Netherlands: Fintech (2nd edition)

The In-House Lawyer Logo

This country-specific Q&A provides an overview of the legal framework and key issues surrounding fintech law in The Netherlands.

This Q&A is part of the global guide to Fintech.

For a full list of jurisdictional Q&As visit

  1. What are the sources of payments law in your jurisdiction?

    The payments sector in the Netherlands is mainly regulated on the basis of European legislation, such as the second Payment Services Directive (PSD2), the second E-Money Directive (EMD2), the Single Euro Payments Area (SEPA) Regulation, the Interchange Fee Regulation and the Payment Accounts Directive. European Regulations have direct effect in the Netherlands. The European Directives have been implemented in – mainly – the Dutch Financial Supervision Act (Wet op het financieel toezicht) and Title 7b of Book 7 of the Dutch Civil Code (Burgerlijk Wetboek). The first act deals with the financial regulatory requirements applicable to financial undertakings involved in the payment chain, whilst the latter focuses on the private law requirements that need to be taken into account by the different parties involved in such payments chain.

    One national piece of legislation worth mentioning is a regulatory framework applicable to payment processing service providers (afwikkelondernemingen). The Dutch Financial Supervision Act distinguishes three types of payment processing services: (i) the forwarding of an electronic authorisation request of a payer to its payment service provider (PSP) for an initiated payment order, (ii) consenting to such authorisation requests on behalf of the paying PSP, or (iii) netting. This piece of Dutch legislation is not based on an European example. It results in – for example – card schemes like MasterCard falling under this type of oversight by the Dutch Central Bank (DNB).

  2. Can payment services be provided by non-banks, and if so on what conditions?

    In line with PSD2 and EMD2, payment services can be provided by non-banks such as payment service providers and electronic money institutions.

    Both EMD2 and PSD2 were implemented in a harmonised manner in Dutch law. The exemption as well as the licence obligation applicable to a financial undertaking when providing payment services in the Netherlands can largely be derived from these European Directives (in particular PSD2). AISPs however need to obtain a (light) licence in the Netherlands, instead of a mere registration as required pursuant to PSD2.

    The Dutch Central Bank (DNB) does, however, maintain a relative narrow reading of the scope of the licence obligation of a payment service provider: DNB considers that a party is pursuing the business of a payment services provider only if ‘it provides a payment service for a payer’s or payee's expense as a separately identifiable activity. This means the activity must be separate and not indissolubly linked to another activity unrelated to payment services’ (

    Another thing to mention is that payment service providers do not (yet) have direct access to the TARGET2 inter bank payment system, resulting in incumbent banks generally maintaining a very important role in scriptural (cashless) payment transactions. From that perspective, non-bank payment service providers are just another intermediary in the payment chain which already involves quite some parties.

  3. What are the most popular payment methods and payment instruments in your jurisdiction?

    The Dutch Payment Association regularly publishes factsheets and figures. The below numbers and percentages are based on their most recent publications (2018)(

    When discussing popular payment methods and payment instruments, a distinction should be made between in store payments and online payments.

    In store payments
    Next to cash payments (approximately 37% in store transactions were paid in cash), the most popular payment instrument for in store payments is the debit card via a ‘point-of-sale’ (POS) payment method (approximately 63% in store transactions were paid by using a debit card). Approximately 50% of the debit card payments made were contactless: generally a debit card holder can make up to 3 contactless payments in a row below a payment amount of €25 each without being requested to enter a pin-code. New technologies such as near field communication (built in in a debit card, but also nowadays more often in smartphones or smartwatches or via NFC tags enabling such contactless payments), e-wallets and other cloud-based payment methods are winning market share rapidly. ING and ABN AMRO recently announced the collaboration with Apple Pay as a new payment method available to their clients for in store payments.

    Online payments
    The most popular ‘payment method’ for online payments in the Netherlands is iDEAL. iDEAL was launched in 2005 by Currence as a joint initiative of eight Dutch banks. It has enjoyed phenomenal success: in 2018, approximately 524 million transactions were settled through iDEAL, with a transaction value of approximately €43 billion. iDEAL redirects a payer to its online banking environment. Approximately 70% of those iDeal payments were made via mobile banking applications (

    The second most popular payment instrument for online payments in the Netherlands is the credit card. According to the numbers published by the Dutch Payment Association, approximately 15% of the online payments included in those 2018 numbers were made by means of a credit card (compared to approximately 84% of online payments made via iDEAL).

  4. What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?

    Open banking is still in its infancy. The implementation of PSD2 in Dutch laws and regulations was seriously delayed. It was only implemented recently, on 19 February 2019. The Dutch law implementation requirements dealing with security measures and strong customer authentication that need to be adhered to in respect of access to the account (XS2A) only took effect even more recently as per 14 September 2019, simultaneously with the effectuation of the European Regulation on Strong Customer Authentication.

    For open banking purposes, XS2A is the most important innovation enabled by PSD2. XS2A entails the possibility for third party providers (such as AISPs, PISPs and other PSPs other than the ASPSP) to get access to online available payment accounts administered by ASPSPs subject to the explicit consent of the account holder. For the financial regulatory framework applicable to such third party providers, reference is made to paragraph 2.

    XS2A was a heavily debated provision in PSD2. From the incumbent banks perspective, it is understandable. They are confronted with an enormous competition risk. The payment transaction data which were, to a great extent, an asset of the incumbent banks only, no longer come to the exclusive use of those incumbent banks since PSD2.These transaction data can – and will - now also be used by third party providers to offer customers new services and solutions.

    One critical note should be made though: recent research shows that Dutch residents are not yet open minded as it comes to open banking. Dutch residents appear to put great trust in the incumbent banks and do not feel comfortable with granting third party providers the required consent to access their payment accounts (

  5. How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?

    As of 25 April 2018 the European General Data Protection Regulation (GDPR) has replaced the Dutch Data Protection Act. The applicable data protection regime in the Netherlands now follows from the GDPR and the Dutch Implementation Act GDPR (Uitvoeringswet AVG). All companies processing personal data within the meaning of the GDPR have to comply with the requirements laid down in this European Regulation. This regime does not have specific implications for fintech companies; it applies to any type of company processing personal data (which is practically any company nowadays). Depending on the type of fintech company and the manner in which it uses personal data, additional requirements following from sector specific legislation could be applicable, such as the explicit consent requirement under PSD2. If a Fintech company makes use of Big Data and/or artificial intelligence specific requirements following from the GDPR with respect to profiling apply. Examples of requirements that must be taken into account if the Dutch data protection regime applies are:

    • personal data may only be processed if such processing is lawfully, fairly and done in a transparent manner in relation to the data subjects;
    • a record of processing activities must be put in place; and
    • depending on the risk to the rights and freedoms of natural persons a data protection impact assessment must be carried out prior to the actual processing of the personal data.
  6. What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?

    The AFM and DNB jointly launched two initiatives in 2016 and 2017 with the aim of both facilitating fintech companies, as well as gaining knowledge of and experience with innovative business models used by fintech companies: the InnovationHub and the ‘Regulatory Sandbox’.

    Whilst the InnovationHub is meant to facilitate fintech start ups with qualifying their contemplated business model and assessing the applicability of financial regulatory laws on such business model, the Regulatory Sandbox is supposed to go a step further. Within the Regulatory Sandbox environment, a fintech company could – theoretically – opt for a more proportionate regulatory treatment and apply for a customized license or partial license. We emphasize the current theoretical character of this sandbox. Due to European legislation rather than national legislation generally determining the regulatory framework applicable to fintech companies and due to the limited discretionary powers granted to the Dutch regulators by the Dutch Ministry of Finance or the Dutch legislator (other than for example the relatively broad mandate of the FCA in the UK), the Dutch regulators experience difficulty in offering a fintech company a deviating treatment compared to other financial undertakings.

    In a recent evaluation report, the regulators concluded that ‘both initiatives are playing an important role in responding to innovation in the financial sector’. They also acknowledge that maintaining an open dialogue with fintech companies is essential to continuously stimulate innovation. To this end, DNB recently launched iForum through which it envisages to share best practices in the fintech sector.

  7. Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?

    Although the Dutch competition authority, the Netherlands Authority for Consumers and Markets (ACM), expressed concerns about the exclusion of fintech companies from the financial markets, especially in the payment industry in 2017 (, the Fintech landscape has matured in the Netherlands since then. We expect no imminent risks to the growth of the fintech market in the Netherlands. Rather, we expect PSD2 to transform the payments sector across Europe, including in the Netherlands.

    However, as described under paragraph 4 as well, Dutch banks enjoy a very strong position in the Netherlands. Although customers are not necessarily perfectly satisfied with the manner in which their banks provide their services, they are very loyal. Developments such as access to the account may make the provision of services faster, more consumer friendly and less costly. However, Dutch account holders place a high level of trust in their respective banks and do not as yet have the same level of confidence in the fintech companies that are offering new PSD2 services.

    Also the regulatory framework will remain a challenge for many fintech companies. The Dutch regulators have the reputation of being good solid regulators, but for that reason not the most flexible or quickest regulators in the European Union. This could result in foreign fintech companies to choose another home Member State than the Netherlands. The Dutch minister of finance recently announced that quantitative and qualitative research on the Dutch fintech sector will be conducted by a third party, which will serve as the basis for more concrete measures to facilitate and promote fintech in the Netherlands (

  8. What tax incentives exist in your jurisdiction to encourage fintech investment?

    Despite the numerous number of taxes and subsidies or grants, the Netherlands does not excel in incentivizing fintech companies, fintech investments or fintech projects via appealing tax rates. That being said, there are two tax related measures which could be used or applied for by fintech companies.

    The first is a tax arrangement offered to an employer that employs specialist talents from abroad (who have lived more than 150 kilometres from the Netherlands for at least the preceding 16 months), such as programmers, blockchain experts and similar ‘Silicon Valley’ hotshots. An employer can pay up to 30% of the salary of its foreign employee on a tax-free basis for a limited period of 5 years. Given the relatively high income tax rates in the Netherlands (36.65%–51.75%, depending on income level), this facility is a welcome bonus for talent migrants.

    The other tax arrangement worth mentioning is the Innovation Box. Innovative fintech research & development initiatives may be eligible for this tax arrangement. In essence it is a considerable discount on the corporate income taxes payable by a company. The current regular Dutch corporate income tax rates are between 19% (first €200,000 of taxable profits) and 25% (taxable profits over €200,000). These rates will be gradually reduced from 2021 to 15% and 20.5% respectively. Under the Innovation Box, only 7% taxes needs to be remitted in respect of the returns obtained from such innovative R&D (

  9. Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?

    Depending on the stage which they have reached, fintech companies are primarily financed by regular seed capital providers, such as angel investors and early-stage venture capital funds. Research conducted by KPMG ( shows that later-stage venture capital funds and private equity funds are also increasingly aware of the potential of the fintech sector. Crowdfunding is another way to fund start-ups, including fintech companies.

    The Netherlands is also home to numerous start-up accelerator programmes. The Dutch government aims to make the Netherlands the best start-up ecosystem of Europe – a ‘unicorn nation’. The most important programme is TechLeap (previously called StartupDelta) ( The Dutch government has made €65 million available for start-ups and scale-ups, including €35 million in funding for TechLeap. Multiple subsidies are also available for fintech companies in the form of loans provided by the Dutch government on interesting terms. Examples include the innovation credit (, government guarantee for SME loans (borgstellingskrediet, and the possibility for closed-end venture capital funds to obtain a subordinated interest-free hybrid loan from the Dutch government to finance one or more investments in tech start-ups (

  10. If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?

    The Netherlands is a welcoming country for fintech companies. Due to its digital ecosystem and high connectivity, thanks to housing two of the largest internet exchange points in the world (AMS-IX and NL-IX), the Netherlands is home to many tech companies, including fintech companies. As the world’s second datacentre hotspot, Amsterdam is known as the digital gateway to Europe (

    The Dutch financial regulators are known for their positive attitude towards financial innovation, and are actively promoting innovation and facilitating fintech companies through initiatives such as the Regulatory Sandbox and the InnovationHub. Furthermore, the Netherlands has a healthy economy and a thriving international business community (especially in Amsterdam).

  11. Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?

    The Netherlands is generally considered the perfect pan-European hub and is known for its lenient business immigration policy. Multiple immigration schemes have been developed to attract specialist talent from abroad.

    Employees from the European Union do not need to obtain a residence permit and a working permit.

    Fintech employees from outside the European Union can apply for schemes such as the Dutch highly skilled migrant programme or the EU Blue Card, the latter of which combines a residence permit with a working permit. No working permit is required for the highly skilled migrant and his or her spouse.

    These immigration schemes require an employment contract, know a minimum salary requirement and the EU Blue Card requires a higher education degree. Moreover, the Dutch highly skilled migrant programme can only be used by employers that are recognised by the Dutch Immigration and Naturalisation Service.

    For the ‘30% rule’ available to employers of specialist talent from abroad, we defer you to paragraph 8.

  12. If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?

    We defer you to paragraph 11.

  13. What protections can a fintech use in your jurisdiction to protect its intellectual property?

    Protection of innovation in the fintech space is relatively difficult. Generally, innovative ideas can be protected by IP rights such as patents, design rights, trade secrets and copyright.
    Software source code and the graphic interfaces of apps are generally protected by copyright by operation of law. Copyright need not be registered, although it is recommended to register an early-stage fintech innovation with the i-DEPOT of the Benelux IP Bureau ( in order to be able to evidence the ownership thereof. Design rights and trademarks can protect the name or logo of a fintech innovation, such as an app.

    A more secure way to protect fintech innovations is to obtain a patent which protects the technical product or process. The functioning of an algorithm, for example, is not protected by copyright, but may be eligible for a patent under certain circumstances. A Dutch patent can be requested from Octrooicentrum Nederland, subject to compliance with the requirements laid down in the Dutch Patent Law.

    It is also possible to obtain a European patent via the European Patent Office (EPO), if the innovation is novel, inventive and susceptible of industrial application. If the EPO approves the request, the applicant must register the patent in the European country in which it wishes to protect the innovative ideas.

    It is expected that in the relatively near future, applicants will be able to opt for a unitary patent – a unilateral instrument that will be valid in almost all EU member states.

  14. How are cryptocurrencies treated under the regulatory framework in your jurisdiction?

    Different types of cryptocurrencies can be distinguished: native coins, stable coins, commodity-backed tokens, (pre)payment or currency tokens, asset or investment tokens, utility tokens and hybrid tokens combining one or more of the terms of the aforementioned tokens.

    Up until now, the position is taken that native coins (such as bitcoin and Ether) which are distributed to miners to incentivize them to maintain the consensus mechanism of the related blockchain (such as Bitcoin and Ethereum) is not an acknowledged type of funds within the meaning of PSD2 (as implemented in Dutch laws and regulations). As such, parties offering brokerage services or exchange services in respect of such native coins only are not (yet) considered to offer payment services. No financial regulatory framework is currently applicable to native coins. However, this will change in the near future.

    Such a clear regulatory boundary cannot be given in respect of cryptographic tokens. The existing laws do not apply neatly to innovations based on DLT or blockchains. Investment tokens that in essence provide the same type of rights that would normally be offered to holders of debt or equity securities, are generally considered security tokens under Dutch laws. The offering of such security tokens or trading in such tokens could trigger the application of Dutch securities laws and European laws such as the Prospectus Regulation and the second Markets in Financial Instruments Directive. But also stable coins and commodity-backed tokens raise regulatory questions, in particular in the field of electronic money and derivatives legislation.

    As per 10 January 2020, being the expected implementation date of the Fifth Anti-money Laundering Directive (AMLD V), so-called ‘custodial wallet providers’ and providers engaged in exchange services between virtual currencies and fiat currencies will fall under the integrity supervision of DNB. DNB has urged these ‘crypto operators’ to notify DNB as soon as possible, to ensure timely compliance with the new law, which is still in draft form (

  15. How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?

    We refer to paragraph 14. The European Union’s financial services commissioner Valdis Dombrovskis recently announced its intention to create an uniform European regulatory framework for cryptocurrencies (

    The Dutch minister of finance, Wopke Hoekstra, already called for such an approach in March 2018 ( As Hoekstra notes in his letter to the Dutch parliament, due to the inherent cross-border character of crypto currencies on, in particular, public blockchains, any regulatory initiatives taken should have a broad level of support. Aiming for a mere Dutch framework does not make much sense.

    Taken these developments and in particular the recent announcement of Dombrovskis, we expect the European legislature to publish and discuss draft European Level I legislation within the upcoming 12-24 months.

  16. Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?

    There are many blockchain projects still in the testing phase; not just in the Dutch financial markets sector but in all sorts of industries. As an example: BlockLab, an initiative of the Port of Rotterdam Authority and the municipality of Rotterdam, is testing blockchain use cases concentrating on two domains: energy and logistics. One of the logistics pilots is DELIVER, a collaboration with ABN AMRO and Samsung. On 1 July 2019 the first container was successfully shipped from Korea to the Netherlands in a ‘paperless and instantly financed’ manner. Via blockchain and other technology, it could be tracked from ‘door to door’ ( This is an interesting proof of concept in the supply chain and logistics sector and could result in letters of credit to be history relatively soon.

    Another example is the endorsement of the Dutch Blockchain Coalition in five societal blockchain use cases. These are in the fields of self-sovereign identity (SSI), logistics, education, pension and governmental subsidies ( The SSI use case is performed within the Techruption programme of, and in collaboration with, the Dutch Organization for applied natural scientific research TNO

    LabChain is yet another example: since May 2019 two hospitals in the Netherlands are using the device and software of LabChain to exchange encrypted lab results and medical patient data via a secure private blockchain with a predefined list of nodes (

    In the financial sector, many companies are experimenting with DLT or blockchain technology, both incumbents and fintech companies. There are multiple use cases, in particular ones to make back end systems more efficient and robust. Blockchain initiatives involving tokenization of assets seem to be the most popular and far advanced blockchain projects in the Dutch financial sector .

  17. To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?

    The Dutch financial regulators have published initial guidelines relating to the use of AI and self-learning algorithms in the financial sector. For example, the Netherlands Authority for the Financial Markets published guidelines on the duty of care involved in semi-automated asset management and its views on roboadvice ( The Dutch Central Bank (DNB) also recently published guidelines for the use of AI ( The acronym of these DNB guidelines is ‘SAFEST’, which hints at DNB's main message. The guidelines urge financial undertakings to use AI responsibly. AI applications in the financial sector should be Sound; someone must be Accountable; the outcome of AI should be Fair and Ethical; only sufficiently Skilled people should be involved in developing AI applications; and the use of AI should be Transparent and explainable. Responsible use of AI is key to prevent incidents which could have a substantial impact on financial stability.

  18. Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?

    As insurance is a financial product, both offering insurance products and services and advising or intermediating in respect thereof are subject to financial regulatory laws. The point of departure is technological neutrality. As a consequence, insurtech players are currently subject to the same regulatory framework applicable to their incumbent competitors. This results in fintech companies involved in the insurtech business in the Netherlands still being relatively limited.

    The AFM and DNB recently published a report describing the 10 key focus areas when using artificial intelligence (AI) in the insurance sector, in which the technical aspects of the use of AI are considered ( In line with the European Insurance and Occupational Pensions Authority’s recent report, the Dutch regulators emphasise the fact that the fast-evolving insurtech market should be monitored closely ( The regulators will pay special attention to the ethical aspects involved in insurtech solutions. The effects of AI (and other types of technology) on solidarity and insurability are important areas of focus.

  19. Are there any areas of fintech that are particularly strong in your jurisdiction?

    Fintech covers a broad spectrum of technology-driven innovation in the financial services sector. The Financial Stability Board divides fintech activities into five categories based on their economic functions, as follows (see

    • payments, clearing and settlement – examples include the new payment services under the second Payment Services Directive (PSD2) (payment initiation services and account information services) and the use of APIs to achieve a more open banking environment;
    • deposits, lending and capital raising – examples include alternative financing and crowdfunding platforms, whether or not based on blockchain technology;
    • insurtech – examples include insurance policies programmed as smart contracts and Internet of Things developments and similar big data collecting wearables, sensors or software;
    • investment management – examples include robo-advisory investment services, mobile trading applications and algorithm-based trading robots; and
    • market support – examples include cloud computing solutions (software as a service, platform as a service, business process as a service, data as a service and infrastructure as a service), regtech and innovative digital and biometric ID (know your customer) services.

    The payments, business lending and market support sub-sectors are the most embedded in the Netherlands.

  20. What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?

    Although fintech companies are not disrupting the stability of the Dutch financial system, the fintech industry is expanding and growing exponentially – both globally and in the Netherlands. Fintech companies are increasingly gaining territory in the broader financial services landscape. PSD2 is helping to promote broader acceptance of Fintech developments, while incumbents are also embracing the potential of fintech solutions.

    Dutch incumbents are investing in fintech companies and exploring other ways of collaborating with them (eg, Aegon’s fintech investments – in particular, in alternative financing platforms – via its venture fund Transamerica Ventures; ABN AMRO’s collaboration with Fintech Temenos and investment through its Digital Impact Fund; and ING Ventures, a fund focused on fintech investments, such as in Dutch Fintech company Cobase, which recently obtained its PSD2 licence from the Dutch Central Bank, enabling it to launch its multibank platform).

  21. To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?

    The Netherlands is home to numerous start-up accelerator programmes. We refer to paragraph 9 above. The largest Dutch banks and insurance companies have acceleration programmes (eg, ING –, or have founded their own fintech start-ups (eg, ABN AMRO’s crowdlending platform New10 and the account information service provider services provided via its Gripp app; Rabobank’s investment app Peaks; Nationale Nederlanden’s insurance app Gappie; and Kasbank’s currency overlay platform for professional investors, KasHedge).

  22. Are there any strong examples of disruption through fintech in your jurisdiction?

    Fintech solutions appear not to be disruptive up until now. In the payment and banking chain, this is probably mainly caused by the relatively high confidence that Dutch customers, still, have in incumbent financial undertakings. The impact of PSD2, and in particular access to the account provisions therein, could however have a more disruptive effect.

    Increased disruption and competition should perhaps be expected from the tech giants – for example, both ABN AMRO and ING recently announced the launch of Apple Pay as an instore payment method for its customers.