Corporate compliance in the Netherlands: which rules apply to you?

Corporate compliance in the Netherlands is not a single regime but a set of obligations from different laws, each with its own supervisor and its own sanction. Most of these obligations apply to every Dutch company, but several important ones depend on your sector and size, so the first step is always to establish which rules actually apply to your business.

What the obligations have in common is that most of them are enforced administratively. A supervisor can impose a fine without anyone having suffered loss and without anyone having complained. Four blocks cover the majority of businesses. First, company law obligations under Book 2 of the Dutch Civil Code (Burgerlijk Wetboek, BW): keeping proper records, filing annual accounts on time, registering ultimate beneficial owners, and the directors’ duties that make a board personally exposed where these are neglected. Second, data protection under the GDPR and its Dutch implementing act, supervised by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), with fines calculated on worldwide turnover. Third, cybersecurity obligations under the Cybersecurity Act (Cyberbeveiligingswet) for organisations in the designated essential and important sectors, in force since 15 August 2026, which place responsibility expressly on the management body. Fourth, for businesses within its scope, the client due diligence, monitoring and reporting duties of the Money Laundering and Terrorist Financing (Prevention) Act (Wwft).

Above a certain size, further requirements apply irrespective of sector: an internal procedure for reporting wrongdoing under the Whistleblower Protection Act (Wet bescherming klokkenluiders), targets for a balanced board, and sustainability reporting for companies caught by the European reporting framework, whose scope and timing were amended considerably in 2026.

What does corporate compliance mean in the Netherlands?

Corporate compliance means that your company meets the legal obligations that apply to it and can show that it does. In the Netherlands, those obligations come from Dutch statutes, directly applicable EU regulations such as the GDPR, and Dutch acts that implement EU directives.

There is no single compliance code that lists everything a company must do. Instead, each law sets its own duties, appoints its own supervisor and has its own sanctions. A BV in the technology sector, for example, deals with the Chamber of Commerce (Kamer van Koophandel, KVK) for its filings and register entries, with the AP for personal data, and possibly with a sector supervisor under the Cybersecurity Act. A trust office or a payment institution also falls under the Wwft and the financial supervisors. Mapping which laws apply is therefore the starting point of any compliance programme.

How do Dutch supervisors enforce compliance?

Most compliance obligations are enforced through administrative law: the supervisor investigates, and can impose a fine or an order subject to a penalty. Criminal prosecution is possible for some violations, but is usually reserved for serious or deliberate cases.

This has practical consequences. A supervisor does not need a victim or a complaint before acting. It can start an investigation on its own initiative, for example after a data breach notification, a media report or a sector-wide inquiry. During an investigation, your company must cooperate and provide information within the term the supervisor sets. A fine decision can be challenged through an objection (bezwaar) to the supervisor and then an appeal to the administrative court.

Supervisors also look at substance rather than paperwork. A policy that nobody applies does not protect you. What counts is whether the measures are actually implemented, whether staff know them, and whether the board monitors them. The level of a fine generally depends on the seriousness and duration of the violation, the degree of culpability and the measures the company took itself. A documented, working compliance system therefore helps both to prevent violations and to limit the consequences if something does go wrong.

Which obligations apply to almost every company?

Every Dutch BV and NV must keep proper records, file its annual accounts on time and register its ultimate beneficial owners. Directors who neglect the first two obligations run a real personal risk if the company goes bankrupt.

The main obligations under company law are these:

• Proper administration: under article 2:10 BW, the board must keep records of the company’s financial position in such a way that its rights and obligations can be known at any time. The board must keep the books, documents and other data carriers for seven years.

• Annual accounts: a BV or NV must prepare annual accounts and file them with the KVK within eight days of their adoption. According to the KVK, the deadline for adoption depends on the legal form but is at most twelve months after the end of the financial year. If the accounts have not been adopted in time, the company must file the provisional accounts.

• UBO register: companies must register their ultimate beneficial owners (UBOs) with the KVK. A UBO is the natural person who ultimately owns or controls the company, for example someone who holds more than 25% of the shares. Changes must be reported to the KVK within one week. Access to the register has been restricted: the general public can no longer consult it, while authorised persons and government bodies such as the Tax Administration can.

• Data protection: every company that processes personal data, including employee data, must comply with the GDPR. Under article 83 GDPR, the most serious violations can lead to a fine of up to €20 million or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher. Other violations, such as failing to secure data properly, carry a maximum of €10 million or 2%.

The link between these obligations and personal liability is direct. Under article 2:248 BW, every director is jointly and severally liable to the bankruptcy estate if the board has manifestly failed to perform its duties properly and this is an important cause of the bankruptcy. Article 2:248 paragraph 2 BW adds that if the board has not met its obligations under article 2:10 or 2:394 BW (administration and filing of the annual accounts), it has performed its duties improperly by law, and it is presumed that this was an important cause of the bankruptcy. The claim can only be based on improper performance in the three years before the bankruptcy. Late filing of the annual accounts is therefore not an administrative detail but a significant risk for every director.

Most businesses also have obligations under employment law, tax law and consumer law. These fall outside the scope of this article, but they belong in the same inventory of applicable rules.

Which requirements depend on your sector and size?

Several important regimes apply only to companies in particular sectors or above particular size thresholds. The Cybersecurity Act, the Wwft, the sustainability rules and the board diversity rules all work this way, so the thresholds determine whether you need to act at all.

The Cybersecurity Act is a good example. It entered into force on 15 August 2026 and implements the European NIS2 Directive. It applies to organisations in critical sectors that have at least 50 employees and an annual turnover or balance sheet total of more than €10 million. Within that group, the law distinguishes between essential entities, in very critical sectors such as energy, transport, banking and healthcare, and important entities in other critical sectors.

Organisations covered by the Cybersecurity Act must register with the National Cyber Security Centre (NCSC), assess the risks to their digital systems and take appropriate measures (the duty of care, or zorgplicht). Significant incidents must be reported in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. The board is ultimately responsible for the duty of care, must keep its knowledge of cybersecurity up to date and must follow training. Fines can reach €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.

The Wwft applies to specific groups of institutions and professionals, such as banks and other financial institutions, and certain service providers like accountants, tax advisers, notaries and estate agents. They must carry out client due diligence, monitor the business relationship and report unusual transactions to the Financial Intelligence Unit (FIU-Nederland). Each group has its own Wwft supervisor. If your business is not an institution within the meaning of the Wwft, these duties do not apply to you directly, although your bank or accountant will ask you for information to meet their own obligations.

Do the sustainability reporting and due diligence rules apply to you?

Since the EU adopted the Omnibus I Directive on 24 February 2026, the sustainability rules apply only to very large companies. Most small and medium-sized businesses now fall outside both the reporting directive and the due diligence directive.

The Corporate Sustainability Reporting Directive (CSRD) requires companies to report on their environmental, social and governance performance. After Omnibus I, it covers EU companies with more than 1,000 employees and a net turnover of more than €450 million. For non-EU groups, the test is a net turnover in the EU of more than €450 million, combined with an EU subsidiary or branch with a turnover above €200 million. Member states must implement these amendments in their national law, so the exact timing in the Netherlands depends on the Dutch implementing legislation.

The Corporate Sustainability Due Diligence Directive (CSDDD) requires companies to identify and address adverse human rights and environmental impacts in their chain of activities. After Omnibus I, it applies to EU companies with more than 5,000 employees and a worldwide net turnover above €1.5 billion, and to non-EU companies with a net turnover in the EU above €1.5 billion. Member states must transpose the directive by 26 July 2028, and companies must comply from 26 July 2029. The maximum fine is 3% of net worldwide turnover. The EU-wide civil liability regime that was originally part of the directive has been removed; whether civil liability applies is now left to national law.

For companies below these thresholds, the rules still matter indirectly. Large customers that fall within the scope often ask their suppliers for information and contractual assurances about their own operations. If you supply such a customer, review those requests and contract clauses carefully. They can create contractual obligations that go further than the law itself.

Which governance and integrity rules apply?

Governance duties also depend on the type and size of company. The strictest board diversity rules apply only to listed companies, while the obligation to have a whistleblowing procedure applies to every employer with 50 or more employees.

The main governance and integrity rules are the following:

• Board diversity: under the Act on balanced gender representation (Wet ingroeiquotum en streefcijfers), the supervisory board of a Dutch company listed in the Netherlands must consist of at least one third women and at least one third men. An appointment that does not contribute to reaching that balance is void. Large NVs and BVs that are not listed must set appropriate and ambitious targets for the board, the supervisory board and senior management, draw up a plan to achieve them, and report to the Social and Economic Council (SER) annually, within ten months after the end of the financial year. The law does not prescribe quotas for professional backgrounds.

• Whistleblowing: under the Whistleblower Protection Act, employers with 50 or more employees must have an internal procedure for reporting suspected wrongdoing. Employees who report in good order are protected against retaliation.

• Corporate governance code: the Dutch Corporate Governance Code applies to listed companies, which must explain in their annual report where they deviate from it (comply or explain). Other companies can use it as a reference, but are not bound by it.

• Risk management: the general duty of directors to perform their tasks properly includes having insight into the main risks of the business. For organisations covered by the Cybersecurity Act, this duty is made explicit for digital risks.

The supervision of the whistleblowing rules is still developing. The Whistleblowers Authority (Huis voor Klokkenluiders) currently has limited powers to enforce the employer obligations, and a bill is being prepared to strengthen its supervisory and enforcement powers. That is no reason to wait: an employee who is disadvantaged after a report can already invoke the protection of the act in court.

Which mistakes create the greatest legal exposure?

The mistakes with the biggest consequences are rarely complex. Late filings, outdated registers and missing procedures create clear violations that a supervisor or a bankruptcy trustee can easily establish.

Which documentation and filing errors are most dangerous?

Documentation errors are dangerous because the law attaches presumptions to them. If the annual accounts are filed late or the administration is incomplete, a director in a bankruptcy must rebut a statutory presumption instead of the trustee proving improper management.

Errors to watch out for include:

• Late filing of the annual accounts: filing after the statutory deadline triggers the presumption of article 2:248 paragraph 2 BW if the company goes bankrupt within three years. Record the deadlines and make sure the shareholders adopt the accounts in time.

• Incomplete records: an administration that cannot show the company’s rights and obligations at any moment does not meet article 2:10 BW. This also applies to group companies and dormant entities.

• Outdated UBO data: changes in ownership or control must be reported within one week. Outdated information can have serious consequences, for example in a criminal investigation, and can cause problems with banks and other institutions that rely on the register.

• Inconsistent information: figures and statements in the annual report, sustainability information and information given to banks or investors should match. Contradictions undermine credibility with supervisors and can lead to liability claims.

Which governance pitfalls should you avoid?

Governance mistakes are often omissions: a procedure that was never adopted, a target that was never set, or training that never took place. Such omissions are easy for a supervisor to identify.

Pitfalls to avoid include:

• No whistleblowing procedure: an employer with 50 or more employees that has no internal procedure breaches the Whistleblower Protection Act. A procedure that exists but that employees do not know about offers little protection in practice.

• Gender balance targets not set or not reported: large NVs and BVs must report to the SER annually. Setting targets without a plan to achieve them does not meet the purpose of the act.

• Cybersecurity treated as an IT matter only: under the Cybersecurity Act, the board itself is responsible for the duty of care and must follow training. A board that leaves cybersecurity entirely to the IT department cannot show that it meets its own obligations.

• No incident procedure: the reporting deadlines of 24 hours, 72 hours and one month under the Cybersecurity Act, and the duty to report data breaches under the GDPR, can only be met if the company has decided in advance who assesses an incident and who reports it.

How do you keep compliance up to date?

Keep compliance up to date by reviewing at least once a year which rules apply to your company, and by checking that the measures you have taken still work. Rules change, and so does your business: growth, a new activity or an acquisition can bring you within the scope of a regime that did not apply before.

The size thresholds in this article show why. A company that grows past 50 employees must adopt a whistleblowing procedure, and an organisation in a critical sector that passes the thresholds of the Cybersecurity Act must register with the NCSC and meet the duty of care. Including these thresholds in your annual review avoids surprises.

What should you check as a director?

Several obligations rest on the board personally, and Article 2:248 BW links them directly to liability in bankruptcy. These checks cover the points that create that exposure.

• The annual accounts are adopted on time and filed with the KVK within eight days of adoption.
• The administration shows the company’s rights and obligations at any time and is kept for seven years (Article 2:10 BW).
• Changes in the UBO data are reported to the KVK within one week.
• Board resolutions and conflicts of interest are documented as the law and the articles of association require.
• If the Cybersecurity Act applies, the board has followed the required training and approved the risk measures.

What should you check as a company?

For the organisation, the main task is knowing which regimes apply and who handles each one. Start with these checks and repeat them at least once a year.

• Make an inventory of the laws that apply, with the thresholds that decide whether they apply, such as 50 employees for a whistleblowing procedure.
• Give each obligation one owner and put the deadlines in a calendar: annual accounts, SER report, UBO review.
• Check that an employer with 50 or more employees has an internal reporting procedure that employees actually know.
• Set up an incident procedure that meets the 24-hour, 72-hour and one-month reporting deadlines of the Cybersecurity Act and the GDPR rules on data breaches.
• Review sustainability and compliance clauses that large customers ask you to sign.

What can we do for you with corporate compliance?

Our corporate lawyer team helps companies and directors build a programme that fits their size and risks.

• We map which compliance regimes apply to your company and at which thresholds.
• We draft or review the whistleblowing procedure, the incident procedure and the board resolutions.
• We check your filings, UBO registration and administration against Articles 2:10 and 2:394 BW.
• We review sustainability and compliance clauses in contracts with large customers.
• We assist during an investigation by the AP or another supervisor and draft the objection (bezwaar) against a fine decision.
• We advise directors on their personal liability under Article 2:248 BW.

Summary

• Corporate compliance in the Netherlands consists of separate obligations from different laws, each with its own supervisor and sanctions; most are enforced through administrative fines.
• Every BV and NV must keep proper records (art. 2:10 BW), file annual accounts on time (art. 2:394 BW) and keep its UBO data up to date; failures can make directors personally liable in bankruptcy (art. 2:248 BW).
• The Cybersecurity Act (since 15 August 2026), the Wwft and the board diversity rules apply depending on sector and size; check the thresholds for your company.
• After Omnibus I, the CSRD and CSDDD only apply directly to very large companies, but suppliers may face requirements through their customers’ contracts.
• Employers with 50 or more employees need an internal whistleblowing procedure; review your obligations at least once a year.

Frequently asked questions