Finance and Fintech

Compliance requirements for the financial sector and fintech.

---

Sector Profile

Attribute	Value
AI Act impact	CRITICAL (High-Risk)
NIS2 category	Essential (Annex I — Banking)
GDPR impact	HIGH
Other regulations	PSD2, DORA, AML, MiFID II

---

AI Act for Finance

High-Risk AI Systems (Annex III)

System	Classification	Obligations
Credit scoring	HIGH-RISK	Full obligations
Fraud detection	HIGH-RISK	DPIA, explainability
AML screening	HIGH-RISK	Human oversight
Algorithmic trading	MEDIUM	Monitoring, testing
Customer service chatbot	MEDIUM	Transparency
Risk assessment	HIGH-RISK	Documentation

Credit Scoring Specifics

Credit Scoring AI — requirements

AI ACT OBLIGATIONS

• Risk classification: HIGH-RISK
• DPIA mandatory
• Bias testing (gender, age, ethnicity)
• Explainability (why it was declined)
• Human appeal process

GDPR OBLIGATIONS (Art. 22)

• Right not to be subject to automated decision-making
• Right to explanation
• Right to human review
• Information about the decision logic

DOCUMENTATION

• Model card (training data, features, performance)
• Fairness metrics per demographic group
• Decision audit trail
• Regular re-validation reports

---

NIS2 + DORA for Finance

DORA = Lex Specialis

The financial sector is subject to DORA (Digital Operational Resilience Act), which is lex specialis and supersedes NIS2 for ICT risk management in the financial sector.

Requirement	NIS2	DORA
ICT Risk Management	Yes	Yes (more detailed)
Incident Reporting	24-72h	4h initial, 72h full
Testing	Penetration testing	TLPT (Threat-Led)
Third-party risk	Vendor audit	ICT concentration risk
Resilience	Business continuity	Operational resilience

DORA Timeline

• 17 January 2025: DORA fully applicable (NOW!)
• 30 April 2025: ICT third-party registers submitted to ESAs
• Ongoing: Supervision by national competent authorities

Key DORA Requirements

Area	Requirement	Priority
ICT Risk Framework	Documented risk management	Critical
Incident classification	Criteria for major incidents	Critical
TLPT	Threat-led penetration testing	Critical
ICT third-party	Register of all ICT providers	Critical
Exit strategies	Plan for replacing critical vendors	High
Resilience testing	Annual testing, stress scenarios	High

---

GDPR for Finance

Specific Areas

Area	Requirement	Legal basis
KYC data	Customer identification	Legal obligation (AML)
Transaction data	Payment history	Contract
Credit history	Scoring, risk assessment	Legitimate interest + consent
Marketing data	Cross-selling, offers	Consent
Fraud data	Fraud prevention	Legitimate interest

Retention Periods

Data type	Retention	Legal basis
KYC/AML data	10 years after relationship ends	AML legislation
Transaction records	10 years	Accounting regulations
Credit decisions	5 years	Internal rules
Marketing consent	Until revoked	GDPR
Fraud alerts	5 years	Legitimate interest

DSAR in Finance

DSAR in finance — client rights

Client has the right to:

• Copy of all data (transactions, communications, scoring)
• Explanation of credit decision (AI explainability)
• Correction of inaccurate data
• Erasure (limited by AML obligations)
• Portability (export transactions)

Limitations:

• AML data cannot be erased during retention period
• Fraud prevention data (legitimate interest)
• Regulatory requirements

---

PSD2 Specifics

Open Banking

Requirement	Description
SCA	Strong Customer Authentication
API access	TPP (Third Party Provider) access
Consent management	Granular consents for data sharing
Fraud monitoring	Real-time transaction monitoring

AI in PSD2

AI in Open Banking

Typical use cases:

• Transaction risk scoring (SCA exemptions)
• Fraud detection (real-time)
• Customer behavior analysis
• AML screening

Compliance:

• Explainability for SCA decisions
• Audit trail for API access
• Consent management for data sharing

---

Checklist for Finance

Immediate (Weeks 1-2)

• AI inventory (credit scoring, fraud, AML)
• DORA gap assessment
• ICT third-party register

Short-term (Months 1-3)

• High-risk AI DPIA
• Incident classification criteria
• ICT risk framework update

Medium-term (Months 3-6)

• TLPT planning
• Credit scoring explainability
• Vendor exit strategies

Long-term (Months 6-12)

• Full DORA compliance
• AI Act high-risk compliance
• Operational resilience testing

---

Typical Costs

Item	Estimate
DORA compliance program	EUR 100-200k
AI compliance (credit scoring)	EUR 30-50k
TLPT (threat-led pen testing)	EUR 50-100k
ICT risk framework	EUR 30-50k
Third-party due diligence	EUR 20-40k
Total Y1	EUR 230-440k

---

Resources

• DORA Regulation
• EBA AI Guidelines
• PSD2 Directive