Frequently asked
questions

Pandect is a Regulatory Operations company for financial institutions. We make regulatory requirements workable in day to day operations, change workflows to support them and take on recurring specialist work through to a verifiable result. Our focus is on midsized banks, regional banks, private banks and investment firms.

We take on clearly defined regulatory processes, analyse how they actually run, design the changes needed and implement the operation so it works in day-to-day use.

Our focus is on midsized banks, regional banks, private banks and investment firms. The starting point is a concrete regulatory task that ties up specialist capacity or does not work reliably in practice. We assess together, case by case, whether and to what extent Pandect can help.

Examples include digital resilience and ICT under DORA, investment services and investor protection under MiFID II, and crypto services under MiCAR. They also include AML, provider oversight, outsourcing, safeguarding client assets and implementing regulatory changes. Relevant requirements and processes depend on your institution’s authorisation, business model and specific needs.

With a clearly defined process. We examine real cases, systems, responsibilities and existing controls to identify where the required state and actual execution diverge.

Pandect builds on what already works and takes over where requirements and systems need to translate into concrete execution.

Pandect handles most of the implementation. We need targeted input from your teams: process knowledge, access to relevant data and key decisions. We carry out the analysis, coordination and technical implementation. Before we start, we agree when and how much support we need, keeping your internal effort manageable and predictable.

The target state is tested against real cases and given clear outcome criteria. Only when the new way of working proves effective is it brought into operation.

No. Existing systems and data sources are retained wherever they serve their purpose. We change or add only what is needed for a reliable workflow.

Institutional responsibility stays with the institution. Pandect can prepare, structure, assess and execute work, but material decisions remain with the people responsible for them.

The operation is continually adapted to new requirements, local market conditions and product-specific characteristics. Where requirements leave room for interpretation, specialist expertise is deliberately brought into execution.

Not from a closed ticket. What matters is whether the defined state is achieved, the necessary evidence is in place and the result can be verified under real conditions.

Pandect can run directly within the institution’s infrastructure, including on-premises and isolated environments where required.

Only when explicitly planned and approved. The aim is to avoid unnecessary data transfers and keep sensitive regulatory work under institutional control.

Yes, where it helps interpret unstructured information or make specialist assessments. Deterministic workflows, controls and state logic remain clearly traceable.

Not without explicit authorisation. Customer data and institutional logic should remain under the control of the respective institution.

The effort depends on the process, its complexity, the systems involved and the scope of ongoing delivery. The scope of service is therefore clearly defined for each operation.

Yes. We deliberately start with a clearly defined process. Only once it works does it make sense to add further operations.

That depends on scope, data availability and the systems involved. A clearly defined process can be validated and implemented much faster than an institution-wide transformation programme.