The Incident Warning System for Financial Institutions (PIFI) is intended to allow financial institutions, under strict conditions, to investigate whether a (legal) person poses a risk to the safety or integrity of the financial sector. The rules and safeguards are set out in the Protocol Incident Warning System for Financial Institutions 2026.
The warning system is not a central general consumer register. Each participating financial institution maintains its own Incident Register. An External Reference Register (EVR) may be linked to that, containing only reference data that other participants can consult under the hit-no-hit system.
PIFI 2026 has been in effect since 1 April 2026. Entry and consultation are only permitted under the conditions of the protocol. The financial institution involved remains responsible for its own file, investigation and registration decision.
It is important to distinguish between different registration systems and the file of the registering institution. This aligns with other registration systems, such as the CIS registration, which has its own purpose and regulatory framework. Because the registration conditions and the available legal remedies depend on the specific file, a careful assessment of the registration file is important.
When will you be included in the incident register?
A financial institution can record data in its own Incident Register when conduct has led or may lead to harm to financial institutions, their customers or employees, or when the integrity of a financial institution may be at stake. A mere payment arrears or a commercial dispute does not automatically constitute grounds for inclusion in the Incident Register or EVR.
An entry does not occur automatically. The institution must apply the protocol conditions, investigate the file carefully and assess the necessity, proportionality and subsidiarity of the processing. Additional, strict conditions apply for an EVR registration.
If you have questions about the criteria or the registration process, you can also look into the EVR registration, which differs from the incident register in certain respects but may also be relevant to your situation.
The consequences of a registration in the incident register
A registration can affect the assessment of an application or an existing relationship with the financial institution involved. The Incident Register itself is not a public credit database. The data in the internal register is accessible only within the limits of the protocol; for an EVR other participants see only a hit-no-hit reference.
A hit in the EVR is not an automatic refusal of a product or service. A financial institution must make its own careful assessment within the boundaries of the protocol and applicable laws and regulations. PIFI provides safeguards for the interests of the data subject.
If you disagree with a registration, direct your request for access, correction or deletion first to the financial institution that recorded the data. Ask for the substantiation and submit relevant documents. Which external complaints or legal route is available depends on the institution involved, the product and the circumstances of the file.
In summary, a registration in the incident register can significantly affect your financial position. It is therefore advisable to obtain legal advice in a timely manner and to act proactively in case of payment problems.
How long does a registration remain?
Do not assume a general retention period for every registration. The applicable period and the question of whether further processing is still necessary and proportionate must be assessed per file on the basis of the protocol, the type of registration and the circumstances. Ask the registering institution for information about your specific file.
The purpose of this retention period is twofold. On the one hand, the incident register serves as an instrument to manage future risks and safeguard integrity within the financial sector. On the other hand, it must be prevented that a registration unnecessarily harms the reputation and functioning of the registered person or company for too long. For that reason many institutions have internal procedures to periodically evaluate registrations and, if justified, remove them.
It is advisable to obtain legal advice if you are unsure about the duration of a registration. Transparency about your own data in the incident register can also be requested from the institution. This contributes to the correct and fair processing of personal data within the framework of the General Data Protection Regulation (GDPR).
The proportionality test: is the registration justified?
A fundamental aspect when recording an incident in the register is the proportionality test. This test assesses whether the registration is proportionate to the actual incident and its consequences. Not every incident automatically justifies an entry in the register. It must concern significant breaches or conduct that are relevant to the institution’s integrity policy.
The proportionality test includes several criteria, including the seriousness of the incident, the intent of the party involved, the impact on the financial sector and the possibility of remediation. If a registration is disproportionate, this may give rise to objection procedures and a request for deletion of the entry.
Correct application of this test prevents unjust blacklisting at banks and contributes to fair treatment of customers and business relations. Financial institutions must therefore act carefully and transparently when recording incidents. For registrants it is important to know that they have the right to challenge a disproportionate registration and to obtain legal advice to protect their interests.
Step-by-step plan: removing an unjust registration
If you suspect that an unjust registration has been recorded in the incident register of financial institutions, it is important to proceed in a structured manner. Below you will find a step-by-step plan that helps you remove such a registration.
- Collecting evidence: Carefully document all relevant correspondence, statements and other evidence that demonstrate the registration is incorrect.
- Contact the relevant financial institution: Submit a formal request to the institution that made the registration. Ask for a reassessment of the situation and removal of the incorrect data.
- Request for access, correction or deletion at the registering financial institution: Explain in writing why the data is incorrect, incomplete or no longer necessary and attach your evidence.
- Review by an independent body: In some cases an independent supervisory authority or a judicial body can be engaged to assess the accuracy of the registration. More information about legal procedures can be found on Rechtspraak.nl.
- Formal removal: When it is established that the registration is unjustified, it should be formally removed from the incident register so that your reputation is restored.
Why seek legal assistance?
The process surrounding an unjust registration in the incident register can be complex and time-consuming. Legal expertise is essential to adequately represent your interests and limit possible damage. A specialised lawyer can support you, among other things, with:
- Correctly formulating objections and correspondence with financial institutions;
- Collecting and presenting evidence in a legally sound manner;
- Engaging supervisory authorities and preparing court proceedings;
- Assessing your rights and obligations within the framework of financial regulation.
Moreover, a legal adviser ensures that you stay informed about the latest developments in financial law and the relevant case law. This significantly increases your chances of a successful removal of the unjust registration. If you want to know more about your legal options, you can consult Rechtspraak.nl for additional information and examples of similar cases.
Frequently asked questions
What is the incident register for financial institutions?
The Incident Register is the individual register of a participating financial institution. The PIFI warning system consists of those separate registers and the EVR reference data linked to them. The aim is to investigate and combat relevant integrity risks under the strict conditions of the protocol.
Who has access to the incident register?
The internal Incident Register is used within the framework of PIFI for investigations by the security departments designated for that purpose. Other participating financial institutions can, in principle, only see via a linked EVR through a hit-no-hit reference that data is present with an institution; detailed information is not generally accessible.
What are the consequences of a registration in the incident register?
A registration can have far-reaching consequences, such as stricter control measures or restrictions when entering into new financial relationships. For financial institutions it means an increased risk of reputational damage and possible sanctions. It is therefore important that reports are made carefully and correctly, and that involved parties obtain legal advice in a timely manner.
See also
- CIS registration: what is it and how do you remove it?
- EVR registration: difference with CIS explained
- Blacklisting at banks – what does this mean for you?
Need help?
Do you have questions about the incident register or have you been confronted with a registration? Arslan & Arslan Advocaten assists you with expert legal advice and guidance. We ensure that your interests are represented optimally and that you take the right steps. Contact us for a free initial consultation and find out what we can do for you.
Need help? Our insurance law lawyer is happy to assist you. Contact us without obligation for a free initial consultation.