Dutch neobank bunq has been fined €2.6 million by the Dutch Central Bank for serious shortcomings in anti-money laundering (AML) controls. Regulators identified failings in high-risk customer monitoring, alert investigation, and consistency in suspicious transaction reporting.
The review covered activity from January 2021 to May 2022, but the fine reflects broader concerns: repeated audits had shown weaknesses, and prior remediation did not prove sustainable. Bunq has filed an objection, emphasizing its use of advanced technology and ongoing improvements.
This fine matters because it signals a new baseline for compliance in fintech. Regulators across Europe are treating digital-first banks with the same rigor as incumbents, and in many cases, with less patience for repeated lapses.
What Went Wrong At Bunq
The regulator highlighted three critical weaknesses:
- Alert handling lacked depth: Suspicious activity flagged by monitoring systems was not investigated thoroughly.
- Inconsistent reporting logic: Transactions with similar red flags were escalated in some cases but not others, without documented rationale.
- Weak oversight of high-risk customers: Ongoing monitoring of high-risk files did not demonstrate that bunq understood or mitigated their risks effectively.
This was not an isolated failure. Bunq had previously faced regulatory scrutiny, but fixes did not last. The penalty underscores a growing regulatory expectation: AML frameworks must be both effective and sustainable.
Why This Fine Matters
The bunq case highlights three broader truths about modern financial crime compliance:
- Sustained compliance is non-negotiable
Regulators are looking for long-term stability, not one-off fixes. Even when remediation programmes are completed, examiners will return to test whether improvements are lasting. - Technology alone is not enough
Bunq has promoted itself as a tech-first bank, but regulators made it clear that automation or AI tools cannot replace human oversight, clear documentation, and accountability. - Fintechs are now treated like incumbents
Fast growth no longer excuses weak AML frameworks. Regulators are holding challenger banks to the same standards as traditional financial institutions, and in some cases with heightened expectations.
Recent Enforcement Across Europe
Bunq’s fine fits a broader pattern of escalating enforcement actions:
- Switzerland – J. Safra Sarasin was fined for failures tied to historic laundering risks connected to Brazil’s Operation Car Wash and separately reached a multimillion settlement with Petrobras.
- Belgium – ING Belgium came under renewed investigation for money laundering lapses, cooperating with authorities amid pressure to demonstrate improved oversight.
- Lithuania – Revolut was fined €3.5 million for deficiencies in monitoring customer relationships and transactions, demonstrating that even pan-European fintechs are not exempt.
- United Kingdom – Starling Bank faced penalties approaching £29 million in 2024 for sanctions screening weaknesses and poor onboarding controls for high-risk clients.
Enforcement At A Glance
| Institution | Country | Year/Date | Issue Summary | Penalty |
|---|---|---|---|---|
| Bunq | Netherlands | Aug 2025 | Failures in monitoring high-risk files, inconsistent suspicious reporting | €2.6m |
| J. Safra Sarasin | Switzerland | Aug 2025 | Failures tied to Operation Car Wash; Petrobras settlement | 3.5m CHF + settlement |
| ING Belgium | Belgium | Aug 2025 | Ongoing AML investigation; cooperation with authorities | — |
| Revolut | Lithuania | Apr 2025 | Deficiencies in transaction and relationship monitoring | €3.5m |
| Starling Bank | UK | 2024 | Sanctions screening and onboarding control weaknesses | £28.96m |
Embedding AML Into Business Strategy
Bunq’s case shows that firms cannot treat AML as a side process. Digital banks, in particular, must build compliance into the business model from the start. Every new product launch, customer onboarding flow, or market expansion carries financial crime risks. Without a compliance-first design, even advanced technology will miss red flags.
Embedding AML into strategic decisions ensures that innovation and risk management evolve in tandem. Growth that outpaces compliance creates vulnerabilities regulators will not tolerate.
Strengthening Suspicious Activity Reporting
A key issue for bunq was inconsistent reporting of suspicious transactions. Regulators expect standardized decision-making backed by thorough documentation. Firms need clear playbooks so that investigators treat similar cases consistently and record the reasoning behind each decision.
Internal audits of suspicious activity reporting, therefore, should consistently test for alignment across different cases to ensure uniform decision-making. Moreover, by making reporting processes more systematic and transparent, institutions can not only reduce regulator criticism but also reinforce trust. In turn, this approach helps demonstrate a strong and sustainable culture of accountability throughout the organization.
Managing High-Risk Customers
High-risk customers demand more than one-time enhanced due diligence. They require continuous, structured monitoring. Bunq’s case showed that weak oversight of such files is a regulatory red line.
Fintechs, therefore, need to ensure they have sufficient staffing, robust systems, and the right expertise to manage these complex relationships effectively. In addition, reviews should be refreshed on a regular basis so that risk assessments remain current and relevant. Furthermore, monitoring must continually adapt as customer behavior evolves or as global risk factors shift. As a result, regulators increasingly expect that high-risk customers will be treated as an ongoing compliance obligation rather than a static, one-time classification.
Documentation And Audit Trails
Regulators criticized bunq for failing to justify why it treated similar transactions differently. This criticism highlights the broader regulatory emphasis on auditability and reinforces the expectation that firms must support every decision with clear and consistent documentation.
Every AML investigation should leave a detailed record explaining:
- What triggered the review.
- What information was gathered.
- Why a decision was taken to escalate or close.
- Who was responsible for the decision.
Audit trails demonstrate that decisions are consistent, traceable, and accountable—qualities regulators value as much as the outcomes themselves.
From Remediation To Sustainability
The bunq fine reinforces a critical point: remediation must stick. Temporary fixes designed to pass an audit are not enough. Regulators return to test whether changes are embedded and effective over time.
Firms must design compliance programmes for long-term resilience by:
- Conducting regular scenario testing and stress checks.
- Reviewing historical remediation to ensure progress hasn’t eroded.
- Escalating compliance updates to board level for visibility and accountability.
Global Lessons For Fintechs
The bunq decision echoes other high-profile actions in Lithuania, Switzerland, Belgium, and the UK. The collective message is simple: no bank is too digital, too new, or too innovative to escape scrutiny.
Fintechs must accept that AML is not optional or secondary—it is a strategic pillar. Companies that embrace this reality can build trust, scale sustainably, and compete on both innovation and integrity.
Seven Strategies To Strengthen AML Compliance
1. Build Compliance Into The Business Model
AML should be a strategic pillar, shaping every new product, market entry, and customer segment decision.
2. Prioritize High-Risk Customer Monitoring
Dedicated teams must oversee high-risk files, refresh profiles regularly, and document findings for regulators.
3. Standardize Suspicious Activity Reporting
Consistency matters. Clear playbooks ensure investigators apply uniform logic when filing or closing suspicious activity reports.
4. Invest In Scalable Technology
Monitoring tools must grow with customer volumes and adapt to emerging risks without generating overwhelming false positives.
5. Combine AI With Human Oversight
Automation is valuable, but human investigators must validate, interpret, and escalate machine-generated alerts responsibly.
6. Strengthen Governance And Accountability
Boards and executives must receive regular AML reports, challenge assumptions, and allocate adequate resources.
7. Prove Remediation Is Sustainable
Track and evidence progress through reduced backlogs, improved QA results, and consistent reporting—regulators demand proof, not promises.
A 90-Day Roadmap To Strengthen AML
Days 1–30: Baseline Review
- Audit high-risk files and clear alert backlogs.
- Assess staffing capacity against case volumes.
Days 31–60: Strengthening Controls
- Refresh risk assessments with updated typologies.
- Adjust monitoring thresholds and document changes.
- Implement QA checks for consistency in investigations.
Days 61–90: Governance And Evidence
- Establish formal oversight of AML models and systems.
- Create change logs for system updates.
- Deliver compliance reports to the board to demonstrate accountability.
FAQ: Bunq And AML Compliance
Why was bunq fined?
Because it failed to properly monitor high-risk customer files, investigate suspicious alerts, and apply consistent reporting practices.
Has bunq appealed?
Yes. The bank has lodged an objection and says it continues to strengthen its compliance framework.
Why are AML fines rising in Europe?
Regulators want evidence of lasting compliance. Repeat findings or incomplete fixes often lead to higher penalties.
What role does AI play in AML compliance?
AI can support efficiency, but regulators require transparency, validation, and human oversight. Machines cannot replace accountability.
What can other fintechs learn?
Embed compliance into strategy, scale systems with growth, maintain strong documentation, and treat AML as central to business success.
Conclusion
The €2.6 million fine against bunq is not just about one bank; rather, it serves as a warning to the entire fintech industry. Consequently, regulators now expect compliance frameworks to be resilient, transparent, and scalable. Moreover, innovation without strong governance has become unsustainable, which means firms that embed AML as a strategic pillar will ultimately outlast those that do not.
Looking ahead, bunq faces both the challenge of its appeal and the responsibility of ongoing system improvements. At the same time, for fintechs and digital banks more broadly, the lesson is equally clear: compliance is no longer merely a cost of doing business; instead, it has become a true competitive advantage.
