DigiD for private companies: who can use it and what to use instead
Can a private company use DigiD? Mostly not: Logius connects only organisations with a public task and BSN rights. What DigiD returns, its eIDAS level, Wwft and AMLR, and the private alternatives.
In short
DigiD for bedrijven, in short: most private companies cannot use DigiD. Logius only connects organisations that perform a statutory public task, are allowed to use the citizen service number (BSN) and use DigiD for that task.[4] For a private business that needs to verify Dutch customers, the routes are a bank or app eID (iDIN, now moving to itsme), the coming NL Wallet, or a document check with chip reading.[18][15]
- DigiD is notified under eIDAS at Substantial and High, and was used 645 million times in 2025.[1][5]
- Companies log in to the government with eHerkenning, not DigiD.[20]
- Plan a document fallback for everyone without a Dutch eID.
People search "DigiD bedrijven" with two questions in mind: can my company accept DigiD to verify customers, and how does a company log in to the Dutch government. The answer to the first is no for almost every private business: DigiD is the government's login for citizens, and Logius connects only organisations with a public task and the right to process the BSN.[4] The answer to the second is eHerkenning.[20]
Below: how DigiD works, its legal standing for anti-money laundering (AML), who may connect, and the electronic ID (eID) routes open to a private company.
DigiD at a glance
DigiD (Digitale Identiteit) is the Dutch government's login for citizens, run by Logius under the Ministry of the Interior and Kingdom Relations (BZK). It has carried that name since 5 October 2004.[2][4]
DigiD
The Netherlands' government login for citizens
How many people use DigiD
In the first half of 2026 people logged in successfully almost 370 million times; nearly three quarters of those logins went through the DigiD app, and more than half used the app with the ID-check.[6]
Logius figures.[5][6][7][2]
- 5 October 2004DigiDThe government login gets its name.
- March 2017AppThe DigiD app arrives; the ID-check follows in November.
- 21 August 2020NotifiedeIDAS levels Substantial and High.
- 1 July 2023WdoThe digital government law starts to apply in phases.
- September 2025Key attestationExtra protection for app accounts with the ID-check.
DigiD from its name to the latest security step.[2][1][9]
What the user sees
The service redirects the user to the DigiD login page. On a computer the user opens the DigiD app, enters the koppelcode (link code), scans the QR code and enters the PIN; on a phone only the PIN is needed.[3]
Log in
Use DigiD to continue.
Log in with DigiD
1The service redirects the user to DigiD.[3]
Use the DigiD app
Enter the koppelcode from the app, then scan the code.
2On a computer, the user enters the koppelcode shown in the app, then scans the browser's QR code with it.[3]
Enter your PIN
Your 5-digit DigiD PIN.
3The user enters the PIN.[3][8]
Hold your ID card
Place the card against the back of your phone to read the chip.
4Level Hoog only: tap the chip.[3]
You are logged in
Continue
5The user returns to the service, logged in.[3]
For level Substantieel, the app must already hold the ID-check: a one-time near-field communication (NFC) read of a Dutch passport, ID card or driving licence. DigiD stores "alleen dat het identiteitsbewijs is gecontroleerd, geldig is en bij wie het hoort" (only that the document was checked, is valid and whose it is).[3][8][6]
Video pending: flow-redirect
A redirect sign-in with a national eID, start to finish.
What a business receives from DigiD
Koppelcode and QR on a computer
Simplified from Logius' description of how DigiD works.[3]
The whole scheme is built around the BSN: Logius lists the right to use the BSN as a condition for connecting.[4] The full attribute list is not published in the pages reviewed.
| Data | What the public sources say | Source |
|---|---|---|
| Citizen service number (BSN) | The scheme is restricted to organisations allowed to use the BSN | Logius[4] |
| Assurance level | Four national levels: Basis, Midden, Substantieel, Hoog | Logius[3] |
| Name, date of birth | Not documented as returned in the sources reviewed | Not published, 5 October 2026 |
| Address | Not documented as returned in the sources reviewed | Not published, 5 October 2026 |
| Document data and photo | Not stored by DigiD during the ID-check | Logius[6] |
Level of assurance and legal standing
The Netherlands notified DigiD to the European Commission at two eIDAS levels: "DigiD Substantieel" and "DigiD Hoog", on 21 August 2020 (OJEU 2020/C 276/02).[1] Nationally, DigiD uses four levels.[3]
| DigiD level | How the user logs in | eIDAS level |
|---|---|---|
| Basis | Username and password | Not in the notification |
| Midden | DigiD app or SMS code | Not in the notification |
| Substantieel | DigiD app with the ID-check | Substantial |
| Hoog | App plus the chip of an ID card issued after 13 March 2021 or a driving licence issued after 16 May 2018 | High |
National levels from Logius, eIDAS levels from the EU list.[3][1]
The Wet digitale overheid (Wdo, Kamerstuk 34.972) has applied in phases since 1 July 2023. It classifies login means by level and allows private login means next to DigiD and eHerkenning, but the government's own page says "het daadwerkelijke gebruik van private middelen is nog niet beschikbaar" (the actual use of private means is not yet possible).[9]
DigiD and Dutch AML rules (Wwft)
Article 11(1) of the Wwft, the Dutch anti-money laundering law, requires verification "aan de hand van documenten, gegevens of inlichtingen uit betrouwbare en onafhankelijke bron" (on the basis of documents, data or information from a reliable and independent source). Article 4(1)(h) of the Uitvoeringsregeling Wwft designates "een voldoende betrouwbaar identificatiemiddel" (a sufficiently reliable means of identification). De Nederlandsche Bank (DNB) says an eID is sufficiently reliable "wanneer deze voldoet aan het betrouwbaarheidsniveau 'substantieel' of 'hoog'" (when it meets the level substantial or high).[10]
DigiD Substantieel and Hoog meet that level on paper.[1] In practice a bank or payment company has no statutory public task and cannot connect.[4]
From 10 July 2027 the EU Anti-Money Laundering Regulation (AMLR) sets the rule directly.
Article 22(6)(b)Regulation (EU) 2024/1624
"the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high' and relevant qualified trust services as set out in that Regulation."
Source: EUR-Lex, Regulation (EU) 2024/1624[12]
The Anti-Money Laundering Authority (AMLA) final draft standards of 30 September 2026, sent to the Commission and not yet law, keep document-based alternatives for customers without access to qualifying eID means, and the obliged entity "shall be able to justify why the customer could not be verified" through Article 22(6).[13] More on the EU side in our European Digital Identity (EUDI) Wallet guide.
DigiD for companies: how a business connects
Logius sets three conditions: a statutory public task, the right to use the BSN, and DigiD used for that task. The organisation must also pass an annual ICT security assessment (ICT-beveiligingsassessment).[4] Connecting takes about one month, through a standard path or an app-to-app path, and the tariffs are set every year by the ministry.[4] We did not verify the current tariff amounts for this guide.
Public task only
DigiD through Logius
- Statutory public task and BSN use required
- Annual ICT security assessment
- About one month to connect
Not open to most companies
Private eID
iDIN, moving to itsme
- Bank or app login the customer already has
- Self-declared or notified at substantial or higher
- Contract with the scheme or a certified broker
Open to private companies
For everyone else
Identity document
- NFC chip reading of passport or ID card
- Liveness and face match
- Works for foreign residents and visitors
AMLR Article 22(6)(a)
Three routes to a verified Dutch customer.[4][17][18][12]
The private alternatives, side by side
| Option | Who runs it | eIDAS status | Status on 5 October 2026 | Source |
|---|---|---|---|---|
| iDIN | iDIN B.V., sold by the Dutch banks to itsme on 17 December 2025 | Not notified; self-declared at substantial | About 15 million identifications in 2024; sunset announced, date disputed (see below) | [16][17][1] |
| itsme | Belgian Mobile ID | Notified at High through Belgium | In the Netherlands since 1 June 2026; more than 300 Dutch companies | [18][1] |
| NL Wallet | Ministry of the Interior (BZK) | Wallet under eIDAS 2 | Under development; waits for national implementing legislation | [15] |
| eHerkenning | Trust framework with several private suppliers | Notified at Substantial and High | Business login to government, not customer KYC | [20][1] |
itsme registers Dutch users with a passport or ID scan and a selfie.[18] The iDIN sunset date is not settled: itsme's launch page says "phased out completely by the end of 2027", while its iDIN page says "In 2028, itsme will fully replace iDIN".[18][19] Our iDIN integration guide and itsme API guide cover both in depth.
The EU Digital Identity Wallet comes later. Under Regulation (EU) 2024/1183, private relying parties required by law or contract to use strong user authentication have to accept it at the user's request by 24 December 2027; micro and small enterprises are exempt.[14] The Dutch NL Wallet is "currently under development" and will let a user share "only whether someone is over 18".[15]
Use cases and sector rules in the Netherlands
| Use case | DigiD | What a private company can use |
|---|---|---|
| KYC and AML onboarding | Meets the DNB level, but no public task means no connection[10][4] | iDIN, itsme, or a document check under Wwft Art. 11 |
| Gambling and age checks | Not offered to commercial sites | A private eID or a document; CRUKS check (see below) |
| Proof of age without a name | Indirect: Yivi can import a verified birth date via DigiD[22] | Yivi, later the NL Wallet's over-18 attribute[15] |
| Telecom | Not covered in this guide | Not covered in this guide |
| Signing | Not a signing tool in the sources reviewed | A qualified trust service; not covered here |
For online gambling, the Ksa requires CRUKS checks, according to Vissers Legal. We found no rule that names a specific eID for that check.
Limits and fallbacks
- DigiD needs a BSN: residents and, since January 2024, anyone abroad with a BSN, whatever their nationality.[2]
- The ID-check needs a Dutch passport, ID card or driving licence; foreign documents are not accepted. Dutch documents issued abroad work since October 2025.[8][2]
- The app with ID-check needs an iPhone 7 or newer, or Android 9.0 or newer.[8]
- Children apply for their own DigiD from age 14, and parents may apply for younger children, according to Ouders van Nu.
On security, DigiD warns about recurring phishing with fake DigiD pages and messages.[11] Logius added key attestation in September 2025 to harden app accounts with the ID-check.[2] We found no dated DigiD outage in the sources reviewed.
1Offer a Dutch eID first
A private eID next to a document option.
The customer completes an eID sign-in
Use the signed attributes
Record the level of assurance received.
Verify with a document
NFC chip reading, liveness and face match.
2Screen and decide
AML screening, then your onboarding decision.
eID first, document route for everyone else.
The document route reaches everyone; under AMLR it is point (a) of Article 22(6).[12] Our guide to eID verification in the Netherlands puts all Dutch options on one page.
DigiD bedrijven: checklist for a private company
- Confirm whether you perform a statutory public task and may use the BSN.[4]
- Use eHerkenning, not DigiD, for your own logins to the government.[20]
- Pick a private eID at substantial or high for Dutch customers.[10]
- Plan the move from iDIN to itsme before the end of 2027.[18]
- Add a document route with chip reading, liveness and face match.
- Be able to justify why a customer could not be verified through an eID route, as the AMLA draft standards expect.[13]
- Prepare to accept the wallet by 24 December 2027 if Article 5f(2) applies to you.[14]
How Didit helps with eID verification in the Netherlands
Didit adds DigiD on request, for organisations that meet Logius' conditions. For Dutch customers today, Didit verifies people with the document route: NFC chip reading, liveness and face match, plus AML screening, in one workflow. A full KYC check costs $0.33, NFC verification $0.15 and AML screening $0.20.
iDIN and itsme are on Didit's roadmap, and EUDI Wallet acceptance is coming soon, in the same workflow.
Didit provides
- Document checks with NFC chip reading, liveness and face match
- AML screening against sanctions, PEP and watchlists
- The evidence of every check
Stays with you
- The Wwft risk assessment and policies
- The onboarding decision
- Any public task and BSN entitlement
Bring DigiD to your service
Tell us where your users sign in, and start with the document route today.
Key takeaways
- DigiD connects only organisations with a statutory public task that may use the BSN.
- DigiD is notified under eIDAS at Substantial and High and was used 645 million times in 2025.
- Private companies use iDIN, now moving to itsme, or a document check; the NL Wallet comes later.
Frequently asked questions
Can a private company use DigiD?
Usually not. Logius connects only organisations that perform a statutory public task, may use the BSN and use DigiD for that task; connecting takes about one month.[4] Others use iDIN, itsme or a document check.
How do companies log in to the Dutch government?
With eHerkenning, the business login, not with DigiD. It comes at levels EH2+, EH3 and EH4 and is bought from one of several private suppliers.[20][21]
What does a DigiD connection cost?
The ministry sets the tariffs every year. We did not verify the current amounts, so check with Logius before you budget.[4]
What data does DigiD give a service?
DigiD is built around the BSN, and only organisations allowed to process it may connect.[4] Logius' public pages reviewed on 5 October 2026 do not list the full attribute set; confirm the exact attributes with Logius before you rely on them.
Is DigiD eIDAS-notified?
Yes. DigiD Substantieel and DigiD Hoog were notified on 21 August 2020 at levels Substantial and High.[1]
Does DigiD meet Wwft customer due diligence?
On level, yes: DNB treats an eID at substantial or high as sufficiently reliable.[10] But private obliged entities cannot connect to DigiD.
Can foreigners and expats use DigiD?
Anyone with a BSN can, including people abroad since January 2024.[2] The ID-check accepts only Dutch documents.[8]
From what age can you have DigiD?
Children apply for their own DigiD from 14, according to Ouders van Nu, and parents may apply for younger children. Like every DigiD user, a child needs a BSN.[2]
What is the DigiD ID-check?
A one-time NFC read of a Dutch passport, ID card or driving licence in the DigiD app, which raises the account to level Substantieel.[3][8]
Will the NL Wallet replace DigiD for businesses?
Not yet. The NL Wallet is under development and waits for national legislation.[15] Regulated private relying parties must accept EU wallets at the user's request by 24 December 2027.[14]
Sources
- Overview of pre-notified and notified eID schemes under eIDAS, European Commission, read 5 October 2026.
- DigiD door de jaren heen, Logius.
- DigiD, hoe werkt het, Logius.
- DigiD aansluiten en wijzigen, Logius.
- DigiD-gebruik groeit naar 645 miljoen inlogacties, Logius, 11 June 2026.
- Ruim de helft van alle DigiD-logins wordt gedaan met DigiD app en ID-check, Logius, 17 August 2026.
- Logius diensten in het jaar 2023 in cijfers, Logius.
- DigiD app, DigiD.
- Wet digitale overheid (Wdo), Digitale Overheid.
- Q&A elektronische identificatiemiddelen en cliëntidentificatie, De Nederlandsche Bank.
- Recognise a fake message, DigiD.
- Regulation (EU) 2024/1624 (AMLR), Article 22, EUR-Lex.
- Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
- Regulation (EU) 2024/1183 (eIDAS 2), EUR-Lex.
- ID wallet, NL Digital Government.
- Nederlandse identificatiedienst iDIN overgenomen door itsme, iDIN, 17 December 2025.
- Regelgeving en compliance, iDIN.
- itsme launches in the Netherlands, itsme.
- itsme and iDIN, itsme.
- Leveranciersoverzicht, eHerkenning.
- eHerkenning aanvragen, Ondernemersplein.
- Age verification with Yivi, Yivi, 2 June 2025.
Dutch customers still need a way in. Our eID verification page shows how national eIDs and the document route sit in one workflow, and what eID verification is covers the basics.
Verify Dutch customers in one workflow
Start with chip reading, liveness and AML screening, and tell us which eIDs you need next.
Related articles
- Cl@ve integration in Spain: who can connect and what to use instead
- PhilSys verification: how businesses check the National ID
- OpenID4VP verifier guide: accepting the EUDI Wallet
- eIDAS regulation explained: what eIDAS 2 (2024/1183) changes
- Smart-ID API: a developer's guide to RP API v3
- National digital identity worldwide: models, leaders, standards