Com­pli­ance Soft­ware
for Banks

The com­pli­ance func­tion, anti-money laun­der­ing unit, in­form­a­tion se­cur­ity team, and in­tern­al re­port­ing office all operate on a shared data­base. Re­spons­ib­il­it­ies, meas­ures, and sup­port­ing doc­u­ment­a­tion can be linked across de­part­ments. This reduces du­plic­ate data entry and ensures con­sist­ent in­form­a­tion.

Ap­provals, con­trols, meas­ures, and pro­cessing steps are doc­u­mented in a trace­able manner. During in­tern­al and ex­tern­al audits—such as those con­duc­ted under Section 44 of the German Banking Act (KWG)—rel­ev­ant context and sup­port­ing doc­u­ment­a­tion are avail­able more quickly.

DORA sets re­quire­ments for ICT risk man­age­ment, the hand­ling of ICT-related in­cid­ents, and the man­age­ment of third-party ICT risks. With otris ISMS, you can manage risks, in­cid­ents, and cor­rect­ive actions; otris di­li­gence sup­ports risk-based audits of service pro­viders and the track­ing of cor­rect­ive actions.

With otris whis­tleblower, you can receive reports through a secure re­port­ing channel, enable an­onym­ous com­mu­nic­a­tion, and track feed­back, terms, and follow-up actions in a trans­par­ent manner. This helps ensure that reports are pro­cessed in ac­cord­ance with the Whis­tleblower Pro­tec­tion Act.

With otris policy, you can create and approve new ver­sions through stand­ard­ized pro­cesses. You can dis­trib­ute policies to spe­cif­ic re­cip­i­ents, collect ac­know­ledg­ments of receipt, and use the re­port­ing feature to see which ac­know­ledg­ments are still pending.

The soft­ware is de­veloped by otris in Germany. For de­ploy­ment, you can choose between SaaS in ISO 27001-cer­ti­fied data centers in Germany and on-premises in your own in­fra­struc­ture.

otris copilot assists with the ana­lys­is, re­search, and clas­si­fic­a­tion of risk-related content. You decide on the AI pro­vider, model, and loc­a­tion of op­er­a­tion; the tech­nic­al de­cisions remain with the data con­trol­lers.

Com­pli­ance soft­ware for banks helps fin­an­cial in­sti­tu­tions manage key com­pli­ance and gov­ernance tasks in a struc­tured manner. These include, for example, policies, risk ana­lyses, reg­u­lat­ory ob­lig­a­tions, whis­tleblower reports, and in­form­a­tion se­cur­ity. Clear re­spons­ib­il­it­ies, stand­ard­ized pro­cesses, and veri­fi­able doc­u­ment­a­tion for in­tern­al and ex­tern­al audits are crucial.

No. The otris com­pli­ance SUITE does not offer trans­ac­tion mon­it­or­ing or sanc­tions list screen­ing. It sup­ple­ments ex­ist­ing anti-money laun­der­ing and banking systems by adding a gov­ernance and com­pli­ance doc­u­ment­a­tion layer—for example, through risk ana­lyses, policies, re­spons­ib­il­it­ies, meas­ures, and trans­par­ently doc­u­mented pro­cessing pro­ced­ures.

For MaRisk, reg­u­lat­ory re­quire­ments can be linked to data con­trol­lers, guidelines, con­trols, and meas­ures and doc­u­mented in a trace­able manner. In the context of DORA, otris ISMS sup­ports the man­age­ment of ICT risks, in­cid­ents, and meas­ures. With otris di­li­gence, service pro­viders can be as­sessed on a risk-based basis, and meas­ures and terms can be tracked. DORA ad­dresses both ICT risk man­age­ment and the man­age­ment of third-party ICT risks.

In a SaaS de­ploy­ment, hosting takes place in ISO 27001-cer­ti­fied data centers in Germany. Role-based access con­trols, logging, en­cryp­tion, and regular se­cur­ity audits help protect sens­it­ive data. Al­tern­at­ively, the soft­ware can be op­er­ated on-premises within the cus­tom­er’s own IT in­fra­struc­ture.

Yes. The spe­cial­ist solu­tions are based on the common doc­u­ment­sOS plat­form and can be in­teg­rated into ex­ist­ing system land­scapes via stand­ard­ized in­ter­faces, such as REST or CSV. This allows for the in­teg­ra­tion of master data, au­then­tic­a­tion, and re­port­ing systems, among other things. Single sign-on is also avail­able, de­pend­ing on the edition.