Deutsche Kreditbank AG (DKB) · Governance finding · severity 2 of 5
On 31 May 2023 Berlin's data-protection commissioner (BlnBDI) announced a €300,000 fine against a bank for failing to explain an automated rejection of an online credit-card application. Per the regulator, the bank's algorithm, built on criteria and rules the bank had defined, rejected a customer with a good SCHUFA score and a regular high income without giving reasons, and the bank then refused to tell him why it assumed poor creditworthiness, breaching GDPR Articles 22(3), 5(1)(a) and 15(1)(h). The regulator did not name the bank; heise online reported it was Deutsche Kreditbank (DKB). The automated decision system was not described as AI. According to the regulator, the bank admitted the violation, had already changed its processes, cooperated fully and accepted the fine.
Record last reviewed Oct 21, 2026 · Markdown
Date
Institution
Deutsche Kreditbank AG (DKB)
Country
Germany
AI system
Rules-based automated decision on online credit-card applications, using criteria and rules defined by the bank plus external data; not described as AI
AI?
Automated system not described as AI
The system was automated, but neither the institution nor a regulator described it as AI; it is listed because it is routinely discussed as an AI failure.
Category
Status
Regulator finding
Severity
2 of 5
Impact
€300,000 fine · One complainant whose credit-card application was rejected and who could not obtain the reasons; no other affected customers are counted in the record.
What happened?
A customer applied for a credit card through the bank's online form, which asked for details of his income, occupation and identity. The Berlin commissioner said: "Anhand der abgefragten Informationen und zusätzlicher Daten aus externen Quellen lehnte der Bank-Algorithmus den Antrag des Kunden ohne besondere Begründung ab. Der Algorithmus basiert auf zuvor von der Bank definierten Kriterien und Regeln" ("Based on the information requested and additional data from external sources, the bank's algorithm rejected the customer's application without any particular justification. The algorithm is based on criteria and rules previously defined by the bank"; our translation).[1]
Because he had a good SCHUFA credit score and a regular high income, the customer doubted the decision and asked for an explanation. According to the regulator, the bank gave only general information about its scoring procedure that was detached from his case and refused to say why it assumed poor creditworthiness, so he could not tell which data and factors had been used or meaningfully contest the automated decision. He then complained to the data-protection authority.[1][3]
The commissioner found that the bank breached Article 22(3), Article 5(1)(a) and Article 15(1)(h) GDPR, the rules on safeguards for automated individual decisions, transparency and the right to meaningful information about the logic involved. Commissioner Meike Kamp said a bank must tell customers the main reasons for an automated rejection, "including concrete information on the data basis and the decision factors as well as the criteria for the rejection in the individual case" (our translation).[1]
The commissioner's release did not name the bank. heise online identified it as Deutsche Kreditbank (DKB), the Berlin-based subsidiary of Bayerische Landesbank, and netzpolitik.org repeated that identification, attributing it to heise.[2][3]
When did it happen?
- May 31, 2023
The Berlin data-protection commissioner announces a €300,000 fine against a bank over the unexplained automated rejection of a credit-card application.[1]
- May 31, 2023
heise online reports that the fined bank is Deutsche Kreditbank (DKB).[2]
- Jun 1, 2023
netzpolitik.org reports the fine and the DKB identification, citing heise.[3]
What was the impact?
- Financial: €300,000 fine[1]
- Customers: One complainant whose credit-card application was rejected and who could not obtain the reasons; no other affected customers are counted in the record.[1]
Severity 2 of 5: A regulatory finding with a €300,000 fine (under $1m) arising from one customer's complaint; the bank accepted the fine and changed its processes, and no wider customer harm was reported.
How did Deutsche Kreditbank AG (DKB) respond?
No public statement by DKB found as of 2026-10-21 (we searched the regulator's release, German tech and finance press and DKB-related coverage). According to the Berlin commissioner, the bank admitted the violation, had already implemented changes to its processes and announced further improvements, cooperated fully and accepted the fine notice.[1][2]
What was the outcome, and did regulators act?
The bank accepted the €300,000 fine notice. The commissioner set the amount with particular regard to the bank's high turnover and the deliberate design of the application process and of its information practice, and reduced it because the bank admitted the breach and changed its processes.[1]
Why was the bank fined if automated credit decisions are legal?
The Berlin commissioner did not object to automating the decision itself. The fine was for transparency: when the customer asked why his credit-card application was rejected, the bank gave only generic information about its scoring and refused to explain his case, breaching GDPR Articles 22(3), 5(1)(a) and 15(1)(h).
Was the system that rejected the application AI?
It was not described as AI. The regulator called it an algorithm based on criteria and rules defined in advance by the bank, which combined the applicant's form data with data from external sources and decided without human involvement. We classify it as automation, not AI.
Which bank was fined?
The Berlin data-protection commissioner did not name the bank. heise online reported that it was Deutsche Kreditbank (DKB), the Berlin-based subsidiary of Bayerische Landesbank, and netzpolitik.org repeated that identification. We found no public statement by DKB about the fine as of October 2026.
What did the bank change?
According to the regulator, the bank admitted the violation, had already changed its processes and announced further improvements, which reduced the fine. The specific changes to its credit-card decision process or its explanations to rejected applicants have not been published.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning