German retail banks' compliance teams can use AI agents to check that fee changes rest on customers' active consent, test that long-term overdraft users were offered advice, review basic account handling and track mandatory training. BaFin supervises conduct and risk management, and credit scoring is high-risk under the EU AI Act, so refunds, credit outcomes and findings stay with people.
What do retail banking compliance teams in Germany spend their time on?
Germany's retail banking market includes large private banks, savings banks, cooperative banks and direct banks. All are supervised by BaFin, with the largest also under ECB banking supervision. German civil law and case law add consumer protections that shape compliance work in specific ways.
Fee changes and consent. German courts have held that banks cannot change fees and terms simply because customers did not object. Fee changes need customers' active agreement. Banks have had to review which customers agreed to which terms, and refund fees charged without a valid basis.
Overdrafts. Banks must offer advice to customers who rely on their arranged overdraft heavily over a long period, and document the offer. Overdraft interest and its disclosure draw supervisory and consumer attention.
Basic accounts. Consumers have a right to a basic payment account, and refusals must follow the permitted grounds.
Risk management and compliance function. BaFin's minimum requirements for risk management set out how the compliance function must work, including monitoring, risk analysis and reporting to the management board.
Training. Staff in advisory and sales roles need documented training, and the compliance function must be able to show it.
Where can AI agents help?
Depth caps how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
Fee consent reconciliation (depth 1). For each account, the agent compares the fees charged with the price list the customer actually agreed to, using consent records, and lists accounts charged under terms without valid agreement. This is the most Germany-specific use, given the case law and the size of the reconciliation it demands.
Overdraft advice testing (depth 1). The agent identifies customers whose overdraft use meets the bank's criteria for an advice offer and checks that an offer was made and documented within the required period.
Basic account refusals (depth 1). The agent reviews refusals of basic account applications and checks that each cites a permitted ground with evidence.
Training tracking (depth 3). The agent tracks mandatory training for advisory and sales staff, sends reminders and reports completion by branch. How far an agent can go here is covered in can an AI agent track compliance training.
Compliance risk analysis drafting (depth 2). The agent gathers testing results, complaints, incidents and regulatory changes and drafts the periodic compliance risk analysis for the head of compliance.
What stays with people?
Refunds. If fees were charged without valid consent, deciding the scope and making refunds is a decision with financial and legal consequences. A person decides; operations pays.
Overdraft advice. The advice conversation itself belongs to a trained adviser. The agent checks that it was offered.
Account refusals and closures. Whether to refuse or close an account affects a person's ability to take part in everyday life and stays with people.
Credit decisions. A compliance agent never scores or decides credit. Credit scoring of individuals is high-risk under the EU AI Act.
Findings and the risk analysis. The head of compliance concludes and reports to the management board.
Auditors will ask how the bank checks the agent's own work. The guide on how to audit a compliance agent's recommendations explains sampling and evidence methods that internal audit can use.
Which rules apply in Germany?
BaFin supervises banks for prudential, conduct and AML matters. Its minimum requirements for risk management cover the compliance function, outsourcing and IT. ECB banking supervision covers the largest banks' prudential matters. The EBA sets EU guidelines, including on internal governance and loan origination.
EU AI Act (Regulation (EU) 2024/1689). Entered into force on 1 August 2024, with obligations phasing in. Annex III lists creditworthiness assessment and credit scoring of natural persons as high-risk. Banks deploying such systems carry Article 26 duties, including human oversight and monitoring. Article 4 AI literacy applies to staff using any AI system. A compliance agent reading files is not itself scoring anyone.
GDPR. Article 5 principles, Article 30 records and Article 35 impact assessments apply. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, which is directly relevant to credit and account decisions.
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025: ICT risk, incident reporting, testing and third-party risk.
Employee co-determination. An agent tracking staff training or reviewing advisers' work is likely to fall within works council rights.
German civil law and case law on consent to terms, overdrafts and basic accounts set the standards the agent tests against.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How to start in the first 90 days
Weeks 1 to 4. Register the agent's provider under DORA and complete the impact assessment. Agree training tracking with the works council. Start with fee consent reconciliation on one account product.
Weeks 5 to 8. Compare the agent's results with the reconciliation your bank carried out after the court rulings. Every account identified then should appear now, unless already remediated.
Weeks 9 to 13. Extend to other products and add overdraft advice testing. Singapore banks work under a different regulator and principles; see compliance agents in Singapore retail banking.
Where Pryme fits
In Pryme, the consent reconciliation agent reads consent records and fee data at depth 1, and refunding a customer is outside its role scope, so the request is refused with the deciding bound named. Attest replays it against your earlier reconciliation before it is relied on. Every verdict is filed, which supports BaFin reviews and internal audit. The guide to AI compliance agents explains the approach.
Questions people ask
Can an AI agent decide which customers get fee refunds?
It can identify accounts and calculate amounts. Deciding the refund approach, and paying, stays with people, because the decision has legal and financial weight.
Does tracking staff training need works council agreement?
If the agent records or evaluates individual staff data in a way that can monitor performance, co-determination rights are likely. Agree the scope early.
Is an overdraft advice check an automated decision about the customer?
No. The agent checks whether the bank met its own duty. It does not decide anything about the customer's overdraft.