title: Netherlands — Operational Resilience & Critical Infra | World Payments Monitor canonical: https://payments.gi/jurisdictions/netherlands/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infra Confirmed confirmed 2026-06-27 Operational resilience is governed by the EU DORA Regulation (EU 2022/2554), applicable from 17 January 2025, which applies directly to Dutch PIs, EMIs, banks, investment firms and MiCA CASPs. DNB is the designated competent authority (with AFM for conduct entities), and DORA was implemented into Dutch law via Annex 35 of the Decree implementing EU Regulations on Financial Markets and Wft amendments (Stb-2024-199 / Stb-2024-379). DORA covers ICT risk management, major-incident reporting (4h/72h/1-month cadence), TLPT (TIBER-NL/TIBER-EU), and third-party/critical-provider oversight. Incidents are reported via the MyDNB / DLR portals. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/netherlands/) Standing sub-brief · as of 27 June 2026 206 words · last cycle 2026-10-04 #### Operational Resilience & Critical Infra DORA (Regulation EU 2022/2554) applies from 17 January 2025 directly to Dutch PIs, EMIs, banks, investment firms and MiCA CASPs. DNB is the designated competent authority via Annex 35 of the Decree implementing EU Regulations on Financial Markets, with national implementation through Wft amendments Stb-2024-199 (enforcement) and Stb-2024-379 (fines). The regime covers ICT risk management, incident reporting, threat-led penetration testing and critical-provider oversight. DORA is live and in-force, and the ESAs have designated 19 critical third-party providers. The operational cadence is specific. Once an incident is classified as major, initial notification is due within 4 hours of classification (and no more than 24 hours after detection), an intermediate report within 72 hours, and a final report within one month, reported via the MyDNB and DLR portals. DNB's TIBER-NL builds on DORA Article 26 threat-led penetration testing. Firms must keep a register of ICT third-party arrangements under Art. 28(3), submitted via MyDNB. #### Outlook W3 is established and stable: DORA is in force, the competent authority is designated, and national fines are codified in the Wft. There is no live timeline change this cycle. The standing watch is supervisory practice on incident classification and third-party-register completeness as DNB beds in its enforcement approach. Periodic update · new data 2026-10-04 #### Operational Resilience & Critical Infrastructure De Nederlandsche Bank's phased implementation of the EU Instant Payments Regulation continues to reshape operational requirements for payment service providers in the Netherlands, with two distinct elements surfacing this cycle. First, DNB confirms that non-bank payment institutions and electronic-money institutions must be able to send and receive instant credit transfers from 9 April 2027, extending an obligation that, under the Regulation's phased timetable, has applied to banks on an earlier schedule. This closes a gap in instant-rail capability between bank and non-bank payment service providers, a distinction that matters here because the obligation timetable itself differs materially between the two PSP types rather than being a uniform requirement from a single date. Second, and reported with slightly lower source confidence, DNB's compliance posture update indicates that transaction-based sanctions screening is no longer permitted for instant credit transfers. In its place, DNB requires harmonised periodic, name-based screening together with annual rejection-rate reporting. This is an operational-resilience and critical-infrastructure requirement rather than an AML/CFT policy change in its own right: it governs how screening is architected and reported for instant-payment infrastructure, not the underlying AML obligations that sit with financial-crime compliance functions. The practical effect for payment service providers, both bank and non-bank, is that the screening methodology they run against instant credit transfers must shift from a per-transaction check to a periodic, name-based process, with the added obligation of reporting rejection rates annually to the supervisor. Both developments trace to DNB's own publications on the Instant Payments Regulation timetable rather than to a single incident or enforcement action, and both should be read as part of the same phased rollout: the Regulation progressively extends instant-rail capability and screening-methodology requirements across the Dutch payments market, with the April 2027 date for non-bank PSPs being the next concrete milestone. #### Outlook The operative deadline for non-bank PSPs is 9 April 2027, by which point instant credit transfer send-and-receive capability must be in place. The screening-methodology shift to periodic name-based checks with annual rejection-rate reporting is reported as already underway in DNB's compliance posture, and payment service providers should expect this to remain the operative screening architecture going forward absent a further DNB update. **1 earlier distinct update(s)** Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure De Nederlandsche Bank has integrated the Digital Operational Resilience Act, in force since 17 January 2025, into its existing IT-risk supervisory approach for Dutch financial entities, covering ICT risk-management, incident-reporting, and third-party-risk requirements under the DORA framework. This integration reflects a supervisory pattern in which a mature, already-established IT-risk oversight function absorbs a new EU-wide operational-resilience framework rather than standing up a parallel structure, meaning that Dutch financial entities already subject to DNB IT-risk supervision face DORA compliance as an extension of existing supervisory relationships rather than an entirely new one. The practical significance of this integrated approach is that DORA's third-party-risk provisions, which require financial entities to manage and report on risk arising from critical ICT third-party service providers, are now assessed by DNB through the same supervisory channel used for its pre-existing IT-risk oversight. This has implications for how payment institutions and other DNB-supervised entities experience DORA compliance in practice: rather than a distinct new reporting relationship, it is folded into established supervisory touchpoints. #### Outlook The operational-resilience picture for the Netherlands is one of continuity rather than disruption, with DORA's substantive requirements already active since January 2025 and absorbed into DNB's established supervisory practice. The area to watch is how DNB's integrated approach scales as DORA's third-party-risk and incident-reporting requirements mature in application, particularly for entities relying on shared critical ICT infrastructure providers across the EU. **Sources and findings (4)** 1. T1 [https://www.dnb.nl/en/sector-information/open-book-supervision/laws-and-eu-regulations/dora/](https://www.dnb.nl/en/sector-information/open-book-supervision/laws-and-eu-regulations/dora/) retrieved 2026-06-27 2. T3 [https://www.cyadviso.com/dora-netherlands-dnb-afm](https://www.cyadviso.com/dora-netherlands-dnb-afm) retrieved 2026-06-27 3. T2 [https://www.norea.nl/uploads/bfile/25981d72-97fe-4c33-8e14-b06ebf32adc6](https://www.norea.nl/uploads/bfile/25981d72-97fe-4c33-8e14-b06ebf32adc6) retrieved 2026-06-27 4. T1 [https://www.dnb.nl/en/sector-information/open-book-supervision/laws-and-eu-regulations/dora/](https://www.dnb.nl/en/sector-information/open-book-supervision/laws-and-eu-regulations/dora/) retrieved 2026-06-27