Dutch neobank bunq has been fined €2.6 million by the Dutch Central Bank for serious shortcomings in anti-money laundering (AML) controls. Regulators identified failings in high-risk customer monitoring, alert investigation, and consistency in suspicious transaction reporting.
The review examined activity from January 2021 through May 2022, but regulators imposed the fine based on broader concerns. Repeated audits had already identified weaknesses, and bunq failed to demonstrate that earlier remediation efforts were sustainable. In response, bunq has filed an objection and highlighted its use of advanced technology and ongoing improvement initiatives.
This fine matters because it establishes a higher baseline for compliance expectations in the fintech sector. Regulators across Europe now apply the same level of scrutiny to digital-first banks as they do to incumbents, and they show less tolerance for repeated compliance lapses.
For organizations in highly regulated industries, this case demonstrates why AML and financial crime compliance must be treated as core business priorities.
What Went Wrong At Bunq
The regulator highlighted three critical weaknesses:
- Alert handling lacked depth: Suspicious activity flagged by monitoring systems was not investigated thoroughly.
- Inconsistent reporting logic: Transactions with similar red flags were escalated in some cases but not others, without documented rationale.
- Weak oversight of high-risk customers: Ongoing monitoring of high-risk files did not demonstrate that bunq understood or mitigated their risks effectively.
This failure did not occur in isolation.
Regulators had already scrutinized bunq in the past, yet the bank failed to sustain effective remediation.
The penalty reinforces a clear regulatory expectation that AML frameworks must deliver lasting effectiveness, not temporary fixes.
Why This Fine Matters
The bunq case highlights three broader truths about modern financial crime compliance:
- Sustained compliance is non-negotiable
Regulators are demanding lasting improvementsshort-term remediation is no longer sufficient. According to the European Banking Authority, firms must demonstrate that controls remain effective over time. - Technology alone is not enough
Bunq has promoted itself as a tech-first bank, but regulators made it clear that automation or AI tools cannot replace human oversight, clear documentation, and accountability. - Fintechs are now treated like incumbents
Rapid growth is no longer an excuse. Digital-first banks are subject to the sameand sometimes stricterregulatory scrutiny as traditional institutions. Similar enforcement has been seen in the UK’s Financial Conduct Authority (FCA) crackdowns.
Recent Enforcement Across Europe
Bunq’s fine fits a broader pattern of escalating enforcement actions:
- Switzerland – J. Safra Sarasin was fined for failures tied to historic laundering risks connected to Brazil’s Operation Car Wash and separately reached a multimillion settlement with Petrobras.
- Belgium – ING Belgium came under renewed investigation for money laundering lapses, cooperating with authorities amid pressure to demonstrate improved oversight.
- Lithuania – Revolut was fined €3.5 million for deficiencies in monitoring customer relationships and transactions, demonstrating that even pan-European fintechs are not exempt.
- United Kingdom – Starling Bank faced penalties approaching £29 million in 2024 for sanctions screening weaknesses and poor onboarding controls for high-risk clients.
This trend shows regulators’ unified stance: AML enforcement is accelerating, and fintechs are firmly in the spotlight.
Enforcement At A Glance
| Institution | Country | Year/Date | Issue Summary | Penalty |
|---|---|---|---|---|
| Bunq | Netherlands | Aug 2025 | Failures in monitoring high-risk files, inconsistent suspicious reporting | €2.6m |
| J. Safra Sarasin | Switzerland | Aug 2025 | Failures tied to Operation Car Wash; Petrobras settlement | 3.5m CHF + settlement |
| ING Belgium | Belgium | Aug 2025 | Ongoing AML investigation; cooperation with authorities | |
| Revolut | Lithuania | Apr 2025 | Deficiencies in transaction and relationship monitoring | €3.5m |
| Starling Bank | UK | 2024 | Sanctions screening and onboarding control weaknesses | £28.96m |
Embedding AML Into Business Strategy
The bunq case reinforces the need to embed AML directly into the business model rather than treating it as an afterthought. For fintechs and digital-first banks, this approach requires integrating AML considerations into product design, growth strategies, and day-to-day operations from the outset, this means:
- Designing onboarding flows that integrate compliance controls.
- Incorporating AML risk assessments into product launches and market entries.
- Ensuring compliance evolves alongside customer growth and geographic expansion.
Riddle Compliance offers risk-based auditing and monitoring for healthcare and financial institutions, which parallels the type of structured oversight fintechs must adopt.
Strengthening Suspicious Activity Reporting
A key issue for bunq was inconsistent reporting of suspicious transactions. Regulators expect standardized decision-making backed by thorough documentation. Firms need clear playbooks so that investigators treat similar cases consistently and record the reasoning behind each decision.
Internal audits of suspicious activity reporting should test for alignment across cases. By making reporting processes more systematic, institutions reduce regulator criticism and demonstrate a strong culture of accountability.
Managing High-Risk Customers
High-risk customers require more than one-time enhanced due diligence, as effective oversight depends on continuous and structured monitoring that evolves with changing risk exposure. Bunq’s case made this expectation clear by demonstrating that regulators view weak oversight of high-risk files as a serious compliance failure.
Fintech firms must ensure they maintain adequate staffing, capable systems, and specialized expertise to manage these relationships effectively. Compliance teams should refresh reviews regularly and adjust monitoring as customer behavior or global risk factors change, since regulators now expect firms to treat high-risk customers as an ongoing compliance responsibility rather than a static classification.
For organizations navigating similar challenges, outsourcing can provide reliefsee Riddle’s outsourced fractional CCO services for expertise without permanent overhead.
Documentation And Audit Trails
One of the key criticisms in the bunq case focused on the bank’s failure to clearly justify why it treated similar transactions differently. This issue highlights a broader regulatory emphasis on auditability, where firms must demonstrate consistent decision-making supported by clear reasoning and documented controls.
Every AML investigation should leave a detailed record explaining:
- What triggered the review.
- What information was gathered.
- Why a decision was taken to escalate or close.
- Who was responsible for the decision.
Audit trails demonstrate that decisions are consistent, traceable, and accountablequalities regulators value as much as the outcomes themselves.
From Remediation To Sustainability
The fine of bunq reinforces a critical point: remediation must stick. Temporary fixes designed to pass an audit are not enough. Regulators return to test whether changes are embedded and effective over time.
Firms must design compliance programmes for long-term resilience by:
- Conducting regular scenario testing and stress checks.
- Reviewing historical remediation to ensure progress hasn’t eroded.
- Escalating compliance updates to board level for visibility and accountability.
Riddle Compliance provides annual compliance oversight programs designed to measure progress and strengthen resilience.
Global Lessons For Fintechs
Regulators across Lithuania, Switzerland, Belgium, and the United Kingdom have reinforced the message delivered by the bunq decision.
They have shown that digital business models, rapid growth, or market novelty do not shield banks from scrutiny.
Fintech firms must recognize AML as a core business requirement, not a secondary compliance task.
Leadership teams that take ownership of AML responsibilities build trust with regulators and customers.
This commitment enables firms to scale responsibly while competing on both operational strength and integrity.
Seven Strategies To Strengthen AML Compliance
1. Build Compliance Into The Business Model
AML should be a strategic pillar, shaping every new product, market entry, and customer segment decision.
2. Prioritize High-Risk Customer Monitoring
Dedicated teams must oversee high-risk files, refresh profiles regularly, and document findings for regulators.
3. Standardize Suspicious Activity Reporting
To promote consistency, provide clear playbooks so investigators apply the same logic when filing or closing suspicious activity reports.
4. Invest In Scalable Technology
Monitoring tools must grow with customer volumes and adapt to emerging risks without generating overwhelming false positives.
5. Combine AI With Human Oversight
Automation delivers value; however, human investigators are still vital to validate, interpret, and responsibly escalate machine-generated alerts.
6. Strengthen Governance And Accountability
Boards and executives must receive regular AML reports, challenge assumptions, and allocate adequate resources.
7. Prove Remediation Is Sustainable
Track and evidence progress through reduced backlogs, improved QA results, and consistent reportingregulators demand proof, not promises.
A 90-Day Roadmap To Strengthen AML
Baseline Review: Days 1–30
- Conduct an audit of high-risk files and work through outstanding alert backlogs.
- Evaluate staffing capacity in relation to current case volumes.
Strengthening Controls: Days 31–60
- Introduce quality assurance checks to ensure investigations remain consistent.
- Update risk assessments with the latest typologies.
- Modify monitoring thresholds as needed and document the rationale behind changes.
Governance and Evidence: Days 61–90
- Put formal oversight in place for AML models and systems.
- Maintain change logs to track system updates.
- Present compliance reports to the board as evidence of accountability.”
FAQ: Bunq And AML Compliance
Why was bunq fined?
For failing to monitor high-risk customers, inconsistently investigating suspicious alerts, and lacking standardized reporting.
Has bunq appealed?
Yes. The bank has lodged an objection and says it continues to strengthen its compliance framework.
Why are AML fines rising in Europe?
Regulators want evidence of lasting compliance. Repeat findings or incomplete fixes often lead to higher penalties.
What role does AI play in AML compliance?
AI boosts efficiency, yet regulators demand human oversight and transparencyaccountability remains a human responsibility.
What can other fintechs learn?
Embed compliance into strategy, scale systems with growth, maintain strong documentation, and treat AML as central to business success.
Conclusion
The €2.6 million fine imposed on bunq goes beyond a financial penalty and serves as a clear warning to the broader fintech sector. It underscores how regulators are responding more decisively to AML failures and related control weaknesses.
Fintech firms are now expected to maintain AML frameworks that are resilient, transparent, and capable of scaling alongside rapid growth.
For bunq, the challenge lies in proving sustainable remediation. For other fintechs, the lesson is clear: AML compliance is not simply a regulatory requirementit is a long-term business advantage.To learn how your organization can strengthen its AML strategy, explore Riddle’s financial crime compliance solutions or contact our compliance experts.
