Banks and compliance in Aruba in 2026: AML enforcement, the banker’s duty of care and the lessons of recent case law

Anyone responsible for compliance or legal affairs at a bank, a trust company, a casino or a real-estate business needs to know these developments. So does the entrepreneur on the other side of the counter. In this article we set out the current state of the law, relying exclusively on the legislation, the published case law and the official publications of the supervisory authorities. Glas & Glas advises and litigates on both sides of this relationship: for financial institutions and for their (prospective) clients.

1. The framework: two obligations that pull in opposite directions

An Aruban bank operates under two regimes that do not always point the same way. On one side stands the AML/CFT State Ordinance (AB 2011 no. 28, last amended by AB 2021 no. 143), together with the AML/CFT Handbook of the Central Bank of Aruba (CBA) of 1 January 2020, the Regulation on the Ultimate Beneficial Owner (AB 2021 no. 153), the State Decree on the principles of administrative enforcement and the CBA’s Guideline on the amount of fines. Those rules require customer due diligence before a relationship is entered into (Articles 3 and 8), enhanced due diligence where the risk is higher – expressly including the case where the client or the ultimate beneficial owner is not a resident of Aruba (Article 11(1)(a)) –, ongoing monitoring of the relationship (Article 3(1)(d)), the prompt reporting of unusual transactions (Article 26) and the termination of a relationship in which due diligence can no longer be completed (Article 9(2)). The 2021 amendment added, among other things, the combating of proliferation financing and the power of the FIU-Aruba to have a transaction suspended for up to five working days, extendable to fifteen (Article 28a).

On the other side stands civil law. Because of its function in society, a bank owes a special duty of care, also towards those who are not yet clients. Without a payment account, participation in economic life is practically impossible. The Aruban courts follow the Dutch Supreme Court on this point (HR 5 November 2021, ECLI:NL:HR:2021:1652): freedom of contract is the starting point, but it is not unlimited, and the outcome is a weighing of interests in the concrete case. A termination is moreover tested against reasonableness and fairness under Article 6:248 of the Civil Code. The tension between these two regimes is exactly what the case law of 2025 and 2026 is about.

2. Access to a bank account: the Princess series

The most discussed cases of this year concern a casino operator that applied for a business account at all four commercial banks in Aruba and was refused everywhere. On 5 February 2026 the Court of First Instance gave three judgments at once (ECLI:NL:OGEAA:2026:47, 48 and 49). On 3 June 2026 the fourth followed (AUA202600316 KG). Together they form the current Aruban framework for refusing a client.

What does support a refusal

• Current, verifiable facts. A licence structure whose approval did not appear from the documents, the use of a third party’s account for prohibited payment services, a director with AML antecedents elsewhere, and four directors and two authorised signatories in just over two years: on those grounds the first bank’s refusal was upheld (ECLI:NL:OGEAA:2026:47, paras 4.10–4.11).
• Subsidiarity. As long as it is not established that every bank keeps its door closed, the applicant’s interest weighs less heavily (para 4.14). In June 2026 that last door had closed – and the outcome turned.

What does not support a refusal

• Dated adverse media. Old reports about the ultimate beneficial owner, without prosecution, conviction, pending investigation or sanctions listing, are insufficient. The bank must be able to point to conduct after the reported events (ECLI:NL:OGEAA:2026:47, para 4.8; AUA202600316 KG, para 4.11).
• Inconsistent internal policy. A bank that claims to serve only licence holders but in practice also has other operators as clients loses that argument (para 4.10).
• Categorical exclusion. A policy of not serving an entire sector – here: stand-alone casinos – is, without concrete and justified objections, an impermissible categorical exclusion (AUA202600316 KG, para 4.11).
• An unsubstantiated reliance on correspondent banks. The importance of those relationships is recognised, but the bank that had made contact and would not say what answer it received did not get away with it (para 4.12). Anyone using this argument must be able to show who was approached, when, with what question and with what answer.

Two considerations have consequences beyond this file. First, the court can order a bank actually to carry out customer due diligence and to complete it within a set period, even where it is not (yet) compelled to contract (ECLI:NL:OGEAA:2026:48). Second, a breach of the special duty of care expressly constitutes a tort towards the prospective client (AUA202600316 KG, para 4.6): in addition to an order backed by a penalty – here Afl. 5,000 per day up to a maximum of Afl. 1,000,000 – a claim for damages therefore looms. Whether integrity risks can be managed by conditions attached to the account (no cash, thresholds, enhanced monitoring) the Court expressly left open in February for proceedings on the merits (para 4.17); in June the bank was criticised for not having examined that possibility. That is where the most important practical opening for banks lies.

3. Termination and de-risking: the Joint Court in March 2026

For existing relationships the Joint Court was already strict in 2020: a bank that terminated a relationship of almost twenty years on grounds of sector risk, dated publicity and correspondent-bank concerns was ordered to continue the relationship until the client had found another bank, because it had put forward “too little concrete factual material” and had not cooperated in finding a solution (Joint Court 15 May 2020, ECLI:NL:OGHACMB:2020:134). The Court warned even then that de-risking leads to re-risking and that the FATF too has spoken out against it.

On 18 March 2026 the Joint Court confirmed that line in a case from Sint Maarten that is equally relevant for Aruba (ECLI:NL:OGHACMB:2026:60). A bank announced that it would restrict the accounts of two companies because the ultimate beneficial owner refused to fill in the periodic KYC questionnaires again; according to him nothing had changed since the last time. The Court recognises without reservation that a bank is legally obliged, and therefore entitled vis-à-vis its client, to verify periodically whether its client data are still correct, and that it also derives that power from its general terms and conditions (para 4.3). But the bank lost, for four reasons that every compliance department should know:

• Say precisely what is missing. The bank did not make clear which information it lacked that the client should have provided under the terms; an answer such as “self, consultant” must be read in the light of the question asked, and where something is unclear, follow-up questions should come before any threat of closure (para 4.6).
• Offer a workable form. A written, signed statement that the information previously provided is still current, plus a new signature card, is something the bank could have proposed; there was no evidence of a refusal to do that (paras 4.5 and 4.11).
• Old signals do not support a new termination. Signals from 2018 about large transfers, after which the accounts had been released again, were no ground for a termination in 2024 (para 4.7).
• Show the detriment. That the bank suffered a detriment from the refusal – sanctions from the supervisor, reputational damage with fellow banks – had not been shown (para 4.8).

The penalties were reduced to USD 100,000 per closed account and USD 2,500 per day for other breaches of the order, capped at USD 100,000 (para 4.12), but the core stands: the duty of care requires the bank to think along and to cooperate. Termination because due diligence genuinely cannot be completed rests on the firm ground of Article 9(2) of the AML/CFT State Ordinance; termination because of a changed risk appetite is a policy choice that is tested in full against the duty of care. The difference between the two must be visible in the file.

4. Enforcement by the Central Bank: the Joint Court’s framework for fines

On the supervisory side the most important development is that in three judgments of 14 January, 11 February and 18 March 2026 the Joint Court laid down the framework for assessing AML fines (ECLI:NL:OGHACMB:2026:5, 2026:18 and 2026:19, and 2026:49). They build on two judgments from 2025 (ECLI:NL:OGHACMB:2025:231 and 2025:264). The main rules:

• The base amount is high. Category 2 offences – including customer due diligence, the reporting duty and ongoing monitoring – carry a statutory base amount of Afl. 500,000 per separate offence, with a maximum of Afl. 1,000,000 (Article 37(2) in conjunction with the State Decree). The CBA treats repeated breaches of one provision during an examination period as a single offence.
• The Guideline and the internal calibration model are valid. The Guideline has seven steps: seriousness and duration, culpability, recidivism, objective capacity to pay, benefit obtained, proportionality test and individualised capacity to pay. The Court holds both the Guideline and the CBA’s unpublished internal calibration model to be within the law; the administrative court does, however, test whether the outcome in the concrete case is proportionate and otherwise sets the fine itself (ECLI:NL:OGHACMB:2026:18, paras 4.1 and 6).
• Sampling is permitted. An examination covering all transactions above the indicator threshold that the institution itself reported is a representative sample; the percentage of late reports determines the seriousness (para 7.1). The Court added one correction: where fewer than ten reports are late or missing, the calculated percentage is reduced “below the line” by 12.5%, so that the absolute number also counts (para 10.1).
• Late reporting on one’s own initiative does not help. Reporting a transaction belatedly before the CBA’s examination earns no reduction: “without delay” means that the FIU can still intervene, and that is no longer possible if a report is (much) too late (para 9.1). Nor does the absence of harm to third parties, market disruption or financial benefit count in favour – that is already built into the base amount.
• Enhanced due diligence has content. For a non-resident client, enhanced due diligence includes an inquiry into the source of funds and an extensive internet search. The Court endorses that interpretation, but held that it only became knowable with the 2020 Handbook (1 January 2020): transactions from before that date could therefore not be fined, a transaction of January 2021 could (ECLI:NL:OGHACMB:2026:49, para 13.1).
• Small or large service provider. The capacity-to-pay reduction depends on the size of the institution under the Guideline’s definitions (small service provider: at least two of the criteria fewer than ten employees, turnover below Afl. 1 million, balance-sheet total or equity below Afl. 3 million); the OECD definition is not decisive (para 7.1). For credit institutions equity is the yardstick.
• Time limits. The power to impose a fine lapses three years after the day on which the non-compliance was established, not three years after the offence itself (Article 41(1)(b); ECLI:NL:OGHACMB:2025:231, confirmed in 2026:49, para 5.1). If proceedings take too long, the fine is reduced according to a fixed scale: 5% for an overrun of less than six months and 10% up to one year, each capped at Afl. 2,500; beyond that an extra 5% per half year, capped at Afl. 5,000 (up to two years) and Afl. 10,000 (thereafter) (ECLI:NL:OGHACMB:2026:5, para 4.3).
• Cumulation. The 10% reduction for cumulation is applied by the CBA only where there are three or more fines; with two fines the individualised capacity-to-pay test may offer relief (ECLI:NL:OGHACMB:2026:18, para 12.1).
• Who is a service provider? A casino operator working under provisional ministerial permission is a service provider within the meaning of the Ordinance and can be fined, even if the definitive licence was only granted later (ECLI:NL:OGHACMB:2025:264).

Practice shows that serious amounts are at stake: a bank ended up with a fine of Afl. 320,000 for failing to monitor clients on an ongoing basis and for late reporting of unusual transactions (ECLI:NL:OGHACMB:2026:5); a jewellery dealer Afl. 355,812.50 (ECLI:NL:OGHACMB:2026:49); a project developer Afl. 161,200 (ECLI:NL:OGHACMB:2026:18). Add to this that offences can also be committed by natural persons (Article 37(3)) and that an irrevocable fine or instruction can be published (Article 44a) – for an institution that depends on correspondent banks often the heaviest consequence.

5. UBO, PEP and the non-resident client

With international clients, due diligence rarely founders on the legal entity itself but on the question of who is behind it. The Regulation on the Ultimate Beneficial Owner (AB 2021 no. 153) works in tiers: first the natural person who directly or indirectly holds more than 25% of the capital or voting rights; in case of doubt or absence, the person who can exercise effective control by other means; and only if that too cannot be established, the person charged with overall management. For trusts a cumulative circle applies: settlor, trustee, protector, beneficiaries and anyone else with ultimate control. Anyone who registers the statutory director as UBO without documenting the first two steps has not identified a UBO but filled in a field.

If the UBO or the client is a non-resident, enhanced due diligence is mandatory (Article 11(1)(a)) – and in March 2026 the Joint Court confirmed what that entails at a minimum: source of funds and a documented internet search. If the UBO is a politically exposed person, entering into or continuing the relationship must be approved at senior management level and the source of wealth must be established; that status continues for five years and extends to family members and close associates (Article 12). The 2026 case law adds a civil lesson: what the bank finds in this inquiry must be current and verifiable, because only that will later support a refusal or termination.

6. Reporting, suspension and sanctions: the FIU-Aruba in 2026

The reporting duty remains the provision on which most fines are based. On 1 April 2026 the FIU-Aruba published practical guidance on the reporting of unusual transactions, intended to help service providers meet their reporting obligations. The FIU’s 2025 annual report shows that 61,704 unusual transactions were reported in that year, more than ten per cent up on 2024, with casinos as the largest reporter among the non-financial service providers and with real estate, virtual assets and the transparency of beneficial ownership as points of attention. Whoever reports in good faith is indemnified against civil liability towards third parties (Article 30) and the reported data cannot be used against the reporter itself (Article 29); the counterpart is the prohibition on informing the client of the report (Article 31). Since 2021 the FIU can moreover have a transaction suspended (Article 28a); a service provider complies with such an order without delay.

Sanctions law also demanded attention in 2026. In June 2026 the FIU-Aruba published guidance on the reinstatement of the UN sanctions against Iran and the related reporting obligations, and as of 1 July 2026 Zimbabwe is no longer subject to targeted financial sanctions under the interim national decree on priority sanctions regimes. Sanctions screening is thus no longer a static list check, but a process that the institution must be able to demonstrate for every change.

7. What this means: an agenda for banks and their clients

For financial institutions

• Write every refusal and termination letter as if the judge will read it. In 2026 banks’ e-mails were quoted verbatim in judgments. Name the concrete, current facts; avoid sector labels and dated publicity.
• Distinguish Article 9(2) from risk appetite. If due diligence cannot be completed, record what was requested, when, with what deadline and what was received. If it is a policy choice, expect a full test against the duty of care and a duty to cooperate in finding a solution.
• Examine a mitigated offer before refusing. An account without cash facilities, thresholds, enhanced monitoring, contractual information duties: record why that does or does not suffice. That criticism was decisive in June 2026.
• Document the correspondent-bank argument. Who was approached, when, with what question, with what answer.
• Report on time, not belatedly. The Court grants no mitigation for spontaneous late reports. Invest in the detection of objective indicators and in the lead time between signal and report.
• Test your enhanced due diligence against the 2020 Handbook. Source of funds, internet search, PEP approval at senior management level, documentation of each step of the UBO determination.
• Know how the fine is calculated. Whoever masters the seven steps of the Guideline, the size definitions and the 12.5% correction when responding to a notice of intent (Article 38a) negotiates on a different level. Do not forget the reasonable time: it starts to run from the notice of intent.

For businesses facing a bank

• Provide the complete file, including context. In the Princess series one missing document – the underlying request to the Minister – made the difference between losing and winning.
• Cooperate, even if you disagree. The client who won in March 2026 had complied with the law and the terms; the bank had not offered him a workable form. Whoever refuses information loses the protection of the duty of care.
• Ask for a reasoned decision and for alternatives. A bank that does not examine whether an account under conditions is possible runs a real litigation risk.
• Summary proceedings are a real instrument. An order to carry out due diligence, an order to open or continue, penalties and – expressly since June 2026 – a basis for damages.

Finally

The common thread of 2025 and 2026 is consistent. The supervisor may be strict and the courts support its fining framework; at the same time the same courts require banks to base their decisions about clients on current, concrete and verifiable facts, to think along about solutions, and actually to perform their customer due diligence instead of replacing it with a sector policy. Compliance and the duty of care are not opposites, but two sides of the same file. Whoever has that file in order stands strong before the CBA and before the courts.

Glas & Glas Attorneys and Legal Consultancy advises financial institutions, trust companies, casinos and real-estate businesses on AML/CFT compliance, on responses to and appeals against Central Bank fines, and on the civil-law side of onboarding, termination and de-risking. We also assist businesses confronted with a refused or terminated banking relationship. In English, Dutch, Spanish and Papiamento.

This article is intended for general information only and is based on the State Ordinance on the Prevention and Combating of Money Laundering and Terrorist Financing (AB 2011 no. 28, as last amended by AB 2021 no. 143), the regulations based on it, publications of the Central Bank of Aruba and the FIU-Aruba, and judgments published on rechtspraak.nl up to and including August 2026. The judgment of 3 June 2026 (AUA202600316 KG) has not been published; it is quoted from the copy available to us. No rights can be derived from this article.

Sources

• State Ordinance on the Prevention and Combating of Money Laundering and Terrorist Financing (AML/CFT State Ordinance, Lwtf), AB 2011 no. 28, last amended by AB 2021 no. 143: incl. Articles 1, 3, 3a, 5, 8, 9, 11, 12, 26, 28a, 29–31, 33, 37–41, 44a, 47–48
• Regulation on the Ultimate Beneficial Owner (Ministerial Regulation of 14 September 2021, AB 2021 no. 153); State Decree on the principles of administrative enforcement; Regulation on indicators of unusual transactions (AB 2012 no. 47)
• Central Bank of Aruba, AML/CFT Handbook (version 1 January 2020); Guideline on determining the amount of administrative fines; Questions and Answers regarding the AML/CFT State Ordinance
• FIU-Aruba, Practical Guidance on the Reporting of Unusual Transactions (1 April 2026); guidance on the reinstatement of Iran-related UN sanctions (12 June 2026); notice on priority sanctions regimes – Zimbabwe (1 July 2026); Annual Report 2025
• Court of First Instance of Aruba 5 February 2026, ECLI:NL:OGEAA:2026:47, ECLI:NL:OGEAA:2026:48 and ECLI:NL:OGEAA:2026:49 (refusal of bank account; customer due diligence)
• Court of First Instance of Aruba 3 June 2026, AUA202600316 KG (order to open bank account; categorical exclusion; correspondent banks)
• Joint Court of Justice 18 March 2026, ECLI:NL:OGHACMB:2026:60 (Sint Maarten; intended restriction/termination of accounts; duty of care and compliance)
• Joint Court of Justice 15 May 2020, ECLI:NL:OGHACMB:2020:134 (termination of banking relationship; de-risking)
• Joint Court of Justice 14 January 2026, ECLI:NL:OGHACMB:2026:5 (fine credit institution; reasonable time)
• Joint Court of Justice 11 February 2026, ECLI:NL:OGHACMB:2026:18 and ECLI:NL:OGHACMB:2026:19 (framework for AML fines; Guideline; sampling)
• Joint Court of Justice 18 March 2026, ECLI:NL:OGHACMB:2026:49 (enhanced due diligence; limitation period; size of service provider)
• Joint Court of Justice 17 September 2025, ECLI:NL:OGHACMB:2025:231 and 5 November 2025, ECLI:NL:OGHACMB:2025:264 (limitation period; concept of service provider for casinos)
• Dutch Supreme Court 5 November 2021, ECLI:NL:HR:2021:1652 (special duty of care of banks; access to a payment account)