DNB replaces second-tier regime for bank key-function staff

The De Nederlandsche Bank (DNB) notice implements the CRD6 framework from 22 September 2026, replacing the Netherlands’ national second-tier assessment regime for key-function employees. Amendments to the Financial Supervision Act (Wft) and the Decree on Prudential Rules under the Wft (Bpr) entered into force on the same date.

The framework also covers approved mixed financial holding companies under Article 3:280a Wft.

Institutions retain primary responsibility

Banks and mixed financial holding companies remain responsible for assessing the fitness and propriety of relevant employees. The population covers people who have significant influence over an institution’s management but are not members of its management body, including heads of risk management, compliance and internal audit functions, and the chief financial officer where that person is not a management-body member.

Institutions must maintain processes covering the timing of assessments, measures where fitness or propriety is insufficient, and the maintenance of current information. DNB expects information on key-function employees to remain current, available and properly documented.

External assessment applies only to specified functions at large institutions.

External assessment and existing applications

DNB or the European Central Bank (ECB) externally assesses the heads of risk management, compliance and internal audit functions, and the chief financial officer, where the institution falls within the large-institution scope. DNB is responsible for less significant banks and the ECB for significant banks. The assessment covers both fitness and propriety.

The large-institution test under Article 91 bis, paragraph 5, of the Capital Requirements Directive covers global systemically important institutions, other systemically important institutions, one of the three largest institutions in a member state, and institutions with assets of at least €30 billion on an individual or consolidated basis. The same external-assessment perimeter applies to mixed financial or EU parent holding companies with a large institution in the group.

Banks outside that scope do not face external assessment by DNB or the ECB under this regime. They remain responsible for the internal assessment of employees with key functions. Where a function holder is also a member of the management body, the assessment regime for management-body members applies instead.

An institution must submit a timely, complete and correct application to DNB or the ECB before appointing a key-function employee who falls within the external-assessment perimeter. The application must include the information and forms required for the authority to assess fitness and propriety.

DNB has also specified how it will handle applications already submitted. Second-tier assessment applications that do not fall within the new regime will be left unprocessed and no decision will be issued.

DNB’s notice identifies no separate transition deadline beyond the 22 September 2026 effective date. The next official record to monitor is DNB’s factsheet on assessing key-function employees at banks and mixed financial holding companies.