Anti-Money Laundering Experts

• Objective/Motivation: PAYONE urgently needs a 360° view of its customers. So far, PAYONE has had no company-wide master data strategy. It is not possible to identify customers across all relevant systems.

The organization is to be enabled to identify customers across all relevant systems. Establishing the basis for master data management at PAYONE

• Challenge: Due to company acquisitions, the system landscape is very heterogeneous. The company is highly dynamic and burdened with many system harmonization and integration projects, meaning that resource bottlenecks and changes in project priorities repeatedly create an almost impossible task.

Due to BaFin findings, the project has a central task and role. The first focus is the migration of all customers, including their AML/KYC data, from the master data backend systems to Salesforce. This is intended to resolve one of the largest findings and establish the corresponding ODD/EDD processes.

In addition, customer data must be harmonized in Salesforce. Previous migrations resulted in duplicate customer records in some cases. The aim is therefore to maintain only one customer in Salesforce and, using the relevant information from the backend systems, also be able to identify which products the customer uses and in which processing systems the customer obtains PAYONE services.

Project: ONE Customer

Budget: €1.5 million

Team: 10/30 employees (full-time/part-time); 4 vendors/providers

Integration: 8 (subsystems/interfaces)

Applications: Salesforce; SAP S4/HANA; in-house developments

Tools: MS Office; Jira, Confluence, SharePoint

Methods: Hands-on; Agile (SAFe); Prince2

The online service "Special Use of Streets and No-Parking Zone" was in a partially completed state. The following tasks had to be carried out to reach final completion:

• Preparation of an expert report on the status of the online service, and recommendations for action
• Ensuring that all LEIKAS to be used are available (service catalog / service descriptions of the authorities)
• Creating and aligning concepts for complex IT projects (business/IT concepts, architecture, interfaces, roadmaps)
• Requirements management
• Multi-project management with 3 stakeholders (Police, Dataport, development company)
• Determining resource needs
• Coordination to identify technical requirements through the IT architects
• Creating use cases and test cases
• Creating action items
• Managing external IT service providers
• Coordination and management of all activities
• Conflict resolution / business mediation
• User Acceptance Test (UAT) and acceptance by Hamburg Police (Traffic Directorate, Policy Department, Central Road Traffic Authority)

Technical environment: .NET, EfA minimum requirements, Leikas, Administrative Procedure Act (VwVfG), HWG (Hamburg Roads Act), Atlassian Jira, Confluence, MS Office

• Head of the group-wide, international, and cross-functional IT Governance & IAM department within the central IT division of a large French-German private banking group. Disciplinary management of around 30 employees at five different locations within the group (Frankfurt, Paris, Tunis, Saarbrücken, Düsseldorf). Head of IT committees and key role in direct communication with management, the supervisory board, external stakeholders, and regulators.
• Definition and establishment of a state-of-the-art IT strategy process and related IT governance structures for the group's IT department with more than 600 employees (testified by the German Federal Financial Supervisory Authority and the ACPR) and successful process run.
• Establishment of a new future-oriented process framework for IT and necessary governance structures (process squads) for the continuous improvement of IT processes with regard to new regulatory requirements (including DORA, EU AI Act, etc.).
• Establishment of stringent processes to close a historical backlog of findings (> 100 IT findings, 40 overdue findings in 2022) from internal and external auditors (WP, ACPR, BaFin). Successful reduction of stock of overdue findings to 0 at the end of 2025.
• Supporting more than 20 IT audits per year and establishment of regulatory monitoring processes. Introduction of ServiceNow to revolutionize regulatory change and IT compliance processes with advanced AI functionalities.
• Realignment of IT control processes in conjunction with the newly established ICT risk function under DORA and the three lines of defense concept using the TopEase GRC solution.
• Reduction of the application landscape, by systematically analysing the purpose with application and business owners, identifying duplicates while implementing a One-Tool Strategy throughout the group. Successful reduction of one third of the application landscape within the CMDB.
• Onboarding of all group applications into One Identity's group-wide IAM solution, as well as operation and further development of the solution in connection with segregation of duties (SoD), role-based access management (RBAC), etc.

Two complementary tracks: (a) building my own AI products and open-source tools under the Neckarshore AI brand, with a focus on AI-supported multi-agent development processes and documentation automation; (b) freelance support for industrial, logistics, and financial companies in IT-related transformation projects.

Current product portfolio under the Neckarshore AI brand:

• Omnopsis Documenter — AI-powered documentation engine: generates compliance, technical, and release documentation from Git, Jira, and Confluence. 500+ automated tests, 100+ API endpoints, RBAC, monitoring stack.
• TrustScope — trust analysis for public GitHub repos: deterministic three-pillar report (Security & Supply Chain, Governance, Community) based on OpenSSF Scorecard, with constructive fix suggestions instead of a single misleading score.
• md-viewer — dependency-free Markdown viewer for macOS (Finder Quick Action) and web, split view of rendered document and raw text.
• Obsidian Vault Autopilot — AI-supported vault automation for Obsidian × Claude Code: sorts the inbox, renames notes, enriches frontmatter.
• Phonesis Voice Bank — voice archive for families, hospices, and cultural archives (guided recordings, inheritable archive, optional voice cloning); currently in the GDPR compliance phase (Art. 9, biometric data).
• Multi-Agent Development Process — 12+ specialized agents (architecture, implementation, security, refactoring, marketing) with structured handoff protocol, parallel execution, and automated quality assurance — powers the entire product development.
• Freelance consulting: Technical Product Ownership for production, logistics, and compliance/AML systems; steering international rollouts including test, cutover, and change management.

Stack: NestJS, TypeScript, PostgreSQL, Redis/BullMQ, Next.js, Claude Code (Opus), Docker, GitHub Actions, Vercel

• Informing and advising on obligations under applicable data protection regulations
• Reviewing compliance with data protection regulations and the client’s strategies for protecting personal data through own audits
• Advising on and preparing data protection impact assessments as well as data protection notices and data protection guidelines and policies
• Drafting, advising on and negotiating data processing agreements
• Raising awareness among management and staff on data protection by creating training materials and concepts and delivering training sessions
• Industries include: financial services, healthcare, trades, mechanical engineering, recruitment, auditing and tax consulting

• Analysis and audit of the current situation on-site and at customer locations
• Planning of IT infrastructures and advice on new hardware purchases as well as migration planning
• Planning and management of the IT budget
• Configuration and support of IT hardware under Windows 7, 8.x, 10 and Mac OS
• Review and update of documentation with regard to GDPR
• Analysis and expansion of technical and organizational measures in accordance with GDPR and BDSG
• Training of employees
• Training in AI-Assistant Consulting and Cybersecurity with AI
• Recording the current state and planning the target state
• 2nd/3rd level support (C/S/N)
• Technical environment: Exchange Administration, Active Directory, MS Server 2016 R2, MS Server 2022, MS SQL Developer, MS SQL, Visual Studio 2013+, Tivoli Monitoring, Tivoli Remote, TeamViewer, weclapp CRM Solution, RA-Micro, IT Compliance, Citrix, UltraEdit, SCCM, Windows XP–11, Office 2010–M365, VPN Solutions, Lexware Solutions, OKI Management Solutions, LogMyTime, SAGE Systems

• Integration of Post-Quantum Cryptography (PQC) algorithms into high level protocols.
• Security of implementations of Post-Quantum Cryptography algorithms.
• Transition to Post-Quantum public key infrastructures.
• Security evaluations of Post-Quantum Cryptography (PQC) primitives.
• Drone Cybersecurity
• Satellite Cybersecurity
• AI Security

Implementation of anti-money laundering requirements in accordance with AMLA/KYC for an international large bank in Munich

Services provided:

• Clarification of the assignment, definition of the work package structure for the AMLA/KYC implementation project
• AI-supported project planning using my own AI workflow for project management
• Creation of the project management plan
• Resource and capacity planning
• Development of collaboration structures between IT service provider and bank client
• Alignment of responsibilities (RACI matrix)
• Management of 5 project members (core team)
• Project control, project monitoring, project reporting
• Communication management
• Escalation management
• Stakeholder management (11 stakeholders)
• Permanent member of the steering committee
• Project representation internally and externally
• Project reporting, management of decision-making bodies
• Project volume: 506 person-days (development effort)
• Risk management
• Quality management
• Organization and running of workshops

Methods: PMI PMBOK, EVM, GWG, DORA, BAIT, KANBAN, AML, AMLR, AMLA, GWG, KYC

IT environment: JIRA, Confluence, Sharepoint, Kantata Kimble, AI LLM Copilot, ChatGPT, anti-money laundering systems (in-house developments and SMARAGD)

• DORA consulting and system optimization
• Process analysis of existing business processes that are complex from both a business and technical point of view
• Analysis of the individual business processes in the relevant business areas Trading, Back Office, Settlement, Custodian Bank
• Interface between the business units and IT to understand and define requirements
• Creation of a business concept incl. adjustments and implementation of software applications and their interfaces to the systems
• Preparation of a decision template for the management board for project approval
• Setting up and running project meetings with the relevant stakeholders and documenting them
• Close collaboration with the stakeholders
• Coordination and control of the analysis
• Creation and planning of resources and budget
• Onboarding of large banks (Asia and Eastern Europe) for Depot B
• Migration of portfolio holdings (volume around EUR 70-100 million)

• Assist with the development of system requirements and specifications to ensure requirements are testable and 21 CFR Part 11 requirements are met
• Coach implementation teams in the proper execution of validation documents
• Evaluate proposed changes to validated computer systems and recommend level of validation activities required
• Coordinate audits of internal computer systems validation activities, protocols and procedures, and prepare responses
• Identify and qualify all computer systems impacting cGMP operations using a risk-based methodology
• Develop CFR Part 11 computer systems validation plans, qualification test protocols, traceability matrices, reports, IQ/OQ protocols and all deliverables within the scope of the validation plan
• Develop and maintain test plans, test scripts and user acceptance tests and manage their execution
• Act as CSV lead for all validation projects and execute or oversee validation plans and documents
• Perform project management activities for the CSV process within the scope of system projects
• Work with project manager to include validation activities in implementation timelines
• Manage internal CSV resources to facilitate completion of qualification activities
• Ensure initiation, preparation and closeout of all CSV-related deviations, discrepancies and change control documents
• Work closely with Validation Manager and QA Compliance to ensure appropriate validation of cGMP computer systems
• Conduct or facilitate validation and 21 CFR Part 11 training

• Data-analysis, Preparation, gathering and coordination of business requirements for retrieval of monthly- and long term (CLV – relevant) cost- and revenue-components per contract for a customer–base–grouping project (HUB–Project) for B2C-Postpaid-Controlling
• Concept and Implementation of cost- and revenue-KPIs calculation and corresponding CLV–reports (Oracle, Perl, SVN, MS SQL Server, MS Power BI, Serviceware Performance Analytics)
• Operational support of the HUB-Project – various ad-hoc reports, deployments, job-scheduling etc. (Oracle, SVN, BICSuite–Scheduler, DWSODA etc.)
• Analysis, implementation, retrieval and reporting of various physical and financial KPIs for B2P-Prepaid Business on an existing data-mart (Oracle, Perl)

• Create a tracking concept for Google Tag Manager and Google Analytics including data layer, events, triggers, and reporting
• Manage the project team (developers, designers, performance specialists)
• Serve as communication interface between stakeholders and digital departments

• Analyzed intensive longitudinal psychological data, uncovering latent behavioral trends.
• Applied Bayesian hierarchical models in R/JAGS; ensured robust parameter estimation and model convergence.
• Led data wrangling, transforming raw survey data into analysis-ready formats.
• Supported peer-reviewed publication through methodology design and statistical evaluation.

• Consulting, training, and coaching in the financial sector on strategy, organization, and IT topics

• MorgenFund: Advising the operator of a fund platform on software selection for a sub-ledger "Cash Accounts" based on Virtual IBANs (VIBAN)

• Structuring requirements, market screening, creating RfIs, communicating with vendors, and conducting the selection process

• UniCredit/HypoVereinsbank: Workstream lead "Booking and Customer Reporting" in the payment transformation project "PULS"

• Business analysis, creating business requirements and aligning solution items as part of the functional specification with the bank's IT service providers

• Business analysis of SEPA CT and SWIFT MX (.camt, .pain, and .pacs formats), change management, team lead for a virtual team of fifteen line experts, and stakeholder management

• equensWorldline Germany: Program management for three projects of the SWIFT service bureau (CBPR+, ESMIG, and Euro1Step1 migration) as part of the SWIFT MX migration

• Managing individual project managers regarding overarching goals and requirements; reporting to internal and external committees and stakeholders; coordinating with dependent projects and programs

• Project management/PMO: interim project management, stand-in for project managers, resource planning, budget and cost management, general PMO tasks