The report below examines how the Financial Intelligence Unit Netherlands uses the Bank Data Referral Portal, specifically the internal controls on queries and authorizations in the second half of 2024. The researchers conclude that work instructions and internal controls do exist, but are not fully formalized, that documentation in files is incomplete (including missing response messages and search criteria), and that not all relevant parties, such as the data protection officer, are being reported to. The report makes several recommendations to formalize work instructions, improve file creation, systematically check all authorizations, and strengthen reporting lines (including to the DPO).
