The Bank Buying-Committee Map: who decides when a bank buys

Home › Financial services › The Bank Buying-Committee Map

A free 10-page PDF for fintech, regtech, data, software and services companies selling to banks and credit unions. Who sits on the buying committee at each size of bank, what each person needs from you, what makes each one block, and who to email first.

Selling to a bank is two sales at once. A business owner has to want your product badly enough to sponsor it, and a row of control functions has to clear you before anyone signs. Most vendors only map the first. This guide maps both.

It is written for B2B companies: fintech, regtech, data, software and services firms whose buyer is a bank, a building society or a credit union.

What is inside

How to use this map. Three rules that hold at every size of bank.
The ten roles, in one table. Business sponsor, operations, IT and architecture, CISO, third-party risk, model risk, compliance and legal, procurement, finance and the final approver: what each needs from you and what makes each block.
Tier 1 and global banks. Who each role usually is, in a committee-run deal.
Regional and mid-size banks. Fewer people, one person in two roles, a stronger executive sponsor.
Community banks and credit unions. Short chains, outsourced roles, and why references count.
Central banks. Public institutions, formal tenders, and why the work happens before the tender.
The vendor-onboarding sequence. Due diligence, security questionnaire, contract, onboarding and ongoing monitoring, with links to the US interagency guidance (OCC Bulletin 2023-17), NCUA guidance for credit unions, the EBA outsourcing guidelines, PRA SS2/21 and DORA.
The document checklist. SOC 2 or ISO 27001, pen test summary, BCP and DR, data processing terms, sub-processor list, insurance, financials and exit plan.
The first email to each role. The angle for each, what to avoid, and which roles to email first.

One table per bank size, a checklist page, and 10 pages in all.

Who wrote it

I am Moe Alhosni. I spent 4 years and 7 months at Moody's in London, most recently as Assistant Director, Sales, covering central banks, financial institutions, asset managers, PE and VC in Central and Eastern Europe plus Portugal, Malta and Cyprus. The map is what I saw from the seller's side, in general terms. It holds no former employer's data, clients or methods.

Get the PDF

Enter your work email and the download button appears straight away. No newsletter. I may follow up once. See the privacy notice.

A sample: four of the ten roles

Role	What they need from you	What makes them block
Business sponsor	A problem they own, solved in their words, and a business case they can take upstairs	Nothing urgent this year; a pitch about your product rather than their problem
CISO and information security	Independent assurance, access control, encryption, incident handling, where data sits	No SOC 2 or ISO 27001 and no credible alternative; vague answers on data location or access
Third-party or vendor risk	A complete due diligence file and a risk rating they can defend	Missing documents, unexplained gaps, unknown subcontractors, weak financials
Procurement	A process they can run: competition, price, standard terms, a vendor record	Off-process buying, no comparison, terms that fight their template

The full table, and one for each size of bank, are in the PDF. For the long version in article form, read how to sell to banks, or the financial services hub for how we run outbound to finance buyers.

This is general information, not legal advice; check with your compliance team or counsel.

ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com