In a consultancy paper for the Dutch government, the Dutch non-governmental organisation Privacy First called for robust safeguards to be implemented alongside the new EU's anti-money laundering legislation (→eucrim 2/2024, 113 et seq.). In light of the planned implementation of the AML/CFT package in the Netherlands, Privacy First is particularly concerned about the involvement of private companies ("obliged entities") in the fight against money laundering and terrorist financing, in particular:

• Assigning unsuitable tasks to companies;
• The disproportionate costs incurred by obliged entities that are passed on to customers;
• The failure to respect the fundamental rights of citizens, and small and medium-sized enterprises (SMEs) and non-profit organisations.

According to Privacy First, safeguards must be improved during the implementation of the EU regulations. These include:

• Improved legal protection of consumers, SMEs, and non-profit organisations, including through the establishment of a financial ombudsman to handle all anti-money laundering complaints and low-threshold access to the independent courts;
• A secure channel for obliged entities to communicate about their customer due diligence;
• The inclusion of a requirement for any automated customer risk profiling to follow the principles of the EU AI Act, including a fundamental rights compliance assessment;
• An obligation for anti-money laundering supervisors, such as the Dutch central bank, to enforce compliance by obliged entities with data protection rules and respect for customers' fundamental rights;
• Periodic mandatory audits by independent auditors on compliance to ensure public authorities and larger obliged entities comply with data protection and fundamental rights legislation.

Through its paper, Privacy First also seeks to spark a public discussion on the privatisation of crime fighting, and calls on politicians to adjust rules, which provide inadequate protection for fundamental rights.