Director liability in the event of a violation of the AML is not a given: a director is not automatically criminally liable when an organization fails to comply with the AML. A recent ruling by the Court of Appeal in The Hague (ECLI:NL:GHDHA:2026:2873, ruling of September 16, 2026) shows that criminal liability requires more than mere knowledge of AML issues. Among other things, the court examined whether sufficient measures had been taken and whether there were concrete indications that additional measures were necessary.
For organizations subject to AML, this ruling contains an important lesson. It is not only important to take measures, but above all to be able to demonstrate that these measures have been taken. Proper documentation, monitoring, and follow-up not only protect the organization but can also be relevant to the position of directors.
What happened at ABN AMRO?
In April 2021, ABN AMRO paid a settlement of €480 million for years of systemic violations of AML and debt laundering. The Public Prosecution Service subsequently investigated whether former directors could be held personally criminally liable.
On December 18, 2024, the Public Prosecution Service decided not to prosecute four former directors. According to the Public Prosecutor’s Office, there was insufficient evidence to hold them personally criminally liable. The investigation revealed that they had taken measures to remedy or mitigate the identified shortcomings. Although those measures did not immediately have the desired effect, it could not be demonstrated that they had deliberately failed to take sufficient action or that other available measures would have resolved the problems significantly faster.
The Court of Appeal in The Hague upheld this ruling on September 16, 2026. The court ruled that there were insufficient grounds for a successful prosecution of the former chairman of the board for de facto leadership of ABN AMRO’s violations of the AML.
When does an AML violation lead to director liability?
Personal criminal liability requires more than just a failure within the organization.
The court emphasized that a director must not only be aware of the violationsbut must also consciously fail to take appropriate measures while having the authority and duty to do so. The mere existence of a compliance issue does not automatically make a director the de facto leader of the violation.
It is important to distinguish between an organization that fails to meet its obligations and a director who is personally liable. Organizations may fail in their gatekeeping role, while directors may at the same time have demonstrably attempted to remedy those shortcomings.
Please note: this blog focuses on criminal liability. There are also other avenues, such as administrative fines imposed by regulators and civil liability of directors. This article provides general information and does not constitute legal advice.
Why is demonstrability so important?
The common thread in this case is demonstrability: the ability to show which remedial measures were taken.
ABN AMRO’s board was able to demonstrate that remedial measures had been initiated, that compliance with the AML was being prioritized, and that programs had been established to address the issues. The fact that they could demonstrate these efforts was a factor in the assessment of the directors’ personal responsibility.
For organizations subject to AML, this means that policy alone is not sufficient. In addition, AML requires institutions to document their risk assessments, keep them up to date, and make them available to the regulator upon request. Being able to substantiate risk assessments and the measures taken is therefore not only practical but also part of the legal obligations. You must be able to demonstrate:
- What risks were identified.
- What measures were taken.
- Who was responsible for implementation.
- When actions were carried out.
- How progress was monitored.
- What improvements were implemented.
When this information is missing, it quickly leads to debate over whether an organization and its board have done enough to manage risks.
What does this mean for organizations subject to the AML?
Many organizations focus primarily on conducting customer due diligence, transaction monitoring, and risk assessments. These are important components of the AML, but documenting the decisions that are made is just as important.
Consider, for example:
How do you demonstrate that risks have been assessed?
Don’t just retain the outcome of a risk assessment; also document the underlying considerations, decisions, and any follow-up actions. If a regulator or judge asks questions later, the rationale is often just as important as the conclusion itself.
How do you demonstrate that measures have been implemented?
A policy document alone offers little protection if it is not clear what has actually been done with it. Therefore, ensure you have action lists, progress reports, and periodic evaluations.
How do you demonstrate that management and compliance are involved?
Document which topics were discussed in board meetings , which risks were identified, and which decisions were made. This creates a demonstrable record of involvement and follow-up.
What lessons can board members learn from this?
The ruling shows that it is not enough for board members to merely identify risks. At the same time, the case makes it clear that demonstrable efforts carry significant weight in the assessment of personal responsibility.
Three lessons are relevant for board members:
- Ensure that compliance is a recurring agenda item.
- Request clear reports on AML risks and follow-up actions.
- Carefully document decisions, measures, and progress.
Not because this provides a guarantee against liability, but because it helps demonstrate that risks were taken seriously and appropriate actions were taken.
Demonstrability starts with having a firm grasp of your compliance process
The ruling shows that directors’ liability for violations of the AML depends heavily on the facts and circumstances. Demonstrable efforts, documentation, and follow-up can play a significant role in this regard. Furthermore, the European Anti-Money Laundering Regulation (AMLR) will take effect on July 10, 2027. This regulation sets out more uniform and detailed requirements for, among other things, customer due diligence, monitoring, and the recording of compliance information. For example, organizations must be able to substantiate how risks were assessed, which controls were implemented, and the basis on which decisions were made. As a result, the ability to demonstrate compliance is becoming even more important.
In practice, this information is often scattered across Excel files, emails, meeting minutes, and separate documents. This makes it difficult to quickly provide insight to auditors, regulators, or the board.
With the Compliance Management Portal (CMP) , you can centrally record risks, findings, corrective actions, responsible parties, and follow-up. This creates a single overview of your compliance activities and allows you to demonstrate what steps have been taken and what results have been achieved.
Would you like to be able to demonstrate which compliance actions have been taken, which risks have been addressed, and who is responsible?
Request a no-obligation demo nd discover how CMP helps make compliance processes verifiable and manageable. Do you have a question first? Contact SCOPE to schedule an introductory meeting.
Experience it yourself: our solution in action
We would gladly demonstrate the functionality of the Compliance Management Portal. Complete the form to gain immediate access to the interactive demo.
By submitting this form, I give SCOPE Marketing Technology B.V. permission to contact me using the contact details I have provided. I confirm that I have read the privacy statement and agree to the processing of my personal data as described therein.
Frequently asked questions about director liability and AML
Is a director automatically liable in the event of an AML violation?
No. For personal criminal liability, it must be demonstrated that a director knowingly failed to take appropriate measures.
Can a director be prosecuted for an organization’s AML violations?
Yes. This is possible, for example, if a director was aware of the violations and knowingly failed to take appropriate measures.
Why is documentation important for AML compliance?
Documentation helps organizations demonstrate which risks have been identified, what measures have been taken, and how the follow-up was conducted.
How does CMP help demonstrate compliance?
CMP centralizes risks, findings, measures, and follow-up, making compliance activities transparent and verifiable.
