--- title: ČSOB url: 'https://omnivery.com/resources/case-studies/csob' markdown: 'https://omnivery.com/resources/case-studies/csob.md' lang: en date: '2026-11-08' description: 'How ČSOB Group got bank-grade control over 100M+ emails a year: a URL allowlist, domain kill switch, Bloomreach click events and journaling for archiving.' --- Customer story - ČSOB Group # How ČSOB Group got bank-grade control over every email it sends Security controls designed with ČSOB's IT security team, click data flowing back into Bloomreach, and compliant archiving for regulated communication, across six brands in three countries. Published 2026 [Download the PDF](https://omnivery.com/documents/csob-case-study.pdf)[See Finance & Insurance](https://omnivery.com/solutions/finance) ## ČSOB in numbers 100M+ Emails a year across ČSOB Group brands CZ - SK - HU 11 days From ČSOB's go-ahead to security controls running in production Jan - Feb 2023 2+ mo Ahead of ČSOB's production deadline, UI and docs included Released 21 Mar 2023 1 day To build the Bloomreach click-event integration June 2023 01 - The challenge ## A bank can't afford a hijacked campaign In 2022 ČSOB moved its email marketing to Bloomreach Engagement and chose Omnivery to deliver it, with Etnetera as integration partner. Omnivery's 100% owned infrastructure, rather than public cloud, met ČSOB's audit requirements. But the bank's IT security and risk teams had a harder question. If a marketing platform or delivery provider were ever compromised, an attacker could send convincing phishing in ČSOB's name. **The bank needed a way to make sure only legitimate email could reach its clients, and to stop sending instantly if anything looked wrong.** Two more requirements followed: marketing wanted its engagement data to stay in Bloomreach, and regulated group companies had to archive what they sent. 02 - Security controls ## Controls designed with ČSOB's IT security team Omnivery worked through ČSOB's risk scenarios with its IT security, risk and digital channels teams, in workshops at the bank's headquarters in early 2023. ČSOB set out the controls it needed; Omnivery built them into the platform as standard features, checked on every message before it is delivered. ### URL allowlist Each sending domain has a list of approved link destinations. An email containing any other link is blocked before it reaches a client, so a hijacked campaign can't point to a phishing site. ### Reply-To alignment The Reply-To address must belong to the sending domain, so replies can't be quietly diverted to an outside address. ### Domain kill switch Sending for any domain can be switched off instantly from the console or the API, stopping a campaign mid-send. ### Security notifications Every change to these settings is reported to a dedicated bank security address, which can verify it and react. Changing that address alerts the previous one. ### Validation alerts Omnivery counts messages that fail validation, so an unusual run of blocked emails stands out as a possible sign of compromise rather than getting lost in the logs. ### Timeline - 23 Jan 2023ČSOB approves direct sending with controls - 3 Feb 2023Controls running in production - 21 Mar 2023Full release with console UI and docs - 31 May 2023ČSOB's production deadline ApprovedSecurity sign-off **On the strength of these controls, ČSOB's IT Security and Risk & Compliance teams approved sending directly from Bloomreach Engagement through Omnivery**, instead of building a separate bank-operated filtering layer in between. "We needed to be sure that even if a platform upstream were compromised, no email with a phishing link could reach our clients. Omnivery built the controls we specified within weeks, which let our IT security and risk teams approve direct sending." Vladimír Selčan, IT Solution Architect, Digital Channels, ČSOB 03 - Bloomreach integration ## Keeping click data where marketing works The URL allowlist checks the real destination of every link, so links can't be rewritten into a marketing platform's tracking redirects. Omnivery tracks the clicks instead. Without this, there would have been a gap in ČSOB's campaign reporting. ### Bloomreach Engagement Campaigns built and scheduled by ČSOB's marketing team ### Omnivery Checks links, Reply-To and domain status, then delivers and tracks clicks ### Client inbox Only email that passes every check is delivered **Click events.** Each click goes back into Bloomreach as a native campaign event, matched to the right campaign and customer. Omnivery built a dedicated Bloomreach events integration in a day, then refined it with Bloomreach's team so each click carries the campaign metadata ČSOB's existing reports depend on. Opens continue to be tracked in Bloomreach, so nothing is counted twice. 04 - Compliant archiving ## A record of every regulated email Banks and investment firms must be able to prove what they told each client, content included, for years. For Patria Finance this is a MiFID requirement, and ČSOB has the same need for its own client communication. Copying every email from every sending system would have meant changes in each of them. Instead, Omnivery added **journaling**: an identical copy of every email on a domain goes to a designated archive address. It is switched on in the domain settings, with no changes to the systems that send the email. Per domainOne setting, every system **Live at Patria Finance**, where client email is archived to meet MiFID record-keeping requirements. 05 - Results ## Security sign-off, without slowing marketing down Approved ### Direct sending signed off Omnivery's controls met the bank's security and risk requirements. 100M+ ### Emails a year across the group Six brands in the Czech Republic, Slovakia and Hungary. Ahead ### Delivered before the deadline Fully released more than two months before ČSOB needed it. Intact ### Reporting kept in Bloomreach Clicks arrive as native campaign events in existing reports. "We got the security sign-off without losing anything in Bloomreach. Our campaign reporting works exactly as before." Jan Kuběna, Technology Platform Designer, Lead Management, ČSOB 06 - Key takeaways ## What other regulated senders can take from it 1. #### Control the destination, not just the sender A URL allowlist keeps phishing links out of email sent in your name, even if a platform upstream is compromised. 2. #### Security requirements can become product features ČSOB's requirements shipped as standard platform features, available to every regulated sender. 3. #### Keep marketing's data where marketing works Moving click tracking for security reasons didn't cost ČSOB its Bloomreach reporting. 4. #### Archive at the delivery layer Journaling in one place covers every system that sends email, with no changes necessary in any of them. At a glance CustomerČSOB Group, part of KBC Group BrandsČSOB, ČSOB Pojišťovna, ČSOB Leasing, ČSOB Stavební spořitelna, usetreno.cz, Patria Finance Sending platformsBloomreach Engagement, plus internal systems at Patria Integration partnerEtnetera Omnivery customer since2022 Key facts ## ČSOB in brief - ČSOB Group, part of KBC Group, has sent email with Omnivery since 2022. - ČSOB Group sends over 100 million emails a year through Omnivery across six brands in the Czech Republic, Slovakia and Hungary: ČSOB, ČSOB Pojišťovna, ČSOB Leasing, ČSOB Stavební spořitelna, usetreno.cz and Patria Finance. - ČSOB sends its marketing email from Bloomreach Engagement through Omnivery, with Etnetera as integration partner; Patria Finance also sends from its own internal systems. - Omnivery designed its URL allowlist, Reply-To alignment, domain kill switch, security notifications and validation alerts with ČSOB's IT security, risk and digital channels teams in early 2023. - Omnivery's URL allowlist blocks any email containing a link to a destination not on the sending domain's approved list before it reaches a recipient. - Omnivery's domain kill switch stops all sending for a domain instantly, from the console or the API, including a campaign that is mid-send. - ČSOB's security controls were running in production 11 days after the bank's go-ahead, from 23 January to 3 February 2023. - The full release of ČSOB's security controls, with console UI and documentation, shipped on 21 March 2023, more than two months before ČSOB's 31 May 2023 production deadline. - ČSOB's IT Security and Risk & Compliance teams approved sending directly from Bloomreach Engagement through Omnivery instead of building a separate bank-operated filtering layer. - Omnivery built a Bloomreach click-event integration for ČSOB in one day, so clicks tracked by Omnivery arrive in Bloomreach as native campaign events. - Omnivery's journaling sends an identical copy of every email on a domain to an archive address, and is live at Patria Finance for MiFID record-keeping. - The security controls and journaling built for ČSOB are standard Omnivery platform features, available to every regulated sender. Sending email in a regulated industry? ## Talk to Omnivery about bank-grade email controls 100% owned infrastructure, ISO 27001 certified, with security controls built for banks and insurers. [Talk to us](mailto:sales@omnivery.com)[Download the PDF](https://omnivery.com/documents/csob-case-study.pdf) --- ## Navigation - Parent: [Case Studies](https://omnivery.com/resources/case-studies.md) - Next: [beehiiv](https://omnivery.com/resources/case-studies/beehiiv.md)