Have you been registered as a money mule even though, in your view, your account or identity was misused? Ask immediately which specific facts the bank relies on to establish your involvement. Strict conditions apply to inclusion in the External Reference Register (EVR). The bank must have sufficient grounds for your involvement and must assess separately whether the registration and its duration are proportionate. Merely being the account holder does not answer every question about your role.
Nederlands: Lees dit artikel in het Nederlands: EVR bij geldezelverdenking of identiteitsfraude: uw rechten
Türkçe: Bu makaleyi Türkçe okuyun: Para katırı şüphesi veya kimlik dolandırıcılığında EVR: haklarınız
Written by Onur Arslan, attorney at Arslan Advocaten. Registered in the Netherlands Bar’s register of practice areas for employment law and personal injury. Onur Arslan practised for many years as a corporate lawyer and insolvency trustee (curator) and has extensive experience in financial law disputes. Last updated: 17 September 2026.
At the same time, handing over a bank card, security code or account can have serious consequences. A general denial is therefore not always sufficient. Build a factual timeline and make sure that any objection to the registration is coordinated with possible criminal law issues, account termination and damages claims.
What is meant by a money mule
A money mule is someone whose account is used to receive or pass on money from fraud. This can happen after handing over a bank card, sharing access or other forms of cooperation. Sometimes the account holder maintains that access was obtained without their consent.
The legal role differs from case to case. A person may have cooperated knowingly, may have carried out actions as a result of deception, or may have had no part at all in an application or transaction. The money mule label must not obscure those differences. The actual involvement and knowledge must be investigated.
In the meantime, a bank may take measures to prevent further losses. A block during an investigation is something different from a definitive external fraud registration. Ask which decisions have been taken, on what grounds and which aspects are still under investigation.
What is an EVR registration?
The EVR contains reference data that allow participating financial institutions to see that a relevant registration exists at another institution. It is not a public criminal record and does not automatically give every institution that consults it the full investigation file. Further exchange of information may take place through the applicable procedures.
The consequences can be significant: an account, credit or insurance may become harder to obtain. The rules are set out in PIFI, the Dutch financial institutions’ incident warning protocol. According to the Dutch Banking Association, PIFI 2026 has applied since 1 April 2026.
For an older registration, it must be checked which version applies to the inclusion and its continuation. So do not rely solely on an old example with a similar story. The current processing, the original facts and the relevant rules must be assessed together.
EVR, IVR, incident register and BKR are different
A bank may record data in several systems. The incident register contains information about incidents and investigations. The EVR is the external reference system. An Internal Reference Register (IVR) has an internal scope and its own assessment. A BKR credit registration concerns credit data and special notes, not automatically fraud.
For each register, request the date, legal basis, purposes, duration and data concerned. An objection that mentions only the EVR does not in itself lead to removal from every other system. The bank may put forward a separate interest for another register, which must likewise be reviewed.
The general overview of the EVR, IVR, CIS and the incident register helps to tell the systems apart. An internal registration following an incomplete investigation under the Money Laundering and Terrorist Financing (Prevention) Act (Wwft), such as CAAML, is yet another situation.
What conditions apply to inclusion?
PIFI sets conditions regarding the nature of the conduct, sufficiently established involvement and the proportionality of external registration. Not every uncertainty or administrative discrepancy justifies an external warning. Where criminal personal data are processed, a higher standard applies to the factual substantiation.
The bank must therefore do more than simply refer to a fraud report from another account holder. It may, however, rely on a combination of circumstances, such as access to the account, transactions, statements and communications. Those data must be assessed in conjunction with one another.
A criminal conviction is not required in every case. The absence of a conviction therefore does not automatically prove that the registration is unlawful. Conversely, the bank may not present a suspicion as proven involvement without a sufficiently concrete basis.
Which facts can the bank use against you?
Relevant factors may include receiving and quickly withdrawing fraud proceeds, handing over a card, changed limits or contradictory statements about a loss. The time between discovery and reporting may also play a role. Their significance depends on the specific events and the available data.
Ask the bank for the core of the set of facts. Which transactions are linked to you? Which act is supposed to demonstrate your cooperation? Has the bank investigated alternative explanations? The bank does not simply have to disclose its full internal security method, but your objection must be able to respond to specific allegations.
Where technical information is concerned, explain which question you want answered. A login on a device does not always show who was actually using the device. A withdrawal location may be relevant, but must be combined with other data. Avoid both automatic denials and unsubstantiated technical conclusions.
What if your card or phone was stolen?
Keep the first report of loss, blocking or theft and the times of the disputed transactions. Request relevant data about access and payment instructions. A report made shortly after discovery can support your timeline, but does not in itself decide everything that happened before it.
Be precise about what was lost: card, PIN, phone or only access to an account. Describe who may have had access without presenting unknown facts as certainties. If an earlier answer was incorrect, correct it transparently and explain the reason.
Where your identity has been misused for an unknown account or loan, it must also be investigated whether you ever entered into that agreement at all. See BKR and identity fraud on this, bearing in mind that an EVR assessment has its own conditions.
What if you did lend out your account or card?
Lending out access can be a weighty circumstance. The bank may infer involvement from it, in conjunction with other facts. A statement that you did not know what would happen must therefore be supported by the communications and context in which you acted.
That does not mean that every case automatically justifies the same registration period. Age, the degree of cooperation, deception, previous incidents and consequences may be relevant. Conduct after discovery, such as reporting promptly and providing correct information, may also be taken into account.
Do not make a new incorrect statement to conceal that you handed over the card. A changing story can complicate the assessment. Where criminal consequences are possible, first have the content and consistency of your statements assessed legally, so that you respond carefully and truthfully.
Young people and minors require an individual assessment
A young age may be relevant to understanding, susceptibility to influence and future prospects. It does not automatically mean that registration is prohibited. The bank must weigh the circumstances of the person concerned and may not simply apply a standard duration from a table without individual reasoning.
In the case of minors, parents or a legal representative may have a role in correspondence and procedures. Establish who is authorised to act on behalf of the person concerned and how their own statement is recorded carefully. The young person involved remains the person to whom the personal data relate.
Substantiate specific consequences, for example for a necessary payment account or education, without assuming that every desired financial service must be available. A general appeal to “a fresh start” is less concrete than documents showing the current obstacle and the person’s development.
Eight years is not an automatic registration period
PIFI sets a maximum duration for external registration, with specific rules on the starting point and any new relevant events. That maximum does not mean that every registration must last eight years. A shorter period chosen must also be proportionate in your situation.
Ask the bank why the chosen duration is necessary. Which aggravating and mitigating circumstances were taken into account? Was your response examined? Is there an explanation of why a shorter period would be insufficient? The reasoning must fit your file and not merely repeat the general interest of combating fraud.
A registration may also be reassessed later if specific circumstances change. That is no guarantee of a reduction, but the current necessity remains relevant. Record new facts and consequences so that a reassessment contains more than a repetition of an earlier request.
What an older Kifid case shows about duration
In Kifid 2020-1038 (Kifid is the Dutch Financial Services Complaints Tribunal), involvement in money mule activities was no longer in dispute. The committee shortened the external registrations on the basis of personal circumstances, while the internal registration period remained in place. The case was decided under an older version of the protocol.
The significance of this example is limited but practical: inclusion and duration are separate questions, and registers can have different outcomes. The period chosen at the time may not be used as a standard for a new file under PIFI 2026.
An objection can therefore primarily seek removal because involvement has not been sufficiently established and, in the alternative, a reduction on account of the circumstances. Make clear that an alternative request is not intended as an admission of facts that you continue to dispute with reasons.
Account access during a registration dispute
If the bank closes your account, day-to-day payments must be considered alongside the registration file. Ask which accounts can still be used and which amounts have been established. An objection to the EVR does not in itself suspend a separate termination.
A consumer can, under certain conditions, apply for a statutory basic payment account. An EVR entry is not in itself an independent statutory ground for refusal; the underlying facts may, however, be relevant, for example to Wwft requirements. The application must therefore be tested against the correct rules.
For this, read what to do if a basic payment account is refused. Securing necessary payment facilities can run in parallel with an objection, without you thereby admitting that the registration is justified.
Criminal law issues and civil damages claims
A fraud investigation may also lead to a police report, an invitation for questioning or a claim from a victim. These are separate procedures with their own rules of evidence. A decision by the bank is not a criminal conviction, but statements can become relevant in several files.
If you are suspected of a criminal offence, have your rights assessed in good time, as well as how your response to the bank fits in with them. You do not need to falsify documents, make them disappear or coordinate a story to protect yourself. Careful legal assistance focuses on facts, procedure and rights.
Nor is a claim for repayment of fraud proceeds automatically decided by an EVR entry. Examine the legal basis, the amounts received and any role of your own. Keep this claim separate from the request for removal or reduction of personal data.
A fictitious example of a useful timeline
A student notices that his banking app no longer works and reports this the same afternoon. It later turns out that money was received and withdrawn earlier that day. The bank suspects that he handed over his card. The student maintains that his bag containing his phone and card had disappeared.
The assessment requires more than choosing between those two accounts. When was the bag last seen? How was access obtained? Which reports and transaction times have been recorded? Are there messages that show earlier cooperation or, on the contrary, data that support the statement of loss?
A timeline with a source for each event helps to answer those questions. Where evidence is lacking, this must be stated honestly. The example shows why being the account holder alone does not explain everything, while a single report of loss does not automatically refute all indications of involvement either.
Building an objection and keeping track of deadlines
First request the registration letter and the relevant substantiation. Then describe which facts you dispute and add your own timeline. Next, address the interest in inclusion and the duration for each register. Request removal, correction or, in the alternative, a shorter period, depending on your position.
For GDPR requests, a response period of one month applies in principle, with a possible extension for which reasons must be given. For the special application procedure under Article 35 of the Dutch GDPR Implementation Act (UAVG), a period of six weeks after receipt of the answer applies in principle. An internal complaint or a police report does not automatically preserve that deadline.
For consumers, Kifid may be an option where the institution is affiliated and the complaint is suitable. In urgent cases or where the procedural position is different, the court may be the appropriate forum. Have the consequences of binding advice, legal costs and any parallel cases assessed in advance.
How do you assess a standard letter with a fixed period?
A registration letter sometimes mainly mentions the incident and an end date, without making clear why that particular duration is appropriate. In that case, do not only ask for a shorter period, but also for the balancing exercise that led to the decision. Which conduct does the institution attribute to you? Which information supports your involvement? Which personal circumstances were taken into account and which were still unknown at that time?
With young people, it may be relevant how old the person was at the time of the incident, how they were approached and what support was started afterwards. That does not automatically make a registration invalid. The facts and the risk continue to carry considerable weight. However, an individual assessment must leave room for relevant circumstances, rather than simply referring to a standard duration. Substantiate support and financial development with specific, appropriate documents.
If you have received several letters, check whether different registrations have the same end date. A correction in one system does not necessarily say what happens in another system. Ask for each register what the decision entails. A decision to keep an account open may also exist alongside a registration; the measures are not always subject to the same test.
Word your request in such a way that it is clear what you seek primarily and, where applicable, in the alternative. You may dispute the basis for inclusion and, in addition, in case inclusion is deemed justified, challenge the duration and consequences. You do not thereby have to admit the alleged incident. The wording must, however, be consistent with your own truthful account of what happened.
Young people, pressure and identity misuse
Where there is a suspicion of money mule activity, it must be investigated who used the account, card, phone and codes and what the account holder knew. A payment received is not in every situation the same as knowing involvement in fraud. Pressure, deception and vulnerability may also be relevant, without automatically removing all responsibility.
Keep messages, the police report, your timeline and data on the loss or transfer of access credentials. Do not give an incorrect explanation to protect someone else. Ask what specific involvement the institution alleges and how personal circumstances were weighed in the registration decision.
Also read about registration periods and bank fraud.
Frequently asked questions about the EVR and money mule suspicions
May the bank register me without a conviction?
A criminal conviction is not always required. However, strict requirements apply to the factual basis and proportionality of external registration. Ask which specific conduct and data the bank links to your involvement.
Is being the account holder sufficient proof that I cooperated?
That does not automatically answer all questions about involvement. The bank must investigate and substantiate the relevant circumstances. You must, however, make your challenge specific and respond to indications concerning access, transactions and statements.
Does a minor always get a shorter registration?
There is no fixed automatic reduction. Age and circumstances can, however, carry considerable weight in the individual assessment. Ask how the bank took into account susceptibility to influence, development and specific consequences, and why the chosen duration remains necessary.
Does the IVR disappear if the EVR entry is removed?
Not automatically. The registers have a different scope and may have a separate legal basis and balancing of interests. Ask for each register what remains in place and why. A removal decision must be clear about its scope.
Must the bank always file a police report before it registers?
PIFI contains rules on reporting criminal offences to the police and possible exceptions. The absence of a police report therefore does not necessarily lead to automatic removal. Have the reason and the applicable protocol provision in your file assessed.
How can Arslan Advocaten help?
Arslan Advocaten can assess the factual basis, the registration period and the connection with account access or a criminal file. Send us the registration letter, the bank’s questions, your earlier answers and relevant reports. The approach and costs are discussed in advance.
Sources and legal basis
- Dutch Banking Association (NVB) on PIFI 2026 and its effective date.
- PIFI 2026, the Dutch financial institutions’ incident warning protocol (Protocol Incidentenwaarschuwingssysteem Financiële Instellingen 2026).
- Kifid 2020-1038 as a historical example of a separate assessment of duration.
- Supreme Court of the Netherlands (Hoge Raad), 15 September 2023, on GDPR proceedings.
Sources checked on 16 September 2026. For inclusion and continuation, the applicable version of the protocol must be established; older rulings do not produce an automatic outcome under PIFI 2026.
