Short answer. A "CIS registration with banks" does not exist as such. The CIS database run by Stichting CIS is the database of the Dutch insurance sector: registrations are entered there by participating insurers and authorised agents, not by banks. Stichting CIS states explicitly that EVR and EVA registrations on banking and mortgage products are not held in the CIS database. If you run into a registration at a bank, it will almost always be that bank’s incident register, the Internal Reference Register (IVR), the External Reference Register (EVR) that banks consult through BKR’s EVA, or Stichting Fraudebestrijding Hypotheken (SFH). Which register it is determines who you have to address and which retention period applies.
Why "CIS registration with banks" is almost always something else
The confusion is understandable. CIS, EVR, IVR, EVA, incident register and SFH are all registers in which financial institutions warn each other, and the names resemble one another. They are nonetheless separate systems with different administrators, participants and retention periods.
Stichting CIS manages one database, and it belongs to the insurance sector. Its participants are insurers, authorised agents and a small number of organisations recognised by the CIS board. A bank does not simply get access to the CIS database, and a bank does not enter registrations in it either.
Banks have their own registers. Those fall under the same Protocol Incidentenwaarschuwingssysteem Financiële Instellingen (PIFI) as the registrations made by insurers. That is where the overlap lies. But the data sits somewhere else, so you knock on a different door.
Which registers does a bank actually use?
| Register | Who registers | Who can see it | Where to request access |
|---|---|---|---|
| The bank’s incident register | The bank itself | That bank only (and its group) | At the bank |
| Internal Reference Register (IVR) | The bank itself | That bank only (and its group) | At the bank |
| External Reference Register (EVR), banking | The bank, through BKR’s EVA | Other affiliated financial institutions | At the bank; the register runs through BKR |
| Stichting Fraudebestrijding Hypotheken (SFH) | Mortgage lenders | Affiliated mortgage lenders | At SFH and at the lender |
| CIS database | Insurers and authorised agents | Participants of Stichting CIS | At Stichting CIS |
The practical consequence: a request for correction or erasure always goes to the party that entered the registration. Writing to Stichting CIS about a banking registration gets you nowhere, because that data is not held there.
So what is in the CIS database?
Stichting CIS distinguishes, among others, claim reports, guarantee fund reports on uninsured motor vehicles, driving disqualifications, confidential notifications (cancellation or non-payment) and EVR registrations entered by an insurer. The periods differ per type: five years for a claim report, three years for a confidential notification due to non-payment, a maximum of eight years for an EVR registration.
One distinction matters: a claim report is not a fraud signal. It only means that cover was once claimed. Anyone wanting to check the periods per type of registration will find them in our article on the retention period at CIS.
How do you find out which register it is?
As long as you do not know where the registration sits, you cannot challenge anything effectively. In practice this order works fastest.
- Ask the bank in writing. Submit an access request under Article 15 GDPR and ask explicitly: in which register am I recorded, on what date, on what ground, for what duration, and what assessment of that duration has been recorded?
- Request the underlying decision. The protocol obliges the institution to substantiate and record the decision to register and the proportionality assessment. Ask for that record, not only for the notification that you are registered.
- Also request access at BKR if a banking EVR registration may be involved, and at SFH if a mortgage application was in play.
- Request access at Stichting CIS if an insurer was involved as well, for instance through a cancelled policy or a rejected claim.
It regularly happens that someone faces two separate registrations: one at the bank and one at the insurer, arising from the same events. That means two files, two responsible parties and two requests.
Consequences of a registration at a bank
How severe the consequences are depends on the register.
The incident register and the IVR operate within one bank and its group companies. The consequences therefore remain, in principle, limited to that bank: no new products, possibly termination of the relationship.
An EVR registration reaches further, because other affiliated institutions get a hit when they run a check. That can stand in the way of a new bank account, a credit facility or a mortgage. An EVR hit does not disclose the content: the other institution sees that a reference exists and has to make its own enquiries.
An SFH registration mainly affects mortgage applications with affiliated lenders.
What a registration does not do is carry over to the other sector through one shared database. That sharing does not exist. If you experience problems with banks and insurers at the same time, that points to two registrations, and you have to address both.
The conditions an EVR registration must meet
Strict conditions apply to the EVR. Article 5.2.1 of PIFI 2026, in force since 1 April 2026, requires cumulatively:
- the conduct posed, poses or could pose a threat to the interests of clients or staff, to the institution itself, or to the continuity and integrity of the financial sector;
- it is sufficiently established that you were involved in that conduct; in the case of criminal offences a report to the police is made in principle;
- the principle of proportionality has been observed.
Criterion b is the sharpest in practice. A suspicion is not enough, and neither is an internal investigation report resting on assumptions. If a police report is also absent without the institution explaining why, that is a point of attack.
How long may a registration last?
Article 4.3.3 PIFI (incident register) and Article 5.3.2 PIFI (EVR) provide that removal takes place no later than eight years after entry in the incident register. Both articles add: the duration is assessed against the principle of proportionality.
Those two sentences together define the room for argument. Eight years is an upper limit, not an automatic outcome. At the same time, the explanatory notes to the protocol assume that, given the nature of incidents, a registration period of eight years is in principle justified. So you cannot rely on an unwritten rule that lighter cases are "standard" shorter; that rule does not exist.
What does work is showing that the required assessment of the duration was not made, not recorded, or left relevant circumstances out of account. The protocol mentions as examples of circumstances that may justify a shorter period a very young age of the person concerned, or acts committed under threat. And Article 5.3.1 obliges the institution to remove the entry of its own motion as soon as Article 5.2.1 is no longer satisfied.
Your rights and the route per register
Access and information
The institution that registers must inform you of it. In addition, the GDPR gives you a right of access to the data processed about you. At a bank you request that from the bank; for an insurance registration you submit an access request to Stichting CIS.
Rectification and erasure
If the data is incorrect or the registration is unlawful, you request rectification or erasure from the party that registered. For a registration entered by an insurer, Stichting CIS puts a correction request to that insurer; CIS cannot amend the data itself. For a banking registration the request goes through the bank.
If the institution refuses
There are then three routes, and the order is not optional:
- The internal complaints procedure. Almost always the mandatory first step, and often the quickest one as well.
- Kifid. For consumers, after the internal complaints procedure. Kifid applies its own time limits for bringing a complaint; they are short, so do not let them expire. A Kifid ruling can be binding where the parties opt for that.
- The court. Proceedings on the merits, or interim relief proceedings if the consequences are acute, for instance a mortgage that would otherwise fall through. No limitation period applies before the court as it does at Kifid, but that is no reason to wait: the court also weighs how long you sat still.
More about choosing between these routes can be found in removing a registration: the legal routes and, in urgent cases, in interim relief proceedings over a CIS registration.
No bank account left? The right to a basic payment account
If no bank will still open a payment account for you, there is a safety net. Article 4:71f of the Financial Supervision Act obliges banks that offer payment accounts in the Netherlands to give consumers lawfully resident in the EU the opportunity to hold a basic payment account in euros, irrespective of nationality or place of residence. The bank must decide within ten working days of a complete application.
Refusal is permitted only on the grounds set out in Article 4:71g of that Act. That list is exhaustive and includes: the bank cannot comply with the Anti-Money Laundering and Anti-Terrorist Financing Act when opening the account; you are not lawfully resident in the EU; you already hold a payment account with a Dutch IBAN; or you were convicted less than eight years ago of, among other things, forgery, fraud or money laundering.
A registration in the EVR or an incident register is not, as such, on that list. That is not a formality: a bank that points only to the registration is not basing its refusal on a statutory ground. The same set of facts may of course produce an assessment under the anti-money laundering rules, and then there is a ground. Drawing that distinction is therefore the first thing that needs to happen.
What to gather for an assessment
- The letter or e-mail announcing or confirming the registration, with its date.
- The investigation report and the conclusions the institution relies on.
- The recorded assessment of the entry and of its duration.
- The outcome of your access requests at the bank, BKR, SFH and, where relevant, Stichting CIS.
- Correspondence about terminated products or rejected applications.
- Documents showing the concrete consequences you face (a refused mortgage, a refused account, a cancelled policy).
The more complete this file, the sharper the assessment of whether the registration meets Article 5.2.1 and whether the duration is substantiated.
What we can do for you
We first establish which register is involved and who the controller is. That determines the entire route. We then test the registration against Article 5.2.1 PIFI and against the GDPR, request the substantiation and the assessment of duration, and conduct the request and, where needed, the proceedings. If an insurance file is running at the same time, we handle both tracks.
What an assessment produces depends on the facts and on the substantiation the institution gives. We say in advance what we can and cannot estimate and what the next step costs. Depending on your income, subsidised legal aid through the Legal Aid Board may be available; we check that at intake. We do not promise guaranteed removal.
Frequently asked questions about CIS registration with banks
Can a bank register me in the CIS database?
No. The CIS database is the database of the insurance sector; its participants are insurers and authorised agents. Banks register in their own incident register, in the IVR, or in the EVR through BKR’s EVA. Stichting CIS states explicitly that EVR and EVA registrations on banking and mortgage products are not held in the CIS database.
Can a bank see my CIS registration?
The CIS database is accessible to the participants of Stichting CIS: insurers, authorised agents and organisations recognised by the CIS board. A bank therefore does not automatically get access. If you face problems at a bank and at insurers at the same time, this usually involves two separate registrations arising from the same events.
Where do I request access if I do not know which register it is?
Start with the institution that sent you the notification, with an access request under Article 15 GDPR. Ask expressly about the register, the date of entry, the ground, the duration and the recorded assessment. Also request access at BKR (banking EVR through EVA), at SFH if a mortgage was involved, and at Stichting CIS if an insurer was involved as well.
How long does a registration stay?
For the incident register and the EVR, Articles 4.3.3 and 5.3.2 PIFI provide that removal takes place no later than eight years after entry in the incident register, with the duration also being assessed against the principle of proportionality. For registrations in the CIS database the period differs per type: five years for a claim report and three years for a confidential notification due to non-payment, for example.
May a bank refuse me a basic payment account because of a registration?
Not on that ground alone. Article 4:71g of the Financial Supervision Act contains an exhaustive list of refusal grounds, and an EVR or incident registration is not on it. The bank may refuse if it cannot comply with the anti-money laundering rules when opening the account, or if you were irrevocably convicted less than eight years ago of, among other things, forgery, fraud or money laundering.
I am registered at my bank and at my insurer. Is that one case?
Legally these are two cases, with two controllers and two requests. In practice they are usually connected, and the substantiation given by one institution is useful against the other. It pays to run both tracks at once.
Read more
- Fraud registrations at banks and insurers: EVR, IVR, CIS and the incident register
- EVR registration for fraud: when does a bank go too far?
- IVR registration at banks
- The incident register: how do you end up in it?
- CIS registration with insurers
- Lawyer for an EVR or CIS registration
Sources and accountability
This explanation follows the information from Stichting CIS on the types of registration, which states that EVR and EVA registrations on banking and mortgage products are not held in the CIS database and which sets out the periods per type of registration; for banking registrations Stichting CIS refers to BKR (EVA) and Stichting Fraudebestrijding Hypotheken. Articles 4.3.3, 5.2.1, 5.3.1 and 5.3.2 and the explanatory notes on the registration period are taken from the Protocol Incidentenwaarschuwingssysteem Financiële Instellingen 2026, in force since 1 April 2026. The basic payment account rests on Articles 4:71f and 4:71g of the Dutch Financial Supervision Act. Source texts checked on 17 September 2026.
Legally reviewed by Onur Arslan, attorney at Arslan Advocaten. Reviewed on 17 September 2026.
