Every Wwft and AMLR duty in one overview
The Wwft asks two things at once: complete due diligence per client, and a demonstrable organisation at firm level. Below are all the duties, with their basis in the Wwft and in the European AMLR (Regulation (EU) 2024/1624) that largely replaces it from 10 July 2027. Every article number links to the official legal text.
Per client: due diligence
| Duty | Wwft | AMLR (2027) | In Cloudpliant |
|---|---|---|---|
| Identify the client and verify their identity | art. 3 opens in a new tab | arts. 20 opens in a new tab and 22 opens in a new tab | ID document review or digital verification |
| Establish and verify the UBOs | art. 3 opens in a new tab | arts. 20 opens in a new tab and 22 opens in a new tab, and the ownership threshold becomes 25% or more (today: more than 25%, AMLR art. 52) | Record, screen and verify against the certified extract |
| Check the representative and their authority to act | art. 3 opens in a new tab | art. 22 opens in a new tab | — |
| Record the purpose and intended nature of the relationship | art. 3 opens in a new tab | art. 25 opens in a new tab | Recorded in the file, shown on the report |
| Source of funds and wealth (PEPs and enhanced due diligence) | art. 8 opens in a new tab | art. 34 opens in a new tab, enhanced due diligence | Client questionnaire with evidence, reviewed by you |
| Consult the UBO register and report discrepancies | art. 10c opens in a new tab | art. 24 opens in a new tab | Discrepancy recorded at UBO verification |
| Sanctions, PEP and watchlist screening | Sanctiewet opens in a new tab | art. 20 opens in a new tab, explicit sanctions check | Automatic, with evidence per check · news screening at intake, review and high risk |
| Risk classification per client | arts. 3 opens in a new tab and 8 opens in a new tab | art. 20 opens in a new tab | Automatic via a transparent rule matrix |
| Acceptance decision, with senior-management approval for PEPs and high risk | arts. 5 opens in a new tab and 8 opens in a new tab | arts. 21 opens in a new tab and 42 opens in a new tab | Decision recorded with motivation and decider |
| Ongoing monitoring and keeping the file current | art. 3 opens in a new tab | art. 26 opens in a new tab: yearly for high risk, at least every 5 years otherwise | List monitoring automatic · periodic review scheduled |
| Report unusual transactions to FIU-Nederland | art. 16 opens in a new tab | art. 69 opens in a new tab | FIU consideration recorded on a refusal |
| Retain the file 5 years after the relationship ends | arts. 33 opens in a new tab and 34 opens in a new tab | art. 77 opens in a new tab | Automatic retention term and cleanup |
A dash in the 'In Cloudpliant' column means you record that part outside Cloudpliant today, for example in your own practice software. How every classification is produced is on the methodology page.
Per firm: policy and organisation
| Duty | Wwft | AMLR (2027) | What it asks of you |
|---|---|---|---|
| Business-wide risk assessment of the firm itself | art. 2b opens in a new tab | art. 10 opens in a new tab, incl. sanctions-evasion risk | RecordKeep it current and hand it over when the supervisor asks. |
| Policy document: guidelines, procedures and measures | art. 2c opens in a new tab | art. 9 opens in a new tab, approved by the management body | RecordThe board adopts it and you review it periodically. |
| Compliance function | art. 2d opens in a new tab | art. 11 opens in a new tab: compliance manager and compliance officer | DoAppoint someone, no document. Falls away if you work alone. |
| Periodic training of employees | art. 35 opens in a new tab | art. 12 opens in a new tab: ongoing programme | DoThe Wwft asks for no log. From 2027 it does.Free Wwft training |
| Integrity screening of employees | art. 35 opens in a new tab | art. 13 opens in a new tab: before starting and repeated | DoNo VOG required. Falls away if you work alone. |
| Internal channel for reporting breaches | art. 20a opens in a new tab | art. 14 opens in a new tab | Set upFalls away if you work alone. |
| Document any outsourcing of AML tasks | — | art. 18 opens in a new tab | RecordFrom 2027 only. |
Note the difference in the last column. Where it says 'do', the law wants an act and not a document: there is nothing to produce. Where it says 'record', something has to exist, stay current and be handed over on request. Three of these seven also fall away entirely if you work on your own.
These duties are policy and organisation: software cannot decide them for you. Cloudpliant delivers the execution side, the client file that shows a supervisor the policy actually runs.
Per profession
The duties themselves are identical for everyone once the law applies. What differs: when the Wwft applies, and who supervises.
| Profession | When the Wwft applies | Supervisor |
|---|---|---|
| Accountants | All client work | BFT |
| Bookkeeping firms | All client work | BFT |
| Tax advisors | All advisory and filing work | BFT |
| Notaries | Real-estate and corporate practice; family practice mostly outside | BFT |
| Lawyers | Listed services only (real estate, companies, funds management); litigation exempt | Local bar president |
| Real-estate agents and valuers | Sale and purchase always; letting from €10,000 rent per month | Bureau Toezicht Wwft (tax authority) |
For lawyers, supervision currently sits with the local bar president; a bill moves it to a single national independent supervisor (OTA).
What the AMLR changes
- From 10 July 2027 the rules come directly from the regulation and apply identically across the EU; the Wwft remains only for national additions.
- Refreshing client files gets hard deadlines: high-risk files yearly, all others at least every five years (art. 26 opens in a new tab).
- The policy document must be approved by the management body and cover around ten mandatory topics (art. 9 opens in a new tab).
- Training becomes an ongoing programme, extending to agents and intermediaries (art. 12 opens in a new tab).
- New are the integrity screening of employees (art. 13 opens in a new tab) and a designated compliance function (art. 11 opens in a new tab).
Get started with Cloudpliant today
10 client files free, the whole product. Connect Exact Online, or add a client by hand.
No credit card needed. The demo takes 30 minutes, online, no obligation.