FIU-Nederland — UTR reporting through goAML
The Dutch standard for AML reporting is “unusual”, not “suspicious” — broader than every other EU FIU regime, and the source of more confusion than any other procedural rule in Dutch fintech compliance. An ongebruikelijke transactie is reportable when it meets one of the published objective indicators or when, in the firm’s professional judgement, it stands out as unusual. The volume that flows into FIU-Nederland is correspondingly higher than in the rest of Europe — and the goAML portal is the only intake. This is the operational walkthrough for PSPs licensed in the Netherlands or passporting in.
1. What FIU-Nederland is
FIU-Nederland is the Dutch financial-intelligence unit. It is administratively independent and operates under the Ministry of Justice and Security. Its mandate sits in the Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft) — the Dutch transposition of the EU AML directives — and the Sanctiewet 1977.
FIU-Nederland is the receiving authority for unusual-transaction reports filed by obligated subjects. Supervision of compliance is split: DNB supervises credit institutions, EMIs, PIs, investment firms and life insurers; AFM supervises certain investment-services firms; the Bureau Financieel Toezicht (BFT) supervises notaries, lawyers and accountants. FIU-Nederland itself does not supervise.
2. Who must file
Article 1a Wwft lists obligated subjects. The fintech-relevant categories:
- Credit institutions and EU-passporting branches
- Electronic-money institutions and payment institutions
- Investment firms under MiFID II
- Crypto-asset service providers (under previous registration regime, and now MiCA-authorised CASPs)
- Crowdfunding service providers
- Trust offices and corporate-service providers
For passporting EMIs / PIs: activity in the Netherlands triggers the obligation. The home-state filing covers home-state activity; Dutch unusual-transactions go to FIU-Nederland through goAML — see our AML representative across the EU piece for how the named-person obligation interacts.
3. The “unusual” standard, in plain terms
The standard sits in Article 16 Wwft. Unusual-transaction reports (UTRs) come in two forms:
- Objective indicators — a published list maintained by FIU-Nederland and approved at ministerial level. These are mechanical: a cash transaction above a threshold, a transfer to or from a designated high-risk jurisdiction, a specific type of instrument or counterparty. When the indicator is met, the transaction is unusual by definition — no professional judgement required.
- Subjective indicator — the catch-all: a transaction that, in the firm’s view, “aanleiding geeft te veronderstellen dat zij verband kan houden met witwassen of financiering van terrorisme” — gives reason to assume it could be related to money-laundering or terrorism-financing.
The two are separately reportable but flow through the same goAML channel.
4. The goAML portal
FIU-Nederland uses the United Nations Office on Drugs and Crime’s goAML platform — the same software used by FIUs in many countries, including FIU Germany. For Dutch reporting:
- Each obligated subject registers a goAML organisation account, with named individuals authorised to file.
- Reports can be submitted manually through the web UI or through the structured XML API.
- Acknowledgements are returned for each submission with a FIU reference.
- FIU-Nederland may request follow-up information through the platform.
The XML schema is the goAML standard. For PSPs filing more than a handful of reports per quarter, an internal case-management system that generates goAML XML is significantly more efficient than the manual UI.
5. Timing — without delay
Article 16 Wwft requires reporting “onverwijld” — without delay. There is no fixed deadline, but FIU-Nederland and DNB expect reasonable promptness:
- Objective-indicator transactions — typically within 14 days of the trigger event.
- Subjective-indicator transactions — within reasonable time of the internal investigation closing, usually a matter of days.
- Persistent late-filing patterns invite DNB scrutiny under the Wwft governance rules.
6. Tipping-off rules
Article 23 Wwft prohibits informing the customer (or any third party) that a UTR has been filed or is being considered. Breach is a criminal offence under the Dutch Economic Offences Act, with prison and fines for individuals.
The prohibition extends to internal communications visible to the customer (including support tooling, audit logs accessible to the customer, and statements that could reveal the existence of an alert). Practical operational guidance: keep UTR-related notes in a separate case-management system not accessible from customer-facing tools.
7. DNB versus FIU-Nederland
Two separate institutions, two separate roles:
- FIU-Nederland — receives UTRs, analyses, disseminates intelligence to law enforcement. Does not supervise compliance with the obligation to file.
- DNB — supervises whether the firm has the right Wwft framework, alert-generation rules, investigation processes and governance. Inspections look at the UTR track record but DNB is not the recipient.
This split parallels the French TRACFIN / ACPR split (see our TRACFIN piece). It differs from Spain’s SEPBLAC which combines FIU and supervisor functions in a single body.
8. The Dutch IBAN connection
If you issue Dutch IBANs (see our Dutch-IBAN walkthrough), you also feed the Banking Information Reference Portal with identifying data on every account holder. The Reference Portal is queried by FIU-Nederland and other authorised public-sector users. The two regimes complement each other: the Reference Portal makes account holders findable; the goAML reporting flow surfaces the unusual transactions.
9. FAQ
What is the difference between an SAR and a UTR?
“SAR” (suspicious-activity report) is the term used in many EU jurisdictions including Spain, France, Germany and Luxembourg. The Netherlands uses “UTR” (unusual-transaction report) because the Dutch standard is broader. A UTR may be filed where a transaction is unusual but not yet suspicious — a lower bar than most EU jurisdictions.
Are objective-indicator UTRs always confidential?
Yes. The tipping-off prohibition applies regardless of whether the trigger was an objective indicator or a subjective judgement.
Can I submit UTRs in batches?
Yes — goAML supports XML batch submission. The technical channel is the standard goAML schema; the structure of each report inside the batch follows FIU-Nederland’s reporting guidelines.
What if my home FIU and FIU-Nederland both have a claim on the same transaction?
You file with both. The two FIUs cooperate through Egmont Group channels but do not deduplicate filings. Coverage of the underlying transaction is the firm’s responsibility, not the FIUs’.
How long must UTR records be retained?
Five years from the date of the report under Article 33 Wwft. Records of investigations that did not result in a UTR follow the general transaction-data retention period of five years from the end of the customer relationship.
Does goAML accept submissions in English?
The structured fields are language-neutral codes. The narrative free-text fields should be in Dutch where practical; English is accepted in cross-border cases. Supporting attachments are typically retained in the language they were produced in.
10. What to do, today
- Register a goAML organisation account with FIU-Nederland before activity in the Netherlands generates the first reportable transaction.
- Calibrate your transaction-monitoring rules to the Dutch unusual-transaction standard — broader detection rules than the Spanish or French baseline.
- Map your case-management system to goAML XML; manual UI submissions break at scale.
- Keep UTR investigation notes in a separate system not accessible from customer-facing tooling.
- If you also issue Dutch IBANs, plan the Reference Portal connection in parallel — the two regimes share data infrastructure.
Related: AML representative across the EU · How to launch Dutch IBANs · What is the Reference Portal?
