Indagine KYC ai sensi del Wwft: cosa richiede e quando fallisce

A KYC investigation is the client due diligence (cliëntenonderzoek) that banks, payment institutions, crypto-asset service providers, trust offices, notaries, accountants and certain lawyers in the Netherlands must carry out under Article 3 of the Money Laundering and Terrorist Financing Prevention Act (Wwft). The depth of the investigation is risk-based, but one rule has no exception: if the investigation cannot be completed, Article 5 Wwft forbids the institution to start the relationship or carry out the transaction, and an existing relationship must be ended.

The investigation has three layers: who the client is, who is behind it and why the relationship exists, and ongoing monitoring for as long as the relationship lasts. Supervisors such as De Nederlandsche Bank (DNB) judge the file on the reasoning it records, not on the number of documents it contains.

What does a KYC investigation under the Wwft require?

Article 3(2) Wwft lists five things the investigation must allow the institution to do. Together they form the backbone of every KYC file, whatever software is used.

• Identify the client and verify that identity.
• Identify the ultimate beneficial owner (UBO), take reasonable measures to verify that person’s identity and, for a legal entity, understand the ownership and control structure.
• Establish the purpose and intended nature of the business relationship.
• Monitor the relationship and its transactions continuously, including, where needed, the source of the funds used.
• Check whether the person acting for the client is authorised to do so, and identify and verify that person.

Article 2b Wwft adds the organising principle: each institution must assess its own money-laundering and terrorist-financing risks, taking into account at least the type of client, product, service, transaction, delivery channel and country. The depth of each file must follow from that assessment, and the institution must be able to explain the choice.

How does KYC relate to money laundering as a criminal offence?

The Wwft imposes preventive duties on gatekeepers; money laundering itself is a crime under Articles 420bis to 420quater of the Dutch Criminal Code (Wetboek van Strafrecht). Under Article 420bis the maximum sentence for intentional money laundering is six years’ imprisonment. An institution can therefore breach the Wwft without any laundering taking place, and a client can launder money through a file that was faultless. Our Guida al riciclaggio di denaro nei Paesi Bassi covers the criminal side.

Which businesses must carry out a KYC investigation?

The Wwft applies to a closed list of institutions in Article 1a, not to business in general. If your organisation is on that list, the investigation is mandatory, and relying on a third party for parts of it under Article 5 Wwft does not shift the responsibility.

The list covers banks, payment and electronic money institutions, life insurers, investment firms and fund managers, crypto-asset service providers, trust offices, civil-law notaries, lawyers, accountants, tax advisers, estate agents, pawnbrokers, providers of games of chance and dealers who accept large cash payments. Our overview of KYC obligations for Dutch businesses sets out the duties per category.

For lawyers the scope is narrower than many clients assume. A Dutch lawyer falls under the Wwft only for defined transactional services, such as buying or selling real estate or businesses, managing money or securities, and setting up or managing companies. Advice on a client’s legal position and representation in court proceedings fall outside the reporting duty, which protects legal professional privilege.

Which rules apply besides the Wwft?

Three rule sets sit on top of each other: the Wwft, the Sanctions Act 1977 (Sanctiewet 1977) and EU law. Mixing them up is the most common structural error in Dutch compliance files.

Why is sanctions screening a separate duty?

Screening against EU sanctions lists flows from the Sanctions Act 1977 and directly applicable EU regulations, and it applies to every business, not only Wwft institutions. Under the EU approach, an entity is caught by an asset freeze if a listed person owns 50 per cent or more of it or otherwise controls it. That test has nothing to do with the 25 per cent UBO threshold, so a UBO check never doubles as a sanctions check. See our guidance on Conformità alle sanzioni per le imprese.

Quali cambiamenti avverranno il 10 luglio 2027?

The EU anti-money laundering package of 2024 replaces much of the directive-based system. Regulation (EU) 2024/1624, the AML Regulation, contains the client due diligence rules and applies from 10 July 2027; the Anti-Money Laundering Authority (AMLA) in Frankfurt drafts the technical standards and will supervise a group of high-risk cross-border institutions directly. Until that date the Wwft is the operative law, and files are judged against it. Mapping your procedures against the regulation now avoids a rush in 2027.

How do you identify and verify a client?

Identification starts with a valid identity document for individuals and a Chamber of Commerce (KVK) extract for companies. Verification means checking those details against a reliable, independent source.

Remote onboarding is accepted if the method is reliable, for example chip reading of a passport, a verified iDIN flow, electronic identification under the eIDAS Regulation, or a first payment from an account in the client’s name at an EU bank. The GDPR principle of data minimisation applies alongside: keep what the Wwft requires, restrict access and delete on schedule.

For companies, a recent extract from the Chamber of Commerce trade register shows the directors and the limits on their authority. That point is often missed: a contract signed by a director who may only act jointly does not bind the company. Foreign entities need equivalent register documents, sometimes legalised or translated.

How do you establish the ultimate beneficial owner?

Under Article 3 of the Wwft Implementing Decree 2018 (Uitvoeringsbesluit Wwft 2018), a UBO of a BV or NV is in any case a natural person who directly or indirectly holds more than 25 per cent of the shares, voting rights or ownership interest, or who has control by other means. If no such person can be found after exhausting all means, the senior managers are recorded as pseudo-UBOs.

The UBO register at the Chamber of Commerce is no longer open to the public. On 22 November 2022 the Court of Justice of the European Union held that general public access was a disproportionate interference with privacy, and the Netherlands closed public access. Two practical rules follow: the register is a check, not a source, and an institution that finds a discrepancy with its own findings must report it to the Chamber of Commerce.

When is enhanced due diligence mandatory?

Article 8 Wwft requires enhanced due diligence (verscherpt cliëntenonderzoek) at least where the relationship carries a higher risk by its nature and where the client is based in a country the European Commission has designated as high-risk. It also applies to politically exposed persons (PEPs), their family members and close associates.

For a PEP, Article 8 Wwft requires approval by senior management before the relationship starts or continues, measures to establish the source of wealth and the source of funds, and enhanced ongoing monitoring. Source of funds concerns the money in a specific transaction; source of wealth concerns how the client’s overall assets were built up. Evidence should be documentary where the risk calls for it: sale agreements, tax returns, audited accounts, inheritance documents.

Simplified due diligence under Article 6 Wwft is the opposite end of the scale, but it is not an exemption. The institution must still identify the client, monitor the relationship and record why the low-risk classification is justified.

When must you report an unusual transaction?

Under Article 16 Wwft an institution must report a completed or intended unusual transaction to the Financial Intelligence Unit (FIU-Nederland) without delay once its unusual character becomes known. There is no fixed number of days, and a payment the institution refused to carry out can still be reportable.

The indicators are laid down in the Wwft Implementing Decree 2018. Objective indicators trigger a report automatically; the subjective indicator covers every transaction where the institution has reason to assume a link with money laundering or terrorist financing. Our article on riciclaggio di denaro contro transazioni insolite explains how the two concepts interact. FIU-Nederland, not the institution, decides whether a transaction is declared suspicious.

The reporting duty comes with protections and a prohibition. Data reported in good faith cannot be used as the basis for prosecuting the reporting institution for money laundering (Article 19 Wwft), and the institution is not liable for damage a third party suffers from a report made in the reasonable belief that it was required (Article 20 Wwft). Article 23 Wwft imposes strict secrecy: telling the client that a report was made is itself a breach.

What happens if the investigation cannot be completed?

The consequence is prescribed by law. Under Article 5 Wwft the institution may not enter into the relationship or carry out the transaction, and under Article 5(3) it must end an existing relationship.

The institution should also consider whether the circumstances call for a report to FIU-Nederland. Continuing to serve a client whose ownership was never resolved, on the promise that the file will be completed later, is one of the failures supervisors fine most often. Under Article 33 Wwft the KYC documents must be kept for five years after the relationship ends or the transaction is carried out.

Who supervises and what are the sanctions?

Article 1d Wwft divides supervision by sector. DNB supervises banks, payment and electronic money institutions, insurers, trust offices and crypto-asset service providers; the Dutch Authority for the Financial Markets (AFM) supervises investment firms and fund managers; the Financial Supervision Office (BFT) supervises notaries, accountants and tax advisers; the local dean of the Bar (deken) supervises lawyers; the Gaming Authority (Kansspelautoriteit) supervises gambling providers; and the Minister of Finance, through the Belastingdienst’s Wwft supervision office, supervises dealers, estate agents and pawnbrokers.

Enforcement runs from a norm-clarifying conversation through an instruction and an order subject to a penalty payment to an administrative fine. Fining decisions are generally published with the name of the institution, which often does more damage than the fine. Intentional breach of the core Wwft duties is also an economic offence: the Public Prosecution Service (Openbaar Ministerie) has concluded criminal settlements with several large Dutch banks over gatekeeper failures, and directors can be prosecuted personally.

What should you check as an institution?

• Is your written risk assessment under Article 2b Wwft up to date and does your acceptance policy follow from it?
• Does each file explain in a short narrative why the client’s activity makes sense, signed off by a second reviewer?
• Is the UBO established above the 25 per cent threshold, and has any discrepancy with the UBO register been reported?
• Do you screen the whole portfolio again when sanctions lists or the EU high-risk country list change, not only at onboarding?
• Are alerts closed with written reasons, and are unusual transactions reported to FIU-Nederland without delay?
• Are files kept for five years after the relationship ends, and deleted after that unless another legal duty applies?

What should you check as a client under investigation?

• Which documents the institution actually needs, and by which date, so you can supply them in one go.
• Sia tuo KVK and UBO register entries match your real ownership structure.
• Whether you can document the source of funds and, for larger relationships, the source of wealth.
• Whether a termination letter gives reasons and a reasonable notice period: Dutch courts have held that a bank’s freedom to end a relationship is limited by its duty of care and by reasonableness and fairness.
• Whether you have been given a genuine chance to provide missing information before the relationship is ended.

What can we do for you with a KYC investigation?

We advise institutions, their directors and their clients on Wwft and sanctions questions as part of our work as avvocati aziendali.

• We review your Wwft risk assessment and client acceptance policy against Articles 2b, 3 and 8 Wwft.
• We assess individual files on UBO, PEP and source-of-funds questions and record the reasoning.
• We set up sanctions screening that applies the EU ownership and control test.
• We represent your institution and its directors in investigations by DNB, the AFM, the BFT or the Public Prosecution Service.
• For clients, we respond to information requests and challenge an unjustified termination of a banking relationship.

Sintesi

• A KYC investigation is the client due diligence required by Article 3 Wwft: identification, UBO and purpose, and ongoing monitoring.
• Depth is risk-based; enhanced due diligence is mandatory for PEPs, high-risk countries and higher-risk relationships (Article 8 Wwft).
• Unusual transactions must be reported to FIU-Nederland without delay, and the client may not be told.
• If the investigation cannot be completed, the relationship may not start or must be ended (Article 5 Wwft).
• From 10 July 2027 the EU AML Regulation takes over most of the client due diligence rules.

Domande frequenti