This country-specific Q&A provides an overview to Fintech law in The Netherlands.
It will cover open banking, regulation of data, cryptocurrencies, blockchain, AI and insurtech.
This Q&A is part of the global guide to Fintech. For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech/
What are the sources of payments law in your jurisdiction?
The legal framework in the Netherlands regarding payments is predominantly based on European legislation. Obviously, the Payments Services Directive (“PSD”) is the most important piece of legislation in this respect. In the Netherlands, the PSD has been implemented in the Dutch Civil Code and the Financial Supervision Act. The Netherlands did not make use of the Member State option to treat micro-enterprises the same way as consumers. Other examples of relevant sources of European legislation are the Regulation on cross-border payments, the E-money Directive, the SEPA Regulation, the Payment Accounts Directive and the Interchange Fee Regulation.
Implementation of the revised PSD, better known as the PSD2, has been seriously delayed and is expected to take place by the end of 2018. In anticipation of the implementation, institutions can already submit a draft application for a PSD2 license.
Can payment services be provided by non-banks, and if so on what conditions?
Apart from banks, payment services can also be provided by authorized payment institutions (“PIs”) and E-money institutions. The Dutch Central Bank (“DNB”) is responsible for granting a PI license and ongoing supervision. Most regulatory requirements for obtaining a PI license are based on the PSD/PSD2. However, DNB also imposes “local” requirements. For example, institutions that apply for a PI license must submit a so-called recovery and resolution plan and a systematic integrity risk analysis (SIRA). The purpose of a recovery plan is to make sure that if the financial viability of a PI can no longer be guaranteed, sufficient funds are available to orderly dissolve the business without any adverse effects for payment service users and other stakeholders. In addition, institutions must have sufficient “substance” in the Netherlands. Although this will be assessed by DNB on a case-by-case basis, a PI should in any event have two directors who are based in the Netherlands and also be active on the Dutch market. Moreover, payment transactions must be routed via depository, typically in the form of a customer accounts foundation. Such a stand-alone legal entity does not have shareholders and its sole purpose is to receive and transfer customer funds. This regulatory requirement has the advantage that such “ring-fenced” customer funds would not fall in the PI’s bankruptcy estate.
Authorized PIs in other EU member state are allowed to provide payment services in the Netherlands by means of the so-called "pass-porting" regime.
What are the most popular payment methods and payment instruments in your jurisdiction?
In the Netherlands, debit card payments have already overtaken cash payments, and the debit card dominance is expected to steadily become bigger in the coming years. According to a recent survey by the Dutch Payments Association and DNB, consumers paid 61% of their purchases at points-of-sale by using debit card and 39% in cash in the first half year of 2018. This increase in debit card payments is in part driven by the introduction of contactless payments in 2014. Currently, about half of consumers’ debit card payments are contactless. As a result of the demise in the use of cash, ABN AMRO, ING and Rabobank will migrate their entire ATM network to Geldservice Nederland who will operate the ATMs under a bank-independent ATM brand. Parties aim to complete the migration by the end of 2020.
In the Netherlands, we have a bank-owned online payment method called iDEAL which is based on the so-called ‘redirect’ model. This means that a user making an online payment is redirected to his own bank’s secure website to authorize the payment transaction. iDEAL remains by far the most popular method for online payments in the Netherlands, well beyond credit card use, and is the focus of continued innovation (such as QR code-based payment).
Many Dutch banks have launched innovative and seamless payment apps that can be used for credit transfers and to redeem money from others. These apps typically use iDEAL and enable users to send a payment request via Whatsapp, Facebook Messenger or SMS. These apps are very popular, especially among younger generations , with one app currently having more than two million active users.
From the beginning of 2019, Instant Payments will become available in the Netherlands. All major Dutch banks will be participating in this new payment scheme. Instant Payments enables credit transfers to be credited immediately to the account of the beneficiary, resulting in access to the funds for the payee within seconds, 24/7, any day of the year. Compared with the European standard, these Instant Payments are processed more quickly and do not have a maximum limit. It is generally expected that Instant Payments will pose a serious threat to credit card based payments.
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
Unlike various other European jurisdictions, screen scraping is not allowed in the Netherlands. This ban on screen scraping is based on a landmark court decision in 2014. Obviously, as a result of the PSD2, account information service providers (“AISPs”) and payment initiation service providers (“PISPs”) will be granted access to a customers’ bank account (“XS2A”).
Although the implementation of the PSD2 has been seriously delayed, all major Dutch banks are testing their newly designed application program interfaces (APIs) for PSD2. Currently, it’s still unclear when AISPs and PISPs will be allowed to use the banks’ PSD2 APIs.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
The use of data in the payment industry is currently a hot topic in the Netherlands. Data relating to payments is becoming increasingly important and its use is growing rapidly. The year 2018 is also the year the GDPR and the PSD2 put the use of data in payments in the spotlights again.
The GDPR directly applies in the Netherlands and sets the rules regarding the use of processing of personal data. Banks and payment institutions need to comply to these rules. The PSD2 requires, as an additional condition, that a payment service user has to provide its ‘explicit consent’ to a third party service provider before this party is allowed to process personal data relating to payments lawfully. The data protection provisions under the GDPR and the PSD 2 together provide for the regulation of data in payments.
One of the reasons why the implementation of the PSD2 has been seriously delayed, related to ongoing discussions as to which regulator was to supervise ‘explicit consent’; DNB or the Dutch Data Protection Authority (“AP”). It has now been decided that the AP will supervise this regulatory requirement. Nevertheless, both regulators have stated that the exact interpretation of the ‘explicit consent’ in practice will be jointly designed by DNB and the AP.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
The Dutch financial regulators, DNB and the Authority for the Financial Markets (“AFM”), are supporting fintech innovation and are willing to enter into a constructive dialogue with fintechs wishing to launch innovative financial services and products. As such, they have launched the so-called ‘InnovationHub’, which offers both fintechs and incumbents the opportunity to submit questions about the scope and applicability of regulatory requirements.
DNB and AFM have also launched a regulatory sandbox, which allows fintechs to test their potentially innovative financial services and products in a designated area. The regulatory sandbox is only available for fintechs that come up with an innovative and valuable concept, but are reasonably unable to comply with the applicable regulatory requirements. One of the criteria to apply for the sandbox, is whether the innovative concept has any added value for the financial industry.
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
We do not foresee any imminent risks to the growth of the fintech market in the Netherlands. However, DNB has raised the potential vulnerabilities that emerge as a consequence of the increased usage and storage of data. This risk might not threaten the growth of the fintech market directly, but DNB does view this risk as prominent since it raises new supervisory questions. Other potential risks are:
a) Some fintechs may be too occupied with achieving fast growth and market share and are less concerned about mitigating potential risks and compliancy with the applicable laws and regulations.
b) Incumbents may lose considerable part of their market share if bigtechs – with their massive client base – will for example claim their role within the payments chain or will start granting consumer credit. Since such parties are currently subject to lighter regulation in comparison to banks, this could potentially result in financial instability.
c) Since bigtechs and other fintechs will most likely monetize payment service users’ data, this could lead to privacy infringements and other unethical behavior.
d) The rise of new, innovative services and service providers makes the financial system more complex and less transparent. This in turn makes supervision more difficult and raises a series of legal issues, such as consumer protection.
e) The increase of the number of actors in the payment chain (e.g. banks and PIs (acting as acquirer or issuer), card schemes, clearing institutions, AISPs and PISPs) makes it more difficult to establish who is responsible and/or liable vis-à-vis the end user.
Obviously, since no one can predict what will happen in the (near) future, it remains to be seen whether any of these risks will actually materialize.
What tax incentives exist in your jurisdiction to encourage fintech investment?
The Netherlands provides for the so-called “innovation box” regime to incentivize R&D activities. Under the innovation box regime, profits that can be allocated to a particular intangible asset, self-developed in the Netherlands, are subject to corporate income tax at a reduced tax rate of 7%. The percentage of profits that can be allocated to the particular self-developed intangible asset is determined on a case-by-case basis in consultation with the Dutch tax authorities. Upon request of the taxpayer, the percentage of the profits which can be allocated to the “innovation box” may be the subject of a tax ruling.
Another tax related incentive of which fintechs may benefit, is that companies with employees performing certain R&D activities in the Netherlands may apply for an R&D tax credit. Such companies may benefit from a reduction of wage tax and national insurance premiums with respect to salaries paid to its employees performing the relevant R&D activities.
Finally, for highly skilled expat employees moving to the Netherlands, the employer may grant a tax free allowance equivalent to 30% of the gross salary for wage tax purposes (30%-ruling). A highly skilled expat is (in short) defined as an employee that (i) has a gross salary of at least € 37,296 (2018), and (ii) has not lived within 150 km of the Dutch border for more than eight months out of the last 24 months prior to the start of employment in the Netherlands. The maximum duration of the 30%-ruling is eight years. In 2017, the Dutch government announced to reduce the duration to five years. No conditions apply to the nature of the activities performed by the employee.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Especially fintechs that are offering innovative payments, identification and security solutions are attracting significant investments in the Netherlands. The level at which investments in fintech start-ups and scale-ups are made, does not significantly deviate from the overall level of investments in similar stage non-fintechs with a relatively high percentage of investments as seed capital and in the series A. Looking at deal value, the Dutch PI Adyen leads the ranks with their IPO during the end of Q2 of 2018, as a result of which Adyen was valued around 7.1 billion euro (at the time of the IPO).
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
The World Economic Forum has ranked the Netherlands as the world’s sixth most competitive country as a result of its solid performance and top ten ranking for “infrastructure, health and primary education, higher education and training, goods market efficiency, technological readiness, business sophistication, and innovation”. The Netherlands is also the third-most competitive economy in Europe.
According to the Dutch Ministry of Finance, the Netherlands’ financial sector is well positioned across Europe, with modern oversight legislation, stable business climate and qualification of professional population as key factors for the location of financial institutions. The financial sector is by far the largest sector in the Netherlands.
Furthermore, according to the European Digital Forum’s 2016 Startup Nation Scoreboard, the Netherlands ranks number 1 in the EU for its startup business climate. Factors that contributed to this position are the digital infrastructure, the, the highly educated, English–speaking workforce and the open corporate business culture.
The Netherlands has over 400 fintechs, mostly located in Amsterdam. The Netherlands, and Amsterdam in particular, is known for being a prominent hub for fintechs in Europe due to its strong entrepreneurial environment, its excellent (digital) infrastructure, its reliable and cooperative regulators and its access to a highly skilled workforce.
In light hereof, many leading trading firms (e.g. IMC, Optiver and Flow Traders), fiat-to-cryptocurrency exchange platforms and online lenders such as Spotcap and Funding Circle are located or active in the Netherlands. In the wake of Brexit, we have also seen an increasing number of trading firms relocating to the Netherlands. In that respect, it really helped that the AFM has a strong reputation as a market-friendly watchdog with a deep understanding of the equities and derivatives markets. Given its sophisticated payments ecosystem, the Netherlands is also home to many global PIs such as Adyen, Payvision and Global Collect.
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
The Netherlands has a liberal business immigration policy. Immigration schemes are intended to facilitate highly skilled labor immigration, rather than restricting it. Employees from an EEA-country or Switzerland do not need a residence and work permit. There are several work authorization schemes that can be used for employees from other jurisdictions.
The knowledge migrant (KMR) scheme KMR scheme is a fast and reliable immigration scheme for highly skilled personnel. Instead of a test on skills and qualifications, a salary threshold is the only material requirement. Required for the KMR permit is that the foreigner has signed an employment contract. For personnel under the age of 30, the salary threshold is set at € 3,229 and for personnel aged 30 or above, the salary threshold amounts to € 4,404. The employer must be recognized as a sponsor by the Immigration & Naturalisation Service when attracting highly skilled migrants. Spouses are allowed to accompany the foreign worker in the Netherlands and are allowed to work as well.
Other options are provided by European legislation such as the European Intra Corporate Transferee permit (ICT-permit). This permit is intended for enterprises that have at least one entity outside the EU and that belong to the same group of companies. This permit requires the work contract between the transferee and the sending company outside the EU to exist. Again, a salary threshold is applicable. And the European Union Blue Card is the European alternative for the KMR permit offering more mobility rights.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
As far as we know, such a gap does no appear to be present in The Netherlands. The aforementioned accelerated migration procedure is praised for facilitating fintechs with highly skilled migrants.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
Ideally, fintech entrepreneurs enjoy the benefit of patent protection. This offers a temporary monopoly on a specific technology and substantiates the innovative merits of the company (an asset often looked at by investors). The Netherlands, like other European jurisdictions, allows certain technological inventions to be protected by patent. The particular upside of a Dutch patent is that the application procedure is relatively cost and time efficient, because the patent is granted regardless whether it meets all the requirements. This means that a Dutch patent also provides an interesting buffer before a company decides to take the international route and apply for patents in other jurisdictions, which can be very costly.
Fintechs that do not meet the innovative and technological thresholds for a patent, can rely on copyright and trade secret protection. Both forms of protection are largely harmonized by the EU and will not differ much from other EU jurisdictions. Copyright protects fintechs from plagiarism of its software (the interface and the source code). This protection is granted automatically, although the company will have to be able to proof how and when it acquired the rights to the software it developed. Trade secret protection allows fintechs to protect its knowhow. Such protection largely hinges on the contractual arrangements the business made with its personnel/contractors and the type of measures it has taken to ensure confidentiality.
Lastly, fintechs can and should apply for trademark protection to safeguard the goodwill associated with their brand. The Netherlands, like most other jurisdictions, offers much stronger protection to distinctive trademarks than marks that are considered generic or descriptive.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
Currently, cryptocurrencies are not considered as fiat currencies and are therefore not subject to any regulatory requirements in the Netherlands. The Dutch legislature and the DNB have furthermore indicated that there are no plans to implement any relevant legislation in the near future. Obviously, the AFM and DNB closely monitor all new developments concerning cryptocurrencies and the associated risks for investors. To that end, the supervisors have issued several warnings regarding the risks of investing in cryptocurrencies.
Currently, fiat-to-cryptocurrency exchange platforms as well as custodian wallet providers are not subject to any anti-money laundering rules. As a result of the 5th Anti-Money Laundering Directive, which entered into force on 9 July 2018, these parties will be brought within the scope of the EU anti-money laundering rules. Member States will have to implement the 5th Anti-Money Laundering Directive ultimately by 10 January 2020.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
Provided a digital token does not have clear characteristics of a ‘security’, such as dividend-, interest-, and/or voting-rights in the issuer, initial coin offerings (ICO’s) remain largely unregulated in the Netherlands. Unlike in the US, there’s currently no case law on this nor do we have something similar like the so-called Howey test, which aims to determine whether a token qualifies as a security. Despite the lack of legislation, the AFM and DNB have issued several warning regarding serious risks associated with ICOs. The issuance of digital tokens, mostly to fund start-ups, is considered vulnerable to misleading information, fraud and manipulation.
That said, there is one piece of legislation that may be relevant here. The Dutch unfair trade act applies to all trading activities vis-à-vis consumers, including ICO’s. This regulation aims to prevent unfair trade practices. In essence, it ensures that consumers are to be fully informed on the product or service and that no (unreasonably) unfair terms apply. Enforcement of the unfair trade act lies with the Dutch consumer and market authority, but to date there are no known cases of enforcement following ICO’s, or the (lack of) information provided prior an ICO.
Furthermore, the European Parliament and the European Commission have been working on a draft proposal for a new regulation for ICOs and other alternative investment channels such as crowdfunding. The EU acknowledges that these channels can help small and medium enterprises (SME’s) to obtain finance, which is why the EU wants to legislate them. However, these new ways also carry risks, such as fraud and the risk of cybersecurity attacks. Therefore, parties that want to offer ICOs should comply with the new rules as set out in the draft proposal.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
We are not aware of any live blockchain projects beyond proof of concept. That said, many Dutch banks are currently investing in multiple blockchain projects and are exploring the impact of blockchain on their core processes, products and services, from mortgages and risk models to cross-border payments. Even DNB has experimented with the potentials of blockchain with regards to payments. According to a recent release, DNB concluded that blockchain is currently not suitable for the existing financial payment infrastructure due to its insufficient ability to scale for large volumes of transactions and other issues. DNB also indicated that blockchain is still very interesting and promising and future algorithms may well offer improved compliance with financial market infrastructures requirements.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
Dutch banks are experimenting with AI technology, ranging from tools that may assist bank employees, to technology that directly interacts with customers. One Dutch bank for example is experimenting with chat robots understanding what clients want and what problems clients encounter. Through chat robots, the customer service will be contactable 24/7. It is predicted that 30% of the employment in the banking sector will be performed by robots, the chat robots will contribute to this development. The robots should be taught to make complex connections. For example, when a client asks if he has enough money on his bank account to go out for dinner that evening, the chat robot should be able to predict future costs that will be collected from his bank account, such as rent, mortgage and other fixed charges.
The AFM has declared it aims to facilitate the development of AI technology while mitigating the related risks (e.g. privacy infringements and cyber crime) at the same time. The main concern is that institutions will abuse the data they collect about how consumers make decisions. The decision making process of consumers is not always based on rational grounds; this fact could be misused and exploited via marketing techniques. A risk is called “evil nudging”: drawing consumers in a certain direction and make them buy goods they do not really need or want, while they are not aware they’re being tempted to behave like that.
For now, the AFM only investigates the existence of these risks. If the supervisor detects a breach in how companies use data for unwanted marketing techniques, the AFM will take action within the scope of the current legislation. As far as we know, new legislation is not yet in the making.
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
Although insurtech is on the agenda of many Dutch insurance companies, insurtech is known to be running behind other areas of fintech. Within the Netherlands, in general there is a current development of existing insurance companies to introduce new IT-solutions to change and improve their service to their customers and to exchange data with the customer. An example is providing customers with the opportunity to make claims under their insurance directly through an app, instead of through a written claim form. In addition, some insurance companies provide discounts on insurance premiums for car insurances if a customers shows safe behavior in traffic. In such case, travelling data is exchanged between the insurance company and the customer. On a more experimental basis, some existing insurers introduce for example peer-to-peer insurance, but so far these initiatives do not represent a substantial portion of the Dutch insurance market.
Some experts in the Dutch insurance market estimate that fintech solutions will evolve towards a situation in which insurers “plug” their insurance services into an existing economic “ecosystem”, for example regarding all services that relate to a household’s home.
Are there any areas of fintech that are particularly strong in your jurisdiction?
Areas of fintech that are particularly strong in the Netherlands are payments and trading (see
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
At the beginning of the fintech wave a few years ago, fintechs were often seen as disruptive and competitors that would jeopardize the traditional banks’ market share. Instead of becoming adversaries, however, we have seen an increased collaboration between fintechs and incumbents. Most fintechs need the incumbents for scaling up and market access whereas the incumbents require fintechs’ cutting edge technology to accelerate the pace of innovation within their own organization and to improve their products and services and introduce new ones.
Especially the major Dutch banks (ABN AMRO, ING an Rabobank) have established significant fintech funds for partnering with and investing in fintechs. The funds are generally available for seed stage investments to scaling stage investments.
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
Dutch banks and other incumbent financial institutions have invested heavily in own fintech development and innovation programs, such as the introduction of (mobile) payment apps, further enhancement of online banking , the use of AI and blockchain technology and so on. More and more, banks are offering a secure open banking platform for financial services by using APIs and are becoming a marketplace to other fintechs.
Are there any strong examples of disruption through fintech in your jurisdiction?
XS2A is one of the most important examples of disruption through fintech since payments is such a critical business for the banking industry. XS2A will no doubt impact current business models and require a rethink of business strategies – probably leading to a new wave of collaboration and partnerships in the new competitive landscape. Although bigtechs already have projects in the financial arena, it remains to be seen whether they will actually take the opportunity and claim their role within the payments chain and other financial services such as the loan market. If they do, this would certainly be a major potential threat with a disruptive effect. It is one thing to compete with new fintechs. Clearly, it is quite another thing to compete against major online platforms such as Google, Apple, Facebook and Amazon.