News Update Financial Regulatory

In this News Update we discuss: AFM's consultation on the revised Policy Rule regarding the provision of information; two AFM studies: 'Buy now, pay later' and 'Design of crypto apps', and; AFM and DNB's report on the impact of AI on the financial sector.

We further highlight some other financial regulatory publications issued since our last News Update. Subscribe here to the News Update Financial Regulatory.

AFM's consultation on the revised Policy Rule regarding the provision of information

The Dutch Authority for the Financial Markets (AFM) recently launched a consultation (in Dutch only) on its revised Policy Rule regarding the provision of information (Beleidsregel Informatieverstrekking). The policy document has been supplemented with interpretations, some of which stem from new regulations. The AFM has expanded the list of examples of incorrect or misleading information, and has introduced a topic addressing the question of who provides the information. Additionally, the AFM explains that information provided in podcasts, apps and social media (i.e. affiliate marketing) could qualify as an advertisement, as could each separate web page. New chapters have been added on the requirements regarding second pillar pensions and the need for information provided by investment firms and for investment funds to be fair, clear and not misleading, particularly in relation to risks. The document further states that the competent authority's name must not be used in a manner that implies consent or for commercial purposes.

The consultation period ends on 31 May 2024.

Two AFM studies: 'Buy now, pay later' and 'Design of crypto apps'

In its Annual Report 2023, the AFM highlighted various developments, including the increased use of 'buy now, pay later' facilities (BNPL) and the design of crypto apps. It has also published studies on these topics, which are briefly discussed below.

Buy now, pay later (BNPL)

Highlights of the AFM's 2022 BNPL study and subsequent market update on the subject include the following:

• Market landscape: although the number of users has decreased in recent years, the volume of transactions continues to rise. An emerging trend is the growth of BNPL in physical stores, either via specific payment cards or the store's webshop. The AFM warns that normalising deferred payment methods in physical stores increases the risk of debt habituation, in particular among younger persons. This may lead to irresponsible lending and the accumulation of debt.
• Code of Conduct: established in October 2023, the sector's Code of Conduct requires BNPL providers to provide clear information on costs, conditions of use, and payment obligations. Additionally, providers must implement a complaints procedure. Despite the Code of Conduct, the AFM emphasises the need for BNPL consumer protection regulation at European level. Practices or developments that raise concerns include unauthorised BNPL use by persons under 18. To avoid debt accumulation, the AFM stresses that, before granting BNPL, providers should consult the register of the Credit Registration Agency (Bureau Kredietregistratie), and should also register BNPL arrears. Fees for late payment are another point of attention. The Dutch Supreme Court has submitted preliminary questions on this topic to the Court of Justice of the European Union, whose ruling is expected late in 2024 at the earliest.
• Consumer Credit Directive (CCD II): this European Directive must be transposed into Dutch law by 20 November 2025 at the latest. As of 20 November 2026, BNPL providers will be in scope of CCD II, unless an exemption applies, resulting in the obligation to obtain a licence and to meet the pre-contractual and contractual information requirements. The extent to which the Dutch legislature will use the Member State options is not yet known. From November 2026, upon implementation of the CDD II, the AFM will also supervise the BNPL sector.

Design of crypto apps

The AFM conducted its survey on the design of the crypto apps in 2023, focusing on three Dutch crypto services providers. The results of the survey were published on 9 April 2024. The report is available in Dutch only.

The AFM observes that the Markets in Crypto-Assets Regulation (MiCA) does not provide any guidance on how to address the risks associated with the use of crypto apps, especially the steering or nudging elements in these apps. Since MiCA does not set requirements on the design of the apps' choice environment, the AFM encourages the crypto industry to design their apps' choice architecture in the best interests of the customer.

Following the survey, the AFM recognised the following risks for users of crypto apps that remain after implementation of MiCA:

• The apps provide low-threshold access for a large audience;
• The apps are designed to nudge users towards trading certain tokens, activating additional services, and to use the apps frequently.

AFM and DNB's report on the impact of AI on the financial sector

On 9 April 2024, the AFM and the Dutch Central Bank (DNB) published their report "The Impact of AI on the Financial Sector and Supervision" ("De impact van AI op de financiële sector en het toezicht", in Dutch only). The report sets out their principles and focus areas for supervising AI use by financial businesses, and shares them with the market. In order to initiate dialogue on the subject with the sector, the AFM and DNB plan to organise a seminar and one or more round-table meetings later this year. They have also already engaged with various institutions. In addition, DNB is set to perform a thematic examination of AI use among insurers this year.

In their report, the regulatory authorities address various relevant aspects of AI use in the financial sector, largely basing their discussion on international research. The subjects covered include the extent to which financial businesses use AI, how they use it, AI risks and opportunities, and the impact that AI can have on supervision methods. The report also looks at the requirements that will ensue for financial businesses from the draft EU AI Act, compliance with which will be subject to AFM and DNB supervision.

Potential advantages of AI use in the financial sector include faster service, improved range of services, and increased efficiency of internal processes. However, disadvantages mentioned by the regulatory authorities include GDPR data processing violations, discrimination and exclusion, and dependence on large AI platforms. As for supervision, they point out that financial supervision rules apply in full to AI use in the financial sector. This means, for example, that the use in question must be consistent with sound and ethical business operations and align with the requirement to put clients' interests first.

Other financial regulatory publications

We have highlighted a selection of other publications by legislatures and regulators for the financial markets and financial supervision since our March 2024 News Update.

AFM

• The AFM regularly publishes updates on the Digital Operational Resilience Act (DORA). Its third update includes the ICT risk management framework, Business Continuity Management and employee learning.
• On 14 March 2024, the AFM published its group insurance interpretation (in Dutch). This interpretation came in response to the judgment of 22 September 2022 of the Court of Justice of the European Union (ECLI:EU:C:2022:733), which contains criteria to determine whether the policyholder under a group insurance policy qualifies as insurance intermediary, which in principle requires a licence from the AFM. The news item includes a simple decision tree and concise information on the licensing process. Financial service providers that are required to apply for a licence need to obtain this licence by 1 October 2025.
• The AFM launched a consultation (in Dutch only) on its Policy Rule regarding scenario analyses (Leidraad scenarioanalyses). Scenario analysis is part of the Product Approval and Review Process. The consultation period ends on 7 June 2024.

DNB

• On 27 March 2024, the Dutch Central Bank (DNB) published a news item (in Dutch only) on how the financial sector can prepare itself for DORA.
• In a 21 March 2024 news item (in Dutch only), DNB published about the impact of MiCA on the crypto market and how this affects DNB's and AFM's supervisory activities.
• On 4 April 2024, DNB published news of its 2019 instruction imposed on Triodos Bank for non-compliance with statutory requirements on customer integrity. In the same announcement DNB stated that Triodos had adapted the relevant systems and now meets these requirements. The instruction is available in Dutch only.
• Since 10 April 2024, DNB has been offering smaller financial institutions the possibility to participate in its Advanced Red Teaming programme (ART programme) to test their cyber resilience.
• DNB published news of its order subject to a penalty imposed on Payward International Markets Limited (operating under the trade name Kraken) for offering crypto services in the Netherlands without the required registration. The total penalty amounted to EUR 4 million. The order (last onder dwangsom) is available in Dutch only.
• On 19 April 2023, DNB published its report on its 2023 investigation on the management of conflicts of interests by insurance companies (in Dutch only). Areas for improvement are the depth of the risk analysis, the focus, specificity and effectiveness of the integrity policy, the independent monitoring of the management of the conflicts of interests, and the register of additional positions.
• On 22 April 2024, DNB published its report Integrity Supervision in Focus 2024-2025. With this report, which replaces the separate sector letters, DNB details its engagement with the sector on compliance with the Anti-Money Laundering and Terrorist Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme), the Act on the Supervision of Trust Offices 2018 (Wet toezicht trustkantoren 2018) and the Sanctions Act (Sanctiewet).

ESAs

• DORA requires financial entities to maintain registers with information on contractual arrangements on the use of ICT third-party service providers. In May 2024, the European Supervisory Authorities (ESAs) will launch a voluntary dry run exercise in preparation for the implementation and reporting of these registers. The exercise timeline and other information is included in a factsheet. The Final Report containing Draft Implementing Technical Standards on the standard templates for these registers was published in January 2024.

EBA

• The European Banking Authority (EBA) published its final Guidelines on national lists or registers of credit servicers.

EIOPA

• The European Insurance and Occupational Pensions Authority (EIOPA) published its 2024 supervisory priorities as part of its Union-wide Strategic Supervisory Priorities 2024-2026. In respect of financial robustness of insurance undertakings EIOPA will focus on two prudential aspects: (i) continuous monitoring of the impact of the macro-economic environment and (ii) risk transfers, including in terms of capacity and appropriateness. In the interests of consumer protection in a disruptive environment, EIOPA's 2024 focus will be on product governance aspects, in particular on value for money in relation to inflation and current macro-economic trends.
• On 4 April 2024, EIOPA published its Supervisory Statement on the supervision of third-country reinsurance.

ESMA

• On 21 March 2024, the European Securities and Markets Authority (ESMA) published practical guidance on the provisions applicable following the entry into force on 28 March 2024 of the revised Markets in Financial Instruments Regulation.
• ESMA's third consultation package on MiCA was published on 25 March 2024. The consultation period ends on 25 June 2024.
• The first Final Report under MiCA was published on 25 March 2024. The European Commission has three months to decide whether to adopt these technical standards.

European Commission

• The adapted base euro amounts for professional indemnity insurance and for financial capacity of insurance and reinsurance were published through Commission Delegated Regulation (EU) 2024/896. The Regulation will apply from 9 October 2024.

European Parliament

• On 24 April 2024, the European Parliament adopted the Anti-Money Laundering Package.

Ministry of Finance

• The updated Decree on EU Regulations (Besluit EU-verordeningen Wft) was published in the Official Gazette on 25 March 2024. The document is available in Dutch only.
• In a letter dated 17 April 2024, the Minister of Finance provided information on the state of play of the Ultimate Beneficial Owner registers following the judgment of the European Court of Justice of 22 November 2022.
• The General guidance on the Anti-Money Laundering and Terrorist Financing Act (Algemene leidraad Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft)) was published on 24 April 2024. The document is available in Dutch only.

Other

• The Accessibility Requirements for Products and Services (Implementation) Act Implementatiewet toegankelijkheidsvoorschriften producten en diensten was published on 15 April 2024. The Act adds a new Article 4:22a to the Financial Services Act (Wet op het financieel toezicht) that applies to credit offerors, banks, investment firms, payment services providers and electronic money institutions that provide banking services to consumers. The date of its entry into force has yet been established.

If you have any financial regulatory questions, please do not hesitate to contact Berry van Wijk, Juan Vervuurt, Lisanne Haarman or Gijs Hamelijnck.