An AI chatbot for banks answers recurring customer questions around the clock, relieves support teams, and fully complies with the requirements of the GDPR, the EU AI Act, and financial supervisory authorities. For banks, both matter: tangibly better customer service and an architecture that withstands regulatory scrutiny. This guide outlines the key use cases, regulatory obligations, and criteria for vendor selection.

At a Glance

• 24/7 Availability: Standard inquiries such as onboarding, login credentials, or product information are automated—even outside regular service hours.

• Data processing exclusively within the EU, with no third-country transfers.

• Traceable answers from verified sources, with controlled handovers to human agents.

• No automated credit decisions made by the bot; such cases require human judgment.

• Regulatory framework: GDPR, EU AI Act, MaRisk outsourcing guidelines, and DORA.

• Proven in production at Volkswagen Bank.

Why Banks Rely on Conversational AI

Banking customers expect immediate answers at any time of day. A large proportion of direct banking inquiries are repetitive: initial online banking login, questions about credentials and PhotoTAN, card-related issues, product terms, or the status of an application. These topics tie up service capacity without requiring personalized financial advice.

An AI chatbot handles precisely these recurring cases. This lowers the cost per contact, reduces wait times, and keeps phone and written support channels free for cases that require genuine human advisory. Studies show that employees spend a significant part of their time merely searching for information. Depending on the subject area, up to 90 percent of standard inquiries can be answered automatically.

Key Banking Use Cases

• Onboarding and Initial Registration: Step-by-step assistance for first-time online banking logins and PhotoTAN setup.

• Access and Security: Guidance on locked accounts, password resets, and security procedures without collecting sensitive data in an uncontrolled manner.

• Product and Terms Inquiries: Information on accounts, loans, cards, and interest rates based on approved product documentation.

• Status Inquiries: Updates on the status of a request or application via backend system integration.

• Handoff to Human Advisors: For complex or regulatory sensitive topics, the bot transfers the conversation—including full chat history—to an agent in the Agent Desk.

The boundary of the use case is critical. A service chatbot answers questions and routes inquiries. It does not make creditworthiness or lending decisions regarding individuals, as such decisions are subject to much stricter regulatory requirements.

In Banking, Compliance Is Table Stakes

In no industry does regulation carry more weight than in the financial sector. A banking chatbot must meet requirements across four levels:

1. GDPR: Legal basis, data minimization, data processing agreements (DPA), and data subject rights. The fundamentals are summarized in our article on GDPR- and EU AI Act-compliant AI chatbots.

2. EU AI Act: Transparency obligation under Art. 50, ensuring customers are aware they are interacting with AI. Service chatbots are generally not classified as high-risk systems, whereas automated creditworthiness assessments are. The operator defines the intended purpose.

3. MaRisk and BAIT: Deploying an external platform constitutes an outsourcing arrangement. It must integrate into the bank's outsourcing management framework, complete with clear responsibilities, audit rights, and full traceability.

4. DORA: The Digital Operational Resilience Act treats the provider as an ICT third-party service provider. Requirements include resilient operations, documented processes, and support with incident reporting.

Data residency is often a knock-out criterion. Processing data outside the EU is legally vulnerable under data protection laws and rarely permitted in tenders by regulated institutions. Learn why in our article on chatbot hosting in Germany.

What Banks Should Look for When Choosing a Provider

• Processing Location and Data Flows: Is all data processed exclusively within the EU, including the language model?

• Data Processing Agreements: How short and EU-centric is the list of sub-processors?

• Traceability: Can every response be traced back to its verified source?

• Audit and Governance: Are comprehensive audit logging, role-based access control, and regular penetration tests in place?

• Escalation: How reliably does the bot hand over to a human agent when an inquiry exceeds predefined boundaries?

• Documentation: Does the vendor provide the necessary documentation for DPAs, DPIAs, outsourcing compliance, and EU AI Act conformity?

How Mercury.ai Implements This for Banking

Mercury.ai is the German conversational AI platform designed specifically for regulated industries:

• Hosting exclusively in Germany (AWS Frankfurt), with no third-country transfers, featuring encryption in transit and at rest.

• A single sub-processor, simplifying outsourcing governance and DPA management.

• European, self-hosted models without API calls to external third-party providers.

• Hybrid AI grounded in verified knowledge: Answers are generated strictly from the bank's approved sources. The risk of hallucination is minimized, and every response remains fully traceable to its source. Learn more about the underlying technology in Mercury Intelligence.

• Operational Security: Multi-tenant isolation, two-factor authentication, full audit logging, and regular penetration testing. The data centers used are ISO 27001-certified; Mercury.ai aligns with ISO 27001 standards.

“Implementation on our websites is straightforward and does not require extensive technical expertise.”

Mario Prüßner, Volkswagen Bank GmbH

Volkswagen Bank: Conversational Banking in Practice

Volkswagen Bank utilizes Mercury.ai in customer service to automate a wide range of recurring inquiries around the clock—such as initial online banking registration, PhotoTAN activation, and login credentials. The business case is compelling, and customer satisfaction has increased thanks to 24/7 availability. This example demonstrates that automation and regulatory diligence can be successfully combined in banking. The article Risk-Free Conversational Banking outlines the risks of generic AI in the financial sector.

Frequently Asked Questions (FAQ)

Is an AI chatbot for banks GDPR-compliant?

This depends on its architecture. A chatbot is compliant if it processes personal data on a valid legal basis exclusively within the EU, includes a data processing agreement, does not use customer data to train third-party models, and transparently informs customers about the use of AI.

Which tasks should a banking chatbot not handle?

Automated decisions regarding creditworthiness or other high-stakes individual determinations should never be left solely to a bot. Such cases are highly sensitive from a regulatory standpoint and must be transferred to human staff.

How does a chatbot provider align with MaRisk and DORA?

Using an external platform constitutes both an outsourcing arrangement and an ICT third-party service provider relationship. The provider must offer the necessary audit rights, certifications, and operational resilience required for the bank to incorporate them into its outsourcing and resilience management frameworks.

How long does implementation take?

Depending on the scope and integration with backend systems, an initial production use case can be deployed within a few weeks. The knowledge base can then be expanded continuously.

Conclusion

An AI chatbot provides banks with customer service that is available around the clock while relieving teams of routine inquiries. To succeed, the solution must align with regulatory requirements from day one: data processing within the EU, verifiable answers, structured outsourcing compliance, and clear boundaries separating service from consequential decisions. Evaluating providers against these criteria ensures automated service while remaining on the safe side of compliance.

Interested in seeing what Conversational Banking looks like for your institution? Get in touch with us or download our EU AI Act Security Whitepaper.