Dutch Authority for the Financial Markets and De Nederlandsche Bank warn that dependence on non-European IT providers is creating systemic risk

The Dutch Authority for the Financial Markets (AFM) and De Nederlandsche Bank (DNB) have published a joint report warning that the Dutch financial sector’s growing reliance on a limited number of non-European IT service providers is increasing concentration risk and the potential for systemic disruption. The report frames digital dependence as a financial stability concern, where an outage or cyber incident at a single provider could affect multiple institutions at once. The regulators highlight increased outsourcing of critical IT functions, including cloud services, software solutions and AI models, and note that geopolitical developments heighten the risk that these dependencies could be exploited for political leverage or in trade disputes. Illustrative scenarios include the sudden suspension of essential IT services due to sanctions and hybrid attacks that combine cyber intrusions with sabotage of infrastructure. AFM and DNB urge institutions to prepare for disruptive scenarios through collaboration with vendors, authorities and peers, including developing threat scenarios, sharing incident intelligence and conducting ecosystem-wide chain tests, and to be able to justify how sourcing decisions support data sovereignty and security. The report also calls for coordinated European solutions to reduce dependence over the longer term, including developing robust European alternatives and strengthening the innovation and investment climate for European technology firms. An English version of the report is expected to follow.