SBI stands for Standaard Bedrijfsindeling (Standard Business Classification), the Dutch industry classification system maintained by Statistics Netherlands (CBS). It is the Dutch national equivalent of the European NACE Rev. 2 classification.

Structure: Up to 5-digit hierarchical codes. Level 1 = broad sector (e.g. F = Construction), progressively narrowing to 5-digit activity codes (e.g. 41201 = general construction of residential buildings). The 2025 revision (effective September 2025) updated many codes in response to digitalisation, sustainability categories, and new business models.
Multiplicity: A company may hold multiple SBI codes — one primary activity plus secondary activities. KVK assigns up to three on initial registration; more can be added as the business evolves.
Mandatory accuracy: The codes must reflect actual activities. Deliberate misclassification can affect permits, tax obligations, insurance, pension fund membership, and subsidy eligibility — making them a meaningful signal for auditors when they diverge from observed transaction patterns.

2. KVK API — Available Endpoints

The official developer portal is developers.kvk.nl. It exposes five APIs:

| API | Purpose | SBI data included? | |-----|---------|-------------------| | Zoeken (Search) | Find KVK registrations by name, KVK number, address, RSIN, branch number | No (index only) | | Basisprofiel | Full company profile by KVK number: legal name, trade names, addresses, legal form, SBI codes, employee counts, owner info | Yes — sbiCode, sbiOmschrijving, indHoofdactiviteit (primary flag) | | Vestigingsprofiel | Branch-level profile by vestigingsnummer: branch address, activities, employee counts | Yes — per-branch SBI codes | | Naamgeving | Trade names by KVK number | No | | Mutatieservice | Push notifications when company data changes | Yes (via changed Basisprofiel data) |

The Basisprofiel returns an array of activity objects per company, each with:

sbiCode — up to 6-digit code (SBI 2008 / SBI 2025 after the migration)
sbiOmschrijving — human-readable description
indHoofdactiviteit — boolean flag for primary vs. secondary activity

3. Access Model

3a. Open Dataset API (no API key required)

URL: https://api.kvk.nl/api/v1/opendatasets/...
No authentication required for this tier.
Scope: BV and NV entities only; intentionally strips personally identifying information (company names, full postcodes) to comply with HVDS privacy legislation.
SBI codes are included in the open dataset, but without the company name the usefulness for Athena's enrichment use case is very limited — you need to already know the KVK number.
Rate limits: Maximum 1 request per minute per IP; global cap of 200 requests per 5 minutes across all users combined. Extremely restrictive for bulk enrichment.
Licence: Creative Commons BY 4.0.

3b. Paid Subscription API (API key required)

Subscription fee: €6.40/month per API key.
Per-call pricing: Zoeken = free; Basisprofiel, Vestigingsprofiel, Naamgeving = €0.02 per query.
Mutatieservice add-on: €1,279/year (push mutations on all Business Register changes).
Registration process: Via the Developer Portal → fill in organisation details → sign the usage agreement → receive API key within a few working days.
Eligibility: Organisations must be registered in the Dutch Business Register and have an authorised signatory. The FAQ confirms foreign organisations can access the Open Dataset APIs; for the paid subscription tier, the requirement to be "registered in the Business Register" implies a Dutch registration or a Dutch-registered entity. Non-Dutch companies without a Dutch entity should contact account@kvk.nl to confirm eligibility.
Testing: A no-registration sandbox is available on the Developer Portal for functional exploration before committing to a subscription.

3c. Rate limits on the paid tier

The paid API documentation does not publish explicit rate limits for the subscription tier (confirmed by inspecting the Basisprofiel API docs page). Practical upper bounds can be inferred from typical government API provisioning; the KVK FAQ recommends contacting support for high-volume use cases.

4. Relevance to Athena's Audit Context

4a. Business activity vs. transaction pattern cross-check (new analytical signal)

Auditors performing NV COS 315 risk assessment procedures are required to "gain an understanding of the entity and its environment, including the industry, regulatory framework, business model, and strategy" (NV COS 315 §11–12; see also docs/kb/audit-process-overview.md:52). SBI codes are the machine-readable form of that entity-environment understanding.

Athena can use a company's SBI code(s) to flag when the observed GL transaction pattern is inconsistent with the registered business activity:

| Scenario | Risk signal | |----------|-------------| | Construction company (SBI 41xxx/43xxx) with a disproportionately large share of transactions coded to IT/software cost centres | Possible misclassification of payroll/subcontractors, or undisclosed side activity | | Retail company (SBI 47xxx) showing large recurring inter-company transfers with no purchase invoices | Possible related-party transactions inconsistent with a pure retail model | | Holding/finance company (SBI 6420) with extensive operational cost patterns | Possible commingling of group and operating entity financials | | Primary activity marked indHoofdactiviteit=true is a minor contributor to transaction volume | Activity mix at odds with KVK registration — either stale SBI or undisclosed business change |

This kind of cross-check is explicitly within scope of NV COS 315 (understanding the entity) and NBA Handreiking 1141 (applying data analytics to risk assessment). It does not constitute audit evidence on its own but informs where to direct further procedures.

4b. G-rekening eligibility validation

The G-rekening (blocked account) regime applies only to companies in construction (SBI F), temporary staffing (SBI 78xxx), and cleaning (SBI 81xxx). DA-094 (Restricted Account) already checks G-rekening rules per docs/liquide-middelen-audit-research.md:135. Knowing the client's SBI code would let Athena determine automatically whether G-rekening rules are even applicable to this client — currently the auditor must configure this manually.

4c. Sector-specific DA check relevance scoring

Some DA checks are high-relevance only for certain sectors:

Cash transaction monitoring (DA-xxx) — highest relevance for retail (SBI 47xxx), hospitality (SBI 56xxx), small services
Payroll-over-salary fraud (DA-098) — highest relevance when the SBI indicates a labour-intensive sector with many staff (construction, staffing, cleaning)
Related-party transfers (ISA 550) — highest relevance for holding structures (SBI 64xx/70xx)

An SBI-aware relevance layer could surface these checks with higher or lower default prominence depending on the client's registered activity, reducing noise for auditors reviewing low-relevance findings.

4d. Verification of the `taxRegIdent` field from the XAF

docs/auditfile-nu-research.md:296 notes that the XAF <taxRegIdent> field (KvK/BTW number) is "completely absent from Athena's data model." If this field were extracted and parsed, the KVK number would be immediately available for an SBI code lookup via the Basisprofiel API — no manual entry by the auditor required.

5. Connection to Existing SRS Items

| Existing item | Relevance | |---------------|-----------| | DA-045 (Stamgegevens) | DA-045 already extracts KvK number from the XAF Bedrijfsgegevens section. This number is the primary key for the Basisprofiel API lookup. An SBI enrichment step could be triggered from the KvK number already surfaced in DA-045. | | DA-094 (Restricted Account / G-rekening) | SBI code determines whether G-rekening rules apply at all. Currently this is manual auditor configuration. | | DA-098 (Fictitious bank / salary fraud) | Sector context (labour-intensive SBI codes) affects the prior probability of payroll fraud; relevant to risk weighting. | | DA-083 (Statistical Outlier) | Outlier thresholds that make sense for a manufacturing firm differ from a trading company; SBI could inform sector-appropriate benchmarks. | | taxRegIdent gap (auditfile-nu-research.md:296) | Extracting this field enables automatic KvK number discovery — prerequisite for zero-friction SBI lookup. |

No existing SRS item specifically covers SBI code enrichment or industry-classification-based check modulation. This is a genuinely new capability.

6. Proposed New SRS Capability (not yet defined — research output only)

Based on this research, a potential new SRS item could encompass:

KVK Enrichment step: After XAF ingestion, extract KvK number from taxRegIdent (once DA-045 / the taxRegIdent gap is resolved) and call the KVK Basisprofiel API to retrieve the company's SBI codes.
SBI-aware check modulation: Store primary and secondary SBI codes on the analysis session; use them to:
- Flag when GL transaction mix is inconsistent with registered activity (new analytical signal, NV COS 315 risk assessment)
- Determine G-rekening applicability automatically (enhancing DA-094)
- Adjust default relevance/prominence of sector-specific DA checks
Auditor disclosure: Always surface the retrieved SBI codes in the Stamgegevens view alongside the KvK number, so the auditor can see the registered activity and override if outdated.

7. Technical Feasibility Summary

| Dimension | Assessment | |-----------|-----------| | API availability | KVK Basisprofiel API is live and documented. SBI codes returned as structured data. | | Cost | Low: €6.40/month subscription + €0.02 per company lookup. An audit firm doing 100 engagements/month = ~€8.40/month total. | | Access eligibility | Requires Dutch Business Register registration (Athena's operator likely qualifies; confirm with KVK if not yet registered). | | Rate limits (paid tier) | Not published; contact KVK for high-volume use. At €0.02/call, metering is the natural throttle. | | Open Dataset tier | Free but too restrictive (1 req/min per IP, no company names) to be useful for enrichment in a real audit workflow. | | Prerequisite | Extracting taxRegIdent from the XAF <company> block (currently missing from Athena's data model per docs/auditfile-nu-research.md:296). | | Risk | SBI codes can be stale (companies don't always update them when activities change). Always present them as registered activity, not as ground truth for current activity. The 2025 SBI revision also means some old codes were remapped — a mapping table from CBS/KVK is needed for historical XAF files. |

Sources

Reacties

Nog geen reacties

Athena — research-kvk-sbi-codes.md

Research: KVK SBI Codes for Athena Audit Context

1. What are SBI Codes?