How to sell to banks: buying committees, vendor risk and who signs

Home › Blog › How to sell to banks: buying committees, vendor risk and who signs

How banks buy: who signs, who blocks, and what vendor-risk, security and DORA reviews ask of you. Lessons from selling to Tier 1 banks, with sources.

By Moe Alhosni · Published 29 October 2026 · 10 min read

Short answer: To sell to a bank you need two things at once: a business owner who wants your product badly enough to sponsor it, and a vendor file that survives third-party risk review. The sponsor gets you in. Procurement, vendor risk, information security and legal decide whether you get signed. Start the second track the week the first one looks real, not after the sponsor says yes.

I spent 4 years and 7 months at Moody's in London, from October 2019 to April 2024. I started as a Client Service Associate, then worked as an Account Manager on Tier 1 banks and asset managers, then in Credit Solutions sales, and finally as Assistant Director, Sales, covering central banks, financial institutions, asset managers, PE and VC in Central and Eastern Europe plus Portugal, Malta and Cyprus. Before that I worked at BLOM Bank France in London on settlements and on customer due diligence and AML/KYC record updates. So I have seen bank buying from the seller's side and from inside a bank's own control functions.

What follows is the general version: how bank buying committees work, who signs, who blocks, and what published regulatory guidance says banks must check before they buy. No former employer's data or method, and no client named. Where I make a claim about the rules, I link the rule. This page is about B2B selling to banks, not about banks winning retail customers.

Why banks buy slowly: they are regulated on what they buy

Most sellers think a bank is slow because it is big. Size is part of it. The bigger reason is that a bank is supervised on how it chooses and manages its suppliers, and the people reviewing you are doing a job their supervisor will check.

The US guidance says a bank's "board of directors has ultimate responsibility for providing oversight for third-party risk management". Everyone who signs off on you answers, in the end, to that line.

This is general information, not legal advice; check with your compliance team or counsel.

The buying committee: who signs and who blocks

Every bank organises this differently. The US guidance itself says some banks spread third-party risk accountability across business lines, while others centralise it under compliance, information security, procurement or risk. The roles below show up in some form almost everywhere.

The lesson from that table: one person can say yes, and six or seven can say no. Find the yes, then give every potential no what it needs before it becomes one.

And the person who likes you most is rarely the person who signs. A sponsor who loves the demo still has to win a budget argument against other projects. Give them a one-page business case in the bank's own terms: the cost of the problem, what changes, and what the risk review will find.

The stages a deal goes through

The US interagency guidance names five life-cycle stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. That is the bank's view. Here is what each one means from the seller's side.

1. Planning. The bank decides it needs something, and whether it should be bought at all. If you arrive after this, you are answering someone else's requirement. Cold outreach works best here, before an RFP exists.
2. Due diligence and selection. Your questionnaire, evidence pack and security review. The guidance says the scope "should be commensurate with the level of risk and complexity" of the relationship. Low-risk tools get a lighter review. Anything touching customer data or a critical activity gets the full one.
3. Contract negotiation. Legal reads your terms against the bank's standards and against what its regulator expects to see in a contract. Under DORA, for example, the contract has to cover where data is processed, termination rights and, for critical or important functions, "unrestricted rights of access, inspection and audit".
4. Ongoing monitoring. After signature you get reviewed again, periodically. A vendor who made promises to get through stage 2 meets them again here.
5. Termination. Banks plan your exit before they let you in. DORA requires exit arrangements with "a mandatory adequate transition period" for critical or important functions. Have an answer ready for how the bank leaves you.

What the due diligence file asks for

You can see the shape of the questionnaire before you receive it, because the US guidance lists the factors a bank typically considers. The headings include strategies and goals, legal and regulatory compliance, financial condition, business experience, key personnel, risk management, information security, management of information systems, operational resilience, incident reporting, physical security, reliance on subcontractors, insurance, and the third party's contracts with other parties.

Build the pack before your first serious meeting:

• Company basics. Ownership, financial statements, insurance certificates, key people and their backgrounds.
• Security evidence. Whatever independent assurance you have (an ISO 27001 certificate or a SOC 2 report, if you hold one), your last penetration test summary, access control and encryption policies.
• Resilience. Business continuity and disaster recovery plans, and when you last tested them.
• Incidents. How you detect, report and fix an incident, and who the bank will hear from.
• Subcontractors. Every subprocessor, what they do, where they are, and where the data sits.
• Exit. How the bank gets its data back, in what format, and how long you support a transition.

If you do not have one of these, say so and say what you do instead. The guidance expects banks to "identify and document any limitations" in their due diligence and consider how to reduce the risk. A gap you explain is a mitigation plan. A gap they discover is a reason to stop.

Stay out of "critical" for your first deal

The fastest lever I know is scope. Every framework above scales scrutiny to how important your service is: "critical activities" in the US guidance, "critical or important functions" under DORA. The heavier tier means longer reviews and harder contract terms.

So for a first deal, sell the smallest useful version: one team, one use case, no customer personal data if you can avoid it, nothing the bank would have to stop doing if you failed. Expand once you are an approved vendor. I cover how to design that first, small engagement in how fintechs land their first bank pilot.

Who to contact first

Not procurement, which runs a process but does not start one. Go to the person who owns the problem.

• Head of the function that feels the pain. Credit risk, treasury, operations, compliance, payments, whoever your product makes faster or safer.
• One level above, if your deal size needs their budget.
• A second sponsor in a neighbouring team, in case your first contact moves.

Write about their problem in their words. "We help banks with X" is noise. A specific manual step your product removes gets a reply, if it is true. Follow up patiently: see how many follow-ups a cold email sequence needs.

Smaller banks are a separate case. The US guidance tells banks to scale their risk management to their own size and complexity, so the rules still apply, but the committee is smaller and the sponsor is often a C-level executive. That makes smaller institutions a sensible first market for many vendors.

Mistakes I watched vendors make

These are general patterns, not stories about any one firm.

• Treating the demo as the finish line. It is the start of a second, longer sale to the control functions.
• Starting vendor risk late. The questionnaire arrives after the sponsor says yes, and takes longer than the sponsor expected. Ask for it early.
• Overclaiming in marketing. The US guidance says a bank may review a vendor's "websites, marketing materials, and other information" to check its claims. Anything on your site that you cannot back up will be read.
• One contact, no map. When your only champion goes on leave, the deal stalls.

Where outbound fits, and where it does not

Cold email gets you into stage 1, planning, with a business owner. It does not get you through stages 2 to 5. That is why the definition of a qualified meeting matters more here than in most markets. For a bank, I would include the person's role in the decision, whether there is a budget line or a route to one, and whether the problem is live this year. The general version is in what counts as a qualified meeting, and the bank-specific version is in what "qualified" means when the buyer is a bank.

On proof, here is the honest position. ROI Maximizer has not run a finance campaign yet. Our published results are in PR, not finance: PR Noir got 27 leads, 10 qualified meetings and a $90K deal, and P1 Communications, a hospitality PR agency, got 20+ qualified meetings. What I bring to banks is the buyer-side knowledge above, not a list of bank logos.

Our prices are published. A setup fee of $1,000–$3,000, then $200–$500 per qualified meeting that took place, or a flat $5,000 a month. No minimum term, and nothing for a no-show. The detail is on the pricing page, and the wider offer for finance is on the financial services page. If you sell to banks specifically, start with lead generation for selling to banks.

FAQ

Who signs a contract at a bank?

The budget holder signs, within a delegated limit, and for larger or critical services a risk committee or the board may approve it. But signing comes last. Before it, procurement, vendor risk, information security, legal and compliance each have to clear you, and any one of them can stop the deal.

Why does vendor onboarding at a bank take so long?

Because banks are supervised on how they choose suppliers. The US interagency guidance, the EBA outsourcing guidelines, DORA in the EU and PRA SS2/21 in the UK all expect due diligence scaled to risk, contract terms such as audit and exit rights, and ongoing monitoring. A larger scope means a longer review.

Should I contact procurement first when selling to a bank?

No. Procurement runs a process once the bank has decided to buy. Start with the person who owns the problem, and ask for the vendor risk questionnaire early.

Before you sign with anyone

If you hire anyone to book meetings with banks, us included, get three things in writing first.

1. The qualification definition. Role in the bank's decision, a budget line or a route to one, a live problem, and the words "held, not booked".
2. No-show terms. A meeting that did not happen should not be charged.
3. What a zero-meeting month costs. On a retainer you pay anyway. On pay per meeting you should pay nothing, and the contract should say so.

Then put your deal size and close rate into the ROI calculator and see what a bank meeting is worth to you before anyone quotes you a price.

If you sell to banks and want to talk through your committee map or your first sequence, book 30 minutes or email moe@roimaxi.com.

Moe Alhosni, founder, ROI Maximizer (M Ventures LTD, 4 Beau Street, Bath BA1 1QY).

About the author: Moe Alhosni, founder of ROI Maximizer. Before that he spent four and a half years in sales at Moody's in London, most recently as Assistant Director, Sales, working with banks, asset managers and private equity firms. He runs the campaigns behind the first-hand data on this site. LinkedIn

Keep reading

• How to sell to asset managers and RIAs: who signs, who blocks — Who decides at asset managers and RIAs: operations signs, compliance and vendor risk block. What DORA, FCA SYSC 8 and SEC rules mean for vendors.
• Fintech lead generation: booking meetings with banks and finance teams — Fintech lead generation for B2B fintechs selling to banks, asset managers and finance teams: why it is harder, how it works, and what it costs.
• Lead generation for selling to banks and credit unions — For vendors selling software, data or services to banks and credit unions: how banks buy, who to email, and meetings paid per held meeting.

Or run the free GTM teardown on your own site for the ICP, cold email and numbers specific to your company.

ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com

© 2024–2026 M Ventures LTD. Privacy notice