Can Security Consultants Use the DAFT Visa? Yes — Here's How
Yes, security consultants can use DAFT. The Dutch-American Friendship Treaty (DAFT) allows US citizens to start a business in the Netherlands, and security consulting is a strong fit. You can offer cybersecurity assessments, physical security planning, risk management, and compliance consulting to clients worldwide.
Security consulting is in high demand across Europe. With GDPR enforcement, increasing cyber threats, and growing regulatory requirements, companies need independent security advisors. The Netherlands is home to major international organizations and tech companies, creating strong local demand.
DAFT Eligibility for Security Consultants
Status: DAFT Eligible
Security consulting is well-suited for DAFT. You're providing advisory and assessment services as an independent business.
Key points:
- Remote and on-site work options depending on specialization
- No special Dutch licensing required for most security consulting
- Dutch market demand: High
- Typical income range: €60,000-€130,000/year
Business Structure Options
Recommended: Eenmanszaak (Sole Proprietorship)
Simplest structure. You are personally liable. Most DAFT applicants start here.
Most security consultants on DAFT start with an Eenmanszaak. If you're doing advisory work without handling sensitive infrastructure directly, this structure works fine.
Other Options
BV (Private Limited Company) Limited liability but requires €0.01 capital and notary. More complex setup. Worth considering for security consultants — clients sometimes prefer working with a limited company for liability reasons, especially for penetration testing or handling sensitive data.
Registration process:
- Apply for DAFT residence permit
- Register with KVK (Chamber of Commerce)
- Receive your KVK number and start operating
Setting Up Your Security Consulting Business
Step 1: Define Your Services Clearly define what services you'll offer. For security consultants, this typically includes:
- Cybersecurity risk assessments and audits
- GDPR and data protection compliance consulting
- Security architecture review and recommendations
- Incident response planning and tabletop exercises
Step 2: KVK Registration Register your business with the Dutch Chamber of Commerce. You'll need:
- Valid residence permit (or proof of DAFT application)
- Proof of address in the Netherlands
- Description of your business activities
- €75 registration fee
Step 3: Tax Registration After KVK registration, you'll automatically be registered with the Belastingdienst (Dutch tax authority) for:
- Income tax
- VAT (BTW) - you may be exempt if under €20,000/year
Common Challenges & Solutions
Challenge: Client trust and credentials Solution: Maintain your existing certifications (CISSP, CISM, CEH, etc.). These are recognized internationally. Build case studies you can share (anonymized, of course). Having US security experience is actually a selling point — American security standards are respected in Europe.
Challenge: Handling classified or regulated work remotely Solution: Some security consulting requires on-site presence or security clearances that are country-specific. Focus on advisory, compliance, and assessment work that can be done remotely or with occasional travel. Dutch security clearances (VGB) are separate from US clearances.
Challenge: VAT for international clients Solution: B2B services to non-EU clients are zero-rated for Dutch VAT. Keep good records.
Income & Tax Considerations
Expected income: €60,000-€130,000/year
Tax obligations:
- Dutch income tax (progressive rates, 36-49%)
- US tax filing required (as a US citizen)
- Foreign Earned Income Exclusion may apply
- Tax treaty between US and Netherlands prevents double taxation
VAT (BTW):
- Services to US/non-EU clients: 0% (reverse charge)
- Services to Dutch clients: 21% VAT
- Small business exemption if under €20,000/year
See our US Taxes While Living in Netherlands guide.
Finding Clients as a Security Consultant
International clients:
- Maintain existing US client relationships
- Use platforms and networks specific to security consulting
- Attend conferences like RSA, Black Hat, or DEF CON (virtually or in person)
- Build thought leadership through blog posts and speaking engagements
Dutch clients:
- The Netherlands hosts major international organizations (ICC, Europol, OPCW in The Hague)
- Strong financial sector in Amsterdam with high security requirements
- Dutch government and EU institutions need security assessments
- Network at local security meetups and events like One Conference
Best practice: Start DAFT with existing clients or committed projects. This provides income stability while you build your European network. GDPR consulting is particularly in demand — if you can combine US data privacy knowledge with GDPR understanding, you'll stand out.
Frequently Asked Questions
Q: Can I work for US companies as a security consultant on DAFT? A: Yes, you can work as an independent contractor for US companies. You bill them as a Dutch business. Many security consultants maintain their US client base while adding European clients.
Q: Do I need Dutch clients to qualify for DAFT as a security consultant? A: No, DAFT does not require Dutch clients. Many security consultants on DAFT work primarily with US or international clients.
Q: Can I do penetration testing for clients while on DAFT? A: Yes, as long as you have proper authorization from clients (which you'd need anywhere). The Netherlands has clear computer crime laws, and authorized penetration testing with written permission is legal. Consider professional liability insurance.
Related Professions
If security consultant isn't quite right for your situation, consider these related professions that also work with DAFT:
- Can Cybersecurity Consultant Use DAFT?
- Can IT Consultant Use DAFT?
- Can Compliance Consultant Use DAFT?
Next Steps
- Evaluate your situation - Do you have clients? Income? A viable business plan?
- Read the complete DAFT guide - Understand all requirements
- Prepare your documents - Start the apostille process early
- Plan your timeline - Most people need 3-6 months to prepare
Digital Guide — $99
We're not immigration lawyers—just Americans who did this. Requirements change, so verify with official sources.