Kansspelautoriteit and Open Banking: rules for the affordability check

The Kansspelautoriteit forces online gambling providers to use Open Banking for the affordability check for high deposits. Players give explicit consent via services covered by PSD2 rules to have their payment accounts viewed. This guarantees compliance with the duty of care and helps combat gambling addiction by using objective financial data. The Kansspelautoriteit itself does not look at these bank details.

The role of Open Banking in the affordability check

The Kansspelautoriteit has tightened the rules for the affordability check. Open Banking is the main tool for objective verification here. This technology allows licensees, provided the player agrees, to request up-to-date financial data. This is how they comply with the duty of care. Registration in CRUKS is a different system, but these financial checks form an extra layer in the fight against problematic gaming behavior and money laundering.

When is an affordability check mandatory?

As the national regulator, the Kansspelautoriteit supervises the sector. Clear limits have been established to protect consumers from gambling addiction and debt. An affordability check is mandatory as soon as a player wants to deposit above certain amounts within a fixed period. Lower limits apply to young adults between 18 and 24 years old. This measure stems from the legislation in force since the market opened in 2021. The focus is on preventing gambling behavior that does not match the player's wallet. Providers must prove that they have used sufficient and verifiable information before allowing higher deposits. This is directly related to their statutory duty of care.

How does Open Banking replace payslips?

Old proof documents such as payslips are easy to forge. The Kansspelautoriteit therefore urges more objective methods. Open Banking, regulated via the European PSD2 directive, offers a solution. Licensed third parties gain access to payment account data, but only if the account holder gives explicit consent. This transaction history is up-to-date and much harder to manipulate than paper documents. In the Netherlands, supervision of these payment service providers falls under De Nederlandsche Bank. This body ensures that only authorized parties, such as Account Information Service Providers, are allowed to view this data for the affordability check. The process guarantees that the financial check is based on actual expenses and income, rather than on static and potentially outdated documents.

Financial verification differs from exclusion via CRUKS. CRUKS (Centraal Register Uitsluiting Kansspelen) is a separate register of the Kansspelautoriteit. Players can register in it to exclude themselves from all legal providers. Registration in CRUKS is separate from the bank data requested via Open Banking. One system serves for self-exclusion in case of addiction problems, the other for preventive financial control. However, both systems have the same goal: identifying risky behavior early. While CRUKS responds to an active request for exclusion, the analysis of bank transactions via Open Banking signals potential financial overstrain before serious damage occurs. This strengthens the provider's general duty of care.

Supervision and powers of the Kansspelautoriteit

The Kansspelautoriteit (Ksa) is the independent regulator that, on behalf of the Ministry of Justice and Security, monitors a safe and fair offer of games of chance in the Netherlands. The Ministry of Justice and Security is politically responsible for the broader policy regarding games of chance and social protection. Within this ministry, the State Secretary for Justice and Security is specifically tasked with the implementation and detailing of the legislation, including the requirements for the affordability check. Although the Ksa sets strict rules, this authority does not have direct access to your bank details. That supervision falls under De Nederlandsche Bank (DNB) via the PSD2 directive.

May the Kansspelautoriteit view my bank account?

No, the Kansspelautoriteit does not look directly into your personal bank transactions. The Ksa acts as a regulator that grants and enforces licenses, but has no live link with private accounts. Instead, the State Secretary for Justice and Security obliges providers to verify the financial capability of players themselves in case of high deposits. This check is done via Open Banking. A third party (an AISP) retrieves the data, but only with your explicit consent.

It is important to know that De Nederlandsche Bank (DNB) supervises these payment services and grants licenses to AISPs. The Authority for the Financial Markets (AFM) focuses more on the behavior of financial service providers towards consumers. It touches on this indirectly through consumer protection regarding data sharing. Without your active consent via Strong Customer Authentication (SCA), no party, including the Ksa, will gain access. This ensures that the Ministry of Justice and Security achieves its goal of addiction prevention without violating privacy through direct state supervision of accounts.

How does the Ksa enforce correct implementation?

The Kansspelautoriteit enforces the rules through audits, fines, and binding instructions. If a licensee neglects the duty of care or does not perform the affordability check correctly, the Ksa intervenes. The State Secretary for Justice and Security has ruled that providers must use objective proof, such as data from Open Banking applications.

Enforcement focuses on the following points: Checking whether the affordability check is based on sufficient and verifiable information. Enforcing against illegal gambling and tackling criminal providers. Publishing sanctions and decisions on objections to guarantee transparency.

In this regard, the Ksa cooperates with other authorities such as the FIU for anti-money laundering measures. The primary focus is on compliance with the Games of Chance Act. The Authority for the Financial Markets (AFM) and De Nederlandsche Bank (DNB) do not play a direct enforcement role in the gambling behavior itself, but they do ensure the stability of the payment infrastructure used.

What is the role of DNB and AFM in this?

There is a clear division of tasks between the regulators. De Nederlandsche Bank (DNB) is responsible for the supervision of payment services under the PSD2 directive, including Open Banking. DNB grants licenses to Account Information Service Providers (AISPs). They make the technical link with banks possible. This ensures that the data exchange is secure and standardized, independent of gambling policy.

The Authority for the Financial Markets (AFM) supervises the conduct of financial enterprises and the protection of consumers in the financial market. Although the AFM is not directly responsible for gambling, it plays a role in the broader context of financial services and transparency. The Kansspelautoriteit, on the other hand, focuses specifically on gambling behavior and the prevention of addiction.

The division of tasks is as follows: 1. DNB: Regulates the technical and legal side of Open Banking and AISPs. 2. AFM: Monitors the integrity of financial service providers and consumer rights. 3. Ksa: Enforces gambling legislation and requires providers to use Open Banking data correctly for the affordability check.

This separation ensures that the Ministry of Justice and Security can steer towards social goals through the Ksa, while DNB and the AFM monitor the financial infrastructure and market integrity.

Technical framework: PSD2 and API standards

The Kansspelautoriteit open banking rules require a solid technical infrastructure based on the European PSD2 directive. This legislation obliges banks to grant access to third parties via standardized interfaces, provided the customer gives explicit consent. For online casinos, this means that payment initiation and account information services are only legal when they comply with strict authentication protocols and are supervised by De Nederlandsche Bank.

How does PSD2 consent work for players?

Consent is not a passive agreement, but an active action secured by Strong Customer Authentication (SCA). Players must identify themselves twice, for example via a PIN code and a biometric scan in their banking app, before data is shared. This SCA procedure ensures that the account holder actually consents to sharing financial data for the affordability check. This is essential for compliance with the duty of care. Without this multi-layered verification, any data transfer to a casino is illegal and unsafe.

Which parties facilitate this link?

Casinos rarely work directly with hundreds of banks. They engage licensed third parties. An Account Information Service Provider (AISP) retrieves balances and transaction history for the affordability check. A Payment Initiation Service Provider (PISP) initiates deposits without credit card details being exchanged. Services like Tink, Plaid, or Yolt act as this crucial link between the player, the bank, and the casino. They ensure that the operator only receives the necessary, anonymized data required for the Ksa checks. This conforms to the principle of data minimization.

What is the Berlin Group standard?

Technical uniformity is guaranteed by the Berlin Group, an industry alliance that developed the NextGenPSD2 API standard. This specification ensures seamless communication between European banks and third parties. This makes integrations for gambling providers more efficient and less error-prone. Because Dutch banks adopt this standard, AISPs and PISPs can develop once and connect everywhere. This reduces friction for players during the verification process and supports the enforcement of the Anti-Money Laundering and Anti-Terrorist Financing Act through reliable data flows.

Privacy, Wwft and legal safeguards

The Kansspelautoriteit open banking rules require a careful balance between fraud prevention and privacy. Although the regulator requires access for affordability checks, GDPR remains the cornerstone of data protection. Players must grant explicit consent. Data is only processed for specific purposes and is not stored indefinitely by providers.

Is data sharing via Open Banking GDPR-proof?

Yes, provided there is explicit, informed consent and data minimization by the provider. Under the PSD2 legal framework, a third party only gains access to payment accounts if the account holder consents to this beforehand. This consent can be withdrawn at any time. The processing must be transparent: service providers must make it clear what data is used for, in accordance with the strict requirements of GDPR. Without this license and consent, access to financial data is strictly prohibited.

How does this relate to the Wwft and the FIU?

Transaction monitoring helps identify unusual patterns for reporting to the FIU (Financial Intelligence Unit). The Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) obliges gambling providers to continuously monitor customer transactions. Suspicious activities must be reported immediately to the Dutch FIU. This is a unit of the Ministry of Finance specialized in analyzing financial flows pointing to crime. This legislation applies to both online and land-based providers, such as Holland Casino, to combat crime within the sector. The Kansspelautoriteit strictly enforces these rules to minimize money laundering risks, while the FIU provides the intelligence for criminal investigations.

Transparency via the Open Government Act

In addition to privacy legislation, the Open Government Act (Woo) plays an important role in the transparency of supervision. Decisions of the Kansspelautoriteit, such as imposing fines or revoking licenses, are made public in accordance with the Woo. This means that sanctions are only published once objection periods have expired, unless it concerns serious violations that directly harm the public interest. This act ensures that citizens and journalists have insight into how the regulator acts against providers who ignore the rules for Open Banking and the affordability check.

They emphasize that Open Banking is more secure than sharing login details (screen scraping). According to the Dutch Payments Association (Betaalvereniging Nederland), this system works via secure APIs where third parties do not see passwords. This industry organization states that transparency and limited data access are essential for consumer confidence.

About this article - Editorial guidelines

Author: SARAH WEBER (Casino Tester & Bonus Analyst)
Fact-checked by: DR. MARKUS HOFFMANN (Senior iGaming Compliance Analyst)
Last updated: 2026-08-28.

This article about "Kansspelautoriteit open banking rules" was written by Sarah Weber and fact-checked by Dr. Markus Hoffmann. Both regularly update the content based on changes in regulations, licenses, and bonus terms. All references to licenses, regulators, and legislation link to public sources (the local gambling regulator, the applicable local gambling law).

About the author

8+ years of experience reviewing casinos, 200+ personally tested platforms within the EU and worldwide. Former member of the eCOGRA Player Advocacy Program (2018-2022). Specialization: wagering requirements, withdrawal processes, and customer service evaluation.

About the reviewer

12+ years of experience in the iGaming industry, including 5 years as a compliance consultant for licensed providers in multiple regulated markets. PhD in economic mathematics. Focus areas: bonus mathematics, wagering analysis, and player protection systems.

Responsible gambling

Gambling can be addictive. If you feel you are losing control of your gaming, please contact the relevant gambling problem helpline or use the national self-exclusion register (the relevant national self-exclusion register). Set personal deposit and loss limits BEFORE playing with real money. The provider's pause and cool-off tools are there to keep gaming responsible.

Legal notice

The information in this article is provided solely for editorial and comparison purposes and does not constitute legal advice. Players are personally responsible for complying with local regulations.