Fintech 2026

NETHERLANDS Law and Practice Contributed by: Roderik Vrolijk, Rogier Raas, Ingrid Viertelhauzen and Maarten Weekenborg, Stibbe

Fintech firms that hold a licence under the Wft will typically qualify as Wwft gatekeepers, meaning they bear direct responsibility for identifying and mitigating money laundering and terrorist financing risks aris - ing from activities conducted on or through their plat - forms. DNB has explicitly stated that CASPs fulfil an important gatekeeper role, as evidenced by enforce - ment actions against unlicensed parties. 2.10 Significant Enforcement Actions AFM and DNB can take a variety of informal and formal enforcement actions. Serious regulatory violations, including unlicensed activity, money laundering and market abuse may also qualify as criminal offences under the Dutch Economic Offences Act ( Wet op de economische delicten ). Informal measures have no statutory basis and typi - cally include compliance briefings and written warn - ings. Formal administrative sanctions escalate pro - gressively: • remedial – order subject to periodic penalty pay - ment ( last onder dwangsom ) or instruction ( aanwijz- ing ); • punitive – administrative fine ( bestuurlijke boete ); and • structural – (a) licence restriction or revocation; (b) appointment of a curator; (c) suspension of voting rights; or (d) prohibition on performing functions. Sanction decisions are generally published, exposing fintechs to significant reputational damage. Individual accountability is increasingly invoked, with de facto directors ( feitelijk leidinggevenden ) potentially facing fines alongside the infringing entity. 2.11 Implications of Additional, Non- Financial Services Regulations Beyond financial regulation, industry participants face an expanding body of horizontal rules on privacy, cybersecurity, online content and software govern - ance. For firms active on social media or operating user platforms, content moderation and transparency duties under EU digital regulation are increasing. Soft - ware development is increasingly affected by prod -

uct safety, accessibility and AI-related rules, requir - ing documentation, risk assessments and life cycle governance. Compared to legacy players, digital-native entrants may be structurally better equipped to comply with data governance and secure-by-design requirements. While core obligations under privacy, cybersecurity and digital regulation formally apply equally to fintech and legacy players, their risk exposure might differ in practice. Fintech firms are typically more exposed to scrutiny due to data-driven models, cloud use and AI deployment. 2.12 Review of Industry Participants by Parties Other Than Regulators External auditors play a key review role, both generally in relation to the often mandatory audit of the financial statements, as well as the mandatory audit of regula - tory reporting by specific regulated entities, including payment institutions and banks. The Wft also obliges these auditors to notify DNB without delay of any cir - cumstance that breaches prudential requirements or jeopardises the institution’s viability, effectively making external auditors an extension of prudential oversight. Since January 2025, DORA further requires financial entities to secure contractual audit and inspection rights over their ICT third-party service providers, subjecting critical vendors to regular review. Industry bodies – including the Holland FinTech Asso - ciation, the Dutch Payments Association ( Betaalve- reniging Nederland ), the Dutch Banking Association (NVB) and the United Payment Institutions Nether - lands (VBIN) – promote best practices and facilitate knowledge-sharing but exercise no binding supervi - sory or enforcement powers. 2.13 Conjunction of Unregulated and Regulated Products and Services It is common practice for fintech firms to offer unreg - ulated services alongside regulated ones. Platforms may combine payment processing or investment ser - vices with unregulated activities such as data aggre - gation, financial planning tools or lead generation and several typical business models involve offering

570 CHAMBERS.COM

Powered by