NIS2 Directive compliance update for Openprovider resellers

As previously shared, the NIS2 Directive was officially set to be transposed into local law by EU member states on October 17, 2024. To date, only six countries—Belgium, Croatia, Hungary, Italy, Latvia, and Lithuania—have implemented NIS2 into their national legislation. This leaves 21 member states still behind schedule—meaning that several respective ccTLD registries have also delayed changes until further notice.

This article provides an update on the status of various EU ccTLD registries concerning the NIS2 Directive, along with the latest developments in email verification processes at Openprovider.

Current status of EU ccTLD registries at Openprovider

Overview

EURid (.eu)

EURid has already established verification procedures as of May 2024. No technical actions are required from resellers at this point, as domain name owners receive direct verification instructions from the registry.

SIDN (.nl and .amsterdam)

Although draft legislation has been published for the Netherlands, it is not expected to become law until Q3 of 2025.

What you need to know

Any previous actions initiated by Openprovider to ensure compliance with the NIS2 Directive and data accuracy have been postponed for now. We will follow the registry’s lead and wait for official changes before making any adjustments.

DNS Belgium (.be)

While initially planning to implement strict validation checks on October 15, 2024, DNS Belgium has postponed these changes until further notice after receiving feedback from the registrar community.

What you need to know

The registry is planning a careful tryout period of at least 3 months, starting in Q1 2025, before moving anything to production. We have aligned our actions accordingly and will update you well before any changes come into effect.

DENIC (.de)

The German registry is planning technical changes related to registrant data verification in March/April 2025, even though the directive hasn’t been transposed into German law yet. We are currently planning the implementation and, when these changes become effective, will contact affected resellers separately and in detail with specific instructions.

A short summary of what’s expected:

• Publication of domain registration data for legal persons (when ORG field has data).
• Syntax and completeness check.
• Validation of name, address, and email of the domain owner.
• DENIC will also asynchronously carry out a risk assessment for new, updated, and transferred domain names.
• Risk levels of “suspicious” or “high” will come with deadlines to verify data. The registry will reach out to domain owners about this.

NIC.AT (.at and *.at)

The Austrian domain registry, NIC.AT, has initiated a proactive review of all contact handles in their system and is sharing potential inconsistencies with registrars. Currently, this process is in its early stages. On our end, we carefully review these lists and will contact you if we identify any inaccuracies that require owner verification. 

What you need to know

There are no legal obligations at this time, as the directive has not yet been transposed into law in the country. We encourage you to take a proactive approach of your own to ensure your domain owner data is accurate and complete, helping you stay ahead of upcoming regulatory requirements.

NASK (.pl and *.pl)

The Polish registry, NASK, has informed us that they will be taking proactive and stringent steps regarding registrant data verification and abusive domains.

What you need to know

We are currently in the final stage of aligning the registry’s directives with our internal requirements and will update you as soon as possible.

A short summary of what’s expected:

• Strict measures will be introduced for abusive domains
• These measures will include domain suspension, potential monetary penalties for recurrent flagging of abusive domains, and in extreme circumstances suspension of the ability to sell .pl and *.pl domains in order to keep the abusive behavior under control.
  

Punktum DK (.dk)

The Danish Domain registry has announced that laws concerning NIS2 will likely not come into effect until the summer of 2025.

What you need to know

No action is required from your side at this time. Domain name owners will receive direct instructions from the registry for data and ID checks. Any changes to the registry’s terms and conditions have already been communicated directly to registrants by the registry.

Internet Infrastructure Foundation (.se, .nu)

Email verification for new domain registrations for .se and .nu domains was placed in April of last year at Openprovider. As usual, we verify holder information during registration. Starting in January, the registry will conduct additional checks, and if inaccuracies are detected, the domain will be flagged for extra verification. These checks are managed by the registry and may evolve over time.

What you need to know

Starting January 1, 2025, the registry will flag domains where incorrect registrant data is suspected. During verification, domains will remain inactive, excluded from the zone file (serverHold), and cannot be renewed or transferred. In this case, we will notify you via email to re-verify the registrant’s data, correct any issues, and ensure 100% accuracy. By updating the domain with a verified holder and correct information (new registrantID), the check is lifted, and the domain is activated and added to the zone file. The block on renewal and registrar transfer has also been removed. The registry may conduct follow-up checks with us, as the registrar, on the information and verification documentation.

Starting May 1, 2025, extra verification checks of domain holders for existing domains will be introduced. During verification, domains will remain active, but cannot be renewed or transferred. The registry will specify a timeframe to update the contact handle per domain, and we will pass on this information to you via email. If it’s not corrected within the given timeframe, the domain will be suspended. We’ll share more details in the coming weeks.

Existing Openprovider email verification for ccTLDs affected by NIS2

At the moment, we trigger email verification for new domain registrations for several European ccTLDs, including. .at, .co.at, .or.at, .dk, .fi, .fr, .nu, .pm, .re, .se, .tf, .wf, .yt, .de, .it, and .pl. This validation for new registrations works as described in our Knowledge Base. Validations or suspensions on domains registered before October 14th under these TLDs have been paused until further notice. 

No email validations are currently required for .nl or .amsterdam domain name registrations as we await official updates before making any new adjustments. No suspensions will be triggered – the previously communicated deadline for January has been postponed to Q3 2025. We will inform you in advance when we know more.

Finally, we are working to refine our processes to ensure clear and accurate communications about these changes moving forward. Our primary goal is to support data accuracy for all parties affected by the NIS2 requirements, and we appreciate your patience and understanding during this time.

Next steps

We will inform you well in advance of any new announcements from registries that will impact how all registrars collect and verify owner data under the new NIS2 Directive. We understand that these changes may feel overwhelming, and we’re here to guide you every step of the way.

How can you stay up to date?

• Subscribe to our newsletter and product communications (or click here to read previous newsletters).
• Keep an eye on the blog section on our website.
• Watch out for updates on the newsfeed on top of the control panel.