Banking transactions at Fidor: Data retention and long-term archiving

Fidor Bank
Future-proof data architecture with a self-service archive and GDPR-compliant deletion logic

At a glance

Client: Fidor Bank AG (a subsidiary of Groupe BPCE), legal data Schröder Rechtsanwaltsgesellschaft mbH (as data trustee)
Sector: Financial services/banking
Challenge: Ensuring long-term data retention and GDPR-compliant deletion of data following the cessation of banking operations
Solution: Implementation of a modular storage architecture with INFONEA® as a self-service data platform, validated deletion logic and legally compliant implementation of all regulatory requirements
Results: Automated, secure and traceable deletion processes, audit-proof data management, efficient data retrieval with minimal operational resource requirements

Challenge
A bank closes – the data remains

Following the decision by the parent company BPCE to close Fidor Bank completely, we were faced with a rare and extremely complex task: how to retain all of a bank’s important data in compliance with the law for ten years – whilst simultaneously dismantling the operational IT infrastructure and ensuring maximum cost-efficiency? This is because the bank (or its successor and data trustee) must remain able to provide information to customers, staff and the authorities even after the licence has been surrendered. At the same time, the original experts are no longer available, and continuing to operate the IT systems would have entailed considerable operational and infrastructure costs.

The operational decommissioning and regulatory winding-up of the bank presented us with a number of key data-related challenges. We therefore had to have all banking data – relating to customers, staff and internal processes – professionally assessed by Fidor, processed, stored and assigned specific retention periods. This had to be done in such a way that information could still be provided in five years’ time – even by people who are not currently part of the project and who have never been involved in the bank’s day-to-day operations.

Approach
Bringing structure to a complex environment

Our multidisciplinary approach combined methodological clarity with technical depth:

Working with Fidor Bank, we identified all relevant data from hundreds of source systems, totalling several hundred terabytes. The result: a drastic reduction to around 45 systems and ‘just’ ten terabytes of raw data – prioritised according to business needs and compliant with regulatory requirements. This was based on a structured assessment framework with clear decision-making criteria for each data package.
Our centralised solution: a ‘data repository’ with self-service functionality based on our INFONEA® BI platform. This enables the data trustee to respond to even complex requests for information – from account holders and auditors, through to public authorities and former employees – quickly, transparently and in an audit-proof manner. No technical expertise is required, thanks to clear user guidance and maximum transparency – all based on carefully prepared and subject-matter-linked data. Our data expertise was crucial here: it was only through the targeted processing and modelling of the heterogeneous source systems that the self-service function could be made possible in the first place. The enquiries themselves are answered by the data trustee – that is, by people who have never been actively involved in the bank’s day-to-day operations, but who can nevertheless find all the relevant information thanks to INFONEA.
To ensure that all data can be deleted at the correct time and in a legally compliant manner, we have determined an individual expiry date for each data record – as the basis for subsequent deletion by year. Beyond that, our focus was on quality assurance: using randomised checksums, automated verification procedures and systematic link analyses, we ensured that all business scenarios were correctly mapped. Validation took place across various stages – both technical and business-related – in collaboration with the Fidor Bank project team.
FI-TS came on board as a further technology partner to ensure the reliable and regulatory-compliant long-term archiving of banking data: the FI-TS data centre provides the technical infrastructure for storage, access and security – including backup mechanisms and access protection. A key element is the so-called WORM status for sensitive data (‘Write Once, Read Many’). This ensures that data is stored once and can subsequently only be read, without being physically altered – a key component for audit compliance and legally sound reporting. Together with Fidor and FI-TS, we were able to design the storage solution so that it is not only secure but also suitable for day-to-day use: with traceable access, stored in an unalterable format and ready for subsequent deletion.

Working with Comma Soft was constructive throughout – the combination of drive, expertise and a hands-on approach made all the difference.

Sebastian Birkett, CFO at Fidor

Results and benefits
Future-proof, legally compliant, efficient

The solution has proven its worth from a technical perspective and also reflects key values: responsibility, pragmatism and trust.

Modular and scalable: Storage architecture with clearly separated deletion years – minimises complexity and costs.
Legal certainty included: GDPR- and BaFin-compliant – even in exceptional or special cases.
Intuitive to use: Self-service interface with high user acceptance – no training required, with clear data logic.
Sustainably documented: Knowledge management for the next ten years – independent of individual persons and compatible with new data controllers.
Validated data basis: Technically sound deletion logic and systematically verified data links.

The Fidor case study demonstrates what sets Comma Soft apart: when there is no blueprint, we create one. When technical, legal and human complexities converge, we create clarity and work together to find solutions that are both excellent and pragmatic. Our experience, our INFONEA® product and our commitment to quality have made all the difference – and have strengthened the trust of all project partners in the long term. This is reflected in the feedback from our client, as well as that from the data trustee, legal data:

INFONEA® is intuitive to use – we’ve been able to use it to respond to all enquiries reliably right from day one.

Georg Schröder, founder and managing director of legal data