AI agent training for compliance officers in retail banking in Germany

Compliance officers at German retail banks should learn to oversee AI agents as a deployer under the EU AI Act, an ICT risk under DORA and, often, a technology the works council must agree to. The skills are reading depth, certificates and the record, and knowing what stays with people, within 90 days.

What does a compliance officer at a German retail bank spend time on?

The compliance function's tasks are set out in BaFin's risk management requirements: identifying the obligations that matter, checking that procedures and controls meet them, advising management and reporting to the board. In retail banking that covers investment advice and its documentation, consumer credit, account fees, complaints and data protection coordination, with a separate anti-money laundering officer in most banks.

German retail banking has a particular structure. Savings banks and cooperative banks are many small institutions working within groups that share central IT, product and compliance services. An AI agent may be built and certified centrally, then used by dozens of local banks. The local compliance officer still answers for its use in their bank, and needs to know what the central certification covers and what it does not.

Where can an AI agent help, and at what depth?

• Advice documentation checks, depth 1. The agent reads investment advice records and suitability documentation and flags files with gaps. It changes nothing in the advisory system.
• Fee and terms monitoring, depth 1. The agent compares account fees charged with the fees disclosed and agreed, and flags mismatches. The core banking ledger is sealed; a customer's complaint letter is declared.
• Compliance reports and risk analyses, depth 2. The agent drafts the annual compliance report and the compliance risk analysis from the bank's records. An officer revises and signs.
• Tracking regulatory change, depth 3. Within bounds, the agent records new BaFin, EBA and ECB publications in the change register and assigns owners. Its summaries are external until an officer confirms them.
• Notifications to BaFin and data breach reports, held. Drafted by the agent, released only by a named person.

What must compliance officers learn, and what stays with them?

Officers need to read the minimum chain behind any decision, know how depth is earned in Attest rather than set in configuration, and trace any verdict through the record. For German banks in a group, one more skill matters: reading the scope of a certificate. Authority is granted per capability and per customer, proven on that customer's own cases. A central certificate earned on the group's pooled cases does not show that the agent performs on one local bank's cases and limits, and the officer should ask whether local certification was done. AI agent skills by role sets these skills beside other roles'.

Banking corrections is a further habit worth building. When an officer overrules a flag, the reason should change the agent's brief; teaching compliance officers to bank corrections shows how.

These decisions remain the compliance officer's, as what compliance officers should never let an AI agent do sets out:

• deciding whether a breach occurred and whether to notify BaFin
• the annual compliance report's conclusions
• approval of the depth any agent may hold in the bank
• judgement on whether advice documentation meets the rules
• coordination with the anti-money laundering officer on suspicious activity

Which German and EU rules shape oversight and competence?

BaFin supervises German banks; significant institutions also sit under ECB banking supervision, and the EBA sets guidelines that both apply. BaFin's risk management requirements cover the compliance function and outsourcing, and DORA, which applies from 17 January 2025, adds ICT risk management, incident reporting, resilience testing and ICT third-party risk. An AI agent platform is an ICT service, and possibly one supporting critical functions. The EU Anti-Money Laundering Authority is being established in Frankfurt, which will bring direct EU-level supervision of some institutions.

The EU AI Act applies to banks as deployers. Annex III lists creditworthiness assessment and credit scoring of natural persons as high-risk, so consumer credit agents may bring Article 14 human oversight, Article 26 deployer duties and an Article 27 fundamental rights impact assessment. Article 4 requires sufficient AI literacy for staff. GDPR applies throughout, enforced by Germany's data protection authorities, including Article 22 on solely automated decisions. German labour law also gives works councils co-determination rights over technical systems that can monitor staff performance, and an agent workspace that records each reviewer's decisions may fall within that.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

What does a 90-day training plan look like?

1. Weeks 1 and 2. Compliance, the anti-money laundering officer's team, information security and data protection complete the Foundations material. Bring the works council in early and share what the record captures about reviewers.
2. Weeks 3 to 5. Officers read the central certificate for each agent the group provides and check whether local certification exists. Each traces three local decisions through the record.
3. Weeks 6 to 8. An advice documentation agent goes live at depth 1. Officers log disagreements with reasons.
4. Weeks 9 to 11. Reviewer certification for the officers who will hold release rights, ending in a two-week practicum.
5. Weeks 12 and 13. The oversight register is approved by management: agents, depths, local and central certificates, expiry dates and responsible officers.

Where the Academy fits

Pryme Intelligence Academy offers the Foundations track free, useful for the works council and data protection staff as well as compliance, and the Operator track for officers who release held items, with module tests set in retail banking. Certified Pryme Operator needs 32 of 40 questions correct and a two-week practicum; certificates can be checked at source through VerifyDoc.ai.