bank asks if I have business relationships with a high-risk profile

High-risk business relationships are a standard question in customer due diligence

This is not an incident and usually not an indication that the bank suspects anything. The bank must know from every business customer whether there are relationships that increase the customer's own risk profile — suppliers, customers or partners in countries or sectors that warrant extra attention. This is part of the customer due diligence that every bank is required to perform, not something that is specific to your business.

The question often comes together with questions that sound slightly different but belong to the same test: the source of the company's assets, or the ultimate beneficial owners of the companyIf you have no business relationships with a high-risk profile — no parties in high-risk countries, no politically exposed persons in your chain, no parties on a sanctions list — then "no" is a complete answer, provided you can also substantiate that. If you are uncertain about one specific relationship, it is more precise to name that relationship separately than to dismiss the entire question with "yes" or "no".

Where this follows from: customer due diligence under the Wwft

The obligation for ongoing monitoring of the business relationship, including investigation of the parties with which the customer does business, derives from the Law on the Prevention of Money Laundering and Financing of Terrorism. The bank is itself the institution that must perform this investigation and must be able to demonstrate that it has done so — which is why the question reaches you as a customer, even if the risk actually lies with a third party in your chain. This is a different assessment framework than sustainability reporting under the CSRD Directive or data from the Trade Register; do not confuse the question with data on bank relationships or with a sanctions test, which has a slightly different angle, as can be seen in the question of whether the undertaking is on a sanctions list.