A Wwft breach is any instance where an institution fails to meet an obligation under the Wwft, such as incomplete customer due diligence, a report that was made late or not at all, or a file that was not kept. The supervisor can then issue an instruction, impose an order subject to a penalty or impose an administrative fine. Sanctions are generally made public. In cases of intent, the Public Prosecution Service can also bring criminal proceedings.
This article describes which sanctions the law allows. The amount of a fine in a specific case depends on the seriousness of the breach, the degree of culpability and the circumstances.
Who enforces the Wwft?
Every Wwft institution has a designated supervisor:
- De Nederlandsche Bank (DNB): among others banks, payment institutions, life insurers and trust offices.
- Dutch Authority for the Financial Markets (AFM): among others investment firms and investment institutions.
- Financial Supervision Office (Bureau Financieel Toezicht, BFT): among others accountants, tax advisers, administration offices and civil-law notaries.
- The dean of the Bar Association (deken van de Orde van Advocaten): lawyers.
- The Minister of Finance: among others estate agents, traders in goods and pawnshops. Since 1 January 2026 the Dienst Financieel-Economische Integriteit (DFEI) carries out this supervision.
- Netherlands Gambling Authority (Kansspelautoriteit): gambling providers.
Which institutions fall under the law is explained in What is the Wwft?
Which measures can the supervisor take?
The Wwft gives the supervisor an escalating set of tools.
- Instruction (aanwijzing). The supervisor orders you to follow a particular course of action within a reasonable period, for example to remediate your files or adjust your policy.
- Order subject to a penalty (last onder dwangsom). You must remedy a breach within a set period. If you do not, you forfeit a penalty.
- Administrative fine (bestuurlijke boete). A penalty for a breach that has already occurred. Failing to comply with an instruction, or complying late or incompletely, can also be fined.
- Bar from a position. For more serious breaches, the supervisor can bar a person from holding a policy-making position at a Wwft institution for up to one year. This period can be extended once by up to one year. Where a legal entity commits the breach, this also applies to those who ordered it or were in actual charge of it.
The supervisor can also publish a warning or statement naming the offender.
How high can an administrative fine be?
The Wwft places every breach that can be fined in one of three categories. Which breach falls into which category is set out in a governmental decree. The following amounts apply per breach:
- Category 1: base amount € 10,000, maximum € 10,000.
- Category 2: base amount € 500,000, maximum € 1,000,000.
- Category 3: base amount € 2,000,000, maximum € 4,000,000.
For banks, other financial undertakings and trust offices, the base amount in category 3 is € 2,500,000 and the maximum is € 5,000,000.
There are three exceptions that can make the fine higher:
- Repeat breach. If a fine was imposed for the same breach within the previous five years, the maximum is doubled.
- Turnover. For banks, other financial undertakings and trust offices, a category 3 fine can reach 20% of net turnover in the preceding financial year, if that is more than twice the normal maximum. For a group, consolidated turnover counts.
- Benefit. The supervisor can also impose a fine of up to twice the benefit the offender gained from the breach.
The base amount is the starting point. The supervisor adjusts the fine to the seriousness of the breach, the degree to which you can be blamed for it and the circumstances in which it was committed.
Publication
A fine costs money; publication costs trust. The Wwft provides that the supervisor publishes a decision to impose an administrative sanction:
- generally once the decision has become final;
- for a category 3 fine, as soon as possible, even while you lodge an objection or appeal;
- for an order subject to a penalty, as soon as possible once a penalty has been forfeited.
Published decisions remain on the supervisor's website for five years. In certain cases, publication is postponed or anonymised, for example if it would be disproportionate for a natural person or would harm an ongoing criminal investigation.
Criminal prosecution
Breaching the main Wwft rules, such as customer due diligence, the reporting obligation, confidentiality and record-keeping, is also an economic offence under the Economic Offences Act (Wet op de economische delicten, WED).
- Intentionally, it is a serious offence (misdrijf). It carries imprisonment of up to two years, community service or a fine. Anyone who makes a habit of it risks up to four years.
- Without intent, it is a minor offence (overtreding), carrying detention of up to six months, community service or a fine.
The court can also impose additional penalties, such as shutting down all or part of the business for up to one year.
How do you avoid sanctions?
Supervisors look mainly at whether your organisation knows and controls its risks. In concrete terms:
- an up-to-date risk assessment and a policy that matches it;
- complete customer due diligence for each client, with enhanced due diligence where needed;
- timely reports, see Reporting obligation under the Wwft;
- complete and retrievable files, see Record-keeping under the Wwft;
- trained staff and a compliance function that monitors adherence.
If you discover backlogs yourself, start a remediation project with a plan, priorities and a realistic schedule. It helps if you can show that you identified a problem yourself and are addressing it.
What changes with the AMLR?
From 10 July 2027 the European AMLR and the new anti-money laundering directive (AMLD6) apply. The directive requires member states to allow higher maximum fines for serious, repeated or systematic breaches. The maximum must be at least € 1,000,000, or twice the benefit gained if that is higher. For credit institutions and financial institutions, the maximum must be at least € 10,000,000 or 10% of annual turnover. How the Netherlands implements this will be set out in new national legislation. Read more in AMLR 2027.