Dutch Court of Audit Finds AML algorithms flag minority names

Tech Times reported that on March 11, 2026, the Dutch Court of Audit published a review finding that 61.8% of suspicious‑activity reports (SARs) examined involved a person with a foreign‑sounding surname in the country where the banks operate.

According to Tech Times, the Dutch Court of Audit’s examination included a total of 217 suspicious‑activity reports (SARs) that banks operating in the country had submitted.

During the calendar year 2020, Dutch banks submitted to the national Financial Intelligence Unit figures showing that nearly 250,000 transactions triggered alerts as unusual or potentially suspicious. By the end of 2024, the total number of such unusual transaction reports that Dutch banks had submitted to the same unit had increased to exceed 530,000.

In 2024, the eight largest banks active in the country each maintained teams devoted to anti‑money‑laundering (AML) compliance, together accounting for roughly 13,000 full‑time‑equivalent employees. The total expenditure incurred by these eight banks for their AML personnel and related activities in 2024 amounted to approximately €1.6 billion.

The Dutch Court of Audit stated that, after reviewing the data, it found no documented risk factor that could account for the disproportionate presence of foreign‑sounding names among the alerts that the banks’ monitoring systems generated. The audit further noted that this unexplained overrepresentation may indicate discriminatory outcomes in the banks’ anti‑money‑laundering processes.

Privacy First, a Dutch privacy advocacy group, warned that the forthcoming EU Anti‑Money Laundering Regulation (AMLR) risks embedding any existing algorithmic bias into the anti‑money‑laundering practices of banks throughout all 27 EU member states. Under the terms of the AMLR, banks must implement ongoing, algorithm‑driven monitoring of their customers’ financial behavior, with this requirement taking effect on July 10, 2027. Should the regulation apply in a uniform manner to all customer accounts, it has the potential to impact as many as 450 million individual accounts in the EU.

On July 6, 2026, De Nederlandsche Bank issued a fine of €8.5 million to ABN AMRO after identifying deficiencies in the bank’s ongoing monitoring procedures for customers classified as high‑risk. According to the provisions of the AMLR, serious shortcomings in a bank’s anti‑money‑laundering controls may result in penalties reaching as high as ten percent of the institution’s total annual turnover.

The regulatory framework does not provide an equal financial penalty for situations in which banks excessively monitor customers that banks have not identified as posing any risk. Likewise, there is no comparable sanction imposed on banks that generate reports which result in discriminatory outcomes against certain customer groups.

Privacy First has called on the EU’s Anti‑Money Laundering Authority (AMLA) to classify anti‑money‑laundering profiling tools as high‑risk artificial intelligence systems under the EU AI Act, insisting that such tools undergo a Fundamental Rights Impact Assessment before use. The EU AI Act officially entered into force in August 2024, and the specific requirements that apply to high‑risk AI applications became enforceable from August 2026 onward.

In June 2026, Amnesty International released a report titled “Automating Suspicion” in which it concluded that the use of automated systems for risk profiling violates established principles of international human rights law. Earlier in May 2026, the Dutch State Commission against Discrimination and Racism issued a recommendation that the use of data‑driven profiling techniques for the purposes of fraud detection and crime prevention should be suspended.

According to research conducted by the Bank Policy Institute, US law enforcement agencies proceeded with further action on only approximately four percent of the suspicious activity reports they received. The same study determined that between ninety and ninety‑five percent of the reports that prompted no enforcement action were ultimately determined to be false positives, meaning they did not correspond to actual illicit activity.