Safeguarding in the Netherlands: Wft 3:29a and DNB

Safeguarding in the Netherlands starts in Article 3:29a of the Wet op het financieel toezicht (Wft), and unlike most member states it gives payment and e-money institutions three routes rather than two. A Dutch betaalinstelling or elektronischgeldinstelling can hold client funds through a separate foundation, the stichting derdengelden; on a statutory segregated account created by Article 3:29aa Wft; or under an insurance policy or guarantee. The method rules sit in Articles 40a and 40b of the Besluit prudentiële regels Wft (Bpr). De Nederlandsche Bank (DNB) keeps finding that the controls around those routes are weaker than the routes themselves.

1. The texts

Three layers carry the Dutch regime:

• Article 3:29a Wft sets the duty. A payment institution or e-money institution with its seat in the Netherlands must safeguard funds received from payment service users, or from other payment or e-money institutions, either in the way set out in Article 3:29aa(1) or in a way laid down by or under an order in council. An e-money institution must do the same for funds received in exchange for e-money. The duty does not apply to a payment institution that only provides services 7 and 8 of the PSD2 annex (payment initiation and account information).
• Article 3:29aa Wft creates the statutory segregated account, the rekening met afgescheiden vermogen. It was added by the Wijzigingswet financiële markten 2022, which DNB presented at the time as an alternative to safeguarding through a stichting derdengelden.
• Articles 40a and 40b Bpr, in Chapter 6a of the decree, are the order-in-council route. They transpose Article 10 of Directive (EU) 2015/2366 (PSD2) and Article 7 of Directive 2009/110/EC (EMD2) almost word for word: segregation or insurance, the end-of-next-business-day rule for payment funds, and five business days for e-money.

One more provision matters in practice. Article 32b(1)(i) Bpr requires an institution to notify DNB in writing, without delay, of any change in the way it complies with Article 3:29a. Changing safeguarding route, or changing the bank behind it, is therefore a notification event, not an internal decision.

2. The Bpr route: segregation or insurance

Article 40a Bpr applies to payment institutions providing services 1 to 6 of the annex. Funds received from users or other payment service providers for executing payment transactions are safeguarded in one of two ways:

• Segregation. The funds are not mixed with the funds of the institution’s other creditors. If they have not been transferred to the payee or another provider by the end of the business day after receipt, they are deposited in a separate account at a bank, or at a central bank at that central bank’s discretion, or invested in safe, liquid, low-risk assets. Either way, the arrangement must keep the institution’s other creditors from recovering against them, in particular in insolvency.
• Insurance or a comparable guarantee from an insurer or bank outside the institution’s group, covering the risk that the institution cannot meet its obligations in respect of the funds, for the amount that would otherwise have been segregated.

Article 40a(5) adds that a payment initiation service provider never holds the payer’s funds. Article 40a(6) applies paragraphs 1 to 4 to e-money institutions for their payment-service funds.

Article 40b Bpr covers funds received in exchange for e-money. They must be safeguarded when they become available to the institution, and no later than five business days after the e-money is issued. The same two methods apply, to cash and to book money. Under segregation the funds go into a separate account at a bank, or into safe, liquid, low-risk assets. Unlike Article 40a(2), Article 40b(3) does not mention a central bank account.

3. Eligible assets and the representative portion

Article 40a(3) Bpr defines safe, low-risk assets by reference to the CRR, Regulation (EU) No 575/2013. Eligible assets are those in a category in Table 1 of Article 336(1) with a specific-risk capital charge of no more than 1.6%, excluding the other qualifying items of Article 336(4). Units in a UCITS that invests only in such assets also qualify. In exceptional and well-reasoned cases, the competent authority may decide that a particular asset does not count, based on its security, maturity, value or other risk factors. Article 40b(4) applies the same definition to e-money funds.

The Netherlands thus uses the EMD2 asset definition for payment institutions as well. PSD2 leaves the definition to the home authority; the Dutch decree writes the 1.6% test into the payment-institution rule directly.

Article 40a(4) allows a representative portion where the share of funds intended for future payment transactions is unknown or variable, provided it can reasonably be estimated from historical data. Article 40b(5) extends this to e-money institutions.

4. Three routes in practice

DNB’s revised explanation to the licence application form, published on 19 March 2026, numbers the routes in the way practitioners use them:

1. Stichting derdengelden. A separate foundation, set up for the purpose, holds the bank account into which users’ funds flow. The funds belong to a different legal person from the institution, which is how the Bpr segregation test — other creditors cannot recover against them — is met. The protection therefore depends on the foundation’s articles, its governance and its account arrangements, not on a dedicated Wft provision.
2. Rekening met afgescheiden vermogen. The institution holds the account itself, under Article 3:29aa Wft. Here the statute provides the ring-fence.
3. Insurance policy or guarantee, under Article 40a(1)(b) or 40b(2)(b) Bpr.

For routes 1 and 2, the application must include proof of an opened bank account, in the foundation’s name or as a separated-assets account. Failing that, the bank can sign a commitment letter confirming that client acceptance is complete and that the account is open and blocked or frozen until the licence is granted. DNB states that this evidence is often missing and that a missing piece can delay the application or lead to it not being processed.

5. Article 3:29aa: how the statutory account works

The segregated account has a precise legal shape:

• the account is used only for safeguarded funds (para. 1);
• it is held at a bank with its seat in the Netherlands, licensed by the ECB or DNB (para. 2);
• the account title must show that the institution holds it in its own name on behalf of one or more third parties, and state the institution’s capacity (para. 2);
• by way of exception to Article 3:276 of the Civil Code, under which a creditor can normally recover against all of a debtor’s assets, the balance forms a separated estate. It serves only two sets of claims: the bank’s claims for running the account that the account agreement allows it to charge to the estate, and the claims of the third parties whose funds are recorded on it, so far as they arise from entrusting the funds (para. 3);
• the institution keeps adequate records of the separated estate (para. 4);
• if the balance is insufficient on liquidation, it pays the bank’s claims first and users’ claims second (para. 5). Other creditors reach it only once those claims are sure to be met and no new ones will arise (para. 6);
• a shortfall must be topped up immediately. Until it is, a user asking for their share receives only what the rights of the other users allow (para. 7);
• further rules on set-up, records and management may be made by order in council (para. 8).

6. The three routes side by side

Spain prescribes the account name; Luxembourg writes the insolvency ring-fence into the law. The Dutch statutory account does both. The foundation route does neither; it rests on corporate structure.

7. What DNB has said

DNB has run two thematic reviews on safeguarding. Its findings of 14 December 2022 were that some institutions did not adequately monitor the creditworthiness of the banks holding client funds, carried out few or no specific controls, gave operational and financial risks too little attention in their risk analysis, and reported incidents such as significant reconciliation differences to DNB late or not at all.

The follow-up review, published on 28 June 2024, found improvement in monitoring the creditworthiness of banks that hold or guarantee funds. Three weaknesses remained: identifying and mitigating operational and legal risks, documenting management processes, and the small number of institutions running targeted controls. From 1 July 2024 DNB began collecting quantitative safeguarding data through prudential reporting.

Two later points follow from that reporting. On 2 July 2025, DNB said client funds may no longer be consolidated into the other tabs of the prudential report, and that income from holding them belongs under gross commission income, giving interest earned on a stichting derdengelden account as its example. And in a review of exit plans published on 13 March 2026, DNB stressed that paying out client balances is part of any wind-down, can take longer than expected, and that a licence can only be surrendered once all client balances have been paid out.

8. Worked case: moving from a foundation to a 3:29aa account

Facts: an e-money institution has safeguarded through a stichting derdengelden since authorisation. It wants to move to a statutory segregated account to simplify its structure.

What the rule says: Article 3:29aa requires a dedicated account at a bank with its seat in the Netherlands, titled to show it is held for third parties in the institution’s stated capacity. Article 32b(1)(i) Bpr makes the change of method a notification to DNB without delay.

What the practitioner does: confirms the bank qualifies, agrees the title wording in writing, and plans a cut-over with no funds outside both structures. Then notifies DNB, updates the safeguarding policy and reconciliation procedures, and winds down the foundation’s account only once its balance is zero.

Outcome: one structure instead of two legal persons, and a file that shows continuous protection through the move.

9. Worked case: a reconciliation shortfall

Facts: the daily reconciliation of a payment institution’s 3:29aa account shows the balance EUR 40,000 below recorded user funds, caused by a failed incoming settlement.

What the rule says: Article 3:29aa(7) requires the shortfall to be topped up immediately. DNB’s 2022 findings show it expects significant reconciliation differences to be reported to it, and on time.

What the practitioner does: tops up from own funds the same day, logs the difference and its cause, assesses whether it meets the internal threshold for a DNB incident report, and if so reports it. Then fixes the settlement break and documents the control that should have caught it.

Outcome: users are never exposed to the pro rata rule, and the incident file is complete.

FAQ

10. What to do, today

• Legal: confirm which of the three routes you use, and that your bank’s seat and account title meet Article 3:29aa if you rely on it.
• Foundation users: review the articles, board and account terms of the stichting. That is where the ring-fence lives.
• Finance: report client funds outside the consolidated tabs of the prudential report, and book interest on them as gross commission income.
• Risk: document creditworthiness monitoring of each safeguarding bank or guarantor, and set a threshold for reporting reconciliation differences to DNB.
• Treasury: check every invested asset against the 1.6% test in Article 40a(3) Bpr.
• Management: make sure the exit plan covers paying out every client balance.

Related: Safeguarding compared across the EU · Safeguarding in Luxembourg