Dutch Corporate Compliance Services: An AML Guide for 2026

Dutch corporate compliance services start with identifying the rules that apply to a company’s actual activities. A Dutch company isn’t automatically subject to every anti-money laundering duty. The Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft) sets obligations for designated institutions and professions. A company’s legal form or Dutch registration alone doesn’t establish whether it must carry out customer checks or report transactions.

KYC checks, UBO information and reports of unusual transactions serve different purposes. The applicable duties depend on the business’s role and the rules for its sector. This guide explains how to assess whether your activities fall within the Wwft’s scope, what risk-based due diligence and escalation can involve, and how Dutch reporting requirements work. It also outlines official sources to consult and records to maintain, so you can assess your obligations without assuming that rules from another country apply in the Netherlands.

Dutch corporate compliance and anti-money laundering: who has obligations?

Anti-money laundering (AML) compliance means applying legally required measures to help prevent money laundering and terrorist financing. These measures can include customer checks and reporting unusual transactions where the law requires them. In the Netherlands, the main framework is the Money Laundering and Terrorist Financing (Prevention) Act (Wwft). It applies to designated institutions and professionals, not automatically to every Dutch business. The broader Anti-Money Laundering (AML) concept covers measures intended to deter and detect the use of financial systems for criminal proceeds.

For a Dutch BV, incorporation alone does not determine whether Wwft duties apply. The relevant question is what the business actually does and whether that activity falls within the statutory scope. Assess AML obligations separately from the company’s general legal, tax and reporting responsibilities.

What makes a business an obliged entity in the Netherlands?

The Wwft identifies the institutions and professions subject to its requirements. Depending on the activity and applicable conditions, these can include banks and other financial institutions, certain crypto-asset service providers, accountants, tax advisers, administrative offices, and lawyers or notaries performing specified services. Compare the business’s actual services with the statutory categories rather than relying on its legal form, trade description or registration alone.

Supervision depends on the sector. Identify the relevant regulator and its guidance after classifying the business’s activity. If an activity falls within the Wwft, the entity may need to apply customer due diligence, maintain relevant records and report unusual transactions to FIU-Nederland. Dutch reporting is based on unusual transactions and applicable indicators. FIU-Nederland assesses reports to determine whether transactions are suspicious.

How does AML compliance differ from general corporate compliance?

General corporate compliance covers duties such as maintaining company records, meeting tax obligations, keeping bookkeeping and preparing annual reporting. AML compliance is narrower and activity-based. Where the Wwft applies, it can require measures focused on customers and transactions, including customer due diligence and reporting unusual transactions. A BV outside the Wwft’s scope should not assume it has those duties simply because it is a Dutch company.

Accounting records can help clarify business activity, but they don’t automatically meet AML-specific requirements. A ledger or customer invoice, for example, isn’t by itself evidence that required due diligence was completed or that a reporting decision was considered. Accounting and administration support wider company obligations, but remain distinct from controls required under the Wwft. First establish whether the law applies, then identify and document the obligations that follow.

How Dutch AML controls work: customer checks, risk assessment, and escalation

For an entity within the Wwft’s scope, controls should follow a clear order: establish which rules apply, assess relevant risks, carry out the required checks, and record decisions. This isn’t a general screening requirement for every Dutch BV. The precise measures depend on the entity’s regulated activity and applicable legal requirements.

What customer due diligence involves

Customer due diligence (CDD) means more than collecting an identity document. Where the Wwft requires it, an entity must identify the customer and verify that identity, establish relevant information about the beneficial owner, and understand the purpose and intended nature of the business relationship. Applicable rules may also require monitoring during that relationship. The Wwft sets the legal framework. Consult the current Dutch legislation and the competent supervisor’s guidance for the requirements that apply to the specific sector.

The depth of checks should reflect the risk assessment and the rules that govern the entity. Enhanced due diligence is required in situations specified by the applicable rules. It shouldn’t be added or omitted based only on an informal impression. A generic checklist can help organize work, but it doesn’t replace a regulated entity’s procedures or the legal assessment of a particular customer or relationship.

How risk assessment and escalation fit together

A risk assessment helps an obliged entity decide what checks and monitoring are appropriate under its legal obligations. Record the basis for the assessment, the checks completed, and any decision to seek further information or escalate a concern. Review the assessment when relevant information changes, following the entity’s applicable procedures. These records help explain how a decision was reached rather than leaving it to memory or an undocumented judgment.

Escalation is a control step, not a conclusion that a customer or transaction is criminal. Staff should refer concerns through the entity’s designated process so an appropriately responsible person can assess the facts against applicable indicators and reporting rules. Under the Dutch framework, obliged entities report unusual transactions, where the reporting duty applies, to the Financial Intelligence Unit (FIU-Nederland). The FIU assesses reports; an internal concern alone doesn’t establish that a transaction is unlawful.

Only entities subject to the relevant Wwft duty must make these reports. They should follow FIU-Nederland’s official reporting guidance and applicable legal restrictions on disclosing a report or related information. Risk assessment, customer checks, internal escalation and external reporting are connected steps, but each has its own legal basis and scope.

Dutch AML requirements compared: obliged entities, other companies, and UBO information

The main distinction is between duties triggered by a regulated activity and duties that apply to a company as part of ordinary administration. A BV’s UBO registration, bookkeeping and annual reporting are not substitutes for customer due diligence or transaction reporting under the Wwft. UBO information alone doesn’t determine whether a business is an obliged entity.

Business or record	What may apply	What it does not establish
Business carrying out an activity covered by the Wwft	Customer due diligence, risk-based controls, recordkeeping and reporting of unusual transactions where required by the applicable Wwft provisions.	The exact controls or supervisor are not identical across all sectors. They depend on the activity and applicable rules.
Dutch company not carrying out a Wwft-regulated activity	General company, tax, bookkeeping and filing duties that apply to its legal form and circumstances.	Dutch incorporation alone does not create Wwft customer-checking or unusual-transaction reporting duties.
Entity required to register UBO information	Register its ultimate beneficial owners as required. For a BV, the UBO threshold is generally more than 25% ownership, voting rights or ownership interest, or control through other means; report changes within 7 days.	Registration does not by itself make the entity an obliged entity or replace customer due diligence by an obliged entity.

Which duties may apply to obliged entities?

The Wwft defines which institutions and professionals are subject to its requirements. If an activity falls within that scope, the applicable rules may require customer due diligence, risk-based measures, records and reporting unusual transactions to FIU-Nederland. The relevant supervisor and sector guidance vary by activity. Use the official KVK UBO information for registration matters and the competent supervisor’s guidance for Wwft controls. Don’t assume that one sector’s procedure applies to another.

What UBO information does and does not establish

UBO registration is a company-information duty, while customer due diligence is a control an obliged entity performs in relation to customers under applicable rules. The >25% threshold concerns identifying a UBO in the relevant registration context; it isn’t a general test for whether a company has AML duties. Those duties still depend on the activity and Wwft scope.

Keep company records and AML evidence distinct. Bookkeeping and annual reporting support general administration, but they don’t document customer checks or reporting decisions unless the applicable AML process specifically requires and records that information. For a separate overview of company records and filings, see this guide to starting a business in the Netherlands.

How to build a practical Dutch AML compliance process

A workable process begins with a scope decision, not a checklist. The Wwft applies to specified activities and entities, so compare what the business actually does with the Act’s requirements first. If the business is within scope, identify the duties that apply to that activity, assign responsibility for carrying them out, and keep evidence of the controls and decisions. If it’s outside scope, don’t treat AML procedures as automatic company-wide duties.

A scope-first compliance review

Map the services the business provides, how it delivers them, and the types of customers and transactions involved. Compare that picture with the Wwft and relevant official guidance. Record the basis for the conclusion, including the provisions and guidance reviewed, the date of the assessment, and any assumptions. This creates a reference point if the business’s activities change.

Revisit the classification when the business introduces a new service, changes its customer base, or alters how it operates. These are practical review prompts, not statutory review deadlines. If a change could bring an activity within the Wwft, assess the applicable rules before relying on the previous conclusion.

Documentation, responsibility, and ongoing review

If the Wwft applies, set out who is responsible for the relevant controls and how staff should raise concerns. The structure should fit the business and its legal duties. Keep dated records of risk assessments, customer checks, escalations and decisions where the applicable requirements call for them. Separate those materials from routine bookkeeping and annual-account records when they serve different purposes. Ordinary accounting records don’t, by themselves, demonstrate that AML-specific controls were completed.

Build review into the process without inventing a fixed schedule. A new service, an unusual customer relationship or a change in applicable guidance can prompt a fresh assessment. Confirm any retention period, reporting deadline and confidentiality restriction against the rules and guidance that apply to the entity. For reporting procedures, consult FIU-Nederland’s official information. Reporting duties apply only where the law places them on the entity.

A scope-first approach keeps Dutch corporate compliance proportionate: maintain the company’s ordinary records, then add AML controls only where its activities make them applicable.

Ongoing Dutch compliance support: connect AML controls with company administration

AML controls and company administration work alongside each other, but they serve different purposes. Accurate bookkeeping, tax filings and company records help a BV meet its general administrative obligations and provide a reliable view of its activities. They don’t, by themselves, show that an obliged entity has completed customer due diligence, assessed risk or reported an unusual transaction where the Wwft requires it.

Where accounting and administration fit

Keep routine financial records and AML-specific evidence organized so each can be found for its intended purpose. A transaction recorded in the accounts may support an obliged entity’s review, but it isn’t a substitute for required customer checks, risk assessment or reporting decisions. The duties of an obliged entity remain with that entity, even where accounting or administrative work is supported by an external provider.

Annual reporting, bookkeeping and tax filings follow rules separate from AML. For company filing requirements, consult KVK’s official guidance on filing annual accounts. International founders can also review this guide to starting a business in the Netherlands for broader company administration information. Neither source determines whether a BV’s activities fall within the Wwft; assess that separately against the Act and relevant official guidance.

Practical next steps for international founders

Keep the ongoing process focused on three questions: what does the company actually do, which official rules apply to those activities, and what evidence must be maintained? If the business is within the Wwft’s scope, assign responsibility for applicable controls and escalation, and retain dated records of assessments and decisions where required. Revisit the scope assessment if services, customers or operating arrangements change. Don’t assume a company’s accounts or UBO registration answer the AML applicability question.

Intercompany Solutions provides accounting and corporate administration support for Dutch entities, including bookkeeping, tax filings and annual reporting. This support helps maintain company records, but it doesn’t replace the legal duties of an obliged entity or determine whether AML rules apply. International founders can discuss their Dutch company administration needs and how these relate to wider compliance responsibilities.

Put a clear compliance process in place

Start by classifying what your Dutch business actually does. Wwft duties depend on whether its activities fall within the law’s scope, not simply on whether it is a BV. If the rules apply, identify the relevant checks, reporting duties and official guidance, then document decisions and assign responsibility.

Keep AML controls distinct from routine company administration. Accurate accounts, tax filings and corporate records support sound operations, but they don’t replace customer due diligence or other duties that apply to an obliged entity. This distinction is central to applying Dutch corporate compliance services appropriately, without assuming every Dutch company has the same AML obligations.

Intercompany Solutions supports international entrepreneurs with Dutch company formation and ongoing business administration, including accounting, tax filing and corporate administration for Dutch entities. With the scope of your activities established, organize the relevant records and identify which requirements need ongoing attention.

A clear, activity-based approach gives you a practical foundation for managing your company’s responsibilities. Contact Intercompany Solutions to discuss accounting and corporate administration for your Dutch entity.

Frequently Asked Questions

Does every Dutch company have to comply with anti-money laundering rules?

No. The Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft) applies to specified institutions and professionals based on their activities, not to every company incorporated in the Netherlands. A BV’s bookkeeping, tax and annual reporting duties are separate from Wwft obligations. To assess whether AML rules apply, compare the company’s actual services with the Wwft.

Which businesses are considered obliged entities under Dutch AML rules?

Obliged entities are institutions and professionals whose activities fall within the Wwft’s scope. Depending on the service and applicable conditions, examples include banks and other financial institutions, certain crypto-asset service providers, accountants, tax advisers, administrative offices, and lawyers or notaries performing specified services. The precise scope depends on the statutory category and the activity performed. Consult the Wwft and relevant supervisory guidance rather than relying on a company’s name or legal form.

What does customer due diligence mean in the Netherlands?

Customer due diligence (CDD) is the set of checks an obliged entity must carry out where the Wwft requires them. It can include identifying and verifying a customer, establishing relevant information about a beneficial owner, and understanding the purpose and intended nature of a business relationship. The required measures depend on the applicable rules and risk assessment. Collecting an identity document informally doesn’t necessarily meet the legal CDD requirements.

Do Dutch companies have to report suspicious transactions?

Only entities subject to the relevant Wwft reporting duty must report transactions under that framework. In the Netherlands, the reporting obligation concerns unusual transactions, assessed against applicable indicators, and reports are made to FIU-Nederland. The FIU analyzes reports to determine whether a transaction is suspicious. A Dutch company outside the relevant legal scope doesn’t acquire this reporting duty merely because it is registered in the Netherlands.

How does a UBO register relate to anti-money laundering compliance?

UBO registration and AML customer due diligence are related but separate requirements. For a BV, the UBO threshold is generally more than 25% ownership, voting rights or ownership interest, or control through other means. This threshold concerns identifying a UBO in the relevant registration context; it doesn’t establish that the BV is an obliged entity or replace customer checks and reporting duties. See KVK’s UBO guidance for registration information.

Can a foreign-owned Dutch company be subject to Dutch AML requirements?

Yes. Foreign ownership does not by itself exempt a Dutch company from the Wwft, nor does it automatically make the company subject to AML duties. The central question remains whether its actual activities fall within the law’s scope. For international founders, compliance planning should start with classifying those activities, then checking the applicable Dutch rules and documenting the controls required for the business.

Last reviewed: October 2026

Sources

• KVK - Registering with the Dutch Business Register
• Business.gov.nl - Private limited company (bv)
• Burgerlijk Wetboek Boek 2 (Dutch Civil Code, legal entities)
• Rijksoverheid - Ondernemen
• RVO - Doing business internationally
• Belastingdienst Douane - Customs
• CJEU, Cadbury Schweppes, C-196/04 (ECLI:EU:C:2006:544)
• Hoge Raad, ECLI:NL:HR:2021:1152
• PwC Worldwide Tax Summaries - Netherlands
• ICLG - Corporate Governance Laws and Regulations, Netherlands