EFRI Briefing · De Nederlandsche Bank authorises Qivalis B.V. as an electronic money institution (announced 14 October 2026) · Published 15 October 2026
On 14 October 2026 Qivalis announced that De Nederlandsche Bank (DNB) has authorised it as an electronic money institution (EMI). The Amsterdam-based company, owned by a consortium of 37 European banks from 15 countries, may now issue a euro-denominated e-money token (EMT) under the Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114). Issuance is planned “within the next months”, once the remaining MiCA requirements are met and the token’s white paper has been published.
EFRI first examined the project in December 2025, when ten banks stood behind it (Qivalis: How EU Banks Undermine the Digital Euro Project). The consortium has since more than tripled. The licence turns a plan into a supervised issuer. This briefing looks at what the authorisation does and does not settle and at the question the announcement leaves out: what happens when a bank-backed euro stablecoin is used to move fraud victims’ money.
What has been authorised
The issuer. Qivalis is led by CEO Jan-Oliver Sell; CFO is Floris Lugt (former ING in charge of Digital Assets) the supervisory board is chaired by Sir Howard Davies, former chair of NatWest Group and of the UK Financial Services Authority. It is under ongoing DNB supervision.
The owners. The founding members (September 2025) were ING, UniCredit, Raiffeisen Bank International, KBC, SEB, CaixaBank, Danske Bank, DekaBank, Banca Sella and BNP Paribas; BBVA and DZ Bank followed. On 20 May 2026 a further 25 banks joined, among them ABN AMRO, Rabobank, Nordea, Swedbank, Intesa Sanpaolo, Erste Group, Groupe BPCE, Handelsbanken and Bank Pekao.
The product. A euro EMT. Under MiCA, holders have a claim against the issuer and may redeem at par value at any time, in principle free of charge (Art. 49); the issuer may not pay interest (Art. 50). At least 30% of the funds received must be held in separate accounts at credit institutions, the rest in highly liquid, low-risk euro assets (Art. 54). EMTs are not covered by deposit guarantee or investor compensation schemes, and the white paper must say so (Art. 51).
The distribution model. Qivalis describes a “B2B2X” model: it will not sell the token to the public itself but distribute it through banks, crypto exchanges, payment service providers and market infrastructure participants. Fireblocks (US company set up by Isrealis) has been selected as digital asset infrastructure provider. The blockchains on which the token will run have not been announced.
Supervision as it grows. If the token reaches the thresholds for a significant EMT, supervision of the relevant obligations shifts to the European Banking Authority (Arts. 56–58 MiCA). With 37 banks behind it, that is a realistic scenario.
The case for Qivalis is serious and should be stated fairly. Euro stablecoins are a fraction of the market, which is dominated by dollar tokens issued outside the EU. A euro settlement asset issued under EU law, by a supervised issuer, redeemable at par and backed by regulated banks, is in many respects safer than what the market uses today. “Europe’s currency deserves Europe’s rules – on-chain,” as Qivalis’s CEO put it.
What the licence does not settle
1. Who sees the end user?
Under the B2B2X model, Qivalis has a direct relationship only with its distributing intermediaries. Once tokens are on a public blockchain, they can be transferred between wallets (including self-hosted wallets) without Qivalis or any of its owner banks being a party to the transfer. Customer due diligence takes place at the point of distribution, not along the token’s path.
EFRI knows this structure from its own case files. In a fraud case documented in EFRI’s case series, a licensed bank operating virtual IBANs for client platforms stated in writing that it holds no IP, device or endpoint data on the “underlying customers of its clients”. An issuer that sits behind several layers of distributors and an open ledger faces the same problem at scale. Licensing the issuer does not, by itself, give anyone visibility of who ends up holding the token.
2. European rhetoric, US infrastructure
Qivalis presents itself as the answer to Europe’s dependence on foreign payment infrastructure. When announcing the expansion of the consortium in May 2026, its CEO said the euro’s infrastructure should be “European-built and European-governed”; its chairman called efficiency in financial infrastructure “ultimately, a matter of sovereignty”.
Yet the digital asset infrastructure on which the token will be issued and managed will be provided by Fireblocks, a company headquartered in New York with its main development centre in Tel Aviv. Fireblocks is an established provider used by many regulated institutions, and the choice is not in itself a weakness. But it raises questions that Qivalis has not addressed publicly: where data relating to the token and its distributors is processed, who controls the cryptographic keys, whether that data or those keys could be reached by non-EU authorities, and how Qivalis manages the third-party dependency under the Digital Operational Resilience Act (Regulation (EU) 2022/2554). For a token that may become significant under MiCA, these questions belong in the white paper.
3. Will Qivalis freeze tokens — and for whom?
Dollar stablecoin issuers can freeze tokens at specific addresses, and have done so at the request of law enforcement. For victims of investment fraud, an issuer-level freeze is often the last point at which stolen funds can still be stopped once they have left the banking system. Qivalis has not said whether its token will have a freeze function, under what conditions it would be used, or whether victims, their banks or their representatives will have a channel to report addresses holding stolen funds. These are not technical details. They decide whether the token becomes a recovery tool or a laundering channel.
4. Which law protects the victims?
An e-money token is two things at once: a crypto-asset under MiCA and electronic money under the payment services framework. The European Banking Authority has drawn the consequences in its Opinion and No Action Letter of June 2025 (EBA/Op/2025/08). Transfers of e-money tokens carried out for clients, and custodial wallets from which tokens can be sent to and received from third parties, are payment services under PSD2. Custodial wallets are treated as payment accounts. Crypto-asset service providers offering these services therefore need a payment or e-money authorisation in addition to their MiCA licence, or a partnership with an authorised provider. The transition period ended on 2 March 2026.
For victims, this creates protection in some scenarios and none in others. Where tokens leave a custodial wallet for a self-hosted wallet, or where a victim is manipulated into buying and sending tokens personally — the typical investment fraud case — the protections of payment law largely fall away, and the new fraud safeguards of the Payment Services Regulation, which has not yet been formally adopted, are designed for IBANs rather than wallet addresses. EFRI will examine these gaps in detail in a forthcoming article.
5. A compliance function appointed at the last minute
Qivalis’s Chief Risk and Compliance Officer took office on 1 October 2026; her appointment was announced on 9 October, five days before Qivalis made its licence public. She brings relevant experience as head of legal at ClearBank Europe, where she was involved in that bank’s authorisation and MiCA notification, and from compliance leadership roles at Worldline Merchant Services. EFRI knows ClearBank Europe as well as Worldline from several victims´ payment routes.
Qivalis was founded in September 2025 and spent around a year preparing its licence application. It has not said who held responsibility for risk and compliance during that period, or whether the function was previously filled by an interim holder or by staff seconded from the owner banks. For an e-money institution, the compliance function is not an add-on: it is the function that will decide how the issuer responds to suspicious flows, law-enforcement requests and (if Qivalis provides for it) reports from fraud victims. For an issuer whose credibility rests on regulatory rigour, who built that function, and when, should be a matter of public record. This is particularly relevant in light of the compliance record of the owners.
6. The compliance record of the owners
Qivalis’s owners include banks with significant anti-money laundering and sanctions enforcement histories:
| Bank | Enforcement history |
|---|---|
| ING | €775 million settlement with the Dutch Public Prosecution Service (2018, Houston) for AML failures 2010–2016 |
| ABN AMRO | €480 million settlement with the Dutch Public Prosecution Service (2021) for AML failures |
| Rabobank | Criminal prosecution by the Dutch Public Prosecution Service for alleged Wwft violations pending; the bank declined to settle |
| Danske Bank | Guilty plea in the United States (2022) and forfeiture of around $2 billion over the Estonian branch non-resident portfolio |
| Swedbank | SEK 4 billion administrative fine from the Swedish Financial Supervisory Authority (2020) over AML deficiencies in the Baltics |
| BNP Paribas | Guilty plea and $8.9 billion in US penalties (2014) for sanctions violations |
| UniCredit | Around $1.3 billion in US penalties (2019) for sanctions violations |
None of these matters concerns Qivalis, which is a new company with its own governance. But the consortium’s owners will also be its principal distributors. The quality of anti-money laundering controls at the point where euros become tokens will largely be theirs. EFRI raised this in its earlier piece European Banks’ Euro Stablecoin – A Compliance Risk?; a licence for the issuer does not answer it.
7. Where do the reserves sit?
At least 30% of the funds backing the token must be deposited with credit institutions. Qivalis has not disclosed where. If a material share is placed with the owner banks themselves, the stablecoin would recycle the banks’ customer funds back onto their own balance sheets, with concentration and conflict-of-interest questions that the white paper should answer.
Our Assessment
The Qivalis licence is a regulatory milestone, and the case for a euro stablecoin issued under European law is legitimate. EFRI does not question that a supervised euro token is preferable to unregulated alternatives. What EFRI questions is that a project backed by 37 of Europe’s largest banks has said a great deal about sovereignty and nothing about the people who will be harmed when the token is misused.
From the victims’ perspective, stablecoins are not an abstraction. In EFRI’s case files, victims of investment fraud are routinely led to convert euros into stablecoins through regulated on-ramps and send them to wallets controlled by fraudsters. A bank-backed euro token, distributed by the same banks that hold victims’ accounts, will be attractive for exactly that purpose: it looks trustworthy, it is easy to acquire, and it moves instantly and irreversibly.
The intermediary is the pressure point. Here, the intermediaries are known by name, licensed, and among the best-resourced financial institutions in Europe. Before the first token is issued, EFRI calls on Qivalis, its owner banks and DNB to answer five questions publicly, ideally in the MiCA white paper:
Freezing. Will the token contract allow addresses to be frozen, and under what published policy — including on reports from victims and their banks, not only on orders from authorities?
Victim channel. Will there be a dedicated, documented procedure for fraud victims and their representatives to report wallets holding stolen tokens, with response times?
Liability. Who is liable when a distributing bank converts a customer’s euros into tokens that are sent to a fraudster within minutes — and will the distributors apply the same fraud-prevention and warning standards to token purchases as to credit transfers?
Monitoring. Will Qivalis or its distributors monitor on-chain flows of the token after distribution, and share risk information on wallets linked to fraud across the consortium?
Reserves. Where are the reserve deposits held, and how much sits with the owner banks?
DNB has licensed the issuer. It now has the opportunity to make victim protection part of how that licence is supervised. If the answers are not given before launch, Europe’s banks will have built a new payment rail with the same blind spot as the old ones and fraud victims will once again be the ones who pay for it.
Sources
Qivalis, press release, Qivalis receives authorisation as an Electronic Money Institution from De Nederlandsche Bank (14 October 2026), as reported by Disruption Banking: https://www.disruptionbanking.com/2026/10/14/qivalis-receives-authorisation-as-an-electronic-money-institution-from-de-nederlandsche-bank/
CoinDesk, Qivalis secures Dutch EMI license to launch bank-backed euro stablecoin (14 October 2026): https://www.coindesk.com/policy/2026/10/14/dutch-regulator-approves-qivalis-as-electronic-money-institution-under-mica-rules
The Paypers, Qivalis gains DNB authorisation for euro stablecoin: https://thepaypers.com/fintech/news/qivalis-secures-emi-authorisation-from-de-nederlandsche-bank
Qivalis, press release on the consortium expansion to 37 banks (20 May 2026): https://qivalis.eu/press/news/qivalis-more-than-triples-in-size-as-25-new-banks-join-the-consortium-accelerating-institutional-shift-towards-a-fully-regulated-euro-stablecoin
Qivalis selects Fireblocks as infrastructure provider: https://stablecoininsider.org/qivalis-consortium-selects-fireblocks/
EFRI, Qivalis: How EU Banks Undermine the Digital Euro Project (2 December 2025): https://efri.io/qivalis-how-eu-banks-undermine-the-digital-euro-project/
EFRI, CJEU Confirms “Refund First” (Case C-70/25, 15 October 2026) https://efri.io/cjeu-banks-must-refund-phishing-victims-first-gross-negligence-is-no-excuse/
Regulation (EU) 2023/1114 (MiCA), Arts. 48–51, 54, 56–58: https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-54-investment-funds-received
Rabobank prosecution status: https://www.accountant.nl/nieuws/2026/4/witwasonderzoek-rabobank-beslaat-langere-periode/
ING Houston settlement (2018): https://www.acams.org/en/news/dutch-prosecutors-assess-record-money-laundering-penalty-against-ing/
Danske Bank guilty plea and $2 billion forfeiture (13 December 2022): https://news.bloomberglaw.com/banking-law/danske-bank-pleads-guilty-to-us-fraud-will-forfeit-2-billion
UniCredit $1.3 billion US sanctions settlement (April 2019): https://www.bnnbloomberg.ca/unicredit-s-german-unit-pleads-guilty-in-u-s-sanctions-case-1.1244785
ABN AMRO settlement (2021) and Dutch prosecution decisions: https://nltimes.nl/2024/12/18/former-ceo-will-prosecuted-money-laundering-scandal-ing
