From Wwft to AMLR: the transition for flex office operators

The rules on compliance and customer verification are changing. For coworking spaces, flex office operators and corporate service providers (registered office providers) that are subject to customer due diligence (CDD) obligations, this is a logical moment to review existing processes.

Whereas the Wwft (Dutch Anti-Money Laundering and Anti-Terrorist Financing Act) currently forms an important part of the framework, the European AMLR introduces more directly applicable and harmonised rules. A large part of these will apply from 10 July 2027.

What is the Wwft and why is there an AMLR?

The Wwft is the Dutch act on the prevention of money laundering and terrorist financing. Among other things, it requires designated institutions to carry out customer due diligence, assess risks and report unusual transactions where applicable.

The AMLR is part of a broader European package. Its aim is to apply rules more consistently within the EU and to reduce differences between national regimes.

What stays essentially the same?

Identification and verification

Organisations subject to CDD obligations must know who they are doing business with. This may include the customer, directors and ultimate beneficial owners. Screening for PEP status, sanctions and relevant adverse media can also form part of the due diligence.

A risk-based approach

Not every customer requires the same depth. A risk-based approach helps to tailor measures to the customer’s profile and to record why a particular approach was chosen.

Monitoring and documentation

Customer due diligence does not always stop after onboarding. Relevant changes can give reason for a reassessment. A complete file shows which checks were carried out, which signals were assessed and who made the final decision.

Which changes require attention?

The AMLR contains stricter and further harmonised provisions on matters including ultimate beneficial owners, risk assessment, data collection and internal controls. How this works out in practice depends in part on whether it applies to the organisation and on further guidance.

For teams, this means that manuals, forms, risk models and work instructions must be reviewed in good time. Content is not the only thing that matters: it must also be clear who is responsible, how exceptions are handled and how decisions can be traced.

The role of technology

Digital identity verification, automated screening and ongoing monitoring can reduce manual work. Technology supports consistent execution, but the organisation remains responsible for policy, assessment and decision-making.

Practical preparation for 2027

1. Map out which services and entities within your organisation may fall under the AML framework.
2. Compare your current intake, checking and acceptance process with the expected requirements.
3. Check whether UBOs, directors, risks and decisions are recorded consistently.
4. Determine when reassessment and monitoring are needed.
5. Train employees on the process and on their own decision-making role.

Start with the process

The transition to the AMLR is not just a matter of new terminology. Above all, it is an opportunity to move from separate checks to a single auditable way of working. A central workflow can help with this, without suggesting that software can guarantee compliance on its own.