Identity verification for Wwft client due diligence.
ID Scan supports organizations with the identification and verification of natural persons. The verification result can be configured around the information that is relevant for the Wwft, while avoiding unnecessary retention of identity documents and biometric data.
What does the Wwft require?
Client due diligence is broader than checking an identity document. Depending on the client and risk, a Wwft-obliged organization must identify and verify the client, determine and verify the UBO where applicable, understand the purpose and intended nature of the relationship, assess risks and monitor the relationship. ID Scan supports the identity-verification part of that process; the organization remains responsible for the complete client due diligence.
Identify
Establish who the client is and collect the information required for your client file.
Verify
Verify the identity using a suitable identity document and record how that verification was performed.
Risk based
Apply normal, simplified or enhanced due diligence according to the applicable risk. Identity verification is one part of that assessment.
Source: BFT specific Wwft guidance for accountants, tax advisers and administration offices (2024)
What should be recorded for a natural person?
Article 33 Wwft requires the documents and data used for client due diligence to be recorded in an accessible manner. For the identity document used to verify a natural person, the law specifically names the type, number, date and place of issue.
Source: Wwft, article 33 - retention of evidence and client due diligence data
Our recommended Wwft verification template
For a Wwft-oriented template we recommend requesting what is needed to perform and evidence the identity verification, without automatically retaining every available data field or image.
Recommended in the verification result
- Name and date of birth required for the client file
- Document type, document number, date of issue and place of issue
- Document validity and the result of NFC chip and authenticity checks
- Where used: the result of the 1-to-1 face comparison
- Verification date, status and an auditable digitally sealed report
Do not request by default
- A stored selfie when only the verification result is needed
- The portrait from the NFC chip when it does not need to be retained
- Front and back document images solely because they are available
- BSN unless your organization has a separate lawful need to process it
Our principle: verify more, retain less.
NFC verification: verify the document, not just the text
Where a supported electronic identity document is used, ID Scan reads the NFC chip and performs cryptographic document checks. This allows document data to be compared with protected chip data and provides stronger evidence than manually copying visible fields or relying only on a photograph of the document.
The result can be included in the digitally sealed verification report so that the organization can demonstrate how the identity was verified.
A Wwft file does not automatically require a stored copy of the identity document
For Wwft client due diligence, the important distinction is between verifying identity and retaining the evidence afterwards. Article 33 Wwft specifies which identity and document data must be recorded. A full copy of the identity document is not automatically required when the required data and the way in which the identity was verified are recorded appropriately.
For remote verification, a photograph or scan of an identity document is often used to assess the document and a separate step may be used to link the document to the person. ID Scan performs those checks differently: the electronic document is verified using its NFC chip and, where enabled, a live selfie is compared 1-to-1 with the official portrait from that verified chip. This enables the identity verification to be completed remotely without relying solely on a stored document copy, video call or physical meeting.
Our advice: use the identity document to verify the client, but do not retain the complete document image merely because it was available during verification. Retain the Wwft data and verification evidence your organization actually needs.
1-to-1 face verification and biometrics
When identity verification is required as part of Wwft client due diligence, ID Scan can perform 1-to-1 facial authentication by comparing a live selfie with the official portrait from the verified NFC chip. This answers one specific question: is the person performing the verification the same person as the holder of the verified identity document? The comparison takes place locally on the user's device and does not search for the person in a biometric database.
The Dutch Data Protection Authority describes 1-to-1 facial comparison as authentication and explains that biometric processing used to confirm identity falls under the rules for biometric authentication. In ID Scan the selfie and chip portrait are used for this 1-to-1 check on the device; they do not need to become part of the client file. The verification result can be recorded instead. Biometric processing for other purposes must be assessed separately.
Source: Dutch Data Protection Authority - Identification at financial institutions
Source: Dutch Data Protection Authority - Biometrics and 1-to-1 authentication
Retention: distinguish verification from storage
Article 33 Wwft provides a five-year retention period for the required client due diligence data after the business relationship ends or after the relevant transaction. That does not mean every intermediate image or biometric source must automatically be retained for five years. Configure the ID Scan template around the information your organization actually needs to retain and export the required evidence to your own client file.
Article 34a Wwft also limits further use of personal data collected under the Wwft and requires destruction after the statutory retention period unless another statutory rule applies.
Dutch documents and “place of issue”
Dutch passports and identity cards show an issuing authority rather than a separate physical office location. ID Scan retains the original issuing-authority value and can normalize recognized Dutch municipal authorities to the municipality name for the place-of-issue field. RvIG documentation also distinguishes municipality codes and issuing authorities in Dutch document registrations.
This normalization is an ID Scan implementation choice based on the document information and RvIG reference data. It should not be read as a legal interpretation by RvIG or a Wwft supervisory authority.
ID Scan supports the process - your organization remains responsible
ID Scan is a technical tool for identity verification and evidence. It does not determine whether a client must be accepted, which risk classification applies, whether enhanced due diligence is required, who the UBO is, or whether a transaction must be reported. Those decisions remain with the Wwft-obliged organization.
Sources and further reading
Wwft - official legislationBFT - Specific guidance for accountants, tax advisers and administration officesDutch Tax Administration - Client due diligence for the WwftDutch Data Protection Authority - Identification at financial institutionsDutch Government - Recording identity data without automatically retaining a copyDutch Supreme Court - ECLI:NL:HR:2026:392 (13 March 2026)RvIG - Handleiding UitvoeringsproceduresHertoghs advocaten - Wwft and GDPR obligationsThis page is informational and does not constitute legal advice. Applicable obligations depend on your organization, professional group, client, service and risk assessment.
Configure a privacy-conscious Wwft verification flow
Use templates to request only the information your process needs and integrate the verified result into your own client file.