
Frequently asked questions
Is a cash payment of EUR 10,000 always unusual?
Not automatically. It is unusual, and must be reported, where the objective indicator for cash payments applies to your category of institution and to the transaction. For the professions named in the Implementing Decree, such as notaries, lawyers, accountants, tax advisers and estate agents, that indicator applies, and the report follows however ordinary the transaction looks.
Do I need to be certain that money laundering is taking place before I report?
No. The test is whether the transaction is unusual under the indicators, not whether you are convinced that a crime has been committed. FIU-Nederland analyses the report and decides whether to declare the transaction suspicious.
Can a client hold my firm liable for a report?
Article 20 of the Wwft protects an institution that reports in good faith against liability for damage resulting from the report, provided it could reasonably assume it was complying with the Act. The protection covers the report and its conditions, not everything done around it.
Does the Wwft apply to lawyers?
Only for the services designated in the Act. Determining a client’s legal position and representation in or in connection with proceedings fall outside the reporting duty; acting as an intermediary in a transaction or structuring one does not.
How long must compliance files be kept?
Five years after the transaction or after the end of the business relationship, under Article 33 of the Wwft.
What is the difference between an unusual and a suspicious transaction?
Institutions report unusual transactions. FIU-Nederland analyses them, can declare a transaction suspicious and then makes the data available to the investigation and security services.
The full text of the Wwft is available on wetten.overheid.nl. Law & More advises institutions on Wwft compliance and supervisory investigations, and defends companies and individuals in money laundering cases.
Unsure where you stand? Tell us about your situation. We will let you know your options within one working day.
