Dutch Corporate Governance Code

The Code applies to companies with registered offices in the Netherlands whose shares or depositary receipts are admitted to trading on a regulated market or a comparable system and, under the Code itself, to certain large companies listed on a multilateral trading facility. For listed companies it has statutory force indirectly: the law requires them to state in the management report how they have applied the Code's principles and best practice provisions, and to explain any departure. The Code is monitored rather than enforced by a regulator, but compliance is scrutinised by shareholders, proxy advisors and the financial press, and departures without a credible explanation can affect voting outcomes.

The version of the Code that governs the reporting obligation is designated by order in council (algemene maatregel van bestuur). The scope of the disclosure obligation covers principles as well as best practice provisions, which is why a departure from a single best practice provision still calls for an explanation in the management report.

The 2022 revision, applying from the 2023 financial year, placed sustainable long-term value creation at the centre of the Code, expanded the treatment of stakeholder interests and of the company's environmental and social impact, and strengthened the provisions on diversity and inclusion policy. It remains the basis for much of the Code's architecture, including board composition, remuneration and the treatment of shareholder engagement.

The Corporate Governance Code 2025 applies from the 2025 financial year. It is a narrower update than the 2022 revision but a demanding one: it introduces the risk management statement, the Verklaring omtrent Risicobeheersing, updates the Code's references to the CSRD and the CSDDD, and replaces the outdated whistleblowing references with the Whistleblower Protection Act.

The risk management statement sits in principle 1.4 of the Code, with the operative requirements in best practice provisions 1.4.2 and 1.4.3, and the audit committee reporting on it under best practice provision 1.5.3. It is a written accountability statement by the management board, included in the management report, covering the design and the operation of the internal risk management and control systems for operational, compliance and reporting risks.

Best practice provision 1.4.3 requires the management board to state, with a clear substantiation, that the management report provides sufficient insight into any failings in the operation of the internal risk management and control systems; that those systems provide reasonable assurance that the financial reporting is free from material misstatement; that they provide at least limited assurance in respect of sustainability reporting; the degree of assurance they provide as to the effective management of operational and compliance risks; that the financial reporting has been prepared on a going-concern basis; and the material risks to continuity over the following twelve months. The differentiated levels of assurance are the point of the provision, since a single undifferentiated statement will not satisfy it.

The Code requires no external auditor assurance engagement on the statement itself. The management board makes the statement on its own responsibility, and the levels of assurance it expresses are its own conclusions on the systems it operates rather than conclusions certified by a third party.

The challenge function sits with the audit committee, which reports on the statement under best practice provision 1.5.3. The practical consequence is that the evidence supporting each element of the statement has to be capable of withstanding examination inside the company: documented control testing, a record of identified failings and of what was done about them, and a substantiated basis for the going-concern conclusion and for the assessment of continuity risks over the next twelve months. Preparing the substantiation requires attention before the closing weeks of the reporting cycle.

Listed companies apply the Code on a comply-or-explain basis, and the Monitoring Committee tracks application annually. An explanation is the substance of the obligation rather than a formality: it identifies the specific provision, states what the company does instead, gives the reason in terms of the company's own circumstances, and says whether the departure is temporary and for how long. Explanations need to be meaningful, specific to the company, and visible in the annual report.

Private companies are not bound by the Code, but parts of it increasingly appear in their governance by another route. Institutional investors, family shareholders professionalising a board, and lenders on larger financings all import Code concepts into shareholders' agreements and board rules: independence criteria for supervisory directors, committee structures and charters, annual board evaluation, a conflicts procedure, and a defined approach to related-party transactions. The right approach is selective rather than wholesale. For a company with three supervisory directors, three separate committees may not be appropriate, and adopting the Code in full may add documentation without improving oversight. What consistently repays the effort in private companies is the discipline around board evaluation, the conflicts procedure, the information protocol, and a considered position on independence where the shareholder base is concentrated, and where a company is preparing for a listing or for institutional investment, an earlier and fuller adoption is worth doing deliberately, because retrofitting governance during a process is expensive and visible.