FIU-Nederland: how to file unusual transaction reports (goAML)
The Dutch standard for AML reporting is “unusual”, not “suspicious” — broader than every other EU FIU regime, and the source of more confusion than any other procedural rule in Dutch fintech compliance. An ongebruikelijke transactie is reportable when it meets one of the published objective indicators or when, in the firm’s professional judgement, it stands out as unusual. The volume that flows into FIU-Nederland is correspondingly higher than in the rest of Europe — and the goAML portal is the only intake. This is the operational walkthrough for PSPs licensed in the Netherlands or passporting in: what triggers a report, the concrete thresholds, how the filing runs through goAML, and three worked scenarios.
1. What FIU-Nederland is
FIU-Nederland is the Dutch financial-intelligence unit. It is administratively independent and operates under the Ministry of Justice and Security. Its mandate sits in the Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft) — the Dutch transposition of the EU AML directives — and the Sanctiewet 1977.
FIU-Nederland is the receiving authority for unusual-transaction reports filed by obligated subjects. Supervision of compliance is split: DNB supervises credit institutions, EMIs, PIs, investment firms and life insurers; AFM supervises certain investment-services firms; the Bureau Financieel Toezicht (BFT) supervises notaries, lawyers and accountants. FIU-Nederland itself does not supervise — it receives, analyses and disseminates.
2. Who must file
Article 1a Wwft lists obligated subjects. The fintech-relevant categories:
- Credit institutions and EU-passporting branches
- Electronic-money institutions and payment institutions
- Investment firms under MiFID II
- Crypto-asset service providers (under the previous registration regime, and now MiCA-authorised CASPs)
- Crowdfunding service providers
- Trust offices and corporate-service providers
For passporting EMIs / PIs: activity in the Netherlands triggers the obligation. The home-state filing covers home-state activity; Dutch unusual transactions go to FIU-Nederland through goAML — see our AML representative across the EU piece for how the named-person obligation interacts.
3. The “unusual” standard, in plain terms
The reporting duty sits in Article 16 Wwft: an obligated subject must report an executed or intended unusual transaction to FIU-Nederland without delay once its unusual character becomes known. “Unusual” is defined by indicators established at ministerial level (in the annex to the Uitvoeringsbesluit Wwft 2018) and comes in two forms:
- Objective indicators — a published list of mechanical triggers. When the indicator is met, the transaction is unusual by definition — no professional judgement, no context test, always reportable.
- Subjective indicator — the catch-all: a transaction that “aanleiding geeft te veronderstellen dat zij verband kan houden met witwassen of financiering van terrorisme” — gives reason to assume it could be related to money-laundering or terrorism-financing.
The two are separately reportable but flow through the same goAML channel. Note the crucial word intended: a transaction you decline or block can still be reportable if it met an indicator — refusing to execute does not, by itself, discharge the reporting duty.
4. The objective indicators, concretely
The objective list is sector-specific, but several thresholds recur across the payments and crypto categories. Treat the figures below as the mechanical floor your monitoring must catch automatically — the point of an objective indicator is that it fires regardless of how innocent the transaction looks.
| Objective trigger (illustrative) | Threshold / test | What the firm does |
|---|---|---|
| Cash transaction (deposit, withdrawal or exchange) | €10,000 or more | Report — always, even a single clean-looking deposit |
| Money transfer / money-remittance | Above €2,000 (unless another Wwft institution handles it) | Report |
| Credit or prepaid card loaded / used | €15,000 or more | Report |
| Transaction already reported to police / public prosecutor for ML/TF | Any amount | Report — the criminal-justice link is itself the trigger |
| Party resident / established in a designated high-risk state | Any amount, per the ministerial list | Report |
Two design consequences follow. First, thresholds are mechanical in letter: your engine must catch the single crossing event, and you should also monitor for structuring just beneath the line as a subjective matter. Second, because objective triggers require no suspicion, they should never sit behind an analyst queue — they should auto-generate a draft UTR the moment the threshold is crossed. Holding an objective-indicator hit for “investigation” is the most common way Dutch firms end up filing late.
5. The goAML portal
FIU-Nederland uses the United Nations Office on Drugs and Crime’s goAML platform — the same software used by FIUs in many countries, including FIU Germany. For Dutch reporting:
- Each obligated subject registers a goAML organisation account, with named individuals authorised to file.
- Reports can be submitted manually through the web UI or through the structured XML API.
- Acknowledgements are returned for each submission with a FIU reference.
- FIU-Nederland may request follow-up information through the platform.
The XML schema is the goAML standard. For PSPs filing more than a handful of reports per quarter, an internal case-management system that generates goAML XML is significantly more efficient — and less error-prone — than the manual UI. Registration itself takes time (identity verification of the authorised filers), so it must be done before live activity, not on the day the first report is due.
6. Timing — without delay
Article 16 Wwft requires reporting “onverwijld” — without delay. There is no single fixed clock, but FIU-Nederland and DNB expect reasonable promptness calibrated to the trigger:
- Objective-indicator transactions — promptly after the trigger event; because no assessment is needed, the practical expectation is measured in days, not weeks.
- Subjective-indicator transactions — without delay after the internal investigation closes on a decision to report; the investigation itself should not be allowed to drift.
- Persistent late-filing patterns invite DNB scrutiny under the Wwft governance rules — the timeliness of your UTR track record is itself a supervised metric.
7. Tipping-off rules
Article 23 Wwft prohibits informing the customer (or any third party) that a UTR has been filed or is being considered. Breach is a criminal offence under the Dutch Economic Offences Act (Wet op de economische delicten), with prison and fines for individuals.
The prohibition extends to internal communications visible to the customer (including support tooling, audit logs accessible to the customer, and any statement that could reveal the existence of an alert). Practical operational guidance: keep UTR-related notes in a separate case-management system not accessible from customer-facing tools, and script front-line responses so a blocked payment is never explained by reference to a report.
8. DNB versus FIU-Nederland
Two separate institutions, two separate roles:
- FIU-Nederland — receives UTRs, analyses, disseminates intelligence to law enforcement. Does not supervise compliance with the obligation to file.
- DNB — supervises whether the firm has the right Wwft framework, alert-generation rules, investigation processes and governance, all anchored in the firm’s systematic integrity risk analysis (SIRA). Inspections look at the UTR track record, but DNB is not the recipient.
This split parallels the French TRACFIN / ACPR split (see our TRACFIN piece). It differs from Spain’s SEPBLAC, which combines FIU and supervisor functions in a single body.
9. Three worked examples
Each of these is the kind of case that surfaces in a Dutch monitoring queue. The pattern is the same: establish the facts, test them against the objective list first and the subjective standard second, then act.
Example 1 — objective threshold, no suspicion needed. Facts: a retail customer of a Netherlands-passporting EMI makes a single cash-equivalent load of €11,500 through an accepted channel; the customer is well-established, the source looks legitimate, nothing looks “off”. Rule: the cash objective indicator (€10,000 or more) is met. What the firm does: file a UTR through goAML without waiting for an analyst to form suspicion — the objective trigger is the whole test. Outcome: the report is timely; treating the transaction’s clean appearance as a reason not to file would have been the classic Dutch error.
Example 2 — subjective judgement, below every threshold. Facts: a small-business account receives eleven inbound transfers of €1,800–€1,950 over nine days from unrelated payers, each just under the €2,000 remittance line, then sends the aggregate onward to a single new counterparty. No individual transaction hits an objective indicator. Rule: nothing on the objective list fires, but the pattern “gives reason to assume” a link to money laundering under Article 16 — the subjective limb. What the firm does: the analyst documents the structuring pattern and files a subjective UTR, keeping the reasoning in the case system. Outcome: the firm captures a case the objective list alone would have missed — which is exactly why the subjective limb exists.
Example 3 — declined transaction, still reportable. Facts: a payment instruction involves a counterparty resident in a state on the ministerial high-risk list; the firm blocks the payment on its own risk policy and the money never moves. Rule: Article 16 covers intended as well as executed transactions, and the high-risk-jurisdiction objective indicator is met. What the firm does: file the UTR even though the transaction was refused, and observe the tipping-off rule when responding to the customer’s query about the block. Outcome: the report stands on the intended transaction; declining to execute did not discharge the duty.
10. The Dutch IBAN connection
If you issue Dutch IBANs (see our Dutch-IBAN walkthrough), you also feed the Banking Information Reference Portal with identifying data on every account holder. The Reference Portal is queried by FIU-Nederland and other authorised public-sector users. The two regimes complement each other: the Reference Portal makes account holders findable; the goAML reporting flow surfaces the unusual transactions.
11. FAQ
What is the difference between an SAR and a UTR?
“SAR” (suspicious-activity report) is the term used in many EU jurisdictions including Spain, France, Germany and Luxembourg. The Netherlands uses “UTR” (unusual-transaction report) because the Dutch standard is broader. A UTR may be filed where a transaction is unusual but not yet suspicious — a lower bar than most EU jurisdictions.
Do I have to report a €10,000 cash transaction even if it looks completely legitimate?
Yes. A cash transaction of €10,000 or more is an objective indicator: it is unusual by definition and reportable regardless of context or suspicion. The clean appearance of the transaction is irrelevant to the objective duty; assessing it away is a common cause of late or missed filings.
If I decline a transaction, do I still have to report it?
Potentially yes. Article 16 Wwft covers intended transactions as well as executed ones. If the intended transaction met an objective indicator or gives reason to assume a money-laundering or terrorist-financing link, a UTR is due even though the money never moved.
Are objective-indicator UTRs always confidential?
Yes. The tipping-off prohibition in Article 23 Wwft applies regardless of whether the trigger was an objective indicator or a subjective judgement.
Can I submit UTRs in batches?
Yes — goAML supports XML batch submission. The technical channel is the standard goAML schema; the structure of each report inside the batch follows FIU-Nederland’s reporting guidelines.
What if my home FIU and FIU-Nederland both have a claim on the same transaction?
You file with both. The two FIUs cooperate through Egmont Group channels but do not deduplicate filings. Coverage of the underlying transaction is the firm’s responsibility, not the FIUs’.
How long must UTR records be retained?
Five years from the date of the report under Article 33 Wwft. Records of investigations that did not result in a UTR follow the general transaction-data retention period of five years from the end of the customer relationship.
Does goAML accept submissions in English?
The structured fields are language-neutral codes. The narrative free-text fields should be in Dutch where practical; English is accepted in cross-border cases. Supporting attachments are typically retained in the language they were produced in.
12. What to do, today
- Register a goAML organisation account with FIU-Nederland before activity in the Netherlands generates the first reportable transaction — enrolment is not same-day.
- Wire the objective indicators (€10,000 cash, €2,000 remittance, €15,000 card, high-risk-state, criminal-justice link) as auto-firing rules that draft a UTR without an analyst gate.
- Calibrate subjective-indicator rules to the broader Dutch standard — structuring just under the objective lines is the classic subjective case.
- Map your case-management system to goAML XML; manual UI submissions break at scale.
- Keep UTR investigation notes in a separate system not accessible from customer-facing tooling, and script front-line responses to respect tipping-off.
- If you also issue Dutch IBANs, plan the Reference Portal connection in parallel — the two regimes share data infrastructure.
Related: AMLA’s harmonised STR format · Dutch AML beyond goAML · AML representative across the EU · How to launch Dutch IBANs · What is the Reference Portal? · AMLA cross-border STR routing
