The EU footing.

Dutch financial services are supervised by De Nederlandsche Bank (DNB) for prudential matters and the Autoriteit Financiele Markten (AFM) for market conduct. Both regulators have a long track record of taking digital-finance and AI supervisory questions seriously, with detailed published guidance on AI in the financial sector. The Dutch framework sits underneath the EU-wide regime set by the European Banking Authority (EBA), the European Securities and Markets Authority (ESMA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European Data Protection Board (EDPB).

For a regulated AI platform, the EU layer is where most of the new substance sits: PSD2 today (PSD3 in passage), the Markets in Crypto-Assets Regulation (MiCA), the Digital Operational Resilience Act (DORA), and the EU AI Act. Each one is enforced in the Netherlands by DNB or AFM acting under the harmonised EU regime.

VEETSO LIMITED is a UK company. Where regulated services are made available to EU customers, they are provided in partnership with EU-licensed institutions under the framework that applies to each service. Post-Brexit, the UK's regulatory regime is no longer equivalent to the EU's for most financial services, which is why the EU-licensed-partner pattern is the only durable way to operate at scale across the bloc.

Dutch supervisory expectations for outsourcing and third-party arrangements follow EBA Guidelines EBA/GL/2019/02 and the related DORA requirements. Veetso's governance system was designed against those standards.

The EU AI Act came into force in 2024 and is being phased in through 2025-2027. It distinguishes prohibited, high-risk, and limited-risk AI systems; financial-services AI used for credit-scoring or for fraud detection is explicitly listed as high-risk in Annex III. The Act requires risk-management systems, data-governance, human oversight, post-market monitoring, and conformity assessment for high-risk systems. Veetso's six gates were designed against these obligations from the start.

The General Data Protection Regulation (GDPR) and the Dutch UAVG continue to govern personal-data processing. Documents and customer data are stored in regions you nominate; AI calls are routed through approved providers under a no-training contractual basis; operational telemetry records counts only, not content.