Remote onboarding in the Netherlands — policy-led

The Netherlands is the outlier in this cluster, and the outlier is instructive: there is no national video-identification circular to conform to. Where Spain authorises procedures, Germany fills an equivalence test by circular, Italy annexes an eleven-step script and France requires two measures from a list, the Dutch position is policy-led. Institutions must have policies for the use of remote customer onboarding solutions, and in setting them must take into account the European Banking Authority’s guidelines on remote customer onboarding solutions.

1. The Article 4 timing relief

Article 4 of the Wet ter voorkoming van witwassen en financieren van terrorisme allows an institution to complete identification of the customer or beneficial owner during the provision of the service, so as not to unnecessarily interrupt the normal conduct of business. Two conditions attach:

• it is permitted only in low-risk situations; and
• identification must be completed as soon as possible after first contact.

The structure mirrors the EU-level position that succeeds it: Article 23(2) of Regulation (EU) 2024/1624 permits verification to be completed during establishment where necessary so as not to interrupt the normal conduct of business and where there is little risk, with completion as soon as practicable after initial contact.

2. Policy-led, with the EBA guidelines as the reference

The absence of a prescriptive national procedure is not an absence of expectation. Institutions are required to have policies governing the use of remote customer onboarding solutions, and to take the EBA guidelines into account when setting them. Both DNB and the AFM publish guidance on the Wwft that addresses initial identification and ongoing monitoring, and DNB additionally publishes questions and answers together with good practices.

3. What a policy-led regime demands

A prescriptive regime lets a firm evidence compliance by conformity: here is the procedure, here is our implementation, here are the specifications met. A policy-led regime cannot be evidenced that way, and firms that treat it as lighter-touch tend to produce the thinnest files in the cluster. Three things carry the weight instead:

• A documented solution assessment. Why this remote onboarding solution, what risks it creates, how each is mitigated — mapped against the EBA guidelines rather than merely referencing them.
• Evidence the policy is operative. Policy-led supervision asks whether the policy governs practice. Sampling, exception rates and the handling of failed sessions are what show that it does.
• A defined failure path. Because Article 4 permits completion during service provision, the risk is relationships that never complete. The regime supplies the permission and not the deadline, so the firm has to set one and enforce it.

4. A worked case

Facts: a payment institution passporting into the Netherlands runs an automated remote onboarding flow. Customers can transact from account opening; document verification completes afterwards, usually within days but sometimes not at all.

What the rules engage: the Article 4 relief permits completing identification during service provision only in low-risk situations and requires completion as soon as possible after first contact. A population that never completes is outside both conditions, and the low-risk determination has to be a real assessment rather than a default applied to everyone.

What the practitioner does: constrains capability rather than record creation — the account exists, transactions do not — sets an internal completion deadline with a defined consequence, and records the low-risk basis for using the relief at population level, with the reasoning documented once and reviewed. The remote solution itself is assessed against the EBA guidelines, and that assessment is the artefact the supervisor will ask for.

FAQ

Related: Remote onboarding compared across the EU · The Dutch AML framework · EBA remote onboarding guidelines