UBO-register Netherlands — KVK access and terugmelding

The Dutch UBO register is not one register with one door — it is three access tiers, and which one you get decides what your onboarding process can actually see. The UBO-register at the Kamer van Koophandel (KVK) closed to the public in November 2022 and reopened in graded form. An electronic money institution and a bank sit in a different tier from an accountancy firm, a notary sits in a third, and none of them see what the Financial Intelligence Unit sees. Alongside that sits an obligation that runs the other way: since 1 October 2024, article 10c Wwft requires institutions to report back to KVK when the register and their own file disagree.

1. Who has to be in the register

The registration duty attaches to the legal entity, not to the beneficial owner. It covers besloten vennootschappen and naamloze vennootschappen, partnerships including the vof, cv and maatschap, stichtingen, associations with full legal capacity, cooperatives and comparable forms. The eenmanszaak is outside it, because the owner is already visible in the handelsregister.

The threshold is more than 25% of shares, voting rights or ownership interest, or control by other means. Where no such person exists, the entity must register its hoger leidinggevend personeel — the senior managing officials, commonly called pseudo-UBOs. Two points follow that catch foreign groups repeatedly:

• Registering a director in the handelsregister is not registering them as a UBO. Dutch law treats these as two separate obligations. A person already known to KVK as a board member still has to be entered in the UBO register if they qualify.
• The pseudo-UBO route is not a fallback of convenience. It applies only after a genuine attempt to identify a real beneficial owner has failed. A structure with an identifiable 30% holder that registers its directors instead has filed incorrectly, not conservatively.

2. The three access tiers, and where a payments firm lands

Since the register stopped being public, KVK has rebuilt access as graded authorisation levels. The distinction is not administrative — it changes which data fields you receive.

An e-money or payment institution supervised under the Wft therefore sits at UBOB2, which is the level that returns enough identity data to perform an actual verification rather than a name match. A firm that has been operating on UBOB1-grade data — or on nothing — is running name-only comparison and calling it identification.

Access routes have moved as well. The KVK data service has been available throughout; digital extracts ordered with eHerkenning and a UBO-API became available in the second quarter of 2026. The phased rollout by sector is not finished, and direct access for some professions is still being extended.

3. The certified extract, and why it still matters

Between the closure of public access and the reopening of direct routes, the Dutch supervisory position settled on a workaround that is still in use: from 1 August 2024, an institution without its own access asks the customer to obtain a gewaarmerkt uittreksel — a certified extract — from KVK through the “view your own data” function, and to supply it.

This satisfies the article 4(2) Wwft expectation that an extract is obtained before entering into a new business relationship. It has one structural weakness worth designing around: an extract supplied by the customer is a document the customer controls. It can be stale, and it is not evidence that the register said the same thing on the day you looked. Where you hold direct access, use it and record the retrieval; where you do not, record the extract’s issue date as a separate field from the date you received it, because the gap between them is exactly the space in which a change goes unnoticed.

4. The terugmeldplicht — reporting back to KVK

Article 10c Wwft makes the flow bidirectional. Since 1 October 2024, an institution that finds a difference between the UBO information in the trade register — or in a certified extract — and the information it holds from another basis must report that difference to KVK. The parallel register for trusts and similar legal arrangements, maintained under the Dutch trust-registration implementing act, is covered by the same duty.

KVK’s own guidance sets out what triggers a report: a beneficial owner missing from the register, a person registered who is not in fact a beneficial owner, an incorrectly characterised interest, and an incorrect size of interest. Reports are submitted through KVK’s portal, which requires a KVK account with a terugmelding authorisation — an authorisation that is applied for on a signed paper form with an identity document, and therefore is not something to start on the day a discrepancy appears.

Where an institution operates across borders, the EU layer sets the pace: under article 24 of Regulation (EU) 2024/1624, a discrepancy report is due without undue delay and in any event within 14 calendar days of detection, must identify whom the institution considers the beneficial owners to be, and must say why. Minor typographical or transliteration differences, and discrepancies arising purely from outdated data where the beneficial owners are known from another reliable source and there is no suspicion of concealment, can be taken up with the customer instead.

5. Three situations, and what the analyst does

Scenario 1 — the register shows a pseudo-UBO and the file shows a real one.

Facts: onboarding a Dutch BV, the extract lists two directors as UBOs. The shareholders’ register supplied by the customer shows a natural person holding 40% through a foreign holding company.

What the rule applies: this is a classic article 10c case. The register asserts that no beneficial owner could be identified; the institution has identified one.

What the analyst does: completes the identification on the customer’s own documentation — the ownership chain, not the extract — and files a terugmelding setting out the 40% holding and the intermediate entity. The relationship is not blocked by the report; the report is a register-correction mechanism, and the decision on whether the structure is acceptable is a separate one on its own merits.

Scenario 2 — a stichting administratiekantoor that assumed it was out of scope.

Facts: a group holds Dutch shares through a stichting administratiekantoor. Nobody registered UBOs, on the view that a STAK holds shares for others and has no owner.

What the rule applies: foundations are within the registration duty, and where no natural person meets the ownership or control threshold the senior managing officials are registered as pseudo-UBOs. A Dutch decision in March 2026 confirmed both that a STAK must register and that the fine imposed for not doing so stood.

What the analyst does: when a STAK appears in a customer’s ownership chain, treats an empty UBO entry as a finding rather than as an answer, and looks through to the certificate holders in the customer’s own documentation. On the firm’s own group structures, the same conclusion means a filing, not an argument.

Scenario 3 — a periodic review two years after onboarding.

Facts: a customer onboarded in 2024 on a customer-supplied certified extract comes up for review. The firm now has UBOB2 access through the UBO-API.

What the rule applies: detection under article 10c is when the comparison is made, wherever in the lifecycle it happens. A discrepancy found at review is as reportable as one found at onboarding.

What the analyst does: re-pulls the register through the API, compares against the identification on file — not against the 2024 extract, which is a copy of the register and not an independent source — and treats the API retrieval timestamp as the detection event if a difference appears. The 2024 extract is retained as evidence of what was done then, not as the comparison input now.

6. The design point underneath

Everything above collapses into a single rule: the register is a verification input, never the source of the identification. A firm that populates beneficial ownership straight from the extract has built a file that can never generate a discrepancy report, because there is nothing independent left to compare — and it has not performed the identification the AMLR requires in the first place.

The cheap version of the control is to make onboarding capture two things separately: who the customer says its beneficial owners are, evidenced by the customer’s own documentation, and what the register says, with a retrieval timestamp. The comparison between them is the article 10c control, and once both fields exist it costs nothing to run.

FAQ

7. What to do, today

• Confirm your access level in writing. If you are a Wft financial undertaking you should be at UBOB2; if your process is running on name-and-birth-month data, you are at UBOB1 or on customer-supplied extracts.
• Apply for the terugmelding authorisation before you need it. It requires a signed paper form and an identity document, which is not a same-day process.
• Split the two fields. Customer-asserted beneficial owners and register-retrieved beneficial owners must be stored separately, with a retrieval timestamp on the second.
• Treat an empty or pseudo-UBO entry as a finding. It is a statement that identification failed, not a confirmation that there is nothing to find.
• Check the trust register too. Article 10c covers the separate register for trusts and similar legal arrangements, and processes built only around KVK will miss it.

Related: Beneficial ownership registers — filing and discrepancies · The Dutch AML framework · FIU-Nederland and the unusual transaction report · What is a beneficial owner