You offer financial services to Dutch consumers, and the AFM is checking whether your website and app are accessible. Here is what to do
Banks, insurers, lenders, payment providers and investment firms fall under the European Accessibility Act, with the AFM as regulator. The AFM started checking firms’ websites in 2026 and wants concrete reports of what does not work. On this page: what the AFM expects, how and when to report in the AFM Portal, and how an audit gives you the answers the form asks for. Kept up to date with the AFM’s own EAA updates.
What the AFM expects, from its three EAA updates
Consumer banking, and any financial service sold online
The AFM names two groups. Banking services to consumers: credit agreements, investment services, payment services, services related to payment accounts and electronic money. And financial e-commerce services: financial services offered over the internet to consumers, on individual request, with a view to concluding a contract. Its examples include big banks and insurers, but also buy-now-pay-later providers, neobrokers, crypto platforms for electronic money, online insurance providers, crowdfunding platforms, online advice and brokerage, fund managers and chains that sell mortgages. The AFM says the list is not exhaustive and asks every firm to work out for itself whether it is in scope.
What the AFM also counts
- The helpdesk and call centre must be accessible
- Information must be offered in at least two ways
- Identification, payment and electronic signing must meet the four WCAG principles
- Information about banking services at language level B2 at most
- A PDF you must provide on a durable medium has to be accessible itself
- Services to business customers are outside the EAA; a sole trader acting privately is a consumer
Report in the AFM Portal, with the WCAG criterion and the platform
Firms must report to the AFM when they do not meet the accessibility requirements, and when they rely on an exception such as disproportionate burden. Reports go through the AFM Portal; anyone with a portal account for your organisation can file. In April 2026 the AFM wrote that many reports were not concrete enough to judge what the problems are and where they sit. It now asks per report: which part of the service (trade name, and the function, such as “upload a document” in the customer portal), how it fails (the WCAG criterion, and for an app whether it is iOS or Android), how many consumers are affected, what the impact is, what measures you take and which departments own them, and whether an equivalent accessible alternative exists. On that last point the AFM is explicit: referring customers to a physical office is not an equivalent alternative.
Report within
- 1 week after finding a problem with a critical or serious impact
- 1 month after finding a problem with a moderate or minor impact
- 1 week after completing an assessment that relies on an exception; keep the documentation for five years after the service was last offered
- The AFM does not contact you after a report unless it has questions
Level A first, level AA expected, four criteria always critical
In its third update, April 2026, the AFM announced a compliance investigation into the digital accessibility of financial firms’ websites, focused on the sectors and services consumers use most, with specific attention to the level A criteria. It adds that it also expects firms to be able to meet level AA. Four criteria always count as critical, because a failure can make the whole website unusable or cause physical reactions: audio control (1.4.2), no keyboard trap (2.1.2), pause, stop, hide (2.2.2) and three flashes or below threshold (2.3.1). The AFM also asks firms to work towards WCAG 2.2 now. We already test against 2.2.
What the AFM wants to see embedded
- A gap analysis as the first step; firms that skip it underestimate the size and the cost
- Fixed guidelines, periodic checks and clear responsibilities
- A complaints procedure for consumers with a disability
- People with disabilities involved in design and testing
- Accessibility information published on your website
How an audit maps onto the AFM's six questions
- 1
Audit website, customer portal and app
A senior auditor tests by hand what a consumer touches: logging in, identification, applying, paying, signing, uploading. Screens that run at a supplier are part of your service, so we include them. A website audit costs from approximately €2,250 to around €5,100 excl. VAT depending on size; an app audit costs €2,150 per platform.
- 2
Report per component, with the criterion and the platform
Every finding names the function, the WCAG criterion, the severity, whether it is iOS or Android, and a fix. That is the information the AFM form asks for, ready to copy.
- 3
Retest and keep a file
After your fixes we retest per finding and record the result. Together with your gap analysis and repair plan, that is the documentation the AFM expects a firm to hold.
Frequently asked questions
Are we supervised by the AFM or by the ACM?
By the service. Consumer banking and financial e-commerce services fall under the AFM. A webshop or app that is not a financial service falls under the ACM. If you sell insurance through another party’s webshop, that party may deal with the ACM and you with the AFM. The AFM expects you to work out yourself whether you are in scope; if in doubt, ask your lawyer.
Do we have to report before the audit is finished?
The reporting clock starts when you find a problem: one week for critical and serious, one month for moderate and minor. What exactly you report and when is a legal question for your own counsel. What the audit does is make the report concrete: which part of the service, which criterion, which platform, which measures.
Our login, identification and signing run at a supplier. How does that work?
Those screens belong to your service, so we include them in the audit. The report says per finding which component it belongs to, so you know what to fix yourself and what to put to the supplier. The AFM writes in its updates that you should involve outsourcing partners early and agree on changes; we give you the wording per finding.
Do you test against WCAG 2.1 or 2.2?
Against WCAG 2.2 level AA. The standard under the EAA is EN 301 549, which currently points to WCAG 2.1 level A and AA. WCAG 2.2 contains everything in 2.1 plus nine new criteria, including accessible authentication, which matters for login flows. The AFM asks firms to work towards 2.2 now, so we test against it as standard.
Does the AFM require an accessibility statement?
The AFM writes that all providers of banking and e-commerce services to consumers must draw up an accessibility statement, describing how the service works, how it is accessible and which assistive technology it supports, and available in more than one sensory format. This is information on your own website. It is not the statement in the Dutch government register, which belongs to the government decree.
Where can I read the AFM's own material?
On the AFM theme page accessibility of services to consumers (in Dutch), with the three EAA updates as PDFs and the page on EAA reports. Questions about the rules can go to [email protected]; the AFM says that address cannot be used for the reports themselves. Our summary of the three updates is in what the AFM expects in three EAA updates (in Dutch).
Get clarity on your digital accessibility — without stress
Schedule an introductory meeting. No commitments — just valuable insight into your risks and opportunities.
Schedule an introduction
