No one was watching the rails.

A payments firm that borrowed its own eyes

On 30 September 2026, De Nederlandsche Bank imposed an administrative fine of €722,160 on Modulr Finance B.V., a licensed electronic money institution, for failing to adequately monitor its clients and their transactions between 1 January 2023 and 16 July 2024. DNB set the fine at €849,600 and reduced it by fifteen percent under a simplified settlement. Modulr acknowledged the findings, accepted the fine, and agreed not to appeal. The breach was of a single provision of the Dutch Anti-Money-Laundering and Anti-Terrorist-Financing Act, the Wwft, that requires ongoing monitoring of business relationships and transactions.

Modulr is a payments business of the modern kind. Rather than onboarding and serving end-customers directly, it distributes accounts and payment rails through partners, which DNB calls outsourcing service providers, or OSPs. Those partners refer the customers, hold much of the information about them, and in many cases run the first line of review. Among them, DNB notes, were high-risk entities such as crypto-exchange platforms. It is the embedded-finance model that now sits behind a large share of fintech: the regulated institution provides the licence and the pipes, and partners provide the customers.

The trouble is what Modulr let travel with the customers. It leaned on those partners not just for distribution but for the AML watch itself, and it assigned its clients the same risk and transaction profiles it had given the referring partners, then did not really use even those. The result was a regulated firm that, in DNB's words, lacked an independent information position from which it could meet its own statutory duties. The eyes it was supposed to keep on its own payment flows belonged, in practice, to someone else.

What DNB found in the files

The legal hook is narrow and the facts are concrete. Article 3(2)(d) of the Wwft requires a firm to conduct ongoing monitoring of its business relationships and the transactions carried out within them, and DNB is explicit that this duty may not be outsourced. Modulr remained responsible for it regardless of how much of the operational work its partners performed. DNB found that it had not discharged that duty, and pointed to a chain of specific weaknesses to show why.

Start with the profiles. Modulr did not build individual risk and transaction profiles for its clients. Instead it gave each client the same profile it had assigned to the OSP that referred it, and then did not use those profiles in its monitoring at all, so there was no working link between the initial risk assessment and the surveillance that was meant to flow from it. On top of that sat monitoring systems that DNB found poorly configured. For clients introduced through one partner, an alert fired only if more than 300 payments were made in a day or a single transaction exceeded €50,000. Those thresholds were very high and were not justified by the expected behaviour of the clients, so sizeable and potentially unusual transactions could pass without triggering anything. Neither system monitored internal account-to-account transfers between clients' Modulr accounts at all, which is how a payment of more than €150,000 on 13 September 2023 moved onward with no alert.

The consequences showed up in the sample. In eight of twelve customer files DNB examined, unusual transaction behaviour was present that Modulr did not detect, or did not detect in time. Very large one-off amounts arrived without clarity about their origin, and the firm conducted little or no investigation. Where alerts did fire, the handling was thin: reviews ran off a short list of standard questions, documentation for closing or disregarding alerts was absent, and in one partner's file a large number of alerts were closed in bulk with no demonstrated investigation and no recorded justification. Reports of unusual transactions reached the Dutch FIU only in July, August, and September 2024, at least one of them, DNB notes, apparently only after the regulator's investigation had begun. The findings touch risk profiling, customer and enhanced due diligence, transaction monitoring, alert handling, outsourcing oversight, and country-risk coverage, but they all orbit the same failure: the firm was not independently watching its own flows.

The blind spot built into the model

Embedded finance works by splitting a bank into parts. One firm holds the licence and the regulatory duties; others own the customer relationship and the product experience. That division is efficient and legitimate, but it creates a specific temptation: because the partner is closest to the customer, it feels natural to let the partner also do the watching. DNB's decision is a clean statement of where that logic breaks. Distribution can be shared. Monitoring responsibility cannot. The moment a licensed firm treats a partner's review as a substitute for its own, rather than an input to it, it has given away something the law does not let it give.

The borrowed-profile finding is the mechanism that made this concrete. A transaction-monitoring system is only as good as the expectation it compares activity against. If a client inherits the profile of the partner that referred it, the system is measuring that client against the wrong baseline, one built for an aggregator rather than an individual. And if the profiles are not even fed into monitoring, there is no baseline at all, just raw thresholds. That is why the €50,000 and 300-payment triggers matter so much. With no customer-specific expectation behind them, those numbers were the entire defense, and they were set high enough that ordinary unusual activity slipped underneath.

Two coverage gaps then did the rest. The first is aggregation: large sums arriving as multiple smaller transactions never breached a per-transaction threshold, so they never alerted, a classic structuring blind spot that any monitoring system has to close by summing activity over time. The second is the internal-transfer hole. A payments firm whose customers hold multiple accounts on its own platform will see a great deal of money move internally, and those hops are exactly where funds get layered before leaving. A system that watches money entering and leaving but ignores the moves in between is watching the least interesting part of the journey. The €150,000 example is not an edge case; it is the predictable output of that design.

Alert handling is where a weak system becomes an invisible one. Even high thresholds produce some alerts, and what a firm does with them is the last chance to catch what the models missed. Closing alerts in bulk, with no documented investigation and no recorded rationale, converts a monitoring program into a formality. DNB could not establish that any real review had happened, which from a supervisory standpoint is indistinguishable from no review at all. The late FIU reports, some arriving only once the investigation was underway, complete the picture: unusual activity that was either not seen or not acted on until an outsider forced the issue.

None of this required the firm to be reckless, and DNB does not find that laundering occurred. It finds that Modulr ran the risk that its services would be misused, because the structure it chose left no one independently responsible for seeing. That is the enduring lesson of the case. In embedded finance, the risk is not that the partner is malicious; it is that everyone assumes someone else is watching.

Six gaps, one missing watcher

Each finding is a different way the same money could move unseen. Together they describe a monitoring program that existed on paper but did not independently cover the firm's own flows.

What every embedded-finance program should check

The first lesson is the one DNB states outright: ongoing monitoring is non-delegable. A partner can perform the operational work, gather information, and run a first-line review, but the licensed firm must retain the ability to form its own judgment, which means holding the data, setting the standards for alert closure and reporting, and testing whether the partner's output actually mitigates risk. The useful artifact here is a clear accountability map that reserves risk acceptance, alert-closure standards, and FIU reporting decisions to the firm itself, not the partner. If a program cannot point to where its own independent judgment lives, it has the Modulr gap.

The second is that monitoring thresholds are a risk decision, not a volume setting. A threshold that only fires at 300 payments a day or €50,000 is, in effect, a statement that nothing below that is worth looking at, and it should be justified against what the specific customers are actually expected to do. Thresholds set for operational convenience, to keep alert volumes manageable, quietly become the firm's real risk appetite. They belong in a documented calibration that ties back to customer-level expected activity, and they need aggregation logic so that many small transactions are summed rather than each waved through.

The third is coverage, and in particular the internal-transfer blind spot that is almost unique to multi-account platforms and payments firms. Money that never leaves the institution still moves, and layering happens precisely in those internal hops. Any firm whose customers can hold more than one account on its own rails should confirm that account-to-account activity is monitored with the same seriousness as money crossing the perimeter. The same goes for the fiat legs of crypto activity, which is where most regulated firms actually touch the crypto economy and where unusual patterns concentrate.

The fourth is that alert disposition is where a program is proven or exposed. Alerts that are closed without a documented investigation and a recorded rationale are not evidence of monitoring; they are evidence of its absence. Bulk closure should be constrained and approved, every disposition should leave a trail, and a sample of closed alerts should be independently re-reviewed. The point is not paperwork for its own sake. It is that a regulator, arriving after the fact, can only credit the reviews it can see.

Each maps directly to a gap in the monitoring map above, and each is a question a firm can put to its own program now rather than discovering it in a file review.

Monitoring that did not cover the ground

The specifics differ, but the failure mode in the Modulr case, a monitoring program that structurally could not see important flows, runs through some of the largest financial-crime actions on record. These three are drawn from the newer, crypto-adjacent and partner-driven corner of the market the Modulr case belongs to, and each turns on the same question: who was actually watching, and what could they not see.

What links a €722,160 Dutch fine to a billion-dollar FinCEN penalty is not the amount but the anatomy. In each, the controls existed on paper, and in each there was a category of activity, a partner's flows, a backlog, a channel, an internal hop, that the system simply did not see. Monitoring that does not cover the ground is the most expensive gap in financial crime, because it fails silently.

Where supervision is heading next

The Modulr case is a marker of where AML supervision is moving. For a decade, the landmark actions were against global banks and their correspondent and trade-finance flows. The frontier now is embedded finance: e-money institutions, payment firms, and the Banking-as-a-Service model in which a licensed entity distributes accounts through a long tail of partners and programs. Supervisors have noticed that this structure can scatter the AML duty across firms that each assume another is responsible, and they are increasingly willing to name the licence-holder as the one who must watch. DNB's choice to anchor this case on a single provision, the non-delegable duty of ongoing monitoring, is a signal of exactly that priority.

The crypto dimension sharpens it. Modulr's partners included crypto-exchange platforms, and the funds in the examined files were headed, among other places, to crypto accounts and abroad. The regulated firm rarely touches a token directly; what it touches is the fiat leg, the on-ramp and off-ramp where crypto meets the banking system. That is precisely the point at which monitoring either covers the flow or does not, and it is where a growing share of enforcement, from the crypto-native actions against exchanges to cases like this one against their banking partners, is now concentrated. A firm that provides rails to crypto businesses inherits the obligation to see what moves across them.

For any institution running a partner or program model, the forward-looking reading is straightforward. Inspections and enforcement are a map of where a regulator's attention is going, and the themes in this decision, non-delegable monitoring, individualized profiles, honest thresholds, coverage of internal and crypto-adjacent flows, and disciplined alert handling, are the ones an embedded-finance program should expect to be examined on next. The most useful response is not to wait for the file review but to read the published cases as a preview of it, and to close the gaps while they are still a design choice rather than a finding.