GOVERNED AGENT RUNTIME FOR REGULATED FINTECH

Deploy AI agents your supervisor can examine.

For banks, insurers, and regulated fintech-native institutions under DORA, EU AI Act Annex III, FCA, MiFID II, and SR 11-7. Every agent action authorized against policy before execution; the audit evidence written in the same transaction; verified offline on your auditor's machine.

Request a demo → Read the technical brief →

Why this matters now

DORA is in force in the EU as of January 2025. The examinations have begun. Article 5 (governance and organization) and Article 6 (ICT risk management framework) both require documented evidence of who authorized what, when, and under what policy. A chat transcript is not that evidence.

EU AI Act Annex III applies from December 2027. Article 12 (record-keeping), Article 14 (human oversight), and Article 15 (accuracy, robustness) each require artifacts a probabilistic runtime does not produce on its own. The interval between now and December 2027 is the window in which a regulated fintech can either build the substrate itself, buy it, or defer AI-agent deployment for another year. Building it in-house means integrating a runtime, an observability platform, an identity layer, a policy engine and a bespoke audit store — five separate systems, each with its own store, process and failure mode — before the first agent ships.

Orkena is the substrate. What follows is how it maps to the regime you are examined against.

How Orkena maps to the fintech regime

Regulation	What it requires	What Orkena provides
DORA Art. 5 (governance)	Documented governance and control framework for ICT	Policy-as-code applied at every action; hash-chained ledger of every authorization decision; evidence bundles exportable on request
DORA Art. 6 (risk mgmt)	ICT risk management framework with documented controls	In-process policy evaluation on every tool call, model call, and credential use; deterministic replay of any run for post-incident review
DORA Art. 11 (operational resilience)	Emergency response and recovery	Four-tier kill switch (org / workspace / graph / agent); durable executor survives infrastructure failure; three-region HA validated in test
EU AI Act Art. 12 (logging)	Comprehensive record-keeping for high-risk AI	Per-tenant hash-chained ledger with Ed25519 signed anchors; every action, authorization, approval, and administrative event captured
EU AI Act Art. 14 (oversight)	Human oversight controls	Four-eyes approval gates with quorum, SLA, and escalation; conflict-of-interest blocking (self-approval, same-team)
EU AI Act Art. 15 (accuracy)	Accuracy, robustness, cybersecurity	Evaluation-gated promotion — no version reaches production without passing the regression suite; policy denies irreversible actions from tainted inputs
MiFID II algorithmic-trading review	Ability to review algorithmic decisions	Deterministic replay + time-travel fork; every non-deterministic input (model response, tool result, timestamp) captured
SR 11-7 (model risk mgmt — US)	Model validation, monitoring, and governance	Version-controlled agent workflows; regression eval suites; drift detection with alert routing

Honesty note: Orkena is not certified against these frameworks on your behalf. It produces the runtime controls and the evidence your own DORA supervisor, FCA reviewer, or BaFin auditor requires. Certification is between you and your certifier.

Four fintech use cases Orkena runs today

1. Refund approval workflow (retail banking / e-commerce).

Agent triages incoming refund requests, proposes a decision, escalates to human approval above a threshold. Four-eyes required for refunds over EUR 5,000. Every decision recorded with the input, the policy that fired, the approver, and the outcome. Evidence bundle exportable on request.

2. AML case triage (financial crime).

Agent enriches AML alerts with context from downstream systems, proposes a priority tier. Human oversight required before any action affecting a customer (freeze, hold, review escalation). Policy denies external tool calls when data contains PII flagged for jurisdiction restrictions.

3. Trade surveillance case-review (broker-dealer).

Agent reviews surveillance alerts, applies house rules, proposes escalation or dismissal. Every decision replay-able against the exact market state and data snapshot at the moment of decision. MiFID II algorithmic-review-ready.

4. Prior-authorization-adjacent workflows (insurers).

Agent evaluates member requests against policy, routes to human approver on threshold exceedances. Full audit trail for state insurance regulator examinations.

For each, the same substrate: authorize before execution, evidence in the same transaction, deterministic replay, evaluation-gated updates.

The demo you will see

A live policy denial. An agent proposes a refund. The policy engine denies it in single-digit milliseconds because the input was derived from an untrusted source (a customer email). The denial appears on the canvas before any downstream system is touched.
A four-eyes approval. A gate opens; an approver on their phone (Face ID) approves; the canvas advances in real-time. The initiator cannot approve their own request; the same-team block is visible in the UI.
A time-travel fork. A completed run is opened; one variable is edited; a fork is created; both runs are linked in the ledger with identical inputs except the changed variable. Model-risk officers watch this demo carefully.
An evidence bundle verified offline. You export the bundle; run verify.py bundle.zip on your laptop; get RESULT: OK. The bundle is then tampered with; the same script returns RESULT: FAILED — hash mismatch at SEQ 0212.

At the end, you receive the bundle from the demo run for offline verification on your own machine.

What Orkena is not for you (in fintech)

Being explicit prevents misplaced expectations:

Not a model gateway. Orkena is model-agnostic across Anthropic, OpenAI, Azure OpenAI, and other providers you already use. It does not hold your model credentials or sit in the inference path.
Not an observability platform. Orkena integrates with your OpenTelemetry + Datadog + Grafana stack. It emits the events; you graph them.
Not a compliance certifier. Orkena produces the runtime controls and the evidence. Your DORA supervisor, your model-risk committee, and your auditor interpret them.
Not for consumer-scale volume. Orkena is designed for the workflow volume of a regulated institution's mid-to-back-office (thousands to millions of runs per month), not for consumer chat scale.
Not shipping SOC 2 Type II today. SOC 2 readiness is in progress; audit engagement is planned. Design partners receive controls implementation details ahead of the report; general availability follows the audit.