CJEU: security deposit service does not qualify as a payment service under PSD2
The Court of Justice of the European Union (the “Court”) delivered its judgment in Case C-51/25 on 16 July 2026, Betaal Garant Nederland (“Betaal Garant”) v De Nederlandsche Bank (“DNB”), following a reference for a preliminary ruling from the Trade and Industry Appeals Tribunal (“CBb”). The dispute concerned an order subject to a penalty payment imposed by DNB on Betaal Garant for carrying out the activities of a payment service provider under the Financial Supervision Act (payment service provider under PSD2) without a licence.
Betaal Garant offers an alternative to depositing a security deposit with a notary in connection with construction projects. The customer deposits a security amount, usually 6% of the contract sum, with a foundation affiliated with Betaal Garant, Stichting BGN Zekerheidsstelling (“Stichting Betaal Garant”). Following the (proper) completion of the project, this amount is paid out to the contractor by Stichting Betaal Garant.
DNB took the view that Betaal Garant was thereby providing payment services without an adequate licence and imposed an order subject to a penalty payment to bring the infringement to an end. Having exhausted the objection and appeal procedures, Betaal Garant lodged an appeal with the CBb against, amongst other things, this order subject to a penalty payment. The CBb subsequently referred the question to the Court of Appeal as to whether the service should be classified as the execution of credit transfers (or payment transactions) within the meaning of PSD2 (service 3(c) of Annex I to PSD2).
According to the Court of Appeal, this is not the case. For a service to be classified as the execution of credit transfers as referred to in PSD2, the Court of Appeal held that it is essential that the payment service provider receiving the payment order from a payer also manages that payer’s payment account. However, Betaal Garant and Stichting Betaal Garant do not manage payment accounts for their customers. The actual transfers are carried out by the customer’s banks on the one hand and Stichting Betaal Garant on the other, which act as payment service providers in this context. The contractual arrangements between the customer, the contractor and Betaal Garant do not alter this.
Betaal Garant’s main activity is to provide personal security in the form of a surety or guarantee for construction projects. The money transfers carried out in that context serve solely to carry out this main activity. According to the Court, classification as a payment service provider requiring authorisation is not justified in this case. The Court also points out that, under Dutch law, Betaal Garant’s main activity constitutes an alternative to notarial escrow and that there is no evidence that such services themselves fall under the licensing requirement under PSD2.
The judgment is relevant to businesses that facilitate the flow of funds between customers and other parties. The mere receipt, holding and transfer of funds does not automatically constitute a payment service requiring authorisation where these businesses do not themselves manage the payment accounts of the parties concerned. In this regard, it is not decisive whether the company instructs its own payment service providers (such as banks) to make payments; rather, it must be assessed whether the company also manages the payment account for or on behalf of its customers.
The judgment was delivered under PSD2. It is therefore still uncertain whether the test applied by the Court will also hold up under the new PSD3 regime. PSD3 is expected to receive formal approval in 2026 and will enter into force twenty days after its publication in the Official Journal of the European Union. Market participants would be well advised to analyse the final text of PSD3 on this point.
Civil law consequences of the Debt Collection Services Quality Act, effective from 1 October 2026
Article 18 of the Debt Collection Services Quality Act (“Wki“) will come into force on 1 October 2026,. This article sets out the civil law consequences for debt collection service providers who are not registered in the Debt Collection Services Register. The entry into force of this article marks the completion of the final phase of the Wki’s implementation.
Background: the Wki in brief
The Wki came into force on 1 April 2024 and requires parties carrying out extrajudicial debt collection activities on behalf of third parties or following the assignment of a claim to register with the Debt Collection Services Register maintained by the screening authority Justis. In addition, the Act sets out requirements relating to, among other things, professional competence, communication with debtors and the handling of complaints. Since 1 April 2025, the registration requirement has applied in full, and failure to comply with it is classified as an economic offence. The scope is broad: providers of deferred payment services (Buy Now Pay Later or ‘BNPL’) and parties for whom debt collection forms only a limited part of their activities (such as owners’ association managers and property managers) also fall under the Wki.
What will change on 1 October 2026?
Until 1 October 2026, the prohibition on carrying out extrajudicial debt collection activities for third parties or following the assignment of a claim without registration was subject solely to sanctions under public law. This means that while Justis could impose a sanction (such as an order subject to a penalty payment) on such a debt collection service provider, parties in civil proceedings could not yet derive any rights from the Wki if they were dealing with an unregistered debt collection service provider. With the entry into force of Article 18 of the Wki, the registration requirement now also has consequences under civil law. The main consequences are:
- No obligation to pay unregistered debt collection service providers. A debtor is not obliged to settle a claim for payment of a sum of money against a provider or operator of extrajudicial debt collection activities who is not registered or whose registration has been suspended.
- No debt collection costs are payable. The statutory extrajudicial debt collection costs can no longer be charged to the debtor if the debt collection activities were carried out by an unregistered debt collection service provider.
- No accruing interest. From the moment of the first payment request by an unregistered debt collection service provider, statutory interest ceases to accrue.
- ‘Tainted’ claim. Perhaps the most far-reaching consequence: if a creditor initially engages an unregistered debt collection service provider, the debt collection costs are not payable even if the claim is subsequently transferred to a registered debt collection service provider. The claim becomes, as it were, ‘tainted’ by the engagement of the unregistered debt collection service provider.
Implementation review and compliance in practice
On 16 June 2026, State Secretary Van Bruggen sent a policy response to the House of Representatives regarding the implementation review of the Wki (Parliamentary Papers II 2025/26, 35 733, no. 19). The implementation review assesses the operation of the Wki in the first year following its entry into force, and the conclusion is clear: compliance with the registration requirement remains significantly behind schedule. On 11 June 2026, only 269 parties were registered in the Debt Collection Services Register, while the Ministry had previously identified 550 debt collection service providers subject to the registration requirement, and the potential group is – according to State Secretary Van Bruggen – “much larger” due to the broad legal definition.
Awareness of the Wki appears to be limited: many organisations do not recognise themselves as debt collection service providers. Furthermore, some organisations are unwilling to register, partly due to the associated costs. A specific example: as of February 2026, Klarna had not yet been registered in the debt collection register, even though, as a BNPL provider, it falls within the scope of the Wki. Nevertheless, it had not interpreted the Wki as meaning that this Act applied directly to its Dutch operations. Klarna states in this regard that, following a closer examination of the Wki and its activities, it concluded that it did, in fact, have to register (see here). This registration was recorded in the Debt Collection Services Register in March 2026 – almost two years after the registration requirement came into force.
Practical implications: enforcement and recommendations
Although enforcement has so far remained limited, the 2025 Annual Report of the Inspectorate of Justice and Security (“Inspectorate JenV“) that a total of 21 inspection visits were carried out in 2025 (eight of which were re-inspections), resulting in eleven warning letters, three orders subject to a penalty payment and one administrative fine. In addition, more than 350 complaints were received via the Wki Hotline regarding debt collection agencies that may not be complying with the rules. Furthermore, in January 2026, the Inspectorate JenV published a formal Policy Rule on Administrative Fines setting out the framework for fines for Wki infringements.
It is important to note that the State Secretary’s policy response indicates stricter enforcement in the future. The Inspectorate of Justice and Security has indicated that an expansion of its range of tools is necessary to ensure more effective supervision, including powers of publication and disclosure, and a power to impose fines specifically for breaches of the registration obligation. The Ministry is exploring whether it is possible and desirable to impose an administrative fine for the wrongful failure to register. Furthermore, the State Secretary has announced a review shortly after 1 October 2026 to assess whether the number of registrations has increased. Finally, the legislative evaluation is being brought forward by one year, to 2028, due to the “strong indications” from the implementation review.
We therefore advise out-of-court debt collection service providers who are not yet registered to assess as soon as possible whether their activities are subject to registration and, if so, to ensure their registration is in order. The statutory decision period for a registration application is thirteen weeks. Creditors should ensure that they engage only registered debt collection service providers: the Debt Collection Service Register on the Justis website can be consulted for this purpose.
Applications for a CCD II licence are already possible
The revised Consumer Credit Directive (Directive (EU) 2023/2225) (“CCD II”) will come into force on 20 November 2026. With this directive, the European legislator aims to better protect consumers and further harmonise the rules on consumer credit within the European Union. The bill for the implementing legislation has been tabled in the House of Representatives. The implementing decree is currently in the preparatory phase. The Netherlands Authority for the Financial Markets (“AFM”) has announced that, in anticipation of the final implementation, it is already processing applications for licences under CCD II.
The implementation of the CCD II brings about significant changes to the regulations governing consumer credit, including changes to its scope. Once it comes into force, more parties will be classified as credit providers or intermediaries. This is particularly relevant for credit providers and intermediaries who are currently still covered by an exemption or exception, such as providers of BNPL services, deferred-debit cards and hire or lease agreements with an option to purchase. In particular, we advise these parties to check whether, following the implementation of the CCD II, they will be subject to the licensing requirement as consumer credit providers under Article 2:60 of the Financial Supervision Act (“FSA“). In addition, credit providers must also check whether they are required to register intermediaries with whom they collaborate with the AFM under the new registration regime set out in Section 2:81 of the FSA. This registration requirement applies to suppliers of movable goods or services that are large undertakings and act as intermediaries in BNPL services.
As the implementation of CCD II is not yet finalised, applicants bear the risk that the legal framework governing the licence application may still change. This is an important caveat that the AFM highlights regarding the possibility of applying for a CCD II licence at this stage.
New AFM policy rule on the suitability assessment of decision-makers at audit firms
The AFM published the Policy Rule on Suitability under the Audit Firms Supervision Act (“Wta“) 2027 on 20 August 2026. This policy rule sets out the assessment framework that the AFM will apply when assessing the suitability of policymakers at audit firms. The policy rule relates to the Accounting Sector Amendment Act and is expected to come into force simultaneously with that Act on 1 January 2027. The new policy rule is therefore not yet applicable, but it does offer audit firms an insight into how the AFM will conduct future suitability assessments.
In view of the public interest in high-quality statutory audits, the legislator has imposed certain governance requirements on audit firms. One of these requirements concerns the fitness assessment of policymakers. The Accountancy Sector (Amendment) Act extends the existing fitness requirement to policymakers at the largest standard audit firms. Until now, this requirement applied only to policymakers at audit firms serving Public Interest Entities (PIEs). The fitness and propriety assessment will also apply to audit firms with a standard licence that generate at least € 3 million in turnover from statutory audits over three consecutive financial years and carry out at least 150 statutory audits annually.
The policy rule sets out in more detail the factors that the AFM considers when assessing the suitability of decision-makers for these audit firms. The annex to the policy rule contains a list of competencies that can be used to demonstrate suitability. These include, among others: adaptability and flexibility, authenticity, decisiveness, communication skills, a strategic overview, a focus on quality and leadership.
In the policy rule, the AFM also emphasises that day-to-day decision-makers must devote sufficient time to carrying out their duties. They must therefore prioritise the management of their organisation and pay attention to internal operations, duty of care, quality control and monitoring, continuous improvement, and behavioural and cultural aspects within the audit firm.
Although the policy rule has not yet come into force, it already offers valuable guidance for assessing the suitability of policymakers for audit firms that will fall within the extended scope of the suitability requirement from 2027 onwards.
Other publications on financial supervision
Below is a selection of other publications relevant to the financial markets and financial supervision.
- On 21 July 2026, DNB disclosed a fine imposed on 9 July 2020 on the payment institution CCV Group BV (“CCV”) for failing to carry out a Systematic Integrity Risk Analysis (SIRA), in breach of Article 3:10 FSA and Article 10 of the FSA Prudential Rules Decree. Due to the absence of a SIRA, CCV lacked a systematic identification and analysis of integrity risks and was unable to fulfil its gatekeeper role adequately. Following an objection, an appeal and a further appeal, the original fine of € 625,000 was ultimately set at € 406,125. CCV has since implemented remedial measures and drew up a SIRA in 2019.
- On 18 June 2026, the Rotterdam District Court reduced the fine of € 375,000 imposed by the AFM on Vodafone Financial Services BV (“Vodafone FS”) to € 185,000. Due to an error in a software update, the income and expenditure test was omitted for several weeks in August 2022 at Vodafone FS when granting telecoms loans. This software error was identified by Vodafone FS itself and reported as an incident to the AFM. After the error had been rectified, it emerged that credit had been granted to 158 customers which should not have been granted (to that extent). The fine was reduced by the Rotterdam District Court to € 185,000 on the basis of the seriousness, duration and culpability of the infringement, and due to the reasonable time limit having been exceeded by five months.
- In its DORA Update 7, the AFM provided further clarification on the application of the DORA thresholds for insurance intermediaries. In Q&A DORA237–3350, EIOPA clarified that, in principle, the figures for the entire undertaking must be taken into account when assessing whether the thresholds have been exceeded. However, in accordance with the principle of proportionality, undertakings whose insurance intermediation activities are of a limited scope may choose to include in the calculation only the activities and resources deployed for those insurance activities. Furthermore, greater clarity has been provided regarding the calculation of the thresholds within group structures. For insurance intermediaries that form part of a group, it must first be determined whether the group is a financial group or a non-financial group. The term ‘financial group’ is not defined in DORA, but on the basis of other EU regulations within financial supervision law (CRR, MiFID II, Financial Conglomerates Directive, Solvency II), it can be taken as a guideline that, in the case of a financial group, more than 50% of the capital, assets, turnover or staff is attributable to entities that qualify as financial undertakings as referred to in DORA (such as investment firms, insurance intermediaries, etc.). In the case of a non-financial group, only the individual undertaking is considered. Should you require assistance in assessing whether DORA applies to your undertaking or your group, please do not hesitate to contact us. We would be happy to assist you.
- It also follows from the Q&As published by the AFM regarding the DORA information register that digital advertising platforms are subject to the reporting obligation. Financial entities that have contractual agreements with such platforms must include them in the DORA information register. At the same time, the AFM clarifies that free services for which no contractual agreement exists do not need to be included in the register. Where advertising platforms are used (in part) without a contract, this provides a practical distinction. Furthermore, from 2026 onwards, the information register may only be submitted in xBRL-CSV format; the one-off conversion service from Excel offered by the AFM in 2025 will not be repeated.