- \n
- CCV\u2019s transaction monitoring solution failed for over two years, highlighting a broader governance failure.<\/li>\n<\/ul>\n\n\n\n
- \n
- The firm failed to fully load over 4200 merchant\u2019s transaction profiles into their monitoring system for 23 months, showing that controls were not consistent.<\/li>\n<\/ul>\n\n\n\n
- \n
- CCV has inadequate ongoing monitoring of alerts, with no explanation of why they were closed or handed over to other teams, meaning the company cannot evidence its decision-making.<\/li>\n<\/ul>\n\n\n\n
CCV’s Historic AML and Sanctions Violations<\/h2>\n\n\n\n
This is not the first time CCV faced enforcement action for similar violations. Back in 2019, the DNB issued a formal instruction (aanwijzing), mandating that the company take specific actions to improve its monitoring policies and procedures. In July 2021, DNB confirmed that CCV complied.<\/p>\n\n\n\n
\n
DNB seeks to safeguard financial stability<\/a> and thus contributes to sustainable prosperity in the Netherlands.<\/p>\n<\/blockquote>\n\n\n\n
However, just years later, in 2024, the firm was fined \u20ac1.1 million for prior AML and sanctions breaches found from 2015 to 2018. Despite its historic failures and remediation, DNB imposed this new fine for controls that were not continuous. What does this mean for regulated businesses?<\/p>\n\n\n\n
Regulatory bodies are emphasizing “not continuous” as a regulatory red line, with higher expectations on sustainable and continuous\u00a0control performance, not just a point in time fix.<\/p>\n\n\n\n
Netherlands Customer Due Diligence and Ongoing Monitoring Requirements<\/h2>\n\n\n\n
In the Netherlands, the Wwft requires regulated businesses to perform robust CDD and\u00a0ongoing monitoring<\/a>. This includes documenting when they are triggered and how they enable continuous compliance.\u00a0<\/p>\n\n\n\n
What must CDD achieve under Section 3(2) of the Wwft?<\/h3>\n\n\n\n
Under AML and CTF laws, businesses must meet four aspects for compliance. These are to perform identity verification on a customer or client, identify the\u00a0Ultimate Beneficial Owner (UBO)<\/a>, establish the nature and purpose of a relationship or transaction, and, lastly, continuously monitor the said relationship and transactions over time.<\/p>\n\n\n\n
What must ongoing monitoring achieve under Section 3(2) of the Wwft?<\/h3>\n\n\n\n
Section 3(2) explicitly calls businesses to run ongoing monitoring. This is a baseline obligation required by all organizations. These mandates echo leading regulatory frameworks, such as Singapore’s MAS, Australia’s AUSTRAC, and the UK’s MLR2017. Authorities increasingly expect proactive monitoring systems with clear risk-based triggers, escalation, and decision-making.<\/p>\n\n\n\n
How to Build a Scalable AML Program in the Netherlands and Beyond? <\/h2>\n\n\n\n
A key lesson from CCV’s case is that AML and CTF compliance must do more than just pass a point-in-time remediation plan. It must be resilient and continue to operate effectively as business volume, customers, and regulatory obligations evolve.<\/p>\n\n\n\n
According to Milosh Caunhye<\/a>, Solutions Consultant at ComplyCube, “Businesses can face enforcement action despite using the best AML technology. Instead, an effective, end-to-end AML program should go further and be able to demonstrate strong and consistent evidence of outcomes.”<\/p>\n\n\n\n
1. Automated monitoring platform<\/h3>\n\n\n\n
Leverage real-time AML screening, including automated Politically Exposed Persons (PEPs) verification<\/a>, sanctions check, and adverse media coverage on a unified platform. Use risk-based rules, customer profiles, and behavioral patterns to trigger escalation to senior management for review.<\/p>\n\n\n\n
2. Robust case management <\/h3>\n\n\n\n
Centralize case management to record alert reviews, compliance officer reasoning, approvals, and escalation decisions in real-time. With a clear audit trail, businesses can strengthen accountability and enhance trust with demonstrable evidence to support compliance decisions.<\/p>\n\n\n\n
3. Connect customer risk directly to monitoring<\/h3>\n\n\n\n
Use robust APIs and integrations to feed CDD, UBO, and other related risk data into the controls applied throughout the customer journey. As a result, companies can identify emerging risks earlier, better allocate compliance resources, and enforce more proportionate controls.<\/p>\n\n\n\n
![\"Fortify](\"https:\/\/www.complycube.com\/wp-content\/uploads\/2025\/04\/contact-complycube-award-winning-aml-and-kyc-1024x577.png\")
<\/a><\/figure>\n\n\n\n
- CCV has inadequate ongoing monitoring of alerts, with no explanation of why they were closed or handed over to other teams, meaning the company cannot evidence its decision-making.<\/li>\n<\/ul>\n\n\n\n
- The firm failed to fully load over 4200 merchant\u2019s transaction profiles into their monitoring system for 23 months, showing that controls were not consistent.<\/li>\n<\/ul>\n\n\n\n