Key Points
- Every Dutch audit firm must perform Wwft customer due diligence before accepting a client engagement, not after.
- Firms must report unusual transactions to FIU-Nederland within two weeks of identifying the unusual nature of the transaction.
- As of 1 January 2026, the Wwft prohibits cash payments of EUR 3,000 or more for the sale or purchase of goods.
- The BFT has fined audit firms up to EUR 133,559 for Wwft failures including missing client due diligence and unreported unusual transactions.
What is the Wwft?
The Wwft designates audit firms, accountants, and tax advisers as gatekeepers in the Dutch financial system. Wwft article 3 requires every gatekeeper to conduct customer due diligence before entering a business relationship or carrying out an occasional transaction. That due diligence has four components: identifying the client, identifying the ultimate beneficial owner (UBO) per article 3(2), establishing the purpose and intended nature of the business relationship, and conducting ongoing monitoring of the relationship.
For audit firms, this obligation runs parallel to the acceptance and continuance process under ISQM 1. The firm cannot sign an engagement letter until it has verified the client's identity, identified the UBO, assessed the money laundering risk, and documented the intended nature of the business relationship. Article 8 requires enhanced due diligence where the risk is higher (politically exposed persons, complex ownership structures, high-risk jurisdictions).
The second pillar is unusual transaction reporting. Article 16 obliges the firm to report any unusual transaction to FIU-Nederland immediately, and in any case within two weeks. Failure to report is a criminal offence. The BFT (Bureau Financieel Toezicht) supervises Wwft compliance for accountants and tax advisers, while the AFM supervises audit firms holding a Wta licence. Both regulators conduct unannounced inspections.
Worked example: Van der Berg Logistics B.V.
Client: Dutch transport and logistics company, FY2025, revenue EUR 19M, Dutch GAAP (RJ) reporter. The firm is engaged for the statutory audit. Van der Berg is owned 70% by a holding company registered in Curacao and 30% by the founder, a Dutch resident.
Step 1 — Client identification and verification
The firm verifies Van der Berg's identity using a current Chamber of Commerce extract. The firm records the legal form (B.V.), registered address, KvK number, and date of incorporation. The engagement partner reviews the articles of association to confirm the shareholding structure.
Step 2 — UBO identification
The 70% holding company in Curacao triggers enhanced due diligence under Wwft article 8. The firm traces the ownership chain through the Curacao entity to identify the natural person(s) with ultimate beneficial ownership (25% or more interest). The holding company is owned by two individuals: a Dutch national (40%) and a Curacao resident (60%). Both are identified and verified using passport copies.
Step 3 — Risk assessment and ongoing monitoring
The firm classifies Van der Berg as higher risk based on two factors: the offshore holding structure and the cash-intensive nature of certain logistics operations. The firm establishes a monitoring plan requiring annual refresh of the UBO documentation and quarterly review of unusual payment patterns in the client's bank statements during the audit.
Step 4 — Unusual transaction identification during the audit
During interim procedures in October 2025, the audit team identifies a EUR 280,000 payment from Van der Berg to a Panamanian entity with no supporting contract or commercial rationale. The engagement partner assesses this as an unusual transaction under Wwft article 16 and reports it to FIU-Nederland within five business days. The firm does not inform the client of the report (tipping-off prohibition under Wwft article 23).
Conclusion: the Wwft procedures produced a documented trail from client onboarding through an in-engagement unusual transaction report, defensible because each step follows the statutory sequence and the enhanced due diligence is tied to specific risk factors identified in the ownership structure.
Why it matters in practice
The BFT fined FSV Accountants + Adviseurs B.V. EUR 133,559 for multiple Wwft violations including failure to conduct adequate customer due diligence and failure to report unusual transactions. The fine illustrates that the BFT treats Wwft failures as cumulative. A single missing UBO identification combined with a single unreported transaction produces a penalty that dwarfs the engagement fee.
Firms frequently treat Wwft due diligence as a one-time onboarding exercise and neglect the ongoing monitoring obligation in Wwft article 3(2)(d). The BFT's October 2024 guideline on Wwft compliance for accountants and tax advisers explicitly requires periodic reassessment of the client risk profile and refresh of UBO information. On multi-year recurring audits, Wwft files often contain stale identification documents with no evidence that the firm reassessed the risk or updated the UBO records.
Wwft vs. Wta (audit firm supervision)
| Dimension | Wwft | Wta |
|---|---|---|
| Purpose | Prevent money laundering and terrorist financing through gatekeeper obligations | Supervise audit firm quality and integrity for statutory audit engagements |
| Supervisor | BFT (for accountants and tax advisers) and AFM (for Wta-licensed firms) | AFM exclusively |
| Scope | All professional services by designated gatekeepers | Statutory audits only (wettelijke controle) |
| Key obligation | Customer due diligence and unusual transaction reporting | Quality management system, independence, engagement quality |
| Penalty for non-compliance | Administrative fines (BFT) and criminal prosecution | Administrative fines, licence conditions, or licence withdrawal (AFM) |
The distinction matters on every engagement. A firm can be fully compliant with the Wta (clean AFM inspection on audit quality) while simultaneously failing the Wwft (no UBO identification, no unusual transaction monitoring). The two regimes impose separate obligations with separate supervisors. Firms that integrate Wwft procedures into their ISQM 1 acceptance and continuance policies reduce the risk of gaps between the two frameworks.
Related terms
Frequently asked questions
Does the Wwft apply to review and compilation engagements, or only statutory audits?
The Wwft applies to all services provided by accountants acting in their professional capacity, not only statutory audits. Review engagements under Dutch COS 2400, compilation engagements under COS 4410, tax advisory work, and general consulting services all fall within scope. The determining factor is whether the professional is acting as a gatekeeper per Wwft article 1(a), not the type of engagement.
What happens if an audit firm fails to report an unusual transaction?
Failure to report an unusual transaction is a criminal offence under Dutch law, carrying potential fines and (in serious cases) criminal prosecution. The BFT can impose administrative fines independently. Beyond the legal consequences, a missed report may trigger an AFM investigation into the firm's broader audit quality if the Wta licence conditions are called into question. Wwft article 16 sets the reporting deadline at two weeks from identifying the unusual nature.
How does the Wwft interact with the EU Anti-Money Laundering Regulation?
The EU AML Regulation (AMLR), expected to apply from mid-2027, will replace parts of the Wwft with directly applicable EU rules on customer due diligence and UBO identification. The Wwft will remain in force for provisions not covered by the regulation, including certain Dutch-specific reporting obligations and the BFT's supervisory mandate. Firms should monitor the transposition timeline, as the interaction between the Wwft and the AMLR will require updated internal procedures.