Handelsregister (KVK) — the Dutch company register

A Dutch extract with a blank visiting address is not an incomplete extract. The Handelsregister is the Dutch business register, held by the Chamber of Commerce (KVK) under the Handelsregisterwet 2007. It is a basisregistratie — part of the state’s authoritative data infrastructure — which means some of what it holds is designated authentic data with a quality regime attached, and some of what it holds is deliberately hidden from public view. For a payments firm onboarding Dutch counterparties, the shielding rules and the three different identifying numbers cause more failed files than anything in the register’s substance.

1. What the Handelsregister is for

Article 2 of the Handelsregisterwet 2007 sets four purposes: promoting legal certainty in economic transactions; supplying factual data about the composition of enterprises; registering all enterprises as part of the government’s data infrastructure; and recording beneficial owners to counter financial crime. Those four pull in different directions, and the tension between the second and the fourth is exactly why access to the register keeps being narrowed.

The register is kept by KVK, a body established by statute rather than a commercial provider, and it is a base registration: other public bodies are meant to consult it rather than ask the entrepreneur again. That status is what gives the register its authority — and what makes the authentic subset of its fields the ones to build a KYB process on.

2. Who is registered — enterprises and legal entities separately

Dutch law registers two different things, and they are governed by different articles. Article 5 covers ondernemingen — enterprises — in six categories: enterprises belonging to Dutch corporate entities and partnerships; sole traders; European corporate forms with a Dutch seat; enterprises belonging to foreign legal entities with a Dutch establishment; other enterprises established in the Netherlands; and enterprises abroad belonging to a Dutch partnership.

Article 6 covers rechtspersonen — legal entities with a Dutch statutory seat: companies, cooperatives and mutual insurers, associations and foundations, and public-law bodies. A Dutch foundation with no commercial activity has no onderneming but is still registered as a rechtspersoon.

The filing duty sits in Article 18: on the entrepreneur, the directors, those running day-to-day operations, or — for a foreign entity — its designated representative in the Netherlands. Note the fourth Article 5 category: a foreign legal entity with a Dutch vestiging is in scope. As in the other EU registers, cross-border provision of services into the Netherlands leaves no trace; an establishment creates one.

3. Three numbers, three questions

This is the single most common cause of a failed Dutch match. The register issues distinct identifiers, and they are not substitutes.

Articles 9 to 12 set out the content behind those numbers: for an enterprise, the unique number, trade names, the relevant dates, the owner’s details, the locations and — where it has one — the Legal Entity Identifier; for a legal entity, the number, the name, the legal form, the statutory seat, dates and again the LEI. The presence of the LEI as a register field is quietly useful: where a Dutch counterparty has one, the register gives you a second, globally resolvable key for free.

4. Shielding — the part that breaks address verification

Article 21 of the Act makes register data publicly inspectable; Article 22 provides for electronic extracts while forbidding the data from being organised by individual person. Article 28 then restricts the genuinely sensitive material — citizen service numbers, residential addresses — to government bodies performing statutory duties and to designated authorities handling beneficial-ownership information for anti-money-laundering purposes.

On top of the statute, KVK’s published rules set out what is shielded in practice:

• Sole traders (eenmanszaak): the residential address is always shielded, and the visiting address can always be shielded on request.
• Legal entities and partnerships: the residential addresses of office-holders are always shielded. The visiting address is shielded only where there is a concrete or likely threat.
• Where a visiting address is shielded, a postal address must be registered instead, it stays public, and it cannot be the same as the residential or visiting address.
• A record-keeper’s address, for a natural person, stays visible for seven years after a closure.

And the provision a compliance team should actually act on: obliged institutions under the Dutch AML act, alongside government officials, lawyers, notaries and bailiffs, can obtain access to shielded addresses from KVK with the proper authorisation. A payments firm that treats a blank address field as an unverifiable counterparty is declining business it has a lawful route to verify. The route is an access arrangement with the register, not a request to the customer.

5. Authentic data, and who must report a discrepancy

Because the Handelsregister is a base registration, part of its content is designated authentiek and carries a stricter quality regime: a duty to report suspected errors, and a corresponding duty on KVK to investigate them. Article 32 of the Act, in force since 1 January 2024, requires a bestuursorgaan — a public administrative body — with reasonable doubt about the correctness of an authentic datum it obtained from the register, or about the correctness of its absence, to report that to KVK. The Act also provides a basis for reporting inaccuracies in non-authentic data.

Read that boundary carefully. The Article 32 terugmeldplicht binds administrative bodies. A private payments firm is not one, so it does not inherit that statutory reporting duty by using the register. Its discrepancy obligation is the separate AML one attaching to beneficial-ownership discrepancy reporting, which runs through the Dutch UBO register rather than through the trade register’s base-registration machinery. Writing one procedure that conflates the two produces reports to the wrong body under the wrong trigger.

6. Filed accounts — a KYB source sitting in the same register

Dutch legal entities publish their annual accounts by filing them with KVK, and the filing becomes part of the public record. The deadline works in two layers under Article 2:394 of the Civil Code: the accounts must be filed within eight days of adoption, and in any event the entity must have made them public within twelve months of the end of the financial year. The second limb is the backstop and the one a reviewer can test against a calendar.

Three things follow for a payments firm. A recent filing is corroboration of trading activity that costs nothing to obtain, which is worth more than a self-declared turnover figure on an application form. A missing filing past the twelve-month backstop is a cheap, objective flag — not a finding on its own, but a reason to ask. And the size regime determines how much you get: the smallest entities publish an abbreviated balance sheet only, so a file whose risk model expects a full profit-and-loss will stall on a large share of legitimate Dutch small companies. Set the expectation from the entity’s size class, which is itself derivable from what was filed.

7. Three scenarios from a Dutch onboarding queue

An address check that fails on a shielded field. A Rotterdam sole trader applies. The automated address check compares the address on the identity document with the register’s visiting address and finds the register field empty, so the case drops into manual review as “address unverifiable”. It is not: for an eenmanszaak the residential address is shielded by design and the visiting address may be shielded on request. The analyst confirms a postal address is registered — mandatory whenever the visiting address is shielded — and, where the firm holds an access arrangement as an obliged institution, retrieves the shielded address. The fix is upstream: the rule should branch on legal form before it flags a blank.

A twelve-digit number in an eight-digit field. A merchant’s onboarding form is completed by someone reading off a location extract, and a vestigingsnummer arrives where the KVK-nummer belongs. The register lookup returns nothing; the case is queued as “not found in national register”. A length check at capture — eight digits is the business, twelve is a location — resolves this class of failure entirely, before a lookup, a screening run and a manual review have been spent on a mis-typed field.

A foundation with no RSIN on the extract. A reviewer treats a missing RSIN as a red flag on a Dutch counterparty. In fact sole traders have no RSIN at all, so it never appears on their extracts; for legal entities it does. The correct reading is that the number’s absence is informative about legal form, not about legitimacy — and legal form is already on the extract, which is the field the rule should have tested.

8. What to do, today

• Validate number length at capture. Eight digits is the business, twelve a location, nine the tax identifier. Reject the mismatch at the form, not in a queue.
• Branch address rules on legal form. A blank visiting address on a sole trader is the design, not a gap.
• Establish the access route for shielded addresses as an obliged institution under the Dutch AML act, and record in the procedure when an analyst may use it.
• Separate the two discrepancy duties in writing. The Article 32 report to KVK binds administrative bodies; your obligation runs through beneficial-ownership discrepancy reporting.
• Capture the LEI when the register carries one. It is a free second key and it resolves across borders.
• Test the twelve-month accounts backstop on legal-entity counterparties, and size the expectation to the entity’s filing class rather than demanding a full profit-and-loss from every Dutch company.

Related: The Dutch UBO register at KVK · BCE/KBO — the Belgian enterprise number and register · The Dutch AML framework beyond goAML