Netherlands: Operational Resilience & Critical Infra

Operational Resilience & Critical Infrastructure

De Nederlandsche Bank's phased implementation of the EU Instant Payments Regulation continues to reshape operational requirements for payment service providers in the Netherlands, with two distinct elements surfacing this cycle. First, DNB confirms that non-bank payment institutions and electronic-money institutions must be able to send and receive instant credit transfers from 9 April 2027, extending an obligation that, under the Regulation's phased timetable, has applied to banks on an earlier schedule. This closes a gap in instant-rail capability between bank and non-bank payment service providers, a distinction that matters here because the obligation timetable itself differs materially between the two PSP types rather than being a uniform requirement from a single date.

Second, and reported with slightly lower source confidence, DNB's compliance posture update indicates that transaction-based sanctions screening is no longer permitted for instant credit transfers. In its place, DNB requires harmonised periodic, name-based screening together with annual rejection-rate reporting. This is an operational-resilience and critical-infrastructure requirement rather than an AML/CFT policy change in its own right: it governs how screening is architected and reported for instant-payment infrastructure, not the underlying AML obligations that sit with financial-crime compliance functions. The practical effect for payment service providers, both bank and non-bank, is that the screening methodology they run against instant credit transfers must shift from a per-transaction check to a periodic, name-based process, with the added obligation of reporting rejection rates annually to the supervisor.

Both developments trace to DNB's own publications on the Instant Payments Regulation timetable rather than to a single incident or enforcement action, and both should be read as part of the same phased rollout: the Regulation progressively extends instant-rail capability and screening-methodology requirements across the Dutch payments market, with the April 2027 date for non-bank PSPs being the next concrete milestone.

Outlook

The operative deadline for non-bank PSPs is 9 April 2027, by which point instant credit transfer send-and-receive capability must be in place. The screening-methodology shift to periodic name-based checks with annual rejection-rate reporting is reported as already underway in DNB's compliance posture, and payment service providers should expect this to remain the operative screening architecture going forward absent a further DNB update.