ICT risk and incident reporting under DORA
ICT risk management owned by the management body, classification of major incidents and the 4h/24h · 72h · 1-month reporting chain.
Typical obligations
What typically lands on your desk
Outsourcing and third parties
Risk analysis before every material outsourcing, the register of information under ITS 2024/2956, contract clauses and exit strategies — including for externally sourced AI services.
MaRisk organisation and control functions
Risk control, the MaRisk compliance function and internal audit, risk-bearing capacity and the at least quarterly overall risk report to management.
AML prevention under the AMLR
Business-wide risk assessment, due diligence, beneficial owners, sanctions screening and suspicious-activity reporting — mapped against Regulation (EU) 2024/1624.
How Agentic360 helps
From rulebook to gap list — and on to evidence
The building blocks banks and savings banks can work with on the platform — each linked to its detail page.
Blueprints for DORA, MaRisk & BAIT and AML
Each regulation as a documented target process with the article or module cited for every step. You map your current state module by module and get a prioritised gap list; the Regulation Watcher flags new requirements.
Compliance agents that cite the paragraph
Role-based agents answer with the exact paragraph, grounded in your own outsourcing contracts and fully logged — shown in the demo scenario of a cooperative bank.
AML onboarding and handbook review
KYC, sanctions and PEP checks against the EU list, OFAC SDN and GLEIF as an agentic workflow with human approval on the SAR path; your prevention handbook mapped article by article against the AMLR.
An operating model your outsourcing analysis can accept
EU SaaS hosted in Germany, private cloud, on-premises or air-gapped. Keys, index and audit log are separated per tenant.
Regulations
Relevant regulations at a glance
Applies since 17 January 2025; incident reporting 4h/24h · 72h · 1 month.
Specifies section 25a of the German Banking Act (KWG); outsourcing in AT 9.
- BAIT
Only for non-DORA institutions; repealed as of 31 December 2026.
Applies from 10 July 2027 — the new EU AML regime with the AMLA as supervisor.
In stages: transparency duties since 2 August 2026, high-risk duties (Annex III) from 2 December 2027.
- GDPR
For every processing of personal customer data — including by AI agents.
Whether and to what extent a regulation applies to your organisation depends on size, sector and business model. This overview is orientation, not legal advice.
Related roles
Your institution, your rulebook — scoped in 30 minutes.
We walk you through the relevant blueprint, map it roughly against your current state and show what the gap list would look like for your institution.