DNB IRAP: the Dutch integrity risk questionnaire
Every year De Nederlandsche Bank (DNB) sends Dutch payment and e-money institutions a long questionnaire on their integrity risks, and every year some of them treat it as a form rather than as the dataset that sets their supervisory intensity. DNB calls it the integriteitsrapportage, or IRAP; in English, the integrity risk questionnaire or annual integrity risk survey. It asks about customers, products, transactions, high-risk sectors and controls, as at 31 December of the previous year. DNB uses the answers to score each institution and each sector. From 2027 the same survey becomes the vehicle for the AMLA risk methodology, which makes the 2026 and 2027 rounds the ones to get right.
1. What the IRAP is
The IRAP is DNB’s annual data request on integrity risk: money laundering, terrorist financing, sanctions and related risks, and the measures an institution takes to manage them. DNB describes it as a key information source for mapping the inherent integrity risks of the institutions it supervises and the controls they have in place.
It is not the SIRA, the institution’s own systematic integrity risk analysis, and it is not an FIU report. The IRAP is structured data the supervisor requests in a fixed format, on its own calendar, and compares across the sector.
DNB sends the IRAP to banks, trust offices, pension funds, insurers and payment institutions. For the payment sector, the published questionnaires have come in separate versions:
- Payment service providers, money transfer and exchange institutions — the main version.
- Payment service providers offering only services 7 and 8 — payment initiation and account information.
- Exempt payment service providers.
E-money institutions also file. DNB’s Integrity Supervision in Focus 2025 reports that in 2024, 75 payment institutions and 17 e-money institutions submitted their IRAP for 2023, against 73 payment institutions and 11 e-money institutions for 2022.
2. Legal basis
There is no stand-alone “IRAP article”. DNB relies on its general information powers, and in its 2022 call for the questionnaire it cited:
- Article 1:74 Wft, which lets DNB demand information for the purpose of supervising compliance with the Wet op het financieel toezicht;
- Article 5 of the Regeling toezicht Sanctiewet 1977, for the sanctions part;
- Articles 5:16 and 5:20 Awb, the general administrative-law power to demand information and the matching duty to cooperate.
The substantive content rests on the Wwft and the Sanctiewet. When DNB clarified its questions on high-risk sectors in June 2022, it tied them to the customer due diligence duty in Article 3(2) of the Wwft.
The practical consequence of that basis is enforcement. DNB has said that late, partial or missing submission can lead to an order subject to a penalty payment (last onder dwangsom) to obtain the full report; that repeated late reporting leads to an administrative fine; and that it will consider formal measures where the information submitted is incorrect or incomplete. It also states plainly that the submission must be correct and complete.
3. Calendar: reference date, release and window
The IRAP is annual and backward-looking. The questionnaires DNB published in April 2022 carried a reference date of 31 December 2021, and that pattern — prior calendar year, as at 31 December — is how the survey runs.
The release date has moved:
- 2022: questionnaires published mid-April; submission due by 9 June 2022.
- 2023: released in early April with six weeks to respond; a delay in DNB’s new survey portal pushed availability to 11 April and the deadline to 5 June 2023.
- 2025: DNB brought the release forward to early February and lengthened the response window to ten weeks, citing feedback that April and May were too crowded with public holidays.
- 2026: same as 2025 — available from early February, ten weeks to respond.
DNB does not publish one fixed due date on its open pages. The exact deadline for each institution sits in its Toezichtkalender (supervisory calendar) in My DNB, and DNB sends an announcement at the end of January to the business email address registered under Organisatiegegevens in My DNB. DNB’s own advice is to contact your account supervisor if that announcement does not arrive.
4. Channel: from DLR to My DNB
In 2022 payment institutions downloaded the IRAP spreadsheet and submitted it through the Digitaal Loket Rapportages (DLR), the same channel as their prudential returns. From 2023 DNB moved its qualitative surveys into a dedicated service in the My DNB portal, Kwalitatieve uitvragen (Qualitative Surveys). Each institution sees only the questionnaires that apply to it.
Two access points matter. At least one person at the institution needs an eHerkenning token with the right authorisation for DNB’s service; colleagues without one can still work on the survey alongside that person. And DNB is explicit that email is not a submission channel: irap@dnb.nl is for questions about content, and DNB’s IT service desk handles technical problems. A questionnaire emailed to either is not filed.
5. What the questionnaire asks
DNB does not publish the full current question set on its open pages, and the questions change from round to round. What it has said about the content gives the shape:
- Customers, products and transactions. The inherent-risk side: how many customers, in which risk categories, which products, and what volumes flow in and out, including to and from higher-risk jurisdictions.
- High-risk sectors. Customer numbers and service levels in sectors DNB regards as more exposed to integrity risk. In 2022 it named commercial real estate, trust offices, crypto exchange platforms and wallet providers, and gambling. DNB stressed that listing a sector does not make every customer in it high-risk, and that customers outside the list can still be.
- Controls. How the institution manages the risks it reports — its control framework and resources. DNB’s sector reporting draws on this: the 2025 report noted that first-line AML staff costs reported by payment, e-money and exchange institutions rose from EUR 28 million to EUR 42 million.
- Sector-specific modules. DNB adds questions where it sees a risk developing. At the start of 2024 it added questions for money transfer organisations on their use of agents.
Expect a stable core with targeted additions: DNB’s 2022 notice described the questionnaire as largely unchanged, with some points tightened, added or removed.
6. How DNB uses the answers
The IRAP feeds DNB’s risk-based supervision at two levels.
Institution level. DNB calculates a risk score for each institution from the answers and, with the annual risk profile, uses it to decide how intensively to supervise integrity there. A higher score means more supervisory attention.
Sector level. DNB aggregates the answers into sector risk levels and publishes its observations. The annual Integrity Supervision in Focus report is built on IRAP data: the 2026 edition is based on sector figures for 2024 collected through the IRAP in 2025. For payment and e-money institutions, that edition records sharp growth in virtual IBANs and white labelling, which DNB links to more complex and less transparent payment chains.
Because the score is computed from the answers, a data error is not neutral. An overstated high-risk customer count raises your score; an understated one is an incorrect submission that DNB will find when an examination compares the IRAP with your customer files or your SIRA.
7. AMLA: the 2026 and 2027 changes
On 19 December 2025 DNB announced how the arrival of the EU Anti-Money Laundering Authority (AMLA) changes the IRAP for banks, life insurers and payment institutions. The trust sector is not affected.
| Round | Change | Source in EU law | What it means for an institution |
|---|---|---|---|
| 2026 | New questions mapping cross-border activity through subsidiaries, branches and cross-border services | Draft RTS under Article 12(7) AMLAR (criteria for AMLA direct supervision) | DNB reports institutions meeting the criteria to AMLA, which selects the 40 directly supervised institutions from 2028; the main criterion is activity in at least six member states |
| 2027 | The survey carries all datapoints in Annex 1 of the RTS; some current IRAP parts are dropped | Draft RTS under Article 40(2) AMLD6 (risk-assessment methodology) | DNB calculates risk scores for all banks, life insurers and payment institutions using the AMLA methodology |
| Both | The survey stays a DNB survey | — | Same channel and counterpart; different data model |
DNB’s advice is concrete: from 2026, record cross-border activity by subsidiary, branch and cross-border service; review the other Annex 1 datapoints now; and adapt data capture and processes in time for the AMLA-based survey in early 2027. Its 2026 sector report adds that the AMLA methodology is meant eventually to replace the current one, including the existing IRAP questions.
For a passporting Dutch institution, this is the first IRAP question whose answer can bring in a different supervisor.
8. Worked case: an EMI passporting into seven markets
Facts: a Dutch-licensed e-money institution serves customers in seven member states, through branches in two of them and under the freedom to provide services in the other five.
What the rule says: the 2026 IRAP asks for cross-border activity through subsidiaries, branches and cross-border services, so that DNB can identify institutions meeting the AMLA selection criteria in the RTS under Article 12(7) AMLAR. Activity in at least six member states is the main criterion.
What the compliance officer does: builds a country-by-channel table from the ledger, not from the passport notifications list — notified but dormant markets and active markets are not the same thing. Reconciles customer and transaction counts per country with finance, has the MLRO sign off the definitions used, and keeps the working file with the submission.
Outcome: a defensible answer to a question that can lead to AMLA direct supervision, and a dataset the firm will need again for the 2027 round.
9. Worked case: the IRAP and the SIRA tell different stories
Facts: a payment institution’s SIRA rates crypto-asset service providers as a high-risk customer segment with 140 active relationships. The IRAP draft, prepared by a data analyst from a sector-code field, reports 30 customers in that sector.
What the rule says: DNB requires a correct and complete submission and will consider formal measures for incorrect information. Its examinations of payment institutions already find risk analyses that do not reflect agents, sub-merchants and partners properly; an IRAP that contradicts the SIRA invites the same finding.
What the compliance officer does: traces the gap to a sector-code field that misses customers onboarded under a generic code. Corrects the classification at source, re-runs the extract, and records the methodology in a short note so next year’s answer is produced the same way. Updates the SIRA’s customer counts as of the same reference date.
Outcome: one number in both documents. The risk score reflects the real exposure, and the next examination opens on the controls rather than on the data.
10. Worked case: a first IRAP after authorisation
Facts: a payment institution offering only account information and payment initiation received its DNB licence in September. In late January it has heard nothing about the IRAP.
What the rule says: DNB has published a separate questionnaire version for providers of services 7 and 8. The announcement goes to the address under Organisatiegegevens in My DNB, and access to the survey service requires eHerkenning.
What the compliance officer does: checks the organisation details and eHerkenning authorisations in My DNB, looks for the round in the Toezichtkalender, and asks the account supervisor whether the institution is in scope for the current round and which version applies.
Outcome: the institution learns its obligation from DNB in February rather than from a reminder after the window has closed.
FAQ
What does IRAP stand for?
DNB uses IRAP for its annual integriteitsrapportage, the integrity risk questionnaire it sends to banks, trust offices, pension funds, insurers and payment institutions, including e-money institutions.
When is the IRAP due?
Since 2025 the questionnaire opens in early February with a ten-week window. The exact deadline for your institution is in the Toezichtkalender in My DNB.
How is it submitted?
Through the Qualitative Surveys service (Kwalitatieve uitvragen) in My DNB, which needs at least one user with eHerkenning. Email is not a submission channel.
Is the IRAP the same as the SIRA?
No. The SIRA is your own integrity risk analysis. The IRAP is DNB’s structured data request. They should be consistent, and DNB compares them.
What happens if we file late or get it wrong?
DNB has said it can impose an order subject to a penalty payment for late, partial or missing submission, a fine for repeated lateness, and that it considers formal measures for incorrect or incomplete information.
What changes because of AMLA?
The 2026 round adds cross-border activity questions for AMLA’s direct-supervision selection. From 2027 the survey includes the Annex 1 datapoints of the AMLA risk-methodology RTS, and DNB scores institutions on that methodology.
11. What to do, today
- Calendar: put the February release and the ten-week window in the reporting calendar, and make year-end integrity data final by late January.
- Access: check the business email under Organisatiegegevens in My DNB and that at least two people hold working eHerkenning authorisations.
- Ownership: name the MLRO as owner, with finance and data as contributors, and keep a methodology note for every figure.
- Consistency: reconcile customer counts, risk categories and high-risk sector exposure between the IRAP and the SIRA as at 31 December.
- Cross-border: start recording activity by subsidiary, branch and cross-border service now, from the ledger.
- AMLA 2027: map your data against Annex 1 of the RTS under Article 40(2) AMLD6 and close the gaps before the early-2027 round.
Related: AML data returns compared across the EU · The DNB SIRA · AMLA entity risk scoring
