FinTech lawyer & legal expert

What we do

FinTech companies have had a significant impact on the financial sector by combining disruptive innovations with financial services. Various prudential questions have since arisen, and legislative directions have been taken. Today, FinTech companies must comply with various licensing requirements with the AFM and DNB.

FinTech companies face all kinds of legal issues regarding matters such as:

• Privacy and data protection
• PSD2 (payment service providers)
• Permits and compliance
• Blockchain
• Artificial Intelligence
• Cybercrime and security
• IT contracts
• Cloud services
• Service Level Agreements (SLA)

We have the knowledge and expertise to assume diverse roles: from advisory services to dispute resolution. We have an experienced team of lawyers and legal experts in the field of FinTech. Contact us to discuss the possibilities.

FinTech within financial law

FinTech is a key subject within financial law. Whereas a payment app, a crowdfunding platform, or a crypto service used to operate in a grey area, these activities now often fall under regular financial supervision. The core question is always: does your service require a license, and if so, from which supervisory authority and under which law? We therefore approach FinTech not as a standalone IT issue, but from the supervisory legal framework of the Financial Supervision Act (Wft) and the European regulations that build upon it.

Licensing and supervision: AFM and DNB

The licensing system under the Financial Supervision Act (Wft) is the guiding principle for virtually every FinTech company. The Authority for the Financial Markets (AFM) exercises conduct supervision and grants many licenses for financial services; De Nederlandsche Bank (DNB) exercises prudential supervision and assesses financial soundness. We map this out for you:

• whether your activity requires a license or falls under an exception or exemption (see, inter alia, Article 1:5a Wft for payment services);
• which permit you need and from which supervisory authority;
• which requirements apply to the suitability and reliability of directors, governance, and business operations;
• how you structure the application and conduct the dialogue with the supervisor.

If your company is faced with enforcement proceedings, a request for information, or a fine, our lawyers will assist you. Read more about financial supervision.

PSD2 and payment services

Many FinTech models rely on payment services. The revised European Payment Services Directive (PSD2) has been implemented in the Wft and has opened up the market to new parties. Two roles are decisive in this regard:

• the payment initiation service provider (PISP), which initiates a payment on behalf of the customer;
• the account information service provider (AISP), which aggregates account data from various banks.

Anyone offering these services generally requires a license or registration and must comply with requirements regarding strong client authentication, liability for unauthorized transactions, and access to payment accounts. In addition, the General Data Protection Regulation (GDPR) applies to the processing of payment data, with the Dutch Data Protection Authority acting as the supervisory body. We assist you with license applications, contracts with banks, and the alignment between supervisory law and privacy.

Crypto, MiCA and blockchain

Since late 2024, the European Markets in Crypto-Assets Regulation (MiCAR, Regulation (EU) 2023/1114) has applied to crypto assets. MiCAR distinguishes between asset-referenced tokens, e-money tokens, and other crypto assets, among others, and sets requirements for crypto service providers (CASPs) and issuers, including a licensing requirement and a mandatory white paper. In addition, the revised Transfer of Funds Regulation (TFR) regarding the transmission of transaction data and the anti-money laundering framework of the Anti-Money Laundering and Counter-Terrorism Financing Act (Wwft) play a role. In the Netherlands, the AFM grants MiCAR licenses, and DNB exercises prudential supervision over issuers of asset-referenced tokens. We assist blockchain and crypto companies with the proper qualification of their token, the license application, and the transition from the old DNB registration.

Operational resilience, data security and IT contracts

FinTech relies on technology, and technology brings its own obligations. The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) sets requirements for the digital resilience of financial undertakings and their ICT service providers: risk management, incident reporting, and agreements with cloud service providers. We draft comprehensive IT contracts, data processing agreements, and service level agreements (SLAs), arrange liability and exit agreements with suppliers, and advise on cybersecurity and data protection. In this way, the legal layer aligns with your technology rather than hindering it.

For whom we work

FinTech has long ceased to be the sole domain of large corporations. We work with mixed teams of lawyers and in-house counsel, covering the entire breadth of the market: from the international payment group requiring licenses in multiple countries to the start-up with a single payment app and the baker on the corner allowing customers to pay via a new platform or utilizing crowdfunding. Because an in-house counsel provides input on commercial aspects and a lawyer is on standby for regulatory oversight and dispute resolution, you receive advice that is both practical and legally watertight. Related topics include crowdfunding and financial litigation.

Frequently Asked Questions about FinTech

Does my FinTech company need a license?

That depends on the service you provide. Payment services, the provision of credit, investment services, and crypto services are generally subject to licensing under the Wft or European regulations. Sometimes an exception or exemption applies, for example under Article 1:5a Wft. We will assess your specific proposition.

What is the difference between the AFM and DNB for FinTech?

The AFM exercises conduct supervision and grants many licenses, including those for crypto services under MiCAR. DNB exercises prudential supervision and monitors the financial soundness and reliability of your company. Many FinTech companies have to deal with both regulators.

Does my crypto company fall under MiCA?

Almost certainly. MiCAR regulates the offering of crypto assets and crypto services and requires a license for providers (CASPs) and issuers. The precise requirements depend on the type of token. Existing DNB registrants had to switch to a MiCAR license; we guide that process.