In fit-and-proper and reliability decisions, what counts vis-à-vis BaFin (the German Federal Financial Supervisory Authority), internal audit and in litigation is not that a check was performed — but whether the decision is traceably documented and owned by a qualified person. A database hit without an assessment is no evidence; an assessment without sources is no basis. That is why, for these decisions, neither software alone nor the pure gut feeling of an experienced reviewer suffices: it takes both, in one process — the hybrid approach.
The Standard: Evidence, Not Just Screening
The evidentiary logic is embedded in supervisory law. The appointment notification under § 24 (1) no. 1 KWG (German Banking Act) requires the facts that are material to assessing reliability — not the output of a database query, but a reasoned assessment. Substantively, § 25c (1) KWG for managing directors and § 25d (1) KWG for administrative and supervisory bodies set the standards for reliability and expertise; for the workforce, § 6 (2) no. 5 GwG (German Anti-Money Laundering Act) requires the reliability screening as an internal safeguard. What all these provisions have in common: responsibility for the assessment rests with the institution and cannot be delegated to an algorithm. What preparing the appointment notification looks like in concrete terms is shown in our article on Fit & Proper at BaFin.
What Software Delivers — and Where It Ends
Software is indispensable in reliability screening: it makes checks repeatable, covers registers, sanctions lists and media at a breadth unattainable manually, and produces consistent documentation. The requirements a tool must meet for this are described in our requirements catalogue for screening software. But software ends where the decision begins: is the name match really the same person? Is a ten-year-old press report still relevant for this function? How does a conflict of interest weigh against an otherwise flawless career? No hit list answers these questions — they demand a qualified human assessment that can, if needed, be defended before the supervisory authority. A pure tool output without this assessment layer merely postpones the real work: to the moment when internal audit or BaFin asks who evaluated the hit.
Three Models Compared
Before choosing a provider, there are in practice three operating models:
- In-house: full control, but limited sources, knowledge tied to individuals and inconsistent documentation — hard to scale and vulnerable in an audit.
- Full outsourcing: relieves operations, but responsibility remains with the institution; moreover, the service provider itself becomes a third party for which Art. 28 of Regulation (EU) 2022/2554 (DORA) requires pre-contractual due diligence and ongoing oversight.
- Hybrid: software delivers breadth, repeatability and dated sources; a qualified person reviews, assesses and owns the result. The institution gets both — scale and a decision with a named owner.
“A decision you can defend”: Indicium’s Hybrid Approach
Exactly this third model is the core of Indicium. Every report combines software-based screening across defined categories with a human final review before delivery — not a fully automated individual decision within the meaning of Art. 22 GDPR, but an assessment owned by humans. Every finding is supported by a dated source, so the report can go unaltered to internal audit or the supervisory authority. The result is what the brand promises: “a decision you can defend” — a decision you can defend vis-à-vis BaFin, internal audit and in litigation. For particularly exposed appointments — managing directors, supervisory board members, key functions — our hybrid boutique model combines the standardised report with in-depth case-by-case research. Reports start at €79, transparently itemised under Pricing.
Recommended Course of Action
Put three questions to every provider — including us: who owns the assessment of a hit? How is each finding evidenced and dated? And can the report be submitted to the supervisory authority unaltered? If any of the answers is “the system does that”, scrutinise carefully. The fastest way to see how Indicium answers these three questions is a demo.
This article provides general information and does not constitute legal advice.