AI agents for operations leaders in fintech in Germany

Most German fintechs run on a partner bank's licence, so AI agents in their operations must produce evidence as well as output: mailbox triage, direct debit returns, end-of-day checks and audit packs. Account terminations, suspicious activity reports and complaint outcomes stay with people. BaFin, DORA, PSD2, the Instant Payments Regulation, GDPR, the EU AI Act and works councils apply.

What takes up fintech operations leaders' time in Germany?

The partner bank. Many German fintechs run on a licensed partner bank's balance sheet and licence, offering accounts, cards or credit under the bank's name. The bank remains responsible to BaFin and treats the fintech as an outsourcing arrangement, so it sets controls, demands reports and audits the fintech's operations. A large share of operations work is producing evidence for the partner.

Direct debits. German customers pay a great deal by SEPA direct debit, and returns are frequent: insufficient funds, closed accounts, revoked mandates and refund requests within the period the rules allow. Each return must be matched, re-presented or escalated, and the customer contacted.

Daily control and documentation. BaFin and partner banks expect documented, repeatable processes. End-of-day checks, four-eyes controls and written procedures for every step are standard, and an audit finding often comes down to a missing record rather than a wrong outcome.

Where can AI agents help?

• Operations mailbox triage (depth 2 and 3). The agent classifies messages from customers, the partner bank and other institutions, routes them, and answers routine status questions in German from approved content. See triaging a shared operations mailbox with an AI agent.
• Direct debit return processing (depth 3). The agent matches returns to customers and invoices, applies the re-presentation rules by return reason, and sends the customer notice. Mandate disputes are held.
• End-of-day checks (depth 3). The agent runs the documented checks on balances, unprocessed items, failed payments and limit breaches, records each result, and raises exceptions to the duty manager. Our playbook on running end-of-day operations checks with an AI agent sets out the method.
• Partner and audit evidence packs (depth 2). For each partner bank review or audit request, the agent assembles procedures, control records and samples, and drafts the response for the operations lead.

End-of-day checks suit German practice. They are written down, they are repeated daily, and the evidence each one leaves is what auditors sample. An agent running them leaves a more complete record than a tired person at the end of a long day, provided every exception it raises goes to a named person.

What stays with people, and why?

Account terminations stay human. Ending a customer relationship, particularly a payment account, affects access to everyday services and must be reasoned. Suspicious activity reports to the German financial intelligence unit stay with the AML officer.

Outsourcing and partner decisions stay with people. Whether to use an agent's supplier at all, and how to notify the partner bank, are governance decisions under BaFin's outsourcing expectations and DORA's third-party rules.

Changes that monitor staff stay with management and the works council. If the agent allocates, measures or reviews employees' work, works councils typically have co-determination rights over its introduction.

Which rules apply in Germany?

BaFin supervises banks, payment institutions and e-money institutions, with the ECB supervising significant banks directly and the EBA setting EU guidelines. BaFin's risk management and outsourcing expectations require partner banks to control the services fintechs provide to them, which is why partner oversight is so detailed. PSD2 sets the payment services rules, including strong customer authentication. The Instant Payments Regulation requires payment providers to verify the payee's name before an instant or standard credit transfer is sent.

DORA (Regulation (EU) 2022/2554) applies from 17 January 2025: ICT risk management, incident reporting, resilience testing and ICT third-party risk, including the agent and its supplier. GDPR governs customer and employee data, with Article 22 limiting solely automated decisions with significant effects and Article 35 requiring impact assessments for high-risk processing. AML duties follow the FATF Recommendations, and AMLA is being established in Frankfurt.

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Credit scoring of natural persons is high-risk under Annex III. Customer-facing agents must disclose they are AI under Article 50, and deployers have duties under Article 26 where a system is high-risk.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How do you start in the first 90 days?

Weeks 1 to 4: tell the partner bank what you plan, register the agent's supplier under DORA, and inform the works council. Start end-of-day checks in shadow alongside the existing checklist.

Weeks 5 to 8: compare every check result and exception with the person's. Add direct debit return processing in shadow.

Weeks 9 to 13: certify end-of-day checks and direct debit returns at depth 3, with exceptions routed to named people. Share the certification evidence with the partner bank. Follow deploying AI agents: train, shadow, certify, widen. For a market where the regulator itself sets out AI principles, see our brief on operations agents in Singapore fintech.