Amsterdam fintech runs on DNB + AFM-grade AI velocity.

Headcount 30-150 FTE at Series A-B, stretching to 200-500 for Series C and unicorn-scale (Bunq, Mollie, Mambu).

A representative Series B shape: 10-18 engineers (heavy backend, Go / Java / Python on AWS Frankfurt or Ireland), 4-8 product, 4-6 design and content, 3-5 compliance and risk including at least one DNB-registered Beleidsbepaler, 6-12 sales and marketing, 3-5 ops and finance, 3-5 customer support. Runway 18-30 months post-round; the 2024-2025 cohort is materially more cash-conscious than the 2021 vintage.

Two geographic nodes hold the operating footprint. Amsterdam Zuidas — the financial CBD around the WTC, Gustav Mahlerlaan and the Atrium tower — anchors ING, ABN AMRO, Adyen's Singel / Zuidas presence, ABN AMRO Clearing, Euronext Amsterdam, AFM and DNB inside a 15-minute walk. Most Series B+ fintechs anchor a second-floor footprint in Zuidas for regulator and corporate-bank proximity.

The Amsterdam Centrum / Amstel corridor holds the early-stage and product-led cohort: Mollie on Keizersgracht, Bunq's Naritaweg HQ near Sloterdijk, Mambu's Amsterdam tech office, Booking.com's Oosterdokseiland campus, and the Rockstart and Holland Fintech accelerator network around Singel and Herengracht.

Buyer triumvirate. Three roles must say yes for an external AI vendor to land: CMO or Head of Growth, Compliance / MLRO plus DPO, and VP Product or Product Marketing. Engineering will not block but gates on EU-region inference, ISO 27001 or SOC 2 Type II, and DORA Article 28 contractual clauses.

Below Series B procurement is light; above it, vendor risk questionnaires aligned to DORA's ICT third-party register and the EBA Guidelines on outsourcing become mandatory. GTM cycle for B2B fintech runs 60-150 days first contact to signed pilot; consumer-fintech CAC has roughly doubled since 2021 as Google CPCs on Dutch financial-product keywords inflated.

Alumni tree is the buying signal. Adyen — founded 2006 by Pieter van der Does and Arnout Schuijff, listed June 2018 at €240/share, now operating under a Dutch banking licence as Adyen N.V. — seeds the densest founder graph in Dutch fintech. Mollie's current CEO Koen Köppen and several Series A founders trace founding-team experience to Adyen.

Booking.com's payments platform processed >€80B GMV in 2024 and the in-house Booking Sponsored Benefits and Booking Pay teams ship embedded finance at scale; Booking alumni seed product and growth roles across Mollie, Bunq, Riverty, Tikkie and Mambu. Holland Fintech and Dealroom both confirm the Adyen + Booking.com network as the majority seed source for new Series A rounds.

DNB + AFM dual supervision is the structural frame. DNB (De Nederlandsche Bank) is prudential regulator and operates the Dutch payments register — PSD2 payment institutions, electronic money institutions, banks (LSI under DNB direct, SI under the ECB SSM), insurers and pension funds.

The Wft (Wet op het financieel toezicht) EMI authorisation requires €350K initial capital, board fit-and-proper (DNB Beleidsbepalers test), safeguarding of client funds and an outsourcing register; the typical authorisation timeline is 9-12 months from complete file. AFM (Autoriteit Financiële Markten) is the conduct regulator — AIFM, MiFID II, IDD, MiCA, market abuse, financial promotions and the entire conduct stack including AI-driven personalisation.

PSD2 → PSD3 + PSR is the live transition. PSD2 has been in force since January 2018; the PSD3 + PSR package was politically agreed in late 2025, with entry into force expected late Q1 / early Q2 2026 and a 21-month transition window.

PSD3 merges the EMI category into payment institutions, mandates IBAN-name verification (already piloted in NL through SurePay), tightens SCA exception logic and expands transaction-monitoring data sharing across PSPs. Around 25-30 EMIs and 35-40 PIs sit on the active DNB register today, with passporting into all 27 EU member states.

DORA + MiCA + EU AI Act is the three-clock calendar. DORA — full application since 17 January 2025 — requires ICT risk governance, incident reporting (initial within 4 hours, intermediate within 72 hours), third-party risk register, threat-led penetration testing building on TIBER-NL which DNB has run since 2018, and ESA-level oversight of critical ICT third-party providers since H2 2025.

MiCA Titles III/IV (stablecoins) live 30 June 2024 and Titles II/V (other crypto-asset services and CASPs) live in NL from 30 December 2024 with the AFM as competent authority — Bitvavo, Coinmerce, BTC Direct and Litebit transitioned through 30 December 2025.

EU AI Act Annex III §5b (creditworthiness assessment) and §5c (life and health insurance pricing) trigger Articles 9-17 provider obligations, Article 26 deployer obligations and an Article 27 Fundamental Rights Impact Assessment from 2 August 2026, with a staggered 16-month postponement for new high-risk systems agreed in the May 2026 political package. Penalties under Article 99: €15M or 3% of global annual turnover.

SMR-equivalent accountability sits with the Wft Beleidsbepaler. The registered policymaker is personally accountable for AI-driven outcomes — that is the line every vendor RFI now interrogates: explainability documentation, model card, sub-processor transparency, DORA Article 28 contractual clauses on exit, audit and sub-outsourcing, and a Fundamental Rights Impact Assessment for any Annex III high-risk use.

The Netherlands sits inside the EU adequacy regime; intra-EU transfers are free-flowing under the AVG (Dutch GDPR); EU → US transfers operate under the EU-US Data Privacy Framework (10 July 2023 adequacy decision) with sub-processor TIAs still the norm.

AP (Autoriteit Persoonsgegevens) is the Dutch DPA — its 2024 enforcement record includes a €30.5M fine against Clearview AI and continued scrutiny of AI-driven profiling.