AI agents for compliance teams in capital markets in Germany

Testing advice records, triaging market abuse alerts, checking watch lists and drafting the monitoring plan: that is what AI agents can do for German capital markets compliance. The compliance officer keeps every finding and report. BaFin supervises, works councils have a say over tools that monitor staff, and EU market abuse rules, GDPR and DORA apply.

What occupies capital markets compliance in Germany?

German banks have a strong retail securities business, with savings and cooperative banks distributing funds and certificates through branch advisers, often supported by central institutions that run trading and product design. Compliance tests whether advice was suitable, whether costs were disclosed, and whether the suitability statement given to the client matches what happened.

Market abuse surveillance runs in parallel at firms that execute orders. Alerts are reviewed, suspicious orders and transactions are reported to BaFin, and insider lists and watch lists are maintained by the control room.

BaFin expects the compliance function to work from a risk-based monitoring plan and to report to management and the supervisory board at least annually. Writing that plan, running the tests in it and reporting results is a large share of the year.

Which uses suit an AI agent?

1. Advice record testing (depth 1). The agent samples advisory files and checks that the client profile, product risk class, cost disclosure and suitability statement are consistent. It lists exceptions by adviser and branch.
2. Market abuse alert triage (depth 2). The agent reconstructs order timelines against ad hoc disclosures and news, and drafts a disposition for an analyst.
3. Watch and restricted list checks (depth 1). The agent compares research, sales and proprietary trading activity with the control room's lists and flags trades that need explanation.
4. Monitoring plan drafting (depth 2). The agent drafts the risk-based monitoring plan from the previous cycle's findings, incidents and business changes, for the head of compliance to set priorities.

A separate agent can test the first agent's outputs. Our view on whether a compliance agent should be separate from the agents it checks is yes: the checker needs its own sources, its own certificate and no ability to change the first agent's work. In German banks, where advisory files are produced partly with agent help, that separation matters.

What stays with people, and why?

The compliance officer is appointed by management and must be able to act independently. Findings, reports to BaFin, and recommendations to management stay with that function. An agent can draft a finding that an adviser repeatedly mis-classified client risk; a person decides whether it is a finding, what remediation the client gets, and what happens to the adviser.

Works councils add a German-specific reason. Technical systems capable of monitoring employees' behaviour or performance generally require co-determination, and advice record testing by adviser is exactly that. Agree the scope and use of the data with the works council before going live.

Our answer to whether an AI agent can replace a compliance officer is no, and the German regime makes the reason concrete: the role carries independence and personal judgement the law expects a person to hold. That is why compliance agents are second line, never the last word.

Which rules apply in Germany?

BaFin supervises securities firms and banks' investment services, including the organisation and independence of the compliance function, conduct of business, and market abuse reporting. German securities trading law implements EU investment services rules on suitability, cost disclosure, product governance and recording of communications. EU market abuse rules require detection and reporting of suspicious orders and transactions and the upkeep of insider lists. ESMA coordinates across the EU, and the ECB supervises the largest banks prudentially.

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Surveillance agents are not among its listed high-risk uses, but tools that monitor or evaluate workers can be, which bears on adviser-level testing. Deployer duties under Article 26 and AI literacy under Article 4 apply.

GDPR covers staff and client data. DORA, applying from 17 January 2025, covers the agent as part of ICT risk management and its supplier as an ICT third-party provider, with incident reporting if it fails in a way that disrupts services.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

What does a careful 90-day start look like?

Month one: present the advice record testing design to the works council and the data protection officer, with the fields the agent reads and the uses its output may and may not serve.

Month two: run advice record testing at depth 1 on a past quarter's files that compliance has already reviewed. Compare exception lists, and look especially at cost disclosure, where errors are easy to miss by hand.

Month three: add watch and restricted list checks at depth 1, and decide whether alert triage is ready to trial at depth 2. Write the DORA register entry for the supplier before any live use.