Technology & Cyber regulatory updates from Netherlands.
We track 19 Technology & Cyber updates from Netherlands regulators, published by AFM. The archive covers 8 reports, 6 guidance notes and 3 speeches. Most recent update: November 2026.
Financieel dienstverleners zetten AI steeds vaker in. Verantwoord gebruik vraagt daarom om duidelijke kaders. Tegelijkertijd blijven cyberdreigingen toenemen en vraagt de naleving van vergunningseisen om aandacht. Ook zien we een belangrijke rol voor financieel dienstverleners bij het versterken van de financiële…
Why this matters
The item is an AFM news piece presenting the findings of the 'Sector in beeld financieel dienstverleners' overview, so the content type is report. It covers AI governance expectations, cyber risk and outsourcing of critical ICT services, and the timely notification and fit-and-proper testing of daily policymakers.
Met nog een jaar te gaan tot de invoering van T+1-settlement op 11 oktober 2027 roept ESMA marktpartijen op hun voorbereidingen af te ronden, hun operationele gereedheid te beoordelen en zo snel mogelijk te starten met testen in de handels- en afwikkelingsketen. Met de publicatie van de laatste technische standaarden…
AI Analysis
AFM is relaying ESMA’s confirmation that the EU T+1 settlement framework is complete and that securities transactions will move from T+2 to T+1 on 11 October 2027. The immediate compliance priority is the first phased requirement, applying from 7 December 2026, for investment firms and their professional clients to exchange allocations and confirmations through electronic, standardised and machine-readable channels; industry commentary highlights material impacts on automation, matching, settlement instructions, custody, FX, liquidity and cross-border operating models.
Key dates
2026-12-07 Deadline
First phased requirements under the amended RTS on settlement discipline and related ESMA guidelines apply to allocations and confirmations, including electronic, standardised and machine-readable communications, subject to the temporary technical disruption exception.
2027-07-01 Deadline
Additional phased requirements under the amended RTS on settlement discipline become applicable, as specified in the regulation’s transitional provisions.
2027-10-11 Deadline
Regulation (EU) 2025/2075 applies and the EU standard securities settlement cycle changes from T+2 to T+1; the final phase of related settlement-layer requirements also applies.
Suggested considerations
Firms should map every affected transaction type, market, currency, venue, CSD, custodian, broker, client and outsourcing provider across the full trading and settlement ecosystem rather than assessing only internal readiness.
Compliance and operations teams may wish to confirm whether allocations and confirmations can be completed on trade date and transmitted through electronic, standardised and machine-readable channels from 7 December 2026, including accurate place-of-settlement data where required.
Firms should assess and test ISO or other applicable international messaging standards, matching platforms, standing settlement instruction governance, exception handling and the documented process for temporary technical disruptions.
Firms should identify manual processing steps that cannot reliably operate within the shortened timetable and consider automation, straight-through processing, reconciliation, controls over data quality and resilient fallback arrangements.
Firms should obtain implementation commitments and test plans from clients, brokers, custodians, CSD participants, CSDs, CCPs, vendors and outsourcing providers, with evidence of end-to-end testing and defect remediation.
Firms should review liquidity, collateral, margin, FX funding, corporate-action, securities-lending, fund dealing and investment-operation processes for the reduced interval between trade and settlement.
Firms should maintain a regulatory change plan covering the phased milestones on 7 December 2026, 1 July 2027 and 11 October 2027, with senior management oversight, documented risk acceptance and escalation of unresolved dependencies.
What changed
Regulation (EU) 2025/2075 amends Regulation (EU) No 909/2014 (CSDR) and provides for the EU settlement cycle to apply on a T+1 basis from 11 October 2027. Commission Delegated Regulation (EU) 2026/1536 amends the RTS on settlement discipline in Commission Delegated Regulation (EU) 2018/1229, with phased application beginning on 7 December 2026. From 7 December 2026, the allocation and confirmation process must use electronic, standardised communication channels and international messaging standards, with machine-readable communications required except during temporary technical disruptions.
Compliance impact
This is a high-priority operational and regulatory change rather than merely a future-market convention: the 7 December 2026 allocation and confirmation requirements are binding requirements under the amended settlement-discipline framework, while the 11 October 2027 T+1 date is established by Regulation (EU) 2025/2075.
Steeds meer Nederlanders gebruiken AI-tools voor financiële vragen en beslissingen. Dat maakt advies toegankelijker, maar verhoogt ook de kans op foutieve informatie en bevestiging van je eigen bubbel, schrijft AFM-bestuursvoorzitter Laura van Geest in haar column voor het Financieele Dagblad. De column verschijnt op…
Why this matters
The document is a column by AFM chair Laura van Geest in the FD, which fits the speech category (op-ed by a named official). It addresses consumer use of AI tools for financial questions, covering risks of inaccurate information, echo-chamber effects, and the regulatory question of how GenAI relates to rules on...
Het Nederlandse juridische kader biedt momenteel geen basis voor effecten die uitsluitend als token worden uitgegeven, aangehouden en overgedragen. Daardoor dreigt Nederland achter te raken bij de ontwikkeling van digitale financiële markten en toekomstige financiële marktinfrastructuren. Dat concluderen de Autoriteit…
AI Analysis
AFM and DNB stated on 7 October 2026 that Dutch law does not currently provide a sufficient legal basis for securities that are issued, held and transferred exclusively as tokens, meaning native tokenisation is not presently workable under existing Dutch legislation. The publication is a policy signal rather than a new binding requirement, but it indicates that the regulators expect a coordinated government, supervisory and market process to assess legislative clarification and align the Netherlands with European tokenisation developments.
Key dates
2026-10-07
AFM and DNB published their joint policy statement and exploration on tokenisation of securities in the Netherlands.
2023-03-23
Applications became available under the EU DLT Pilot Regime as implemented and supervised in the Netherlands; this is relevant background for firms assessing DLT market-infrastructure models, not a new deadline arising from the AFM and DNB publication.
Suggested considerations
Firms should classify each proposed tokenised instrument by its legal and regulatory characteristics, distinguishing securities or other MiFID II financial instruments from crypto-assets covered by MiCA and from non-financial crypto-assets.
Compliance and legal teams may wish to document whether the proposed arrangement is native tokenisation or a hybrid model, identify which record constitutes the legally authoritative record, and assess the resulting title, transfer, custody, settlement and insolvency risks under Dutch law.
Market infrastructures and investment firms considering a DLT model should assess whether Regulation (EU) 2022/858 and the Dutch DLT Pilot Regime are available, including the need for specific permission and the eligibility limits applicable to DLT financial instruments and operators.
Firms should continue applying existing requirements, including MiFID II conduct and organisational rules, the Prospectus Regulation where applicable, Regulation (EU) No 596/2014 on market abuse, Regulation (EU) No 909/2014 on central securities depositories where applicable, and relevant custody, client-asset and investor-protection controls; the AFM and DNB statement does not disapply them.
Issuers, custodians, trading venues and service providers may wish to participate in or monitor the proposed government-supervisor-market follow-up and prepare concrete use cases that identify where statutory clarification, contractual documentation or a Dutch legislative amendment would be needed.
Firms operating cross-border should compare the Dutch position with jurisdictions that have introduced specific legal recognition for electronic or DLT-based securities, while avoiding reliance on another jurisdiction's legal treatment without confirming Dutch offering, custody, settlement and investor-protection implications.
Governance functions may wish to update technology, legal, operational-resilience and outsourcing risk assessments to account for the possibility that infrastructure and issuance activity migrate to jurisdictions offering greater legal certainty.
What changed
No legislation, regulatory technical standard, authorisation requirement or immediate compliance deadline was introduced. AFM and DNB jointly identified a legal gap: although EU and Dutch law do not generally prohibit DLT, market participants are commonly forced to maintain both a DLT-based record and a traditional legal administration, creating uncertainty about the legal significance of the token and limiting efficiency gains.
Compliance impact
The immediate compliance impact is limited because the publication creates no new binding obligation or deadline. Its strategic and legal significance is material: the regulators warn that continued reliance on hybrid records may create uncertainty over the legal status and transfer of tokenised securities and may cause investment and future market infrastructure to move to other jurisdictions, while signalling that Dutch legislative or regulatory clarification may follow.
Financial institutions are becoming increasingly dependent on digital systems. At the same time, the risks of disruptions are rising due to cyberattacks, geopolitical tensions, and the growing complexity of IT landscapes. A rapid and effective recovery of IT systems is essential to maintaining service availability for…
Why this matters
This is a regulatory intelligence report from the AFM (Netherlands Authority for the Financial Markets) examining IT recovery preparedness among large institutional asset managers. The content is informational in nature—presenting findings from a completed study rather than announcing new rules or enforcement actions.
Nederlanders houden hun financiën lang niet altijd actief tegen het licht. Veel mensen weten bijvoorbeeld niet of zij bepaalde verzekeringen hebben, hoe hun pensioen is geregeld of welke mogelijkheden hun betaalrekening biedt. Tegelijkertijd doet AI zijn intrede bij financiële keuzes: één op de zeven Nederlanders…
Why this matters
This is a press release announcing findings from the AFM's annual Consumer Monitor survey (2026 edition). The content is informational and research-based rather than prescriptive.
"As Europeans, we all are in the same boat, and therefore we should act in unison," zei Hanzo van Beusekom op de tiende Annual European Compliance and Legal Conference. "Not just because ‘we all breath the same air and we are all mortal’, as President John. F Kennedy once said. But also because we are all part of a…
Why this matters
This is a speech by AFM leadership at a compliance conference emphasizing the importance of unified European action on financial market regulation. The content references three themes—Resilience, AI, and Europe—and five conditions for centralized supervision, but provides no specific rules, guidance, or enforcement...
The financial sector has made major progress since the introduction of the Digital Operational Resilience Act (DORA). At the same time, as a result of its supervision and requests for information, the Dutch Authority for the Financial Markets (AFM) has identified areas requiring further action from financial…
Why this matters
AFM regulatory update on DORA compliance progress and implementation gaps. Informational content summarizing sector-wide developments, compliance improvements (94% register approval), and areas requiring attention (incident reporting, policy documentation, threshold calculations).
Businesses procuring IT services should join forces more often, as this is key to strengthening their digital autonomy. Public authorities and businesses should make digital autonomy a core consideration in their procurement decisions, helping to drive the development of European digital services.
Why this matters
Dutch supervisory authorities' joint press release on digital autonomy and reducing IT service provider dependencies. Addresses operational resilience through supply chain risk management and cybersecurity considerations aligned with DORA and NIS2 Directive implementation.
Het Financieel Stabiliteitscomité (FSC) constateert tijdens zijn vergadering van 26 juni 2026 dat geavanceerde AI-modellen het cyberdreigingslandschap ingrijpend veranderen. Het FSC benadrukt dat financiële instellingen hun cyberweerbaarheid hierop moeten aanpassen en pleit voor sterkere coördinatie en betere…
Why this matters
FSC press release discussing AI-driven cybersecurity threats to financial stability, private credit growth monitoring, and resilience requirements. Informational statement from regulatory committee addressing systemic risks and coordination needs across financial sector.
Veel pensioenuitvoerders gebruiken online tools voor keuzebegeleiding. Een aantal van die tools hebben we grondig geanalyseerd. In te veel gevallen stuitten we daarbij op fouten.
Why this matters
AFM guidance on testing online pension choice guidance tools for errors. Addresses consumer protection risks from faulty calculations and the need for proper testing procedures involving multiple expertise areas. Informational bulletin preceding a full investigation report.
De Autoriteit Financiële Markten (AFM) is een professionele en doelmatige toezichthouder die haar wettelijke taken doeltreffend uitvoert en aantoonbare resultaten boekt. Dat blijkt uit de onafhankelijke evaluatie van het functioneren van de AFM als zelfstandig bestuursorgaan (zbo) over de periode 2021–2025. In het…
Why this matters
This is an informational news article announcing the AFM's five-year regulatory evaluation results (2021-2025). The evaluation covers the AFM's supervisory effectiveness across multiple domains including crypto, cybersecurity, and sustainability. It is a positive assessment with recommendations for improvement.
Per 19 juni treedt de herziene Distance Marketing of Financial Services Directive (DMFSD) in werking. De DMFSD bevat regels ter bescherming van consumenten bij het online sluiten van overeenkomsten voor financiële diensten. De regels gaan over precontractuele informatie, een ontbindingsrecht voor consumenten en…
Why this matters
AFM regulatory guidance on DMFSD implementation (effective 19 June 2024) regarding consumer protection in online financial services. Addresses dark patterns and manipulative design in digital customer journeys across multiple financial sectors.
In its SREP Market Overview 2025, the AFM notes that many firms have their foundations in order, but that implementation is lagging behind. Internal control and IT risks, in particular, require improvement. The message is clear: ensure that policies are not merely in place, but that they demonstrably work in practice.
Why this matters
AFM's SREP Market Overview 2025 provides regulatory guidance on implementation gaps in internal controls, IT risk management, and governance. This is informational content highlighting supervisory expectations rather than announcing new rules.
Advanced AI models can speed up the process of identifying and combining vulnerabilities. As a result, organisations have less time to address vulnerabilities and mitigate incidents. Small and medium-sized enterprises in particular, with less advanced security or older systems, may be relatively more vulnerable. The…
Why this matters
AFM speech addressing AI-driven cyber threats and resilience requirements. Applies broadly across financial services sectors with emphasis on vulnerability management, patch management, and incident response. Classified as informational/advisory content rather than binding regulation, hence null urgency.
The escalation of the Middle East conflict leaves the global economy in a clearly worse state than previously expected. Higher inflation expectations, lower growth and heightened uncertainty are also affecting the financial sector, according to the annual Financial Stability Report from the Dutch Authority for the…
Tijdens de verenigingsdag van het Verbond van Verzekeraars stond Hanzo van Beusekom (AFM) stil bij de impact van data en digitalisering op de verzekeringssector. In zijn speech schetste hij hoe technologische ontwikkelingen het mogelijk maken om premies steeds persoonlijker te maken. Dat biedt kansen, zoals beter…
Why this matters
AFM speech addressing balance between data-driven personalization and insurance solidarity principles. Focuses on conduct expectations for insurers regarding algorithmic pricing and risk of consumer exclusion. Informational/guidance content rather than binding regulation, hence null urgency.
De Autoriteit Financiële Markten (AFM) waarschuwt voor telefoontjes van mogelijke oplichters die uit naam van de AFM bellen en zo proberen u gevoelige informatie te laten delen.
Why this matters
AFM consumer warning about phone spoofing fraud targeting financial sector customers. Alerts about identity theft, credential harvesting, and unauthorized access attempts. Applies broadly across financial services as threat affects all regulated entities and their customers.
Financial institutions are working to make their digital services accessible. This is important, because it ensures that people with disabilities can manage their finances independently. To provide further guidance to the sector, the Autoriteit Financiële Markten (AFM) shares expectations and points of attention in…
AI Analysis
AFM’s third EAA update makes clear that Dutch financial institutions must not only fix accessibility gaps, but also **assign clear internal accountability**, **embed accessibility compliance in governance and monitoring**, and **submit more specific non-compliance notifications**. AFM also announced a **sector-wide compliance review in the coming months**, with a focus on whether websites meet WCAG criteria, especially **level A** requirements, so compliance teams should treat this as an active supervisory campaign rather than routine guidance.
Key dates
28 June 2025
- The European Accessibility Act came into force, and Dutch national measures began applying to covered new products and services
Coming months (TBD, est. late 2026) Deadline
- AFM will conduct an accessibility compliance review of the sector, focusing on WCAG compliance, especially level A criteria
23 April 2026 Deadline
- AFM published its third EAA update and announced a forthcoming sector compliance review
Suggested considerations
Firms should map all consumer-facing digital services and identify which websites, apps, and digital documents fall within EAA/WCAG scope.
Firms should assign a named internal owner for accessibility compliance, monitoring, remediation tracking, and regulatory notifications.
Firms should document accessibility risks and remediation plans for each in-scope digital service, including the precise pages, functions, or documents affected.
Firms should embed accessibility checks into design, development, testing, and change-management processes so compliance is monitored continuously.
Firms should review EAA non-compliance notifications and make them more specific, including the exact accessibility issues, affected locations, and remediation status.
What changed
- AFM expects financial institutions to identify accessibility risks in their digital services and implement improvements that meet the required WCAG criteria.
AFM expects firms to embed and monitor accessibility through internal processes, rather than treating accessibility as a one-off remediation project.
AFM is emphasizing clear accountability for safeguarding digital accessibility, which means firms should be able to show who owns accessibility compliance, monitoring, and remediation internally.
AFM says EAA notifications of non-compliance must be more specific, because current submissions often do not describe the exact accessibility issues or where they are located.
AFM has published further instructions on how to answer certain questions in the EAA notification form, indicating a stronger supervisory focus on the quality of regulatory reporting.
Compliance impact
The compliance risk is material because AFM is moving from guidance to active review and may directly challenge firms with shortcomings. In practice, poor documentation, vague notifications, or weak governance can expose firms to supervisory intervention, remediation orders, and escalating scrutiny over the accessibility of consumer-facing channels.