AML/KYC Requirements for Cryptocurrency Service Providers in the Netherlands

Cryptocurrency service providers in the Netherlands must comply with the Money Laundering and Anti-Terrorist Financing Act (Wwft), which implements the Fifth Anti-Money Laundering Directive (5AMLD)[2]. The Dutch Authority for the Financial Markets (AFM) and De Nederlandsche Bank (DNB) jointly oversee compliance, with the AFM handling licensing under MiCAR regulations and DNB maintaining the AML/CFT register[6].

Regulated Service Providers

The following entities are subject to regulation[5]:

• Natural persons or legal entities providing professional or commercial services for exchanging virtual currency and fiat currency
• Natural persons or legal entities providing professional or commercial custodial wallet services

Customer Due Diligence Requirements

Basic KYC procedures require crypto service providers to verify customer identities and detect suspicious transactions[3]. For higher-risk situations, enhanced due diligence (EDD) is mandatory and includes[1]:

• Verifying clients' identities with additional scrutiny
• Obtaining detailed information about the origin and destination of funds
• Closely monitoring transactions

High-risk scenarios requiring EDD involve transactions with self-hosted addresses or transactions involving third countries, which carry higher integrity risks under AFM guidance[1].

Transaction Monitoring and Reporting

CASPs must implement robust transaction monitoring systems to continuously oversee business relationships and transactions[1]. This includes monitoring both fiat and crypto transactions to detect unusual activities, with advanced analytical tools used to assess transaction histories and identify potential links to criminal activities[1].

Reporting obligations require all financial institutions to report unusual transactions to the Netherlands Financial Intelligence Unit (FIU-the Netherlands) without undue delay, including transactions raising suspicions of money laundering or terrorist financing[1][4].

Sanctions Compliance

CASPs must establish policies and procedures enabling compliance with sectoral sanctions and sanctioned distributed-ledger addresses[1]. The European Banking Authority (EBA)'s guidelines on internal policies and procedures for implementing Union and national restrictive measures guide the design of CASPs' sanctions screening policies[1].

Record-Keeping and Training

While specific record-keeping details are not extensively outlined in the available guidance, the Wwft framework requires CASPs to maintain documentation supporting compliance with AML/CFT obligations[5]. Additionally, organizations must provide ongoing AML/CFT training requirements for employees[7].

Regulatory Oversight Structure

The dual supervisory structure ensures comprehensive oversight[6]:

• AFM: Licenses and supervises crypto-asset service providers under MiCAR; opened its digital portal for MiCAR license applications as of April 22, 2024[2]
• DNB: Maintains the register of crypto service providers and oversees AML/CFT compliance under the Wwft[6]

Registration with DNB is required for crypto service providers to operate legally in the Netherlands[3]. Non-compliance can result in significant fines, penalties, and reputational damage[5].