AI in banking and insurance, designed for DORA requirements and justifiable to an auditor.
AI consulting and agent deployment for banks, insurers and fintechs. Sovereign architecture, encryption, full audit trail, MCP credential isolation, prompt injection defence. An approach designed to meet the requirements of DORA and PCI DSS, the expectations of the ACPR and the EBA, and your internal cybersecurity rules.
Colombani.ai supports banks, insurers and fintechs deploying AI agents designed to meet the requirements of DORA and PCI DSS and the expectations of the ACPR and the EBA. Each deployment rests on a sovereign architecture or a contracted European cloud. Data is encrypted, every agent decision is logged, system access is compartmentalised and the agent withstands manipulation attempts by its users. The documentation supervisors expect is part of the deliverable.
Use cases
Automated KYC and AML
Structured extraction of ID documents, document consistency checks, atypical transaction alerts. Auditable trail for Tracfin and ACPR. The final decision rests with the analyst.
ACPR / EBA / AMF compliance monitoring
Weekly synthesis of ACPR, EBA, AMF, DGCCRF publications relevant to your activities. Filtered by risk type (credit, market, operational). Sourced from official texts.
Financing contract review
Rapid facility agreement analysis, covenant extraction, atypical clause alerts. Used by financing teams pre-signing.
B2B client advisor assistant
Meeting preparation support, summary of the client's situation, monitoring of company life events. Without exposing card data or PSD2-covered information.
Ethics and regulatory framework
DORA, Digital Operational Resilience Act
Applicable since January 2025. Obligations: ICT risk management (including AI agents), resilience testing, major incident notification, governance and model risk register. Every Colombani.ai deployment includes documentation expected by the supervisor.
PCI DSS and payment data isolation
No card data must be sent to an LLM without prior tokenization. Solutions: agent restricted via MCP to systems outside the PCI perimeter, or pre-tokenization via a dedicated service before any AI processing.
ACPR / EBA / AMF, model governance
Supervisors require documentation of models in use, continuous performance evaluation, and demonstration of effective human oversight on material decisions. Colombani.ai produces this documentation alongside the deployment.
What we don't do
- Personalized financial advice: reserved for regulated advisors.
- Algorithmic trading: it calls for different expertise and a specific AMF framework.
- Automated credit scoring without human intervention: prohibited by GDPR art. 22.
- DORA certification of a third-party ICT service provider: certifications are issued by accredited bodies, not Colombani.ai.
How do we work with you?
Consulting: sectoral AI compliance
AI compliance audit against DORA, PCI DSS, ACPR, EBA, AMF, GDPR art. 22.
Solutions: AI agents and security
Banking and insurance AI agent plugins, AI-assisted security audits.
Training: AI for regulated teams
Training delivered by a Qualiopi-certified provider, eligible for OPCO Atlas funding, for banking and insurance teams.
Frequently asked questions
How do you ensure an AI agent does not leak card data? +
Two layers. First, the agent never has direct access to card data: MCP tools are scoped to systems outside the PCI perimeter or pass through a tokenization service. Second, a post-tool hook validates every agent output against card patterns before emission (DLP). Everything is logged and can be checked during an audit.
How do you meet DORA resilience testing for AI agents? +
Each plugin ships with a reproducible test suite covering: degradation scenarios (LLM unavailable, hallucinated response, tool timeout), load tests, adversarial injection tests. Results are documented and versioned for presentation to supervisors in case of inspection.
Can we use Claude in the cloud or must we stay on-premises? +
Depends on data classification. Public or already-anonymised data: Claude in the cloud (Anthropic or via EU Bedrock) acceptable with a data processing agreement. Sensitive or classified banking data: local Mistral, or Claude on a dedicated EU instance. Choice made at scoping.
Got a project in mind?
Describe your situation. The first 30-minute call is free. Get a frank response within one business day.