The Wwft is the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme). It has applied since 2008. It requires banks, trust offices, accountants, notaries, estate agents and other institutions to know who their customers are, to report unusual transactions to FIU-Nederland and to keep their files in order. An organisation that falls under the act is called Wwft-obliged.
The Wwft is the Dutch implementation of the European anti-money laundering directives. From 10 July 2027 a European regulation is added: the AMLR.
Why the Wwft exists
Criminals want money from crime to look like legitimately earned money. To do that, they need banks, companies and advisers. Terrorists need money for their activities. The Wwft turns the institutions that handle money and assets into a first line of defence. They must know who they are doing business with and pass on unusual behaviour to the authorities.
Who does the Wwft apply to?
The act lists the institutions in Article 1a. In short:
- banks, payment institutions and electronic money institutions
- life insurers, investment firms and investment institutions
- crypto-asset service providers
- trust offices
- accountants, tax advisers and bookkeeping firms
- lawyers and notaries, for certain activities
- estate agents and intermediaries in real estate
- traders who receive large cash payments, art dealers and pawnshops
- gambling providers, such as casinos
Not sure whether your organisation is covered? In Wwft check: are you Wwft-obliged? we go through the categories one by one.
The core obligations
The Wwft asks a number of fixed things of every Wwft-obliged institution.
- Risk assessment and policy. You map your organisation's money laundering and terrorist financing risks. You then set down policies and procedures that fit those risks.
- Customer due diligence. Before you enter into a business relationship, you establish who the customer is. You verify the identity, establish the UBO, understand the purpose of the relationship and check whether the customer is a PEP. You can read how this works in What is KYC?. If you cannot complete the investigation, you may not enter into the relationship.
- Enhanced due diligence where the risk is high. For PEPs or high-risk countries, for example, you do more. See enhanced customer due diligence.
- Ongoing monitoring. The investigation does not stop after acceptance. You keep an eye on the relationship and the transactions, and you keep the file up to date.
- Reporting to FIU-Nederland. You report unusual transactions to FIU-Nederland without undue delay. You may not tell the customer that you have made a report.
- Record keeping. You retain the customer due diligence data for five years after the end of the business relationship or after the transaction.
- Training. Your staff know the act and can recognise unusual transactions. You make sure they receive regular training for this.
Who supervises?
Which supervisor applies to you depends on the type of institution.
- De Nederlandsche Bank (DNB): banks, payment institutions, insurers and trust offices, among others.
- Dutch Authority for the Financial Markets (AFM): investment firms and investment institutions, among others.
- Bureau Financieel Toezicht (BFT): accountants, tax advisers, bookkeeping firms and notaries, among others.
- The dean of the Netherlands Bar: lawyers.
- Dienst Financieel-Economische Integriteit (DFEI): estate agents, traders in goods and pawnshops, among others. Since 1 January 2026 the DFEI carries out this supervision on behalf of the Ministry of Finance; before that it sat with the Belastingdienst/Bureau Toezicht Wwft.
- Kansspelautoriteit: gambling providers.
A supervisor can impose a fine or an order subject to a penalty, among other measures. In many cases sanctions are made public. Serious breaches can also be prosecuted under criminal law.
The Wwft and the AMLR
From 10 July 2027 the European Anti-Money Laundering Regulation, the AMLR, applies. It is directly applicable in all Member States and replaces a large part of the Wwft. The basis stays the same: know your customers, monitor, report and retain. The rules do become more precise and more uniform across the EU, including for UBO research.
In addition, there is a new European supervisory authority, AMLA, based in Frankfurt. You can read more in AMLR 2027.
Complying with the Wwft yourself or outsourcing
Many organisations organise compliance entirely in house, with their own compliance function and their own analysts. That requires knowledge, good systems and capacity for busy periods. An alternative is to outsource the execution of customer due diligence to a specialist party. You then remain responsible for the policy and for the decision to accept a customer.