DNB fine shows why partner-led payments need customer-level visibility

On 5 October 2026, De Nederlandsche Bank (DNB) announced a €722,160 administrative fine against Modulr Finance B.V. (MFBV) for serious shortcomings in its anti-money laundering controls between 1 January 2023 and 16 July 2024. The enforcement action focused on the ongoing monitoring of customers and their transactions.

MFBV is an electronic money institution. According to DNB, a large part of its customer base was introduced through outsourcing partners, including crypto-asset platforms. Those partners enabled their users to open MFBV accounts and access IBANs and payment services. DNB found that the introduced users were also MFBV customers under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act, so the responsibility for ongoing monitoring remained with MFBV.

DNB found that customer risk and transaction profiles were not tailored to the individual customers. In practice, MFBV applied profiles created for the intermediary partner to customers introduced by that partner. In one example, alerts for certain customers were set to trigger only after 300 payments in a day or a transaction above €50,000. Internal transfers between MFBV accounts were not monitored, and indicators involving high-risk countries, non-resident customers and unusual transaction patterns were missing or inadequately covered.

The regulator also found that essential customer information often remained with the partners. MFBV did not always request or obtain enough information to investigate alerts properly, some alerts were closed using limited standard questions, and the rationale for closing or dismissing them was not documented. Of 12 selected customers whose 2023 transactions included amounts of €10,000 or more, DNB identified unusual behaviour in eight cases that MFBV had not detected, or had not detected in time.

The decision records substantial remediation. Before DNB began its investigation, MFBV had terminated or restricted relationships with three of the four partners examined. It later strengthened transaction monitoring, customer risk assessment, screening and oversight. MFBV accepted the findings and fine through a simplified settlement procedure and will not object to the decision.

The central KYB lesson is that due diligence on an intermediary partner cannot stand in for visibility into the customers actually using the service. In embedded-finance and partner-led payment models, the commercial relationship may sit with a platform while the regulated provider still has obligations toward each introduced customer.

For introduced businesses, that means maintaining a customer-level view of legal identity, ownership and control, business purpose, expected activity, relevant geographies and anticipated transaction behaviour. Applying one partner-level risk profile across a diverse portfolio removes the baseline needed to decide whether an individual customer’s activity is unusual.

Data access is therefore part of the control design. A partner may collect information or conduct first-line reviews, but the provider needs timely, structured access to the underlying evidence and must be able to test its quality. Contracts, service levels and escalation paths should define which data is supplied, how quickly material developments are shared and what happens when information is incomplete.

Transaction monitoring also needs to connect account activity to the correct customer and risk profile. Generic thresholds set at partner level can hide meaningful behaviour below each threshold, while incomplete coverage can leave internal transfers or aggregated patterns outside the review. Effective continuous monitoring should therefore connect partner risk, customer changes, transaction alerts and review outcomes rather than treating them as separate records.

This is as much an evidence architecture issue as a policy issue. A defensible workflow should show who performed each check, which source was used, what the provider received from the partner, how an alert was resolved and why the final decision was reasonable. Structured KYB workflows make those dependencies and gaps visible before a regulator has to reconstruct them from individual files.