Dutch finance runs on Microsoft: DNS study of 390 firms

Half of the Dutch pension funds have their mail signed in a Microsoft 365 environment they share with other institutions. Lindstead checked the public DNS records of all 390 institutions with an active licence from De Nederlandsche Bank on 4 October 2026.1 52 of the 111 pension funds sit in just five Microsoft tenants, whose names match the administrators NN, TKP, Achmea, Blue Sky Group and APG. Among them are ABP, PME, the KLM funds and the pension fund of De Nederlandsche Bank itself.

Which pension funds share a Microsoft environment?

When an organisation sends mail through Microsoft 365, it publishes a DKIM record so receivers can check the signature. That record names the Microsoft tenant that signs the mail.2 For 94 of the 111 pension funds that receive mail, the record names a tenant. 56 of them share it with at least two other institutions.

Most Dutch pension funds outsource their administration, and the administrator often runs mail and accounts as well. The DNS records show how far that goes: five tenants carry 52 funds.

A tenant name is chosen by whoever set up the account, so it shows who runs the environment, not who owns the fund. It does show where a disruption would land. An outage, a suspended account or a legal order at one tenant reaches every fund inside it.

The five Microsoft 365 tenants with the most Dutch pension funds

Source: DKIM selector records of each fund's mail domain, public DNS, 4 October 2026; fund list from the DNB register. DNB: Stichting Pensioenfonds van De Nederlandsche Bank. Every fund per tenant is in the CSV below.

De Nederlandsche Bank and the AFM warned in October 2025 that dependence on a few non-European IT suppliers creates concentration and system risk in the financial sector.3 They published no figures per institution. The DNB pension fund signs its mail in the same tenant as NN's own domain.

How many institutions run their mail on Microsoft?

Four in five. Lindstead counted strong evidence when an institution's mail is delivered to Microsoft, or signed in a Microsoft 365 tenant.4 282 of the 360 active institutions whose domain receives mail meet that test. With weaker signals, such as an SPF entry for Microsoft, it is 296.

Payment and e-money firms more often use Google Workspace: 35 of the 90 show Google signals. Microsoft 365 or Google together cover 335 of 360 institutions (93.1 percent). Only 20 institutions show no US company anywhere in their mail chain, mostly small pension funds and insurers on Dutch hosting and the branches of Asian and British banks.

Do the big banks use Microsoft too?

All six Dutch banking groups under direct ECB supervision do: Rabobank, ING, ABN AMRO, ASN Bank, BNG Bank and NWB Bank. Elsewhere in the euro area the picture is mixed. Lindstead ran the same checks on the other significant banking groups on the ECB list.5

ECB-supervised banking groups with strong evidence of Microsoft 365 mail, by home country

Source: ECB list of supervised entities, cut-off 1 January 2026; public DNS, 4 October 2026; Lindstead analysis. Indicative: domains for groups outside the Netherlands were mapped from desk research, not from the institutions' own pages. Other EU groups: all EU-headquartered groups outside the Netherlands.

French banks and Deutsche Bank run their own mail servers. Many large banks put a US mail filter in front of the mailbox; Proofpoint is the first mail server for 15 of the 112 groups. The Dutch supervisors use the same platforms as the sector: afm.nl delivers mail to Microsoft 365, and dnb.nl runs its own mail server but signs mail in a Microsoft tenant.

Which institutions verified ChatGPT or Claude?

Companies that set up single sign-on or a business workspace with an AI vendor often prove they own their domain with a DNS record.6 55 of the 328 organisations in the register (16.8 percent) carry such a record for OpenAI or Anthropic. Anthropic, the maker of Claude, appears 46 times and OpenAI 24 times; 15 have both.

Adyen, bunq, Mollie, Bitvavo and Buckaroo are among the firms with a record. None of the six large Dutch banks has one, nor do 108 of the 110 pension funds. That does not mean they use no AI: access through Azure OpenAI or Microsoft Copilot runs inside the existing Microsoft tenant and leaves no separate record.

None of the 370 Dutch domains checked has a record for Mistral, the French model maker. Two EU banks outside the Netherlands do: ABANCA and Bpifrance. DNB board member Steven Maijoor said in February 2026 that the sector could be far less dependent on US technology within five years.7

How well are institutions protected against fake mail?

A DMARC policy tells receiving mail servers to reject or quarantine mail that falsely uses a domain. 81 of the 360 institutions (22.5 percent) publish no enforcing policy: 26 insurers, 26 pension funds, 17 payment institutions, 6 e-money institutions, 5 banks and 1 reinsurer. Lindstead does not name them, because a list would help fraudsters pick targets. Institutions can check their own record in a minute with any public DMARC lookup.

What do these records show, and what not?

The records show where mail and user accounts run. They do not show where payments, policy administration or pension administration run. Mail still carries client correspondence, documents and sign-in links, and the DNB and AFM report counts it among the services outsourced to cloud providers.3

Microsoft Ireland Operations, Google Cloud EMEA and Amazon Web Services EMEA are designated critical ICT third-party providers under DORA since November 2025, overseen by the European supervisory authorities.8 The US CLOUD Act still lets US authorities order a provider under US jurisdiction to hand over data in its possession, custody or control, wherever it is stored.9 The guide to the CLOUD Act and AI data explains what the law reaches.

How was this measured, and what are the limits?

Population. The DNB public register export of 4 October 2026 lists 414 institutions with an active Dutch licence or registration as bank, insurer, reinsurer, pension fund, payment institution, e-money institution or premium pension institution. 24 in liquidation were excluded, leaving 390.1

Domains. Each institution was matched to its website and mail domain, with a source for every row. 371 have a domain and 360 receive mail. 208 matches are confirmed on the institution's own page, 147 through a trade name or group site, and 35 are unverified.

DNS. Lindstead queried 520 domains through a public resolver: 12,359 lookups of MX, SPF, DKIM, autodiscover, TXT and DMARC records. No institution's systems were contacted. Every figure comes from one script run on that snapshot.

Limitations

• DNS shows configuration on one day, not contracts or volume. Verification records can be years old.
• Captives, branches and employer-run pension funds often use a parent's domain. Without those 13 rows and the 35 unverified matches, the Microsoft share is 267 of 340 (78.5 percent).
• Group domains repeat. Counting each mail domain once, the Microsoft share is 230 of 307 (74.9 percent).
• Tenant names are chosen by administrators and say nothing about ownership.
• The comparison with other euro-area banks rests on desk-mapped domains and is indicative only.

Earlier work: Follow the Money reported in January 2026 that DNB and the AFM run on Microsoft 365.10 Bert Hubert described the sector's US dependencies from public sources.11 This analysis adds a count for every licensed institution, the tenant concentration at pension administrators and the AI verification records.

Download the data

Download the data (CSV): one row per institution whose domain was confirmed, 355 rows. The 35 institutions whose domain could not be confirmed on a public page count in the totals but are left out of the download. Each row has the sector, name, website and mail domain, the first mail server, the Microsoft 365 and Google signals, the Microsoft tenant name, the OpenAI, Anthropic and Mistral records, the website network and the source of the domain match. DMARC results are left out on purpose.

Cite: Lindstead (2026), Dutch finance runs on Microsoft: DNS study of 390 firms, DNB register and public DNS of 4 October 2026. CC BY 4.0 applies to Lindstead's analysis. Research questions and corrections.

What should financial institutions do with these findings?

The records show where the dependency is concentrated. Lindstead recommends five checks:

1. Pension boards: ask the administrator which tenant runs the fund's mail and accounts, and which other funds share it.
2. Record mail, identity and AI accounts in the DORA register of information, next to core systems.
3. Test the exit plan for mail and identity: how long would the institution be without mail if the tenant stopped?
4. Check which AI vendors staff have verified the domain with, and whether that matches policy.
5. Publish an enforcing DMARC policy.

These checks show the size of the dependency. The next question is whether to reduce it, and how far. For mail, identity, documents and AI there are European providers that are not under US jurisdiction. A move touches every user, every integration and the contracts with administrators and service providers, so it needs a plan in stages rather than a single switch.

How can an institution move to European infrastructure?

Lindstead is an independent advisory firm as well as a research firm. It helps banks, insurers and pension funds decide whether to move to fully European infrastructure, and guides the move when they do. It takes no fees or commissions from cloud or software vendors, so the advice is not tied to a provider.

1. Assessment. Every service is mapped to its provider, jurisdiction, tenant and DORA criticality: mail, identity, documents, collaboration and AI. The result shows what can move to European providers now, what can follow later and what should stay, with the reasons.
2. Choice of providers. European options are compared on ownership, certification, DORA exit requirements, functionality and cost. The comparison of EU sovereign cloud providers shows the starting field.
3. Migration. Lindstead plans the order of the move, the tests and the fallback, and prepares the documentation for the board and the supervisor. AI workloads often move first, on European or the institution's own infrastructure.

Not every workload has to move. For some services, the current platform with customer-held encryption keys and a tested exit plan is the proportionate answer. The assessment says which, per service. Institutions that want a first answer quickly can start with the AI Sovereignty Scan: readiness, regulation and hosting for up to 10 AI systems in 10 working days, at a fixed price of €6,500 excluding VAT. The financial services page covers DORA and the AI Act for banks, insurers and pension funds.

Frequently asked questions

• How many Dutch financial institutions use Microsoft 365?

  282 of the 360 active DNB-licensed institutions whose domain receives mail (78.3 percent) show strong evidence of Microsoft 365 mail in public DNS on 4 October 2026: mail delivered to Microsoft, or mail signed in a Microsoft 365 tenant. With weaker signals included it is 296 (82.2 percent).

• Which pension funds share a Microsoft environment?

  52 of 111 pension funds sign their mail in one of five Microsoft 365 tenants: nngroup (16 funds), tkpconnect (14), achmea (8), blueskygroup (7) and cloudapg (7). The names match the pension administrators NN, TKP, Achmea, Blue Sky Group and APG. The funds include ABP, PME, the KLM funds and the pension fund of De Nederlandsche Bank.

• Do Dutch banks use ChatGPT or Claude?

  None of the six Dutch ECB-supervised banking groups has an OpenAI or Anthropic domain verification record. Among all 328 institutions, 55 (16.8 percent) do, led by payment and e-money firms at about 42 percent. A record shows that someone proved control of the domain to the vendor, not how the service is used. Use through Azure OpenAI or Copilot leaves no such record.

• Does the CLOUD Act apply to Microsoft 365 in an EU data centre?

  The CLOUD Act lets US authorities order a provider under US jurisdiction to disclose data in its possession, custody or control, wherever the data is stored. Microsoft is such a provider. Under DORA, Microsoft Ireland Operations is also a designated critical ICT third-party provider, overseen by the European supervisory authorities.

• Can a financial institution move off Microsoft 365 to European providers?

  Yes, for mail, identity, documents and AI there are European providers outside US jurisdiction. A move touches every user, integration and outsourcing contract, so it is done in stages: an assessment of each service, a choice of providers against DORA exit requirements, and a planned migration. Lindstead, an independent advisory firm that takes no vendor fees, assesses and guides such moves. For some services the current platform with customer-held keys and a tested exit plan is the proportionate answer.

• Is this data public?

  Yes. Every signal comes from public DNS records that any mail server reads when it delivers mail: MX, SPF, DKIM, autodiscover and TXT records. Lindstead did not contact or test any institution's systems.

• Can I reuse this data?

  Yes. The CSV on this page has one row per institution whose domain was confirmed, with the DNS classification and the source of the domain. Lindstead's analysis is published under CC BY 4.0. Cite Lindstead (2026) with a link to this page.

Sources

1. De Nederlandsche Bank, public register, complete CSV export, downloaded 4 October 2026. www.dnb.nl/en-GB/registerdownloadcomplete/TheNetherlands/csv
2. Microsoft, Set up DKIM to sign mail from your cloud domain (selector CNAME records contain the tenant's initial domain). learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure
3. AFM and DNB, Digitale afhankelijkheid in de financiële sector, 20 October 2025. www.dnb.nl/algemeen-nieuws/persbericht-2025/afm-en-dnb-waarschuwen-voor-systeemrisico-s-financiele-sector-door-digitale-afhankelijkheid/
4. Microsoft, External DNS records for Microsoft 365. learn.microsoft.com/en-us/microsoft-365/enterprise/external-domain-name-system-records
5. ECB, List of supervised entities, cut-off 1 January 2026. www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.listofsupervisedentities202602.en.pdf
6. Anthropic, Set up single sign-on (domain verification record anthropic-domain-verification). support.claude.com/en/articles/13132885-set-up-single-sign-on-sso
7. NOS, In vijf jaar minder afhankelijk van Amerikaanse ICT-reuzen kan, denkt DNB, 24 February 2026. nos.nl/artikel/2603848-in-vijf-jaar-minder-afhankelijk-van-amerikaanse-ict-reuzen-kan-denkt-dnb
8. European Supervisory Authorities, List of designated critical ICT third-party providers under DORA, 18 November 2025. www.eba.europa.eu/sites/default/files/2025-11/e388451b-356b-408a-bbf2-b8e425865d75/List%20of%20designated%20CTPPs.pdf
9. 18 U.S.C. 2713, Required preservation and disclosure of communications and records (CLOUD Act). www.law.cornell.edu/uscode/text/18/2713
10. Follow the Money, Nederlandsche Bank waarschuwt voor bigtech, maar draait zelf op Microsoft, 20 January 2026. www.ftm.nl/artikelen/nederlandsche-bank-waarschuwt-voor-bigtech-microsoft
11. Bert Hubert, Dashboard totale Amerikaanse afhankelijkheden, 20 January 2026. berthub.eu/articles/posts/dashboard-amerikaanse-afhankelijkheden/

Method: all figures from Lindstead's analysis of the DNB public register and public DNS records of 4 October 2026; context sources opened on the same date. This page is general information, not legal advice. Corrections: contact@lindstead.com. Research policy.