Supervision in Practice: DNB and the AFM as DORA Supervisory Authorities

Digital Escrow Legal Insights — Episode 3

DORA sets the requirements, but supervision determines what compliance actually looks like. In the Netherlands, that supervision splits between two authorities, and both work from evidence, not intention.

The twin peaks model

De Nederlandsche Bank (DNB) is the prudential supervisor for banks, insurers, payment institutions, e-money institutions, and pension funds. The Autoriteit Financiële Markten (AFM) handles conduct-of-business supervision for investment firms, MiCA-authorized crypto-asset service providers, crowdfunding platforms, and data reporting providers. Institutions with multiple authorizations may need to satisfy both.

What they actually examine

DNB doesn’t prescribe escrow anywhere, but its Good Practice on information security covers the territory escrow answers to: governance, outsourcing, testing, and chain risk. The real question a supervisor asks isn’t whether an escrow agreement exists, it’s whether the continuity claim behind it survives scrutiny.

Reporting deadlines that matter day to day

 Major incidents require an initial notification within 4 hours of classification (max 24 hours after detection), an intermediate report within 72 hours, and a final report with root cause analysis within a month. Separately, the Article 28 register of information logs every ICT third-party arrangement, making unaddressed dependencies visible to supervisors.

Continuity for hosted services

Recovery time and recovery point objectives (Articles 11–12) have to be tested, not just documented. A rebuild-from-source-code recovery plan often can’t meet an objective measured in hours, a step-in arrangement can. Article 29’s concentration risk assessment also reaches the hosting layer behind your software supplier, which is exactly where SaaS escrow operates. And Article 28(8) requires an exit that doesn’t disrupt the business or degrade client service, not just an exit that exists on paper.

Escrow as audit evidence

 An escrow agreement shows materials were lodged. A verification report shows those materials actually work. Periodic re-verification is what produces the ongoing evidence trail testing obligations require.

Takeaway:

Neither DNB nor the AFM prescribes escrow, but both examine the continuity claims it supports, and a critical dependency with no documented exit route is a gap they can see.

Watch the video: Episode 3 – Supervision in practice: DNB and the AFM as DORA supervisory authorities