How to Sell to Banks When Vendor Reviews Decide Deals

To sell to banks, first reach the executive who owns the problem you solve. That is usually the head of a business line, the COO or the CIO, and you want them talking to you before anyone sends you a vendor questionnaire. Then be ready for the review that follows. The regulatory detail below covers US banks.

A bank does not buy because someone liked a demo. New suppliers go through a third-party risk process with five stages: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. How deep each stage goes depends on the risk you bring.

You win when a senior business owner wants your outcome badly enough to sponsor you through the review. Your proof also has to answer the review's questions before anyone asks them.

Three decisions shape almost every bank deal:

1. Who gets your first message. The business owner. Vendor management comes later.
2. What you have ready before the first serious call. Security documents, references and contract terms.
3. How long you plan for. Months, because legal, risk and procurement join after the first meeting.

For a financial services firm, my team and I booked 26 sales calls in the first 7 days, with 4 contracts, then 132 calls in 30 days and 344 calls in 60 days. I do not present that client as a bank case, so I use it for one point only: outbound can start real sales conversations in financial services, fast. With banks, that first conversation has to happen well before procurement opens a file.

Who actually decides to buy from you at a bank?

Before I build any list, I go back to the client's closed deals and check who really signed each one. If you have sold to banks before, check those deals against the real titles in the map below. The buying group usually has three sides: the business that wants the outcome, the risk people who must approve it, and the operations and technology people who will live with it.

Here is the buyer map I would start from:

Different deals surface different owners. A lending product belongs to the head of lending. A reporting or data product often lands with the COO or the CFO. An IT service usually starts with the CIO. Whoever feels the pain every week gets your first message.

Vendor management is almost never that person. Its job is to run the same fair, documented process on every supplier the business brings in. Writing to them first is asking the referee to pick a team. Reach them second, introduced by a sponsor who already wants you.

At a smaller bank, expect the same roles in fewer chairs. The CEO may chair the risk discussion, and one officer may cover IT and information security.

What does bank vendor due diligence check?

The main reference behind most US bank vendor reviews is the 2023 Interagency Guidance on Third-Party Relationships, issued by the Federal Reserve, the FDIC and the OCC. The OCC's bulletin says it covers every bank that uses third parties and aims for consistency in how the agencies supervise this risk. The guidance itself imposes no new requirements and does not have the force of law. Because it describes how examiners look at vendors, though, it is the shape your review will take.

Here is the lifecycle translated into what it means for you as the vendor:

The guidance names specific contract topics: who may audit the vendor and demand fixes, who carries liability, and how either side exits after a default. These come up early for a simple reason. A business owner who sponsors you wants to know you will not stall at legal. If your standard contract fights audit rights, your sponsor finds out after spending their reputation on you inside the bank.

Review depth is not the same for every vendor. The 2023 guidance says a bank's third-party risk management should fit its size, complexity and risk profile. The OCC adds that not every relationship carries the same risk or criticality.

The Federal Reserve's guide for community banks describes higher-risk relationships. They include vendors that see customer or other sensitive data, vendors that process transactions, and vendors that provide essential technology and business services. If your product does any of those, plan for the full review.

How long is the sales cycle when you sell to banks?

Plan in months. B2B sales cycles are often 6, 9 or 12 months, and at a bank, legal, risk and procurement each add their own queue after the first meeting.

Slow cycles are normal at this deal size. Most of the companies we work with sell deals worth USD 10,000 or more, often at six or seven figures. Those deals take months even without a bank on the other side, and a bank adds a formal review on top.

What that means for how you run the pipeline:

1. Treat a booked call as the start of the cycle. Booking a call and closing a deal are separate jobs.
2. Judge outreach in the first months on conversations started and sponsors won. Signed contracts come later.
3. Prepare whoever takes the calls on how a bank decides: who else approves, which review comes next, and when to bring in your security lead.
4. Fix a weak closing rate before you buy more meetings.
5. Keep following up after "not this quarter". At a bank, that answer often points to the budget cycle.

What changes in the September 2026 proposal for vendors?

On September 15, 2026, the OCC, the Federal Reserve, the FDIC and the NCUA published a joint proposal on third-party risk oversight with a request for comment. It is still a proposal. Comments are due by November 16, 2026.

The FDIC's letter on the proposal says a final version would take the place of the 2023 guidance and some related resources.

What the proposal would do, in plain English:

1. Move to principles-based guidance that tailors oversight to the reasonably assessed risk of each third-party relationship.
2. Point banks at what matters most: material financial exposure, legal compliance and where oversight time goes.
3. Bring the NCUA into the same proposal, so credit unions sit in the same conversation as banks.
4. Come with a separate Joint Statement on Community Banks' Engagement with Core Service Providers from the FDIC, OCC and Federal Reserve. The statement aims to clarify how the agencies supervise certain services that core providers deliver to community banks.

One thing does not move. The FDIC letter states that using third parties "does not diminish banks' responsibility to manage risks and comply with applicable laws and regulations."

For sellers, the practical reading is that review effort would follow risk even more closely if this is finalized. A narrow tool that never touches customer data or transactions could face a lighter review. Anything near payments, customer records or core systems should expect the same depth as today.

Say plainly in your outreach what your product touches. A business owner who can guess your risk level can also tell you how hard the review will be.

If you sell to community banks, ask early which core service provider the bank runs on and how your product connects to it. The joint statement on core service providers in item 4 makes that question more likely.

Watch the comment period too, because final text can differ from a proposal. This is not legal advice.

How is selling to a community bank different from selling to a large bank?

The lifecycle is the same at both, since the 2023 guidance applies to every bank with third-party relationships. What changes is how many people run it and how deep each stage goes.

The Federal Reserve's community bank guide says third parties can give these banks access to new technology, risk tools, skilled people, delivery channels and new markets. It also says engaging one does not remove the bank's responsibility to operate safely and follow the law. So a community bank gains capabilities through vendors and still carries the full accountability, with fewer people to share it. Expect a small team checking you very carefully.

The segment is finite, and you can count it. For banks, the FDIC Quarterly Banking Profile page links data tools for comparing financial performance across institutions and states. For credit unions, the NCUA's call report data page links a spreadsheet of all active federally insured credit unions, with membership, assets and loans. That is enough to size your list before you write a word.

Finite markets change the tactics. When a market is small, I skip intent data: if only about 10 of 2,000 target companies show signals, I build an offer the whole segment wants instead. I always run the market arithmetic before writing any message, because a finite list of institutions with one real buyer each will not survive a careless campaign.

How do you open the conversation before vendor management takes over?

The rules for the first touch are short:

1. Open with the business problem, in the words the business owner would use with their own COO.
2. Sell the meeting in the first message, never the product. A pitch up front is the quickest way to get ignored.
3. Give a reason to take the call. A free call costs you nothing, but it still costs a banker time, so you have to sell it.
4. Put proof inside the messages themselves, by the second or third touch at the latest. I write a real result from a similar client straight into the text, so nobody has to click a "learn more" link to find it.
5. Choose the opening channel on purpose. For bank buyers I open on LinkedIn; here is how I decide which channel goes first.

The first-touch checklist, before anything is sent:

1. An offer in one sentence that a head of lending could repeat to their COO without you in the room.
2. One proof line with a number and a timeframe, taken from a client the reader would recognize as a peer.
3. A security pack that is ready to send but not attached to the first message.
4. Two references who have agreed to take a call.
5. A standard contract that already accepts audit rights, remediation and a clean exit.
6. One clear next step: a 20-minute call about one problem, with a proposed week.
7. Sender profiles that show the same proof the message mentions.
8. SPF, DKIM and DMARC configured and a verified list in place before any volume.

Items 3 to 5 never appear in the first message. They exist so that when the business owner asks "will this get through our review?", you answer with documents the same day.

What should your bank-selling outbound sequence look like?

Plan several touches across LinkedIn and email, with real time between them. I never make the email the first touch: a warm email follows a LinkedIn touch.

A worked example for one business owner:

Here is what touch 2 could sound like for a vendor that speeds up commercial loan document collection:

"Hi Dana, a question for you as head of commercial lending. How many days does your team lose chasing borrowers for documents before a file reaches credit? If that step drags for you too, 20 minutes is enough to show where the days go. Worth a look next week?"

Notice what is missing: no compliance vocabulary, no "vendor onboarding", no feature list. The banker reads a problem they own and a simple question. The proof line from a similar lending team comes in touch 3. For how the two channels hand off to each other, see what holds up when LinkedIn and email run together.

The angle changes with the role you reach:

Once someone shows interest, stop selling and start mapping. Ask who else would need to see this for it to move, and whether their third-party risk team has a questionnaire you can start early. Then offer to send your security summary straight to that team after the call.

Log every reply and every name the sponsor gives you in a CRM, whichever one you use. Bank deals stretch across months and people change jobs.

Scale only once the sequence produces real conversations at a small size.

Finding the sponsor who owns the problem is a big part of selling to a bank. If you would like help with that, book time with me and bring what you have.