A registration in the Dutch External Referral Register (EVR) can have serious consequences for your financial life: an insurance application may be refused, a mortgage application may stall or a bank may terminate your account. How severe the impact is depends on the registration and on the policy of the institution that consults it. Other institutions see a hit/no-hit result and can then ask the reporting institution for information.
Written by Onur Arslan, lawyer at Arslan Advocaten. Onur Arslan has many years of experience with private-law disputes, including insurance-law and BKR-related disputes. Updated: 2 October 2026. This article concerns Dutch law.
Whether the entry is justified depends on three questions: were the protocol’s conditions met, was the duration assessed separately, and was that assessment documented? Below we explain how to examine each point and support a request for removal or a shorter period.
What is the EVR, and who manages it?
The EVR is the external part of the financial sector’s warning system. Its safeguards are laid down in the Protocol on the Financial Institutions Incident Warning System (PIFI). According to the Dutch Banking Association, PIFI 2026 took effect on 1 April 2026, replacing PIFI 2021. For older registrations, establish which version applied when the entry was made and which framework governs its continuation today.
EVR, EVA and EDR are different concepts. EVR is the External Referral Register; EVA is an application through which participating institutions consult referral information. EDR Credit Services also exists and provides, among other things, credit information. An EDR reference is therefore not automatically a misspelling of EVR. Ask which organisation processes information and which register or credit check is involved. See our comparison of EVR, IVR, CIS and the Incident Register (Dutch).
The system is not administered by a single central controller:
- Insurers: the referral application is managed by Stichting Centraal Informatie Systeem (CIS).
- Other participants: their referral application is managed by Stichting Bureau Krediet Registratie (BKR).
CIS and BKR act as processors for these applications. The bank or insurer that registered you is the controller for its entry. Address requests for access, correction and removal to that institution. Check the current participant list and admission conditions where necessary.
The institution also maintains an Incident Register containing incident information. Security departments may share information under PIFI’s strict conditions; its contents are therefore not exclusively internal in all circumstances. The EVR is linked to it. Removal from the EVR does not automatically remove the Incident Register entry: each requires assessment. Our guide to fraud registrations (Dutch) explains the registers.
The three conditions for EVR registration
Article 5.2.1 PIFI sets cumulative requirements. Registration is not justified if a necessary requirement is absent.
- Threat. The conduct threatened, threatens or may threaten the financial interests of clients, employees or the institution, or the financial sector’s continuity and integrity.
- Sufficiently established involvement. A mere suspicion is insufficient. Case law requires more than a reasonable suspicion of guilt: concrete evidence supporting involvement. The protocol also addresses reporting criminal offences to investigating authorities; a criminal conviction is not a prerequisite for registration.
- Proportionality. The interest in recording the information must be balanced against the adverse consequences for you. Subsidiarity also matters: can a less intrusive measure, such as an internal entry, achieve the same purpose?
If an insurer is investigating alleged fraud, also read your rights during an insurer’s fraud investigation. An investigation and a final registration decision are distinct matters.
Eight years: the maximum and the individual assessment
The maximum is not an automatic outcome. The retention period and its starting point must follow the applicable protocol. Eight years is a ceiling for the relevant entry, subject to the protocol’s rules about a new incident; it does not dispense with individual necessity and proportionality.
Your individual duration. PIFI starts from the position that, given the nature of incidents, eight years may in principle be proportionate. It nevertheless requires relevant circumstances to be considered, including whether they justify a shorter period. Examples include very young age or acting under threat. The assessment must be documented and the duration periodically reconsidered.
There is no general rule reducing “lighter” cases to five or six years. Examine whether the institution assessed duration, recorded its reasons and considered your relevant circumstances. A decision without any explanation for choosing eight years is a reason to challenge its justification.
The GDPR applies alongside the protocol. Article 5(1)(e), storage limitation, permits retention only as long as necessary for its purpose. Article 5(2) requires the controller to demonstrate compliance. A protocol maximum does not create an unconditional entitlement to retain data for that whole period.
Ask expressly for the recorded duration assessment and any periodic reassessment. The institution must account for necessity; you should also evidence the individual circumstances supporting reduction. If it provides no assessment or only a generic sentence, explain why that does not answer your case and connect your objection to the request for erasure or reduction. A documented balancing exercise can be scrutinised; a bare reference to the maximum cannot replace it.
A practical example: in Kifid decision 2026-0341 of 9 April 2026, registration remained justified but its duration was reduced from eight to six years. One of the two alleged acts was not established, and the consumers had substantiated private and business disadvantages. Their lack of insight into the seriousness of their conduct also counted against a greater reduction.
Two practical lessons follow: evidence your actual disadvantage and address each allegation separately. Removing one allegation may affect both the basis and duration of registration. Do not treat a six-year outcome in another case as an entitlement in yours.
In alleged money-mule cases, your actual role, pressure or threats, age and experience at the time, and whether you reported the incident can be relevant. Record these facts and support them with documents.
Your request for removal or a shorter period
A useful request has four parts. Specific objections and relevant documents allow a substantive assessment.
- Facts. Request the file. When were you entered in the Incident Register and EVR, on which grounds and for how long? What conduct is alleged? Were you given an opportunity to respond before the decision?
- Evidence. Identify what is missing for each relevant requirement of Article 5.2.1. For example, no explanation of the reporting decision, reliance solely on your failure to explain, or no examination of your role. Include statements, correspondence, a report of threats or third-party evidence where relevant.
- Interests. Specify the application refused, its date and supporting letter. If a deadline is running, such as a financing condition in a purchase agreement, identify the date and attach it. These are facts relevant to proportionality, not a guarantee of removal.
- Requested decision. Ask explicitly for EVR removal, alternatively a shorter stated period, and separately say whether you seek removal from the Incident Register. Request a written reasoned decision within the applicable period.
Access first. Submit a written request and use appropriate identity verification. The institution must respond without undue delay and normally within one month. An extension of up to two months for complexity or volume must be notified with reasons within the first month. Any restriction of access requires a valid legal basis, such as an applicable exception concerning an investigation; it is not enough simply to call the file confidential.
Response periods and court proceedings
Separate the institution’s time to answer from your time to bring that answer before a court.
| Issue | Response period | Court petition |
|---|---|---|
| Basis | Article 12(3) GDPR | Article 35 UAVG |
| Period | Without undue delay and within one month of receipt | Within six weeks of receiving the response |
| Extension | Up to two additional months for complexity or number of requests, notified with reasons in the first month | No corresponding automatic extension |
| No answer? | If taking no action, the institution must explain why within one month and identify supervisory and judicial remedies | If no answer is given within the GDPR periods, filing is not bound to that six-week limit; the period triggered by a response has not started |
Article 35 UAVG provides a written petition to the district court where the decision was made by a non-administrative controller such as a bank or insurer. It concerns giving effect to rights under Articles 15–22 GDPR. The court grants the request to the extent it considers it well founded.
Record the date you sent the request and the date you received the answer. The latter starts the six weeks. Also document the absence of an answer within the applicable period. An internal complaint should not cause you to overlook a court deadline.
Internal complaint, Kifid or court: choose deliberately
- The institution: address Security Affairs and request a definitive position.
- Internal complaints: following refusal, use the institution’s complaint process where required for your chosen next step.
- Kifid: check jurisdiction and the applicable rules. Kifid gives binding advice only if you and the institution both choose that; otherwise the decision is non-binding and the court can reassess the case in full. Binding advice normally binds you. A court reviews it only within a limited framework, not as a full rehearing. Exceptionally, being bound may be unacceptable under standards of reasonableness and fairness, for example because of a serious defect in the process or reasoning. See the Kifid procedure guide (Dutch).
- Civil court: court proceedings may also be available directly. A substantiated urgent need, such as a concrete expiry or termination date, may warrant interim proceedings (Dutch). Evidence urgency; a general assertion is insufficient.
When the criminal case ends differently
A decision not to prosecute or an acquittal does not automatically erase the entry. The legal assessment of registration is distinct from the criminal case, but the outcome and its reasons can be important, especially where the institution relies on the same facts. See EVR after acquittal or discontinuance (Dutch). If investigation costs are also claimed, read challenging investigation costs and a SODA claim (Dutch).
For a file assessment, see our EVR and CIS legal assistance page (Dutch), including the documents needed and discussion of next steps and costs.
How we can help
We assess Article 5.2.1 PIFI, whether you were able to respond, and the separate justification for duration. We can prepare a request or objection and, if appropriate, pursue Kifid or court proceedings.
We agree fees beforehand in writing. Some procedures may allow recovery of costs from the institution, depending on the route and result; this cannot be promised in advance. An initial discussion establishes what is realistic for your circumstances.
Contact us without obligation to have the registration assessed.
Urgency involving a mortgage or work
Evidence the obstacle with a refusal, quotation, employment requirement or deadline. An actual application provides more information than a wish to obtain a mortgage at some future point. Even in urgent cases, the registration grounds and balancing of interests must be assessed.
Registration by a bank after an investigation
A bank investigation, account termination and EVR entry are separate decisions. Ask which facts support registration and what role you allegedly played. An incorrect mortgage document requires assessment of its origin, knowledge, use and any intent, not merely its filename.
The Data Protection Authority, Kifid or court
A privacy complaint, financial complaint and court claim have different powers and purposes. The Dutch Data Protection Authority does not simply award compensation in every individual dispute. Kifid must have jurisdiction; urgent protection may require a court. Also see shortening registration and compensation (Dutch).
Frequently asked questions about EVR entries
Is eight years always justified?
No, but automatic reduction is not the rule either. PIFI 2026 treats eight years as in principle proportionate given the nature of incidents while requiring consideration and documentation of circumstances supporting a shorter period, such as very young age or threats. Support your request with your own facts.
Where should I send the removal request?
To the participant that registered you, usually the bank’s or insurer’s Security Affairs department. It is the controller. CIS and BKR manage the referral applications as processors and do not independently decide to change the institution’s entry. Request access first if you do not know the source.
How quickly must an access request be answered?
Without undue delay and normally within one month of a properly identified request. A permitted extension must be communicated with reasons in that first month. Access restrictions require a specific lawful justification and assessment.
Can I still go to court after a binding Kifid decision?
Not for an automatic full rehearing. If you and the institution both chose binding advice, it normally binds the parties and court review is limited. A serious defect in the procedure or reasoning may be relevant under the applicable legal test. Consider the available non-binding route or direct court proceedings before making your choice.
What if someone else misused my account?
The institution must still sufficiently establish your involvement, for example alleged knowing provision of a card, credentials or account. If the necessary involvement is not established, the EVR condition is not met. Report actual misuse and include the report and other relevant evidence with your request.
