why does the bank ask if we do business with customers outside the Netherlands

Countries outside the Netherlands are part of the risk profile

The bank asks this because customer due diligence under the Anti-Money Laundering and Counter-Terrorist Financing Act (Wwft) requires account to be taken of geographical risk. Doing business with customers in other countries — especially outside the EU, or in countries with a higher risk of money laundering or terrorist financing — increases the risk profile that the bank assigns to your business. This is not suspicion; it is a fixed step in the investigation that the bank must conduct for every business customer, regardless of sector.

Specifically, the bank usually wants to know: in which countries your customers and suppliers are located, whether it concerns incidental or structural trade, and whether any of those countries are on a sanctions list-related or high-risk list. This is connected with the question the company or one of its directors is on a sanctions list — sanctions risk and country risk are often asked about in one breath in practice, even if the form presents them separately. If you do not have export administration that breaks this down by country, a global description with the main regions is usually sufficient; do not invent precise percentages if you do not have them.

Justification from customer due diligence

This follows from customer due diligence as elaborated in the Wwft: banks must monitor the business relationship and transactions on the basis of a risk-based approach, in which the country of origin and destination of money flows is one of the fixed factors. That investigation is separate from the Trade Register Act 2007, which only establishes who the business is and who runs it — that touches more on the question who are the ultimate beneficial owners of the company— it is separate from the Trade Register Act 2007, which only establishes who the business is and who runs it. The country question itself therefore does not come from the trade register, but from the bank's own obligation to assess the risk of the relationship.