A Dutch licence for foreign fintechs.

Three reasons. Predictable supervisor process — DNB and AFM operate under codified procedures, documented timelines and defined assessment frameworks; the same questions surface across files, so you can prepare.

English-first correspondence — although Dutch is the official language, DNB and AFM accept and respond in English; files, governance documents and reporting can be in English, with Dutch translation only where specifically required.

Mature ecosystem — a dense network of compliance professionals, fintech-specialist law firms and ICT-risk advisors who can stand next to you through DNB exchanges.

Four routes, depending on where you stand today.

New Dutch entity with full DNB licence — establish a Dutch BV (or NV) and apply directly with DNB for a payment institution licence under the Wft. Twelve to eighteen months is realistic, averaging around fourteen.

EU passport from another Member State — if you already hold a licence in another EU Member State (e.g. Ireland or Luxembourg), you can passport into the Netherlands on a freedom-of-services basis or via a branch. Notification rather than authorisation; fast (two to three months), but your home regulator stays primary. Not available from a UK or US licence.

Dutch branch of an EU-licensed institution — a middle path: the branch operates under your home licence but with substantive Dutch presence (local management, local compliance officer, local AML programme).

Acquisition of an existing licensed institution — less common but viable: acquire a Dutch licensed payment institution. Faster time-to-market, but DNB must approve the change of control (itself a multi-month process).

Most foreign payment institutions reuse parts of the parent group — technology, fraud monitoring, customer support, finance. EU rules allow this, but under strict conditions: the Dutch entity remains the licensed party and must demonstrate compliance with every requirement, even where execution sits elsewhere in the group. The principle DNB tests against: you can outsource almost everything, except your responsibility.

For UK fintechs there is an added dimension — post-Brexit the UK is a third country, so group outsourcing from a UK parent faces the same scrutiny as any non-EU arrangement (data transfers, supervisory access, exit strategies, DORA resilience). Every material outsourcing relationship needs a contract, a risk assessment, a monitoring approach and an exit plan. Allow four months of preparation before submission.

After submission, the case officer typically distributes the file across internal teams — integrity, IT, outsourcing, prudential — each asking questions in their domain. Multiple rounds are normal; with each round the file is sharpened and DNB builds its assessment. It is a dialogue, not a paper review; direct lines with DNB save weeks, because you can quickly ask what they actually mean before drafting an unnecessarily long answer.

Expect regulation to shift mid-trajectory: in one recent case DORA entered into force during the application — four days later DNB asked the institution to show how it complied. The lesson is not “wait for stability” (there is none; PSD3/PSR is next) but to choose advisors who absorb such shifts for you.

For a new Dutch entity with a full DNB licence, with thorough preparation:

Months 1–2 — Scoping and structuring: map activities to PSD2 (and PSD3) categories, choose the legal vehicle, line up Dutch-resident directors, draft the business plan. A pre-application meeting with DNB surfaces fit-issues early.

Months 3–6 — File preparation: business plan, governance, fit-and-proper, ICT-risk and DORA, AML/Wwft programme, safeguarding architecture, capital plan, outsourcing register.

Months 7–12 — DNB review and questions: multiple rounds; a well-prepared file compresses this to four months, an underspecified one stretches to nine.

Months 13–14 — Operational onboarding: licence granted under conditions, open safeguarding accounts, finalise key hires, complete ICT testing, registration in DNB’s register, public launch.

Better to take a little more time up front and submit a thorough file than to rush and deal with extra rounds and delays later — that ultimately saves time.

Five mistakes we see often:

Treating the licence as a checkbox — DNB penalises applications that read as transactional; substance (real Dutch operations, real local management, real compliance discipline) is assessed, not just documented.

Underspecifying group outsourcing — the most common cause of rounds-of-questions; each material relationship needs a contract, oversight model, exit plan and risk assessment. For UK groups the third-country status amplifies this.

Optimistic safeguarding plans — the architecture must be operational at application time, with bank confirmation, segregation and reconciliation procedures.

Inadequate Dutch-resident representation — purely remote management rarely passes the substance test; key compliance and risk roles must be fillable by people who can be physically present at DNB.

Last-minute AML scaling — Wwft and TFR (Transfer of Funds Regulation) requirements scale with volume; an application forecasting €50M but documenting AML controls calibrated to €5M will be sent back.

We act as the single point of contact for both the client and the supervisor. We draft the file, manage the dialogue with DNB and translate between regulatory expectations and the realities of a growing foreign fintech — whether you are entering Europe from the US or rebuilding EU access from a UK base.

In the start-up phase we often take on the operational compliance and risk function ourselves on an interim basis, so the client can build while the regulatory track keeps moving. After authorisation we hand over to a permanent compliance officer or stay on retainer.

Yes — that is exactly the appeal. A Dutch PSP or EMI licence gives access to all EU/EEA markets through the European passport. In return, DNB requires real presence: mind and management in the Netherlands, locally accountable directors and sufficient own staff and processes. A letterbox construction will not pass the assessment.

Applying now remains the right route: a PSD2 licence stays valid for up to 27 months after PSD3 enters into force through grandfathering, provided re-authorisation is applied for in time. The smart move is to structure the file along PSD3 lines already — including the merged PI/EMI category — so the re-authorisation becomes an update rather than a rebuild.

DNB accepts application files in Dutch and in English. More important than the language is the structure: follow the eleven chapters from the DNB guidance, make sure policies, projections and the programme of operations are mutually consistent, and cross-reference instead of copying. Inconsistencies between documents are the biggest source of question rounds.