AI in Banking and Financial Services: Use Cases, Tools and the Compliance Framework

An adviser at a Volksbank opens a client meeting having spent the previous forty minutes doing something a machine could have done: pulling the account history, reading the last three contract changes, checking the open service tickets, and skimming a product sheet. The conversation that follows is good, because the adviser is good. But the value the bank pays for is in that conversation, not in the forty minutes of gathering that came before it. Multiply that by every adviser, every compliance analyst chasing false positives, and every back-office clerk keying the same data twice, and you have the real cost base of a modern bank.

The pressure to change it is coming from two directions. The workforce that carries the institutional knowledge - the senior credit officers, the AML specialists, the risk managers who know why a rule exists - is ageing and retiring, and the specialists to replace them are scarce. At the same time the regulator has stopped treating AI as an experiment: BaFin now folds it into ICT risk management under DORA, and the EU AI Act names credit scoring a high-risk use with obligations attached^10,11.

This is an honest map of where AI actually works in a bank in 2026 - the use cases across departments, the real tools and vendors that serve each one, and the BaFin, MaRisk, DORA, EU AI Act, and DSGVO frame you have to work inside. No tool wins every row. And there is one thing almost none of them keep, which is the difference between software that runs your process and a system that remembers how your institution actually decides.

Where a Bank Actually Loses Time and Knowledge

A bank runs on process and on people who know the process. The cost problem is not that the work is hard; it is that skilled, expensive staff spend most of their day on routine gathering and drafting, and the knowledge that makes the hard calls right lives in a handful of heads.

• The back office is document-bound - KYC files, credit dossiers, regulatory reports, and complaint responses are assembled by hand from data that already exists in ten systems, over and over.
• Compliance drowns in false positives - AML transaction monitoring generates far more alerts than are real, and analysts spend their days clearing noise rather than catching the genuine risk.
• The specialists are retiring - the senior credit officers, risk managers, and compliance leads who know why a rule exists are ageing out, and the replacements are scarce and slow to train.
• Knowledge lives in people, not systems - why a corporate client always draws down late, which alerts your best analyst dismisses and why, how the credit committee really weighs a borderline file - none of that is written down.
• Every decision is regulated - a lending or compliance call is not just a business choice; it carries MaRisk, EU AI Act, and DSGVO duties, so the reasoning has to be defensible and logged, not just fast.
• The core systems do not talk - the account is in the core banking platform, the client in the CRM, the risk in a separate model, and the context in an inbox, so staff become the integration layer, copying between them.

So the question is not whether to put AI on the problem. It is which use case fits which department, which tool serves it, and whether the tool just runs the process or actually keeps the judgement your best people carry.

Why 2026 Is Different for Banks

Banks have used models for decades, from credit scoring to fraud rules. What changed is that language models can now read and draft the unstructured documents that fill a bank, agents can act across systems rather than answer in a chat window, and the regulator has set a clear frame, so the technology and the rules arrived at the same time.

1. Language models handle the documents - KYC files, contracts, complaints, and reports are unstructured text, and AI can now read, summarise, and draft them, which is where most of a bank’s manual load sits¹.
2. Agentic AI moved from chat to action - early frontline pilots report a two to threefold increase in qualified leads, because an agent gathers, drafts, and acts rather than just answering a question²⁰.
3. The regulator set the frame - the EU AI Act classifies credit scoring as high-risk, and BaFin folded AI into ICT risk management under DORA in December 2025, so the rules are now concrete rather than pending^10,11,22.
4. The sector data centres shipped AI - Finanz Informatik built the S-KIPilot into OSPlus toward roughly 200,000 Sparkassen workplaces, and Atruvia offers GenoGPT to the cooperative banks, so AI is arriving through the platforms banks already run^14,15.
5. The workforce cliff is here - the specialists who hold credit, risk, and compliance knowledge are retiring, so capturing what they know is now urgent, not aspirational.
6. The honest caveat - most banks have not yet turned AI into scaled revenue or efficiency, and slower adopters risk what McKinsey calls pilot purgatory, so the winners pair the technology with governance and real integration, not demos²¹.

With that lens in place, here is the honest read on where AI works across the bank.

AI Use Cases Across the Bank

AI does not arrive as one project; it arrives department by department. Here is where it earns its keep across a bank or financial-services firm, from the front line to the back office, with the honest note on what stays human.

Advisory and the front office

• Meeting preparation - an assistant pulls the account, contracts, past contacts, and open tickets into a briefing, so the adviser walks in ready instead of spending forty minutes gathering, as the Sparkassen S-KIPilot is built to do¹⁴.
• Next-best-product suggestions - grounded in the customer’s real position, not a generic campaign, with the adviser deciding what to actually recommend.
• Call and meeting documentation - the routine write-up and CRM update drafted automatically, so the record is complete without the adviser keying it.

Credit, lending and underwriting

• Credit file assembly - gathering financials, collateral, and history into a structured dossier, the slow part of every lending decision, with platforms like nCino built around this workflow¹⁸.
• First-pass analysis - drafting the credit memo and flagging the risks, so the officer starts from a reviewed draft rather than a blank page.
• Decisioning models - Zest AI and the German cooperative sector’s parcIT run credit and risk models, which sit squarely in the EU AI Act high-risk class and need the governance to match^16,22.

Compliance, KYC and AML

• Onboarding and KYC - reading identity documents, checking sanctions and PEP lists, and assembling the file, the highest-volume routine work in compliance.
• Transaction monitoring and alert triage - NICE Actimize, Nasdaq Verafin, SymphonyAI, and ComplyAdvantage use AI to cut false positives and prioritise the alerts that matter¹⁷.
• Suspicious-activity drafting - AI assembles the case and drafts the report, but a qualified human owns the filing decision, as the rules require.

Fraud, risk and reporting

• Real-time fraud detection - AI scores transactions for fraud far faster than static rules, a mature category with vendors like Featurespace and FICO alongside the AML leaders¹⁹.
• Regulatory reporting - drafting and reconciling the returns that consume the risk and finance functions, with a human checking the numbers that carry capital and MaRisk weight.
• Model monitoring - watching deployed models for drift, which is not optional in a bank, because a model that quietly goes wrong is a real financial and regulatory risk¹⁶.

Operations, IT and service

• Customer service and requests - answering routine queries and drafting responses, with escalation to a human for anything that affects an account or a complaint.
• Legacy code modernisation - documenting and refactoring the old core-banking code that no one who wrote it still works there, a use case half the leading banks are pursuing.
• Back-office automation - the reconciliations, data entry, and inter-system copying that turn skilled staff into an integration layer.

The AI Tool Landscape for Banks in 2026

Here is the honest read on the categories that matter, grouped by the job each does best, what it is genuinely good at, and where it stops. Pricing is quote-only for almost all of these, because they are sold on modules, users, and volume.

Financial crime, AML and fraud

1. NICE Actimize

• What it is - A leading financial-crime platform covering AML, fraud detection, and market surveillance, with AI-driven transaction monitoring and case management¹⁷.
• Best for - Banks that want an established, broad enterprise platform for the whole financial-crime stack.
• Where it stops - It monitors and flags; the investigation judgement and the filing decision still sit with your analysts.

2. Nasdaq Verafin

• What it is - A cloud financial-crime platform strong in AML and fraud, using consortium data and AI to sharpen detection¹⁷.
• Best for - Institutions that value cross-institution data to reduce false positives.
• Where it stops - Powerful for detection; the compliance reasoning and case ownership remain human.

3. SymphonyAI and ComplyAdvantage

• What they are - AI-native financial-crime tools; SymphonyAI (Sensa) focuses on AML detection and investigation, ComplyAdvantage on real-time AML and sanctions risk data¹⁷.
• Best for - Firms wanting modern, AI-first detection, including fintechs and mid-size banks.
• Where they stop - They score and surface risk; the SAR decision and the audit trail stay yours to own.

Credit, lending and decisioning

4. nCino

• What it is - A cloud banking platform strong in commercial lending, with AI-assisted credit decisioning and workflow across the loan lifecycle¹⁸.
• Best for - Banks wanting to digitise and speed the commercial credit process end to end.
• Where it stops - It runs the lending workflow; the final credit decision and its EU AI Act duties stay with the bank.

5. Zest AI

• What it is - An AI credit-decisioning specialist that builds and runs underwriting models aimed at more accurate, more inclusive lending¹⁸.
• Best for - Lenders wanting to modernise the scorecard itself, especially in consumer credit.
• Where it stops - Credit scoring is high-risk under the EU AI Act, so the model needs conformity, validation, and human oversight²².

6. parcIT (Atruvia)

• What it is - The credit and risk methodology provider inside the German cooperative group, supplying the models the Volksbanken and Raiffeisenbanken rely on¹⁶.
• Best for - Cooperative banks whose risk and credit models must fit the sector’s standards.
• Where it stops - As one public case showed, a model error can strain a bank’s risk limit, which is exactly why MaRisk validation and monitoring matter¹⁶.

Digital engagement and core banking

7. Backbase

• What it is - An engagement banking platform folding AI across onboarding, service, and the customer journey on top of the core¹⁸.
• Best for - Banks modernising the digital front end without replacing the core all at once.
• Where it stops - It owns the engagement layer; the risk, compliance, and credit judgement live elsewhere.

8. Temenos, Avaloq and Finastra

• What they are - Established core and wealth banking platforms embedding AI features into the systems of record European banks already run.
• Best for - Institutions extending AI inside their existing core rather than adding a separate tool.
• Where they stop - The AI is bounded by the platform; it does not reach the email, the past cases, and the tacit knowledge outside it.

DACH sector platforms and assistants

9. Finanz Informatik - S-KIPilot and SparkasseGPT

• What it is - The Sparkassen data centre’s AI, with the S-KIPilot built into OSPlus for advisers and SparkasseGPT developed with OpenAI, rolled out toward roughly 200,000 workplaces^13,14.
• Best for - Sparkassen using the standard advisory and service workflows inside OSPlus.
• Where it stops - It is a sector-wide assistant; the workflows and knowledge specific to one Sparkasse still need something on top.

10. Atruvia - GenoGPT

• What it is - The cooperative group’s AI knowledge platform, bundling bank knowledge and making it available context-specifically for the Volksbanken and Raiffeisenbanken on agree21¹⁵.
• Best for - Cooperative banks wanting sector-standard AI inside their core environment.
• Where it stops - It is a shared platform; a single bank’s own processes and institutional memory are not its focus.

11. General assistants (ChatGPT, Microsoft Copilot) as a baseline

• What they are - General-purpose assistants that draft text, summarise a document, or answer a question.
• Best for - One-off drafting and analysis alongside the real banking systems.
• Where they stop - They are not a banking system. They do not hold your accounts, do not connect to your core, and used without governance they create a shadow-AI and DSGVO problem. Use them as a co-pilot, not the system.

What Every Banking Tool Misses

Run the tools above side by side and a pattern appears. They differ on price, on breadth, and on how much they automate. They agree on one blind spot: each is a process engine for one part of the bank, and none of them keeps the reasoning that makes a decision right when the specialist who held it retires.

• They run the process, not the judgement - the AML tool flags an alert. It does not know that this pattern, for this client, is the same false positive your best analyst cleared last quarter and why.
• The context walks out the door - when a senior credit officer retires, the platform keeps the files but loses the sense of which borrowers to trust, which sectors are turning, and how the committee really weighs a borderline case. The next hire relearns it.
• Each tool sees only its own box - the core banking platform, the AML tool, the lending system, and the CRM each hold a slice, so no single tool has the cross-department view a real decision needs.
• Drafting is not deciding - a perfect credit memo still needs someone to weigh the risk and own the number, and a regulator expects that human to be accountable, not the model.
• Reach stops at the system edge - the reason a decision should move often lives in an email, a past case note, or a conversation the tool never sees.
• Governance is left to you - the EU AI Act, MaRisk, and DORA duties around a model are the bank’s to carry, and a point tool rarely gives you the logging and oversight the supervisor wants across everything.

This is the gap a Company Brain, plus AI employees, is built to close.

The Company Brain Approach

A Company Brain is company memory: the people-knowledge, processes, and decisions that make your bank work, captured so they survive turnover and can be acted on. It is the layer above your banking tools, and it is what turns a process engine into an AI employee that works the task and answers the questions - inside your compliance frame, not around it.

What it keeps

• How your credit really decides - the way your committee weighs a borderline file, the sectors you are cautious on, and the borrowers you know, so analysis reflects your risk appetite, not a generic model.
• Which alerts are noise - the transaction patterns your best analysts clear as false positives and why, so triage improves instead of repeating the same investigations.
• The client patterns - who draws down late, who is worth the exception, and the relationship history, so advice and credit reflect who you are really serving.
• Why you decided - the reasoning behind past credit, compliance, and pricing calls, kept and logged, so the next decision learns from the last and is defensible to the supervisor.
• Feedback as it happens - the Company Brain learns from your specialists’ corrections every day, so it stays accurate as markets, rules, and clients change, rather than going stale.

The AI employees on top

Grounded in that memory, AI employees do the routine work end to end and stay connected to the systems where your accounts and their context actually live - the core platform, the CRM, email, Teams, and SharePoint.

• Assemble the file - pull the KYC, credit, or complaint file together from every system and flag what needs a human eye.
• Draft the analysis - produce the credit memo, the case summary, or the regulatory draft in your format, ready for review.
• Triage the alerts - separate the AML and fraud noise from the genuine risk, using your own history of what turned out to matter.
• Prepare the adviser - build the meeting briefing and the next-best-action from the client’s real position.
• Improve daily - every correction and every closed case feeds back into the Company Brain, so you get more output without more headcount.

A Company Brain does not replace your core banking platform or your AML tool. It sits above them and keeps the thing they never captured: how your institution actually decides, and who works the follow-through.

Build vs Buy vs Layer: The Verdict

The instinct with banking AI is to frame it as build versus buy. That is the wrong question. The right frame has three parts, and for most banks the answer is all three, in order.

1. Buy the banking tools - core platforms, AML engines, and lending systems are solved problems built by vendors with years of data and compliance work. Building your own is a false economy; pick the tools that fit your sector and connect them.
2. Do not build the platform - a homegrown AML or core system competes with specialists and carries the regulatory burden alone. You will spend more and see less.
3. Layer memory and action on top - the part no banking tool gives you, the retained credit and compliance reasoning and the AI employees that work the routine tasks across your core, CRM, and inbox, is where a custom layer earns its place, because it is specific to how your bank decides.

The 90-Day Deployment Playbook

Most banking AI projects stall because they try to boil the ocean, or because they start with a high-risk use case and get stuck in governance. A focused 90-day plan takes one lower-risk, high-volume back-office process from baseline to a working, measurable loop, with the compliance frame in place, then expands. Here is the shape.

Phase 1: Baseline and capture (Weeks 1-4)

1. Week 1: Pick a lower-risk, high-volume process - KYC file assembly, complaint drafting, or meeting prep, not credit decisioning, so you get value without the full high-risk conformity burden first.
2. Week 2: Baseline the numbers - measure handling time, volume per staff member, error and rework rate, and backlog. This is your before picture.
3. Week 3: Capture the reasoning - sit with your best specialist and document how the process really runs and where the judgement lives. This seeds the Company Brain.
4. Week 4: Set the guardrails - define what the AI may do automatically, what needs review, and what always goes to a human, plus the logging DORA and MaRisk expect.

Phase 2: Build and test (Weeks 5-8)

5. Week 5-6: Connect and ground - wire the AI employee to the core, CRM, and document stores, and ground it in the captured reasoning. It runs alongside the team, not on live cases yet.
6. Week 7: Shadow mode - the AI assembles files and drafts on real cases, and your specialists review and correct. Every correction feeds the Company Brain.
7. Week 8: Refine - tune the edge cases, finalise the review checkpoints, confirm the audit trail, and set the go-live scope.

Phase 3: Run and measure (Weeks 9-12)

9. Week 9: Soft launch - let the AI run the process for one team, with a human owning every decision and the log capturing every step.
10. Week 10-11: Full rollout - expand to the wider function, and only then plan the move toward a higher-risk use case with the governance already proven.
11. Week 12: Measure and expand - compare handling time, volume, and rework against the week-1 baseline, review the audit trail, then pick the next process.

How Superkind Fits

Superkind builds AI employees grounded in a Company Brain. In a bank, that means AI employees that work the routine, regulated back-office tasks - file assembly, drafting, alert triage, meeting prep - connected to the systems you already use, and a company memory that keeps how your institution decides even when specialists retire.

• Works on top of your banking tools - it sits alongside OSPlus, agree21, Temenos, nCino, or your AML platform, no rip-and-replace of the systems you already run.
• Grounded in your Company Brain - analysis reflects your real credit appetite, your known clients, and your false-positive history, not a generic model.
• Connected to your real systems - it acts across the core, CRM, email, Teams, and SharePoint through API connections, so it works where the context lives.
• Works the task, not just a chat - it assembles the file, drafts the memo, triages the alerts, and prepares the adviser, with a human owning every decision that affects a customer or a regulatory obligation.
• Built for the compliance frame - human-in-the-loop by design, logged actions, EU data residency, and provider governance that fits DORA and MaRisk, not a consumer chatbot bolted on.
• Keeps the knowledge - the credit, compliance, and advisory judgement your specialists hold is captured as the work happens, so it survives retirements and turnover.
• Improves every day - your team’s feedback and every closed case make it more accurate over time, so you get more output without more headcount.
• Live in weeks - a first lower-risk process typically reaches supervised production in 8 to 12 weeks, running one workflow before it expands.

BaFin, MaRisk, DORA, the EU AI Act and DSGVO

For a bank or financial-services firm, compliance is the first line of the AI shortlist, not the last. The good news is that most back-office AI is lower risk, but credit scoring is high-risk, AI now sits inside DORA and MaRisk, and personal data falls under DSGVO, so the frame has to be part of the design.

EU AI Act

• Credit scoring is high-risk - Annex III names creditworthiness assessment and credit scoring of natural persons as high-risk, bringing risk management, data governance, documentation, logging, human oversight, and a conformity assessment²².
• Most back-office AI is lower risk - assembling files, summarising documents, and drafting internal text generally sit outside the high-risk categories, so the heavy duties usually do not apply.
• Article 50 transparency - where an AI system interacts with a person, that should be clear, so disclose the AI in customer-facing messages²³.
• Enforcement is real - breaches of the AI Act can draw fines up to 15 million euros or 3 percent of worldwide annual turnover, so classification is not a formality¹¹.

DORA, MaRisk and BaFin

• AI is ICT risk under DORA - BaFin’s December 2025 guidance treats AI as part of ICT risk management under DORA, so the model and its provider fall inside your resilience framework¹⁰.
• Model risk under MaRisk - any model feeding a risk or capital number needs validation, monitoring, and clear ownership, and a public case where a provider model error strained a bank’s risk limit shows why¹⁶.
• Third-party governance - an external AI provider is a third party to register, assess for concentration risk, and oversee, exactly as DORA requires for critical ICT services.
• Human oversight and logging - keep a qualified human on every regulated decision and log what the AI does, which satisfies the supervisor and is simply good banking governance.

DSGVO and the DACH fit

• Customer data is personal data - account, transaction, and identity data are covered by DSGVO, so process them lawfully, minimally, and with a clear purpose and legal basis.
• Keep data in the EU - prefer tools that process within your infrastructure or a compliant EU boundary, a point sharpened by the sovereignty debate around US cloud providers¹².
• Works council involvement - where AI changes how staff work, the Betriebsrat is typically involved in German institutions. Bring them in early, not after the pilot.
• Sector fit - a tool that cannot work inside OSPlus or agree21, or that ignores German reporting conventions, will not fit a Sparkasse or Volksbank however good its AI.

Frequently Asked Questions

Related Articles

• AI Tools for Insurance Brokers
• AI for Credit Management
• The AI Compliance Assistant
• The EU AI Act for the Mittelstand
• Sovereign AI: Keeping Your Company’s AI in the EU
• AI Agents for the Mittelstand

Henri Jung

Co-founder of Superkind, where he helps SMEs and enterprises deploy custom AI employees that actually fit how their teams work. Henri is passionate about closing the gap between what AI can do and the value it creates in real companies. He believes the Mittelstand has everything it needs to lead in AI - it just needs the right approach.