DORA made contract review urgent for German fintechs, and AI agents can check ICT contracts for required terms, keep the register of information current, test monitoring plan controls and triage AML alerts. Compliance keeps every sign-off, finding and report. BaFin supervises, and DORA, PSD2, EU AML rules, GDPR and the EU AI Act apply.
What does fintech compliance involve in Germany?
Many German fintechs operate in partnership with a licensed bank, which provides accounts or cards under its own licence while the fintech runs the customer experience. Others hold their own BaFin authorisation as a payment or e-money institution. Either way, compliance must show that responsibilities are clearly allocated and that the licensed party keeps control.
Third-party management is central. A fintech relies on cloud providers, core banking software, card processors, identity checks and, increasingly, AI model providers. DORA requires financial entities to manage ICT third-party risk, include specific terms in contracts with ICT providers, and keep a register of information covering those arrangements. Building and maintaining that register, and getting contracts into shape, is a large task.
AML is the third load. Fast growth, digital onboarding and high transaction volumes test AML controls, and BaFin can order special audits or impose measures when controls lag behind growth. Transaction monitoring, reports to Germany's financial intelligence unit, and periodic reviews never stop.
Where can agents help?
- Contract review for DORA terms (depth 2). The agent reads each ICT contract and checks it against the firm's checklist of required terms, such as service descriptions, data location, audit and access rights, incident support and exit arrangements, and drafts the gap list for legal. Our answer to whether an AI agent can review contracts for compliance explains where that review stops.
- Register of information upkeep (depth 2). The agent drafts and updates register entries from contracts and supplier records, and flags entries that conflict with the contract.
- Monitoring plan tests (depth 1). The agent runs control tests from the compliance monitoring plan, such as onboarding samples and safeguarding checks, and drafts findings. See how to run compliance monitoring tests with an AI agent.
- AML alert triage (depth 2). The agent drafts dispositions for alerts using account, device and transaction data, for an analyst.
Contract review is often the best first use in Germany because DORA made it urgent and the work is document-heavy. A fintech with dozens of ICT suppliers can get a cited gap list for every contract in days, and legal can prioritise renegotiation by risk.
What stays with people?
Contract decisions stay with legal and management. Whether a gap is acceptable, how to renegotiate and whether to change supplier are judgements with commercial and regulatory weight. The agent finds the gaps; people decide.
Allocation of responsibilities between a fintech and its partner bank stays with the two firms' management. The bank remains responsible under its licence and must be able to show control, whatever agent the fintech uses.
AML reporting, customer exits and communications with BaFin stay with named people, including the money laundering officer. This is the posture we describe in AI compliance agents: second line, never the last word.
Which rules apply in Germany?
BaFin authorises and supervises payment and e-money institutions and banks, including their organisation, risk management, outsourcing and AML compliance, and can order special audits. The ECB supervises the largest banks prudentially. The EU AML Authority (AMLA) is being established in Frankfurt.
DORA (Regulation (EU) 2022/2554), applying from 17 January 2025, requires ICT risk management, incident reporting, resilience testing and ICT third-party risk management, including contract terms and the register of information. An AI model provider or agent platform is an ICT third-party provider. PSD2 strong customer authentication and the Instant Payments Regulation's payee verification apply to payments.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Most fintech compliance uses are not listed as high-risk; creditworthiness scoring of individuals is. Deployer duties, AI literacy and Article 50 transparency for customer chatbots apply. GDPR governs customer data, including Article 22 on solely automated decisions with significant effects.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How should a German fintech start in the first 90 days?
Month one: run DORA contract review at depth 1 over all ICT contracts, starting with suppliers that support critical or important functions. Legal checks every gap the agent raises.
Month two: build or refresh the register of information with the agent drafting entries, and agree with your partner bank how your register feeds theirs.
Month three: run monitoring plan tests at depth 1 and start AML triage at depth 2 with analysts deciding. Record the agent's own supplier in the register.
Questions people ask
Is an AI agent platform an ICT third-party provider under DORA?
Generally yes, if it provides digital services the financial entity relies on. Include it in the register of information and apply the contract requirements.
Who is responsible when a fintech uses a partner bank's licence?
The licensed bank remains responsible for the regulated activity and must keep control, while the fintech is bound by the outsourcing arrangement. Both should document how agents fit into that split.
How does Germany compare with Singapore for fintech compliance?
Singapore's fintechs work under MAS payment licences and the Technology Risk Management Guidelines rather than DORA. See our brief on compliance agents in Singapore fintech.