Dutch Watchdog Urges Caution as AML Rules Expand Data Sharing Powers

Key Takeaways

• Effectiveness Must Be Proven: The Dutch Data Protection Authority says expanded anti-money laundering powers can only be justified if the government can clearly demonstrate that they actually reduce money laundering and terrorist financing.
• Privacy Impact Is Significant: The proposed law would increase the collection and sharing of sensitive personal data, including nationality, possible refugee status, and citizen service numbers, raising concerns about proportionality.
• Risk of Exclusion and Bias: Greater reliance on risk-based and automated analyses could lead certain groups to be flagged more often, exposing innocent people to extra scrutiny, exclusion, or suspicion without clear recourse.
• Mandatory Evaluation Urged: The authority is calling for a legally required national evaluation of the AML system, focused on effectiveness, proportionality, and the risks of discrimination and exclusion.
• Oversight and Resources in Question: The watchdog warns that the Financial Intelligence Unit must align with GDPR standards and remain politically independent, while noting that no extra resources have been allocated to handle the expanded supervisory workload.

Deep Dive

The Dutch data protection watchdog is urging lawmakers to slow down and look closely at the real-world impact of sweeping new anti-money laundering rules, warning that a major expansion of financial surveillance can only be justified if it is proven to work and if people’s privacy is meaningfully protected.

In a statement recenlty published, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) welcomed the ambition behind the Netherlands’ proposed implementation of new European anti-money laundering and counter-terrorist financing legislation. At the same time, it raised sharp concerns about how much additional personal data would be collected, how widely it could be shared, and whether the system’s effectiveness has been sufficiently demonstrated.

At the heart of the proposal is a broader and more tightly aligned European AML framework. The bill would extend existing obligations beyond traditional gatekeepers such as banks, notaries, and real estate agents to include new sectors like crowdfunding platforms, luxury goods retailers, and even football clubs. These entities would be required to collect customer data, carry out due diligence checks, monitor transactions, and flag unusual activity to the Financial Intelligence Unit (FIU).

The legislation also expands information-sharing powers. Under the proposal, confidential data held by the FIU and supervisory authorities could be shared more easily with other government bodies, including the police, the Public Prosecution Service, and tax authorities. The changes reflect a wider European push to harmonize AML enforcement and include the creation of a new EU-level supervisory authority.

According to the AP, there is potential upside. The new rules are designed to make AML supervision more targeted, reducing the volume of low-risk transaction reports and allowing authorities to focus their attention on higher-risk cases. In theory, that could mean better use of limited supervisory resources.

But the watchdog says theory is not enough.

“Money laundering and terrorist financing must be addressed. There’s no doubt about that,” said Aleid Wolfsen, chair of the AP. “At the same time, more citizen data will be collected and potentially shared, such as nationalities, possible refugee status, and citizen service numbers. These drastic measures can only be justified if they demonstrably work, don’t go beyond what’s necessary, and ensure people are properly protected.”

The AP is particularly uneasy about the cumulative impact on ordinary people who are not involved in financial crime. It notes that it is still unclear whether such an extensive system will actually reduce money laundering and terrorist financing, while the consequences for innocent individuals could be significant. Automated risk analyses, for example, could lead certain groups being flagged as “high risk” more often, triggering additional checks, delays, or even exclusion from financial services—often without clear explanations or accessible routes to challenge those decisions.

That risk, the authority says, makes careful implementation of the so-called risk-based approach essential. Without strong safeguards, errors and bias could quickly undermine both fairness and public confidence.

To that end, the AP is calling for a mandatory, legally enshrined evaluation of the new AML regime. Lawmakers, it argues, should require national-level assessments that explicitly examine whether the system is effective, proportionate, and free from discriminatory effects.

“The government must be able to show that such far-reaching interference in private life is truly necessary and effective,” Wolfsen said. “And that people are protected from mistakes, exclusion, and discrimination. Without that assurance, trust in government will inevitably come under pressure.”

The watchdog also raised red flags around the proposed legal framework governing the FIU. It warned that the FIU bill appears to rely on a privacy regime that diverges from the General Data Protection Regulation, despite European lawmakers indicating that FIU activities should be designed and assessed in line with GDPR standards. Given the sensitivity of the data involved, the AP stressed that the FIU must also be able to operate independently and at a clear distance from political influence.

Finally, the authority pointed to a more practical concern. The new rules would significantly increase the AP’s own responsibilities, as larger volumes of sensitive and special-category personal data are processed and shared through expanded information-sharing arrangements. Yet, the watchdog noted, no additional resources have been earmarked to support this extra workload.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.