# Berlin DPA fines a bank, reported as DKB, €300,000 over an unexplained automated credit-card refusal Source: https://www.bankingnewsai.com/ai-incidents/dkb-2023-automated-credit-card-refusal-fine Last updated: Oct 21, 2026 Deutsche Kreditbank AG (DKB) · Governance finding · severity 2 of 5 On 31 May 2023 Berlin's data-protection commissioner (BlnBDI) announced a €300,000 fine against a bank for failing to explain an automated rejection of an online credit-card application. Per the regulator, the bank's algorithm, built on criteria and rules the bank had defined, rejected a customer with a good SCHUFA score and a regular high income without giving reasons, and the bank then refused to tell him why it assumed poor creditworthiness, breaching GDPR Articles 22(3), 5(1)(a) and 15(1)(h). The regulator did not name the bank; heise online reported it was Deutsche Kreditbank (DKB). The automated decision system was not described as AI. According to the regulator, the bank admitted the violation, had already changed its processes, cooperated fully and accepted the fine. ## Key facts | | | | --- | --- | | Date | May 31, 2023 | | Institution | Deutsche Kreditbank AG (DKB) | | Country | Germany | | AI system | Rules-based automated decision on online credit-card applications, using criteria and rules defined by the bank plus external data; not described as AI | | AI? | Automated system not described as AI — The system was automated, but neither the institution nor a regulator described it as AI; it is listed because it is routinely discussed as an AI failure. | | Category | Regulatory finding (Governance finding) | | Status | Regulator finding | | Severity | 2 of 5 — A regulatory finding with a €300,000 fine (under $1m) arising from one customer's complaint; the bank accepted the fine and changed its processes, and no wider customer harm was reported. | ## What happened? A customer applied for a credit card through the bank's online form, which asked for details of his income, occupation and identity. The Berlin commissioner said: "Anhand der abgefragten Informationen und zusätzlicher Daten aus externen Quellen lehnte der Bank-Algorithmus den Antrag des Kunden ohne besondere Begründung ab. Der Algorithmus basiert auf zuvor von der Bank definierten Kriterien und Regeln" ("Based on the information requested and additional data from external sources, the bank's algorithm rejected the customer's application without any particular justification. The algorithm is based on criteria and rules previously defined by the bank"; our translation). [1] Because he had a good SCHUFA credit score and a regular high income, the customer doubted the decision and asked for an explanation. According to the regulator, the bank gave only general information about its scoring procedure that was detached from his case and refused to say why it assumed poor creditworthiness, so he could not tell which data and factors had been used or meaningfully contest the automated decision. He then complained to the data-protection authority. [1][3] The commissioner found that the bank breached Article 22(3), Article 5(1)(a) and Article 15(1)(h) GDPR, the rules on safeguards for automated individual decisions, transparency and the right to meaningful information about the logic involved. Commissioner Meike Kamp said a bank must tell customers the main reasons for an automated rejection, "including concrete information on the data basis and the decision factors as well as the criteria for the rejection in the individual case" (our translation). [1] The commissioner's release did not name the bank. heise online identified it as Deutsche Kreditbank (DKB), the Berlin-based subsidiary of Bayerische Landesbank, and netzpolitik.org repeated that identification, attributing it to heise. [2][3] ## Timeline - May 31, 2023 — The Berlin data-protection commissioner announces a €300,000 fine against a bank over the unexplained automated rejection of a credit-card application. [1] - May 31, 2023 — heise online reports that the fined bank is Deutsche Kreditbank (DKB). [2] - Jun 1, 2023 — netzpolitik.org reports the fine and the DKB identification, citing heise. [3] ## What was the impact? - Financial: €300,000 fine - Customers: One complainant whose credit-card application was rejected and who could not obtain the reasons; no other affected customers are counted in the record. [1] ## How did Deutsche Kreditbank AG (DKB) respond? No public statement by DKB found as of 2026-10-21 (we searched the regulator's release, German tech and finance press and DKB-related coverage). According to the Berlin commissioner, the bank admitted the violation, had already implemented changes to its processes and announced further improvements, cooperated fully and accepted the fine notice. [1][2] ## What was the outcome? The bank accepted the €300,000 fine notice. The commissioner set the amount with particular regard to the bank's high turnover and the deliberate design of the application process and of its information practice, and reduced it because the bank admitted the breach and changed its processes. [1] ## FAQ ### Why was the bank fined if automated credit decisions are legal? The Berlin commissioner did not object to automating the decision itself. The fine was for transparency: when the customer asked why his credit-card application was rejected, the bank gave only generic information about its scoring and refused to explain his case, breaching GDPR Articles 22(3), 5(1)(a) and 15(1)(h). ### Was the system that rejected the application AI? It was not described as AI. The regulator called it an algorithm based on criteria and rules defined in advance by the bank, which combined the applicant's form data with data from external sources and decided without human involvement. We classify it as automation, not AI. ### Which bank was fined? The Berlin data-protection commissioner did not name the bank. heise online reported that it was Deutsche Kreditbank (DKB), the Berlin-based subsidiary of Bayerische Landesbank, and netzpolitik.org repeated that identification. We found no public statement by DKB about the fine as of October 2026. ### What did the bank change? According to the regulator, the bank admitted the violation, had already changed its processes and announced further improvements, which reduced the fine. The specific changes to its credit-card decision process or its explanations to rejected applicants have not been published. ## Sources 1. [Computer sagt Nein: 300.000 Euro Bußgeld gegen Bank nach mangelnder Transparenz über automatisierte Ablehnung eines Kreditkartenantrags](https://www.datenschutz-berlin.de/pressemitteilung/computer-sagt-nein) — Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), May 31, 2023 (official): "Die Datenschutzbeauftragte hat festgestellt, dass die Bank in dem konkreten Fall gegen Art. 22 Abs. 3, Art. 5 Abs. 1 lit. a und Art. 15 Abs. 1 lit. h DSGVO verstoßen hat." 2. [DSGVO-Verstoß: Bank muss wegen automatisierter Kreditabsage zahlen](https://www.heise.de/news/DSGVO-Verstoss-Berliner-Bank-muss-wegen-automatisierter-Kreditabsage-zahlen-9103167.html) — heise online, May 31, 2023 (news): "Mangelnde Aufklärung rund um die automatisierte Ablehnung eines Antrags auf Erhalt einer Kreditkarte kommt die Deutsche Kreditbank (DKB) teuer zu stehen." 3. [300.000 Euro Bußgeld gegen Bank wegen automatisierter Entscheidung](https://netzpolitik.org/2023/datenschutzgrundverordnung-300-000-euro-bussgeld-gegen-bank-wegen-automatisierter-entscheidung/) — netzpolitik.org, Jun 1, 2023 (news): "Bei der Bank, die in der Pressemitteilung nicht namentlich genannt wird, soll es sich laut Heise.de um die DKB handeln." All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents --- Canonical page: https://www.bankingnewsai.com/ai-incidents/dkb-2023-automated-credit-card-refusal-fine Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.