Self-Hosted AI Deployment in Amsterdam, Netherlands

Banking / Financial Services / Self-Hosted AI / Amsterdam

A Dutch systemic bank (EUR 14.2B revenue, 28,000 employees, EUR 420B total assets, serving 8.4 million retail customers and 180,000 commercial clients across the Netherlands and 8 European markets) needed to deploy enterprise-scale AI capabilities while satisfying DNB supervisory expectations, preparing for EU AI Act compliance, and eliminating dependency on US cloud AI providers. The bank's executive board had approved an "AI-first" strategy, but the CISO and CRO had vetoed cloud AI API usage for any application processing customer data, internal communications, or proprietary financial models. Core challenges: (1) DNB supervisory expectations — as a systemic institution (designated by DNB as a systemically important institution under CRD V), the bank faced heightened supervisory scrutiny on technology risk. DNB's SREP (Supervisory Review and Evaluation Process) had specifically flagged "AI and algorithmic risk" as a supervisory priority. DNB expected: model risk management for all AI systems used in customer-facing or risk-relevant processes, concentration risk management for AI service providers (DORA Article 28 — the bank could not depend on a single AI provider for critical business services), data governance demonstrating GDPR compliance for AI training and inference data, and operational resilience ensuring AI systems could continue operating during third-party service disruptions. Cloud AI API dependency would create exactly the concentration risk and third-party dependency that DNB's supervisory framework was designed to prevent. Self-hosted AI on bank-controlled infrastructure addressed all DNB concerns by design. (2) Multi-domain AI requirements — the bank needed AI capabilities across 6 business domains: retail banking (8.4 million customers): customer service automation (handling 2.1 million monthly contact centre inquiries), personalised financial advice (savings recommendations, mortgage refinancing alerts), and customer document processing (ID verification, income verification, address change processing). Commercial banking (180,000 clients): credit analysis (processing annual reports, financial statements, and industry reports to assess credit risk for commercial loans), trade finance (processing letters of credit, bills of lading, and certificates of origin), and KYC/AML (enhanced due diligence for complex corporate structures — beneficial ownership analysis, sanctions screening, PEP identification). Wealth management (EUR 86B AUM): investment research summarisation, portfolio analytics, and client reporting — processing confidential portfolio positions and investment recommendations. Risk management: market risk modelling, credit risk assessment (IRB models), operational risk event analysis, and stress testing — all requiring model governance that met both DNB and ECB (via SSM — Single Supervisory Mechanism) expectations. Compliance: regulatory change monitoring (tracking ECB, EBA, ESMA, and DNB regulatory publications), regulatory reporting automation, and complaints analysis. HR and operations: CV screening and candidate assessment (high-risk AI system under EU AI Act Article 6), employee onboarding, internal knowledge management, and IT service desk automation. Each domain had different model quality requirements (wealth management needing the highest-quality reasoning; customer service needing the fastest response times), different data sensitivity levels, and different regulatory considerations. (3) EU AI Act preparation — the bank's legal team had analysed the AI Act and identified 14 planned AI applications classified as "high-risk" under Annex III. These included credit scoring (financial services — access to essential services), insurance pricing (financial services), employee recruitment screening (employment), and AML/CTF systems (law enforcement adjacent). High-risk AI systems required: conformity assessment before deployment, technical documentation (data governance, model architecture, performance metrics), quality management system, ongoing monitoring and incident reporting, and transparency obligations (informing individuals when AI was used in decisions affecting them). The bank needed AI infrastructure that supported comprehensive documentation and governance for high-risk systems — capabilities that cloud AI APIs could not provide because the bank had no visibility into or control over the underlying model lifecycle. (4) Multilingual European operations — the bank operated in 8 European markets (Netherlands, Belgium, Germany, Poland, Romania, Czech Republic, Austria, Spain), processing documents and communications in 9 languages. AI models needed genuine multilingual capability — not translation-based processing but models that understood Dutch financial terminology, German commercial law concepts, Polish banking regulation, and Romanian fiscal language. The bank's existing translation-based approach (translating everything to English for AI processing, then translating outputs back) produced unacceptable quality for financial documents where terminology precision mattered. (5) Scale — the bank projected 4.5 million AI inference requests daily across all domains (scaling to 8 million within 18 months as adoption grew). This volume at cloud AI API pricing would cost EUR 12-18M annually — a significant expense that self-hosted deployment could dramatically reduce while simultaneously addressing sovereignty and compliance concerns.

We deployed a bank-wide self-hosted AI platform over 16 weeks — the largest self-hosted enterprise AI deployment in the Dutch financial sector. (1) EU-sovereign GPU infrastructure: purpose-built for banking. Hardware: 64 NVIDIA H100 80GB GPUs across 8 server nodes, deployed across the bank's two Amsterdam-area data centres (primary facility in Schiphol-Rijk, secondary in Almere — both Tier 3+ facilities owned and operated by the bank). Primary cluster: 48 GPUs (6 nodes) handling production inference workload. Secondary cluster: 16 GPUs (2 nodes) for DR, development, and model fine-tuning. Total GPU memory: 5.12TB — capacity for simultaneous deployment of large models across all 6 business domains. Network: InfiniBand HDR200 interconnect between nodes within each facility. Dedicated 40Gbps dark fibre between primary and secondary sites. AI cluster connected to the bank's internal network through security zones — no direct internet connectivity. Storage: 80TB NVMe for model weights and active data. Connected to the bank's existing enterprise data lake (Cloudera-based, 4.2PB) for training data access through controlled data pipelines. Sovereignty assurance: all hardware procured through EU supply chains, deployed in Dutch facilities, operated by Dutch-resident bank employees. No US-headquartered company had access to any component of the AI infrastructure — addressing both CLOUD Act and FISA concerns completely. (2) Multi-domain model architecture: one platform, six domains. Model portfolio: Llama 3 405B (FP8): deployed on 32 GPUs for complex reasoning tasks — credit analysis, regulatory document interpretation, wealth management research, and compliance assessment. Highest quality for tasks where accuracy directly affected financial outcomes. Llama 3 70B (INT4): deployed on 8 GPUs for medium-complexity tasks — customer document processing, KYC analysis, HR screening, and internal knowledge queries. 3x faster than 405B with quality sufficient for most operational tasks. Mixtral 8x22B: deployed on 8 GPUs for high-throughput multilingual tasks — customer service (handling 2.1 million monthly inquiries), email classification, and complaints routing. MoE architecture providing excellent quality-to-cost ratio for high-volume processing. Mistral 7B (fine-tuned per domain): deployed on 4 GPUs for specialised high-speed tasks — transaction classification, sentiment analysis, alert triage. Sub-200ms inference for real-time applications. Embedding models: deployed for semantic search across the bank's document corpus (42 million documents). Domain isolation: each business domain operating within a separate virtual environment — retail banking AI could not access wealth management data, commercial banking AI could not access HR data. Information barriers enforced at the platform level through the bank's existing IAM (Active Directory) and data classification system. Routing intelligence: requests classified by domain and complexity, automatically routed to the appropriate model. Customer service queries routed to Mixtral for fast multilingual response; credit analysis requests routed to Llama 405B for thorough assessment. (3) Domain fine-tuning: banking-grade accuracy. Dutch financial language: the primary fine-tuning focus — creating models that understood Dutch financial terminology with precision. Training data: 28,000 Dutch-language financial documents (annual reports, credit agreements, mortgage contracts, regulatory correspondence) annotated by the bank's domain experts. The model learning Dutch banking concepts: "dekkingsgraad" (coverage ratio — critical for Dutch pension fund analysis), "hypotheekrenteaftrek" (mortgage interest deduction — key Dutch housing finance concept), "Wft" (Wet op het financieel toezicht — Dutch Financial Supervision Act), and "Wwft" (Wet ter voorkoming van witwassen en financieren van terrorisme — Dutch AML law). Credit analysis fine-tuning: 12,000 credit files annotated by senior credit analysts — the model learning to extract key financial ratios, identify risk factors, and assess covenant compliance from commercial loan documentation. Credit risk assessment accuracy: 93.4 percent agreement with senior analyst assessments (measured on 400 blind test files). KYC/AML fine-tuning: 8,400 KYC files annotated by compliance officers — the model learning to identify complex corporate structures, beneficial ownership chains, PEP connections, and sanctions risk indicators. KYC processing accuracy: 91.8 percent for standard cases, with mandatory human review for enhanced due diligence cases. Multilingual fine-tuning: models fine-tuned on banking documents across the bank's 9 operational languages — ensuring consistent quality when processing German Geschaeftsbericht (annual reports), Polish sprawozdanie finansowe (financial statements), or Romanian situatii financiare (financial statements). (4) EU AI Act compliance infrastructure: ready for high-risk classification. Conformity documentation: for each of the 14 high-risk AI applications, comprehensive technical documentation covering: intended purpose and scope, data governance (training data provenance, quality measures, bias assessment), model architecture and development methodology, performance metrics (accuracy, precision, recall, fairness metrics across protected groups), limitations and residual risks, and human oversight mechanisms (how human reviewers could override AI decisions). Model cards: standardised model documentation following EU AI Act Article 11 requirements — published internally for each deployed model, accessible to risk management, compliance, and internal audit. Bias testing: comprehensive fairness assessment for high-risk systems — testing for discriminatory outcomes across protected characteristics (gender, age, ethnicity, nationality) as required by Dutch equal treatment law and EU AI Act Article 10. Credit scoring model tested across demographic groups, with bias metrics reported quarterly to the bank's AI Ethics Committee. Transparency: for customer-facing AI applications, clear disclosure that AI was being used — meeting AI Act Article 52 transparency obligations. Customer communications including standardised AI disclosure language approved by the bank's legal team. Incident reporting: infrastructure for mandatory incident reporting under AI Act Article 62 — automated detection of significant AI malfunctions, with escalation procedures and reporting templates ready for national competent authority notification. (5) Operational resilience: DORA compliance. Dual-site deployment: primary and secondary AI clusters operating in active-passive configuration with 15-minute failover. During primary site failure, secondary cluster assumed full production workload (reduced capacity — critical applications prioritised). Regular DR testing: quarterly failover exercises demonstrating compliance with DORA operational resilience expectations. The bank's existing DR governance framework extended to cover AI systems with specific recovery time objectives: customer service AI — 30-minute RTO (classified as important business service), credit analysis AI — 4-hour RTO, and support functions (HR, internal knowledge) — 24-hour RTO. No single point of failure: the AI platform deliberately avoiding any dependency on a single external provider — self-hosted infrastructure eliminating the concentration risk that DORA was designed to address.

Results over 12 months post-deployment. Platform adoption: 18,400 of 28,000 employees (66 percent) actively using the AI platform. 4.5 million daily inference requests achieved within 6 months (meeting projection). Growing to 6.8 million daily by month 12. Retail banking: customer service AI handling 68 percent of 2.1 million monthly inquiries without human escalation (1.43 million automated resolutions). Customer satisfaction for AI-handled inquiries: 4.1/5.0 (versus 4.3/5.0 for human-handled — within acceptable range). Customer document processing: ID verification, income verification, and address changes automated for standard cases — processing time from 3 days to 4 hours. Commercial banking: credit analysis processing time from 5 days to 8 hours for standard commercial credits. Credit analyst capacity: analysts processing 2.4x more credit applications with AI assistance. Trade finance document processing: letter of credit review from 4 hours to 35 minutes per transaction. KYC/AML: standard KYC reviews from 6 hours to 45 minutes. Enhanced due diligence cases flagged for human review: 18 percent of total (complex structures, PEPs, high-risk jurisdictions). False positive reduction in transaction monitoring: 34 percent (reducing alert volume from 42,000 to 27,720 monthly while maintaining detection sensitivity). Wealth management: investment research summarisation saving 2,400 analyst hours monthly. Client reporting automation reducing report production from 3 days to 4 hours. Compliance: regulatory change monitoring: AI scanning 140 regulatory publications daily across ECB, EBA, ESMA, DNB, and national regulators in 8 countries. Relevant changes identified and summarised within 4 hours of publication (versus 3-5 days for manual monitoring). Risk management: operational risk event classification automated — 89 percent accuracy for standard events. Stress testing scenario documentation: AI-assisted documentation reducing preparation time by 45 percent. Cost: infrastructure investment: EUR 5.8M (64 H100 GPUs, servers, networking, storage, DR). Annual operating cost: EUR 1.6M (power, cooling, maintenance, operations team). Versus cloud AI API estimate: EUR 14.2M annually at actual usage volume (6.8M daily requests across multiple model sizes) — self-hosted deployment saving EUR 12.6M annually versus cloud API pricing. Total savings over 3-year projected lifespan: EUR 37.8M (EUR 42.6M cloud cost minus EUR 5.8M infrastructure minus EUR 4.8M operations). DNB and AI Act compliance: zero DNB examination findings related to AI governance. AI Act conformity documentation completed for all 14 high-risk applications — ready for regulatory inspection. Bias testing results within acceptable thresholds across all protected groups. Board AI governance report delivered quarterly with zero escalations. DORA: quarterly DR failover testing completed successfully. No concentration risk findings — self-hosted deployment eliminating the third-party AI provider dependency that DORA targeted. Risk reduction: the bank's CISO estimated self-hosted deployment eliminated EUR 400M+ in potential data sovereignty, regulatory, and operational risk exposure from cloud AI API dependency.