Article 2d Wwft: compliance function and Wwft policymaker
Article 2d Wwft is the Dutch rule that puts AML compliance into the governance of a payment or e-money institution: one named policymaker answers for the Wwft, an independent compliance function checks it, and an independent audit function checks both. Two of its four paragraphs carry a proportionality qualifier that small firms read as an exemption; for a DNB-licensed payment or e-money institution, the prudential rules say otherwise. This is the Dutch leg of our national AML-officer series, and it ends where all of them end: Article 11 of the AMLR from 10 July 2027.
1. What article 2d Wwft says
Article 2d of the Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft) has four parts. In paraphrase:
- Paragraph 1 — the Wwft policymaker. Where two or more people determine the day-to-day policy of an institution, the institution designates one of them as responsible for its compliance with the Wwft and the rules made under it.
- Paragraph 2 — the compliance function. To the extent appropriate to its nature and size, an institution has an independent and effective compliance function.
- Paragraph 3 — what that function does. It monitors compliance with statutory and internal rules, and its tasks include supplying the article 16 Wwft unusual-transaction data to the Financial Intelligence Unit.
- Paragraph 4 — the audit function. Where applicable and appropriate to nature and size, the institution ensures an audit function is exercised independently over its activities. It checks Wwft compliance and the compliance function.
The text is unchanged in the version of the Wwft in force since 1 July 2026. Read it with article 2c(3): the institution’s Wwft policies, procedures and measures need the approval of the people who determine its day-to-day policy.
2. When “where appropriate” applies
Paragraph 1 is unconditional: if your management board has two or more members, one of them is the Wwft policymaker. Only paragraphs 2 and 4 are qualified by nature and size.
DNB’s reading of that qualifier comes from the explanatory memorandum to the 2018 implementing act (Parliamentary Papers II 2017-2018, 34 808, no. 3), which it cites in its Q&As:
- the set-up of the compliance function can be tailored to the institution’s nature and size;
- as a principle, people performing the compliance function should not also be involved in the activities they monitor — but for smaller institutions guaranteeing independence that way can be disproportionately burdensome;
- the compliance function may be outsourced, wholly or partly, and so may the audit function;
- the intensity of the audit function should follow the risk profile, and its degree of independence should fit the institution’s nature and size.
DNB’s Q&A on whether smaller institutions need an independent Wwft compliance function answers that it may be disproportionately burdensome and therefore inappropriate, with size and type both relevant. That answer covers the whole Wwft population, not licensed payment firms specifically.
3. The prudential layer: Wft and Bpr for PIs and EMIs
For a payment or e-money institution seated in the Netherlands, the Wet op het financieel toezicht (Wft) and the Besluit prudentiële regels Wft (Bpr) add requirements with no size qualifier:
- Article 3:10 Wft requires an adequate policy ensuring the business is conducted with integrity.
- Article 3:17 Wft requires controlled and sound business operations, with the detail set by decree.
- Article 17 Bpr requires clear structure and reporting lines, and an at-least-annual independent test of the effectiveness of the organisation and its procedures by a unit exercising an internal control function. For payment and e-money institutions, that test also covers their use of payment service agents.
- Article 21 Bpr names payment institutions and e-money institutions expressly: they must have a unit performing a compliance function independently and effectively.
4. DNB’s guidance: from the Leidraad to the Q&As
Many manuals still cite the DNB Leidraad Wwft en Sw. That guideline, first published in 2011 and last revised in December 2020, has been replaced for Wwft purposes by the DNB Wwft Q&As and Good Practices, published in May 2024 after a public consultation that opened in October 2023. Only the Sanctiewet chapter of the old Leidraad stays in force, now issued as a separate document.
Good practices in the document are examples, not rules: another route is acceptable if you can show on reasoned grounds that it complies. Section 2.1.3 covers the duties of policymakers and of the compliance and audit functions, and its good practices are the closest thing DNB publishes to a checklist:
- Compliance framework. The design and standing of the compliance function are written down: access to all relevant information, premises and people, a defined reporting line, and direct access to the supervisory board.
- First line ownership. Policy states that the first line is primarily responsible for identifying, assessing and managing ML/TF risk in day-to-day work.
- Escalation. Findings go to the department’s management with agreed actions, copied to the Wwft policymaker and the audit function.
- Audit. The audit function operates independently, assesses Wwft compliance and the compliance function at least annually, documents its findings, and checks that the resulting remediation is sufficient.
DNB points to the EBA Guidelines on the role and responsibilities of the AML/CFT compliance officer, and to the EBA Guidelines on internal governance where they apply, as the reference for how duties are split between the management body, the Wwft policymaker and the compliance function. Where the Dutch and English versions differ, the Dutch text prevails.
5. Fit and proper screening, and changes in My DNB
- Policymakers are screened. Articles 3:8 and 3:9 Wft require the day-to-day policymakers and supervisory board members of a payment or e-money institution with its seat in the Netherlands to be fit and proper. DNB assesses them before appointment, and a candidate may take up the position only after a positive decision. The Wwft policymaker under article 2d(1) is, by definition, one of those policymakers.
- The compliance officer is not, as such. The statutory extension of fitness and propriety to the management layer directly below the policymakers applies to credit unions and insurers, and DNB lists second-tier screening only for banks and insurers. Nothing in articles 3:8 and 3:9 Wft or in the Wwft extends DNB screening to the compliance officer of a PI or EMI, unless that person is also a policymaker.
- Your own screening still applies. Under article 35 Wwft and the Q&As the institution trains and screens its own staff — an internal control, not a DNB procedure.
Changes run through My DNB. An application for a new policymaker goes through the supervision applications service there, and DNB reassesses fitness when an already-screened board member moves to a different position at the same institution. The Wwft has no separate notification for re-allocating the article 2d(1) role between directors, but minute it and update the Wwft policy so you can show DNB who holds it.
6. The compliance function and FIU-Nederland
Article 2d(3) ties the compliance function to reporting: its tasks include supplying the article 16 Wwft data to FIU-Nederland. The compliance function therefore owns, or at least controls, the route from alert to report, and DNB will look to it if reports are late or missing.
The institution needs a clear line on who decides to report, who files in goAML, and how the decision is recorded. Our guide to reporting unusual transactions to FIU-Nederland covers the mechanics.
7. EEA branches and agents: who carries article 2d
How a passporting firm meets the Wwft depends on its form of presence.
- Branches. Article 1a(3)(l) Wwft makes Dutch branches of payment and e-money institutions seated elsewhere into Wwft institutions in their own right. Article 2d is not adapted for branches, so the branch should be able to show which member of its management answers for the Wwft in the Dutch business, and where the compliance and audit work on Dutch activity is done. If that sits at head office, document how it covers Dutch rules and FIU-Nederland reporting.
- Agents and distributors. Article 2e Wwft lets the supervisor ask a payment institution, e-money institution or crypto-asset service provider with its head office in another member state, operating through establishments other than branches, to appoint a central contact point in the Netherlands. The contact point ensures compliance with the Wwft on the institution’s behalf and supplies the information the supervisor requests. The criteria come from article 45 of the Fourth AML Directive and Commission Delegated Regulation (EU) 2018/1108.
For broader context on local representatives across the Union, see the AML representative across the EU.
8. From article 2d to Article 11 AMLR
Regulation (EU) 2024/1624 applies from 10 July 2027 and replaces the national rule with a directly applicable one. The table maps the change.
| Element | Article 2d Wwft (today) | AMLR (from 10 July 2027) |
|---|---|---|
| Board-level owner | One day-to-day policymaker, where there are two or more | A compliance manager from the management body in its management function (Art. 11(1)) |
| Operational owner | An independent and effective compliance function, where appropriate | A named compliance officer appointed by the management body, with sufficiently high hierarchical standing (Art. 11(2)) |
| FIU reporting | Part of the compliance function’s tasks (Art. 2d(3)) | The compliance officer is responsible for reporting under Art. 69(6) |
| Audit | Independent audit function, where applicable and appropriate | Independent audit function, or an external expert where there is none (Art. 9(2)(b)) |
| Screening | Policymakers only, under Wft 3:8 and 3:9 | Compliance officers verified where the entity is subject to checks on senior management (Art. 11(2)) |
| Removal | No specific rule | Prior notice to the management body; the supervisor is notified (Art. 11(2)) |
| Combining roles | Not addressed | Permitted where nature, risks, complexity and size justify it (Art. 11(7)) |
For a Dutch PI or EMI, the screening and removal rows change the most. Our guide to the AMLR compliance manager and compliance officer covers the EU text in full.
9. Worked cases
A two-director payment institution
Facts: a Dutch payment institution has two statutory directors and twelve staff. Its CFO also acts as “MLRO”, and no director has been formally designated for the Wwft.
What the rule says: with two policymakers, article 2d(1) requires one of them to be designated. Article 21 Bpr requires an independent and effective compliance function, and the Q&As say compliance staff should, in principle, not monitor activities they are involved in.
What the practitioner does: has the board designate one director as Wwft policymaker in a minuted resolution. Moves day-to-day compliance to a person outside finance — in-house part-time or outsourced — with a written compliance framework, a reporting line to the Wwft policymaker and direct access to the supervisory board.
Outcome: a structure that meets the Wwft, the Bpr and the Q&As, and maps onto the 2027 roles.
An outsourced audit function
Facts: an e-money institution has no internal audit department and asks whether the audit function in article 2d(4) is optional.
What the rule says: the Wwft qualifies the audit function by nature and size, but article 17(4) Bpr separately requires an at-least-annual independent test of effectiveness, covering agents too. DNB’s explanatory sources confirm the audit function may be outsourced.
What the practitioner does: outsources an annual Wwft audit with a scope that covers the compliance function itself, records findings and remediation, and has the audit confirm that remediation worked.
Outcome: one annual cycle that satisfies both the Wwft and the Bpr, and already matches Article 9(2)(b) AMLR.
10. FAQ
Does article 2d Wwft require a compliance officer?
It requires a compliance function where appropriate, and one designated policymaker where there are two or more. For DNB-licensed PIs and EMIs, article 21 Bpr requires an independent and effective compliance function in any case.
Does DNB screen the compliance officer of a payment institution?
No, not as such. DNB screens day-to-day policymakers and supervisory board members under articles 3:8 and 3:9 Wft. The compliance officer is screened only if they are also a policymaker. That may change under Article 11(2) AMLR.
Is the DNB Leidraad Wwft en Sw still valid?
Only its Sanctiewet chapter. For the Wwft it was replaced by the DNB Wwft Q&As and Good Practices, published in May 2024.
Do we notify DNB when the Wwft policymaker changes?
The Wwft has no separate notification duty. A new policymaker needs prior fit and proper approval through My DNB; re-allocating the role between screened directors should be minuted and reflected in your policy.
Does article 2d apply to a Dutch branch of an EEA institution?
Dutch branches of PIs and EMIs seated elsewhere are Wwft institutions under article 1a(3)(l), so the Wwft obligations, including article 2d, apply to them.
11. What to do, today
- Board: confirm in a minuted resolution which director is the Wwft policymaker under article 2d(1), and have the board approve the Wwft policies under article 2c(3).
- Compliance officer / MLRO: write or refresh the compliance framework against section 2.1.3 of the DNB Q&As: access, reporting lines, direct access to the supervisory board, escalation.
- Head of audit: set an annual Wwft audit scope that covers the compliance function itself and the use of agents, aligned with article 17(4) Bpr.
- Policy owner: replace references to the DNB Leidraad Wwft en Sw with the 2024 Q&As, keeping the Leidraad only for sanctions.
- COO: map the 2027 roles now — compliance manager, compliance officer, audit — and plan for supervisory verification of the compliance officer and notification on removal.
- Passporting firms: confirm whether your Dutch presence is a branch or an agent network, and be ready for a central contact point request.
Related: The DNB SIRA · Geldwäschebeauftragter: Germany’s AML officer · AMLCO in Belgium
