Netherlands: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCAR / Regulation (EU) 2023/1114), implemented domestically via the Dutch MiCA Implementation Act (Wet implementatie verordening cryptoactiva) in force since 30 December 2024; supervised by the Authority for the Financial Markets (AFM) for licensing and conduct and by De Nederlandsche Bank (DNB) for prudential, ART/EMT issuer and AML/Wwft supervision. Tax treatment under the Income Tax Act 2001 (Wet IB 2001), primarily Box 3.

Crypto-asset activities are legal in the Netherlands and comprehensively regulated through MiCAR, which applies directly across the EU and was supplemented by the Dutch MiCA Implementation Act entering into force on 30 December 2024. The AFM acts as the licensing authority for Crypto-Asset Service Providers (CASPs) and was among the first EU regulators to accept and grant CASP applications, while DNB supervises ART/EMT stablecoin issuers and continues AML/Wwft oversight. Holdings are taxed as wealth in Box 3, while professional/business activity (mining, staking as a trade) falls into Box 1.

Framework: EU Artificial Intelligence Act (Regulation (EU) 2024/1689), applied nationally via the draft Uitvoeringswet AI-verordening (AI Act Implementation Act); decentralised supervision coordinated by the Autoriteit Persoonsgegevens (AP) and the Rijksinspectie Digitale Infrastructuur (RDI)

As an EU member state, the Netherlands is governed by the directly-applicable EU AI Act, whose prohibited-practice and AI-literacy rules apply since 2 February 2025, GPAI obligations since 2 August 2025, and high-risk/transparency rules from 2 August 2026. National implementation is set out in the draft Uitvoeringswet AI-verordening, published for public consultation on 20 April 2026 (open until 1 June 2026), which establishes a decentralised supervisory model. Supervision is distributed across roughly ten existing sectoral market-surveillance authorities, with the Autoriteit Persoonsgegevens and the Rijksinspectie Digitale Infrastructuur designated as coordinating authorities.

Framework: EU General Data Protection Regulation (GDPR / 'AVG', Regulation 2016/679), directly applicable since 25 May 2018, supplemented nationally by the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, UAVG). Supervised and enforced by the Autoriteit Persoonsgegevens (AP).

As an EU member state, the Netherlands has a comprehensive personal-data protection regime based on the directly applicable GDPR, supplemented by the national UAVG which entered into force on 25 May 2018. The independent supervisory authority is the Autoriteit Persoonsgegevens (AP), which enforces the GDPR, the UAVG and ePrivacy/cookie rules and can impose administrative fines up to the GDPR maximum of €20 million or 4% of global annual turnover.

Framework: EU PSD2 (Directive 2015/2366) transposed into the Wet op het financieel toezicht (Wft), supervised by De Nederlandsche Bank (DNB); MiCA (Regulation (EU) 2023/1114) for crypto-assets supervised mainly by the Autoriteit Financiële Markten (AFM); plus the EU Instant Payments Regulation and CCD II for BNPL.

The Netherlands operates a clear, fully in-force licensing regime for digital payments and fintech, built on the EU PSD2 framework implemented in the Wft, with DNB as prudential supervisor for payment institutions and electronic money institutions. Crypto-asset services are licensed under MiCA (AFM as primary supervisor, DNB for asset-referenced/e-money tokens), and EU-wide instant-payment and revised consumer-credit rules are being phased in. BNPL is moving into formal AFM supervision under the revised Consumer Credit Directive from late 2026.

Framework: Dutch Aliens Act 2000 (Vreemdelingenwet) administered by the Immigration and Naturalisation Service (IND), with economic assessment by the Netherlands Enterprise Agency (RVO); EU/EEA/Swiss nationals require no permit

The Netherlands has no dedicated digital-nomad or remote-work visa. Non-EU/EEA/Swiss remote workers and relocators must qualify through existing routes, chiefly the self-employed residence permit, the startup permit, or the simplified Dutch-American Friendship Treaty (DAFT) route for US nationals, while EU citizens can live and work freely. The former investor 'golden visa' was abolished on 1 January 2024.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) as implemented nationally by the Uitvoeringswet digitaledienstenverordening (DSA Implementation Act, in force 4 Feb 2025); enforced by the Netherlands Authority for Consumers and Markets (ACM) as Digital Services Coordinator, with the Dutch Data Protection Authority (AP) for profiling/data, plus the ATKM authority for CSAM and terrorist content online.

The Netherlands applies the directly-effective EU Digital Services Act as its baseline online-content/online-safety regime, with a national implementation act (in force 4 February 2025) designating ACM as Digital Services Coordinator and the AP as co-supervisor for data/profiling issues. Separate national authorities and EU regulations cover terrorist content and child sexual abuse material online, while age-verification and a statutory social-media age limit remain at the proposal/development stage. Overall the country has a comprehensive, enforced framework rather than partial or restrictive controls.

Framework: Wet beveiliging netwerk- en informatiesystemen (Wbni), currently in force (implements EU NIS1); being replaced by the Cyberbeveiligingswet (Cbw, NIS2 implementation), pending in the Senate with entry into force targeted for Q2 2026. Supervision/incident response led by NCSC-NL and sector regulators (RDI, ILT).

The Netherlands currently has a horizontal cybersecurity statute in force, the Wbni (in effect since 9 November 2018), which obliges essential-service operators and digital service providers to take security measures and report serious incidents. Its NIS2 upgrade, the Cyberbeveiligingswet (Cbw), was approved by the House of Representatives on 15 April 2026 and is awaiting Senate approval, with entry into force expected in Q2 2026. The regime is layered on top of GDPR data-breach duties and EU sectoral rules (e.g. DORA for finance), with NCSC-NL as the central coordination/incident-response body.

Framework: Dutch Civil Code (Book 2, on legal persons / the 'Flex-BV' rules) and the Trade Register Act (Handelsregisterwet), administered by the Netherlands Chamber of Commerce (KVK) and a civil-law notary; tax registration via the Belastingdienst. EU member state baseline applies.

The Netherlands is one of the easier places for a foreigner to incorporate. There are no foreign-ownership restrictions on the standard private limited company (BV), non-residents and foreign entities may own 100%, minimum share capital is just EUR 0.01, and since January 2024 a BV can be incorporated remotely via a digital notarial deed. The main steps are a notarial deed of incorporation, KVK Business Register registration, and tax registration; the practical constraints are the mandatory civil-law notary and (for non-EU founders) a separate residence/work permit.