Answers that hold up
Even when BaFin asks
Credit analysts, compliance officers, and legal teams spend hours cross-checking circulars, reviewing vendor contracts under DORA, and preparing credit memos. Omnifact gives your specialists an AI assistant grounded in your approved work instructions, with automatic personal data pseudonymization via the Privacy Filter, group-level access controls, and hosting in Germany.
Does our document-scanning provider count as an ICT third-party service provider under DORA?
Most likely yes. DORA treats digital and data services provided on an ongoing basis through ICT systems as ICT services, which covers a provider that scans and digitizes your documents.
- Record the contract in your register of information
- Assess whether the service supports a critical or important function
If it supports a critical or important function, the stricter contractual requirements of DORA apply.
DORA Regulation & EBA Guidance.pdfAlready in use at banks and financial service providers
Built for
banking and finance
Separate sensitive customer and credit data by business unit, back every answer with citations to your approved guidelines, and meet internal and external audit requirements.
Privacy Filter™
Rule-based and AI-powered detection pseudonymizes names, IBANs, account numbers, and contact details before a model processes them. Confidential client data stays within your institution.
Privacy Filter™JMJulia MeyerDraft a reply to Thomas Berger about his leasing application. Payments come from DE89 3704 0044 0532 0130 00, and he asked us to answer at t.berger@example.de.
Answers from your own documents
Combine DORA regulations, credit work instructions, BaFin circulars, and contract checklists in dedicated Spaces. Every answer cites the exact document and clause.
Personal onboarding
Individual onboarding, use-case workshops and product training for your teams.
- Kickoff call
- Admin setup
- Use-case workshop
- Product training
Single sign-on
Staff sign in with your existing identity provider, and groups can be synced automatically.
Entra IDOktaSign in with SSOKeycloakSAML 2.0
From the BaFin letter
to the credit file
Take the manual comparison work out of banking and compliance operations: check ICT vendor contracts against DORA checklists, draft replies to supervisory inquiries, and look up credit rules with exact source citations.
Draft a reply to the BaFin request about our outsourcing of document scanning, summarizing our risk assessment and exit strategy.
Outsourcing of document scanning
We have assessed the outsourcing of document scanning in line with our risk management framework. The service does not support a critical or important function, and the provider is recorded in our register of information.
Our exit strategy provides for a transition to an alternative provider within three months. We would be happy to provide the full risk assessment on request.
Audit-ready governance
Clear lines per unit
Keep credit, risk, compliance, and sales separated in permissioned Spaces. Enforce EU-only model routing and retain clear audit logs for internal and external reviews.
Strict separation by business unit
Credit, compliance, risk, and sales each search only the Spaces approved for their role, managed through groups synced from your identity provider.
EU-hosted models with Zero Data Retention
Allow only EU-hosted models from OpenAI, Anthropic, Mistral, or Google under contractual Zero Data Retention. Prompts and documents are never stored by providers or used for training.
Audit logs for personal data reveals
Every reveal of pseudonymized personal data is logged per user with a timestamp, giving your compliance and audit teams a clear record of access.
- ABAnna Beckera.becker@musterbank.de
- JWJonas Weberj.weber@musterbank.de
- LDLeyla Demirl.demir@musterbank.de
- TSThomas Schulzt.schulz@musterbank.de
- MHMarie Hoffmannm.hoffmann@musterbank.de
- DKDaniel Krügerd.krueger@musterbank.de
- SWSophie Wagners.wagner@musterbank.de
- LNLukas Neumannl.neumann@musterbank.de
- FYFatma Yılmazf.yilmaz@musterbank.de
- Upload Files & AttachmentsAttach documents and other files to chats and Spaces.Revoke
- Use Web Search and BrowsingSearch the web and access live information.Revoke
- Generate ImagesUse AI image generation to create visuals.Grant
- Use Premium ModelsUnlocks frontier and expensive models.Revoke
- Enable US-Hosted Models AccessData residencyRoutes model requests to US-region infrastructure.Grant
Frequently asked questions
clear answers for financial institutions
What compliance, risk, IT security, and data protection officers ask before introducing Omnifact.
Which financial institutions use Omnifact in daily work?
Omnifact is built for banks, banking-group subsidiaries, leasing and factoring companies, securities institutions, asset managers, and insurers. Teams in credit analysis, compliance, legal, risk management, and customer service use Omnifact to check contracts against checklists, research internal work instructions and BaFin circulars, and draft correspondence. Each department works in its own permissioned Spaces.
How does Omnifact support DORA and third-party contract reviews?
You can upload DORA regulations, EBA guidelines, and your internal contract checklists into a dedicated Space. Compliance and legal teams use Omnifact to check vendor contracts against required clauses, identify missing provisions such as exit strategies or ISMS evidence, and verify every finding via direct source citations. Final legal and regulatory assessments stay with your specialists.
How does Omnifact assist with credit memos and four-eyes reviews?
Omnifact summarizes credit files, checks applications against your internal credit work instructions, and prepares structured draft memos with citations to the underlying documents. Your analysts and back-office specialists review the output and make and document every credit decision themselves under your existing four-eyes policy.
What documentation does Omnifact provide for outsourcing assessments under KWG, MaRisk, and DORA?
Omnifact provides an Art. 28 GDPR data processing agreement, documented technical and organizational measures (TOMs), subprocessor transparency, and ISO 27001 certification documents for your third-party risk and outsourcing assessment. We also support institution-specific DORA and banking secrecy addenda in coordination with your compliance and legal teams.
Can employees process customer and credit data in Omnifact?
Yes. Omnifact's integrated Privacy Filter uses rule-based and AI-powered detection to pseudonymize personal data such as client names, IBANs, and contact details before a prompt reaches an AI model. Contractual Zero Data Retention with EU-hosted models ensures that inputs and outputs are never stored by model providers or used for training.
Where does Omnifact host and process financial data?
Omnifact is operated in ISO 27001-certified datacenters in Germany. Administrators control per user group which AI models from OpenAI, Anthropic, Mistral, or Google are available, allowing you to restrict teams strictly to EU-hosted models. For institutions with dedicated infrastructure requirements, private cloud and on-premises deployments are also available.
See how Omnifact fits your regulatory requirements
Walk through realistic financial services workflows with our team, from DORA contract checks to credit policy research. Bring your outsourcing checklist and test how Omnifact handles your requirements.