Every Wwft duty in one overview

The Wwft asks two things at once: complete due diligence per client, and a demonstrable organisation at firm level. Below are all the duties, with their basis in the Wwft and in the European AMLR (Regulation (EU) 2024/1624) that largely replaces it from 10 July 2027. Every article number links to the official legal text.

Per client: due diligence

DutyWwftAMLR (2027)In Cloudpliant
Identify the client and verify their identityart. 3 opens in a new tabarts. 20 opens in a new tab and 22 opens in a new tabID document review or digital verification
Establish and verify the UBOsart. 3 opens in a new tabarts. 20 opens in a new tab and 22 opens in a new tabRecord, screen and verify against the certified extract
Check the representative and their authority to actart. 3 opens in a new tabart. 22 opens in a new tab
Record the purpose and intended nature of the relationshipart. 3 opens in a new tabart. 25 opens in a new tab
Source of funds and wealth (PEPs and enhanced due diligence)art. 8 opens in a new tabart. 34 opens in a new tab, enhanced due diligence
Consult the UBO register and report discrepanciesart. 10c opens in a new tabart. 24 opens in a new tabDiscrepancy recorded at UBO verification
Sanctions, PEP and watchlist screeningSanctiewet opens in a new tabart. 20 opens in a new tab, explicit sanctions checkAutomatic, with evidence per check
Risk classification per clientarts. 3 opens in a new tab and 8 opens in a new tabart. 20 opens in a new tabAutomatic via a transparent rule matrix
Acceptance decision, with senior-management approval for PEPs and high riskarts. 5 opens in a new tab and 8 opens in a new tabarts. 21 opens in a new tab and 42 opens in a new tabDecision recorded with motivation and decider
Ongoing monitoring and keeping the file currentart. 3 opens in a new tabart. 26 opens in a new tab: yearly for high risk, at least every 5 years otherwiseList monitoring automatic · periodic review scheduled
Report unusual transactions to FIU-Nederlandart. 16 opens in a new tabart. 69 opens in a new tabFIU consideration recorded on a refusal
Retain the file 5 years after the relationship endsarts. 33 opens in a new tab and 34 opens in a new tabart. 77 opens in a new tabAutomatic retention term and cleanup

A dash in the 'In Cloudpliant' column means you record that part outside Cloudpliant today, for example in your own practice software. How every classification is produced is on the methodology page.

Per firm: policy and organisation

DutyWwftAMLR (2027)
Business-wide risk assessment of the firm itselfart. 2b opens in a new tabart. 10 opens in a new tab, incl. sanctions-evasion risk
Policy document: guidelines, procedures and measuresart. 2c opens in a new tabart. 9 opens in a new tab, approved by the management body
Compliance functionart. 2d opens in a new tabart. 11 opens in a new tab: compliance manager and compliance officer
Periodic training of employeesart. 35 opens in a new tabart. 12 opens in a new tab: ongoing programme
Integrity screening of employeesart. 13 opens in a new tab, new
Internal channel for reporting breachesart. 20a opens in a new tabart. 14 opens in a new tab
Document any outsourcing of AML tasksart. 18 opens in a new tab

These duties are policy and organisation: software cannot decide them for you. Cloudpliant delivers the execution side, the client file that shows a supervisor the policy actually runs.

Per profession

The duties themselves are identical for everyone once the law applies. What differs: when the Wwft applies, and who supervises.

ProfessionWhen the Wwft appliesSupervisor
AccountantsAll client workBFT
Bookkeeping firmsAll client workBFT
Tax advisorsAll advisory and filing workBFT
NotariesReal-estate and corporate practice; family practice mostly outsideBFT
LawyersListed services only (real estate, companies, funds management); litigation exemptLocal bar president
Real-estate agents and valuersSale and purchase always; letting from €10,000 rent per monthBureau Toezicht Wwft (tax authority)

For lawyers, supervision currently sits with the local bar president; a bill moves it to a single national independent supervisor (OTA).

What the AMLR changes

  • From 10 July 2027 the rules come directly from the regulation and apply identically across the EU; the Wwft remains only for national additions.
  • Refreshing client files gets hard deadlines: high-risk files yearly, all others at least every five years (art. 26 opens in a new tab).
  • The policy document must be approved by the management body and cover around ten mandatory topics (art. 9 opens in a new tab).
  • Training becomes an ongoing programme, extending to agents and intermediaries (art. 12 opens in a new tab).
  • New are the integrity screening of employees (art. 13 opens in a new tab) and a designated compliance function (art. 11 opens in a new tab).

Get started with Cloudpliant today

It's time to take control of your compliance. Cloudpliant provides one streamlined way to meet your WWFT, AML and KYC obligations, without the hassle.

The demo takes 30 minutes. Free account, no credit card needed.