The Modulr fine: DNB penalises an e-money institution for leaving ongoing monitoring to its crypto platform partners

The Modulr fine is a 722,160 euro penalty from De Nederlandsche Bank on Modulr Finance B.V. for failing to monitor customers introduced by crypto platforms and other partners. The decision, published on 5 October 2026, finds that the e-money institution gave end users its partners' risk profiles and left the partners to investigate alerts it should have assessed.

• DNB fined Modulr Finance B.V. 722,160 euros for breaching Article 3(2)(d) Wwft, the Dutch ongoing monitoring duty, between 1 January 2023 and 16 July 2024.
• End customers were given partner-level risk profiles, and for one partner an alert only fired at 300 payments a day or a single transaction above 50,000 euros.
• In eight of twelve customers in DNB's transaction sample, unusual behaviour went undetected or was detected late; internal account-to-account transfers were not monitored at all.
• The penalty fell from 944,000 euros by 10% for remediation and 15% for a simplified settlement in which Modulr admitted the facts and waived appeal.

What did DNB find at Modulr Finance B.V.?

DNB found that Modulr Finance B.V., the Dutch e-money institution of the Modulr group, did not carry out its own ongoing monitoring of customers introduced by partner platforms. Its published decision states that "MFBV relied heavily on intermediary partners, including crypto-asset service providers" for that monitoring, which left the firm without sufficient insight into its own customer base.

The facts behind the Modulr fine are set out in the abbreviated fining decision, in Dutch. Modulr Finance B.V. has held a DNB e-money licence since 23 December 2021. The Modulr group is UK-based, with Modulr Finance Limited registered in England. Much of the Dutch entity's customer base arrived through what it called outsourcing partners, which DNB describes as mostly high-risk entities such as crypto exchange platforms, whose users opened a Modulr account with an IBAN the partner could not issue itself. Those end users are Modulr's customers under the Wwft, a point not disputed.

DNB notified Modulr of its investigation by letter on 30 April 2024, selected four partners, examined thirteen customer files and built the case on ten. A penalty report followed on 13 March 2026, notice of intention to fine on 18 May 2026 and Modulr's hearing on 29 June 2026. Under the AFM and DNB simplified settlement procedure Modulr admitted the facts, waived objection and appeal, and received a 15% reduction.

How did the partner model break ongoing monitoring?

The failure behind the Modulr fine had a single root: Modulr treated each partner as the unit of risk, not the end customer. It gave every introduced customer the profile it had built for the partner, and set detection thresholds to the partner's aggregate flow, not the individual behind it. Alerts, reviews and customer information sat with the partner.

The consequences ran through all four stages DNB examined. Profiles: DNB could not establish that any end-user profile was applied in either of Modulr's two monitoring systems, so there was no baseline for a deviation. Detection rules: for customers of one partner an alert required 300 payments in a day or a single transaction above 50,000 euros, and neither system monitored internal transfers between Modulr accounts. In a separate sample of twelve customers of two partners who moved 10,000 euros or more in 2023, eight showed unusual behaviour that was not detected, or not detected in time.

Alert handling: alerts that did fire were closed on a few standard questions with no documented reasoning, since the information needed sat with the partner. One corporate customer generated 70 alerts; two were investigated in autumn 2023 and the rest were closed in bulk. Reviews: partners blocked accounts and in some cases decided that fraud indicators were not reportable, without telling Modulr. Modulr reported several of those transactions to FIU-NL only between July and September 2024, after DNB had begun asking questions. The files include 280,000 euros received by one individual in under a year, a 150,000 euro credit moved on internally with no alert, and 50,000 euros split into ten onward payments the day it arrived.

The Modulr fine sits at the low end of recent DNB customer due diligence penalties centred on ongoing monitoring, which reflects the firm's size and early remediation, not the weight DNB gave a breach it called serious.

Zyphe covered the CCV decision and the ABN AMRO decision; the bunq figures come from DNB's enforcement page, which records bunq's appeal of 24 November 2025.

How was the 722,160 euro Modulr fine calculated?

DNB reached the Modulr fine in five stages, shown below. A breach of Article 3(2)(d) Wwft is a category 3 offence, with a 2.5 million euro base and a 5 million cap for an e-money institution. Group turnover triggered the turnover regime, and steps 5 and 6 of DNB's fine policy, then the settlement discount, produced the final figure.

Article 32(1) Wwft replaces the cap with up to 20% of the previous year's net turnover where that 20% exceeds 10 million euros, twice the statutory maximum, measured on group consolidated accounts. The regime lifts the ceiling, but DNB's general fine policy still scales the base amount to the offender's own size, which is how a group subsidiary ended below the 2.5 million euro base; the abbreviated decision omits the intermediate figures. Step 5 weighs the offender's size by its highest capital requirement in the fourth quarter of 2025: 944,000 euros. Step 6, the proportionality test, took 10% off for measures Modulr had taken, some before the investigation began: ending or restricting three of the four partner relationships, tightening its risk appetite and rebuilding monitoring and partner oversight. DNB judged 849,600 euros proportionate, and the settlement removed a further 15%.

What does the Modulr fine change for your obligations?

The Modulr fine confirms that the duty of ongoing monitoring attaches to whoever holds the business relationship, and that a contract requiring a partner to monitor does not transfer it. For e-money and payment institutions that distribute accounts through platforms, the decision maps onto three Wwft provisions today and onto the EU AML Regulation from 10 July 2027.

Under Article 3(2)(d) Wwft the institution must exercise continuous control over the relationship and its transactions against its own knowledge of the customer's risk profile, with source-of-funds enquiries where needed. DNB reads that as a per-customer profile, detection rules calibrated to it, documented alert assessment and periodic or event-driven reviews. Article 10(1) Wwft lets an institution have parts of customer due diligence performed by a third party "onverminderd haar verplichting" to comply, but the parts it lists are Article 3(2) a, b, c, e and f: ongoing monitoring under (d) is not delegable by statute, and the decision adds that only intra-group arrangements escape that. Article 16(1) Wwft requires an unusual transaction to be reported to FIU-NL "onverwijld", without delay, once its unusual nature is known, as the late 2024 reports in the Modulr files illustrate.

The EU regulation hardens each duty the Modulr fine enforces. Article 26 of Regulation (EU) 2024/1624 requires ongoing monitoring of transactions "throughout the course of a business relationship" against the entity's own knowledge of the customer. Article 18 permits outsourcing but the obliged entity "shall remain fully liable for any action" connected to the task, and under Article 48(1) ultimate responsibility for due diligence "shall remain with the obliged entity" when it relies on another one. Article 90 applies the regulation from 10 July 2027. AMLA's draft customer due diligence standards and its consultation on ongoing monitoring will set the detail. A partner that is itself a crypto-asset service provider owes its own duties: a two-layer model adds a second obliged entity without removing the first one's obligations.

What is still uncertain after the Modulr fine?

Three questions stay open after the Modulr fine, and each carries cost for firms running a partner model: who bears the loss when a partner's investigation fails, how much customer data the account provider must hold to monitor on its own, and whether DNB's reading will be applied to every embedded finance structure in the EU.

On liability, DNB found the partners' own reviews deficient: one declined to report despite a customer refusing to explain the source of funds, and another decided fraud was not reportable. The decision penalises Modulr for relying on that work but says nothing about the partners, which answer to their own supervisors; whether a contractual indemnity for a supervisory penalty is enforceable is untested here.

On data, independent monitoring requires the account provider to hold enough about each end user to build a profile and judge an alert. That means more personal data flowing from platform to institution and a larger breach surface. The Modulr fine does not say how to reconcile data minimisation with the depth of knowledge DNB expects.

On scope, the Modulr fine concerns one Dutch e-money institution and four partners, and it was settled rather than litigated, so no court has ruled on where permitted outsourcing ends and prohibited delegation begins. Other EU supervisors apply the same directive through different national texts until July 2027, so readings may differ by market until then. Thresholds remain a trap: several Modulr transactions stayed below 50,000 euros and were split into small onward payments, so size-only alerting will keep missing them.

How should compliance teams respond?

Teams running accounts through partner platforms should treat the Modulr fine as a checklist for their own model, starting with whether a risk and transaction profile exists for each end user rather than for the partner. The next test is whether alerts can be assessed with information the institution holds, and whether partner reviews and reports reach it unprompted.

Rebuild profiles at end-user level and calibrate detection rules to the expected behaviour of an individual or small business, not a platform's aggregate flow. Add rules for internal account-to-account transfers and for structuring below thresholds, both gaps seen in the Modulr files. Require partners to notify blocks, reviews and suspicions within a set deadline, and log what you requested and received for every alert. Reassess partner relationships against your own risk appetite: the remediation package, which included ending or restricting three of four partner relationships, some of them before DNB's investigation began, earned Modulr a 10% reduction. Finally, give each duty in the transaction monitoring requirements a named owner.

Zyphe's AML software gives account providers screening and risk signals on every end user, as verification results and proofs rather than document copies, with no central store of customer PII. If you distribute accounts through partners and need your own verified knowledge of every end user, book a demo.

The bottom line

The Modulr fine is a ruling on architecture, not on a single missed alert. An account provider that lets partner platforms hold the customer knowledge, run the reviews and decide what is reportable has no ongoing monitoring of its own, whatever its contracts say, and DNB has now priced that model. Teams should hold their own profile and evidence for every end user, and treat partner information as an input to their judgement, not a substitute for it.

Cited sources

• DNB, Administrative fine imposed on Modulr Finance B.V. for inadequate customer due diligence, published 5 October 2026
• DNB, Verkort boetebesluit Modulr Finance B.V., abbreviated fining decision (PDF, Dutch)
• Wwft, Article 3, customer due diligence including ongoing monitoring
• Wwft, Article 10, outsourcing of customer due diligence
• Wwft, Article 16, reporting of unusual transactions
• Wwft, Article 31, fine categories and statutory maximum
• Wwft, Article 32, turnover-based maximum fine
• Regulation (EU) 2024/1624, the AML Regulation, Articles 18, 26, 48 and 90
• DNB, Algemeen boetetoemetingsbeleid, general fine policy (PDF, Dutch)
• Modulr Finance Limited (registered in England), press release on the Dutch e-money licence, 25 January 2022
• DNB, Boete voor bunq B.V. wegens onvoldoende cliëntenonderzoek, decision 6 May 2025, published 25 August 2025
• DNB, Fine for ABN AMRO Bank N.V. for inadequate customer due diligence for high-risk customers, decision 6 July 2026, published 9 July 2026
• DNB, Boete aan CCV wegens tekortkomingen cliëntenonderzoek, decision 2 March 2026, published 13 July 2026