To sell to banks, pick the few institutions with a dated reason to change, map the committee before the first meeting, and prepare for vendor risk review from day one. Banks are slow buyers, but they are also among the most publicly documented buyers in B2B. Sellers who know how to sell to banks use that documentation to choose 20 targets out of 200 and walk in with the bank's own numbers.
TL;DR: Bank deals stall for three reasons: the wrong bank, too few stakeholders, and a vendor risk process nobody planned for. Fix targeting with public data (quarterly call reports, enforcement actions, earnings calls, Pillar 3 reports). Fix coverage by mapping five roles, not two. Fix timing by anchoring to an event with a date, such as an asset threshold, a regulatory order or a merger integration.
How do banks actually buy software?
Banks buy through a committee, and the vendor risk function has a formal say that it does not have in most industries. The reason is regulatory: supervisors hold the bank responsible for what its vendors do.
In the US, the Federal Reserve, FDIC and OCC issued joint guidance on third-party relationships in June 2023. It tells banks to scale oversight to "the criticality of the activity supported by the third party." The agencies' guide for community banks states the principle plainly: "Engaging a third party does not diminish or remove a bank's responsibility to operate in a safe and sound manner."
The practical consequence is that your first qualification question is about classification, not budget. Will the bank treat your product as supporting a critical activity?
- Critical: touches customer data, core processing, payments or regulatory reporting. Expect full due diligence, board-level visibility and contract terms on audit rights and exit.
- Not critical: internal productivity, research, marketing tools. Expect a lighter questionnaire and a faster path.
In the EU, two regimes apply. The Digital Operational Resilience Act has applied since 17 January 2025 and covers ICT third-party risk, including required contract provisions and a register of ICT arrangements. The EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) have applied since 30 September 2019 and require institutions to keep a register of all outsourcing arrangements. On 18 September 2026 the EBA published final guidelines on third-party risk that focus on arrangements supporting critical or important functions, with a two-year transitional period. The EBA states they will repeal the 2019 guidelines once applicable.
Credit unions follow a parallel track. The NCUA's guidance on evaluating third-party relationships covers risk assessment and planning, due diligence, and ongoing monitoring and control.
The broader guide on selling to financial services covers the life-cycle stages and the documents to prepare. This post focuses on which banks, which people and when.
Auto-generate account plans with AI research
Salesmotion builds living account plans from 1,000+ sources — updated continuously, not quarterly.
Why are banks easier to research than other buyers?
Banks publish more about themselves, on a fixed schedule, than almost any other buyer group. Most sellers never read it. That is the opening.
| Source | What it gives you | Cadence |
|---|---|---|
| Call Reports | Balance sheet and income for every US national bank, state bank and savings association, including assets and expenses | Quarterly |
| CFPB supervised institutions list | Which banks, thrifts and credit unions are over $10 billion in assets | Quarterly |
| OCC enforcement actions search | Orders against national banks and federal savings associations issued since 2012, searchable by bank name and action type | As issued |
| Annual reports and 10-Ks | Strategy, risk factors, named technology programs, material vendors | Annual |
| Pillar 3 disclosures | Capital, risk exposures and risk management, published under Basel standards that "aim to encourage market discipline" | Periodic |
| Earnings calls | Management's own words on cost, efficiency targets, technology spend and regulatory pressure | Quarterly |
| Job postings | Programs being staffed: core modernization, data, model risk, compliance build-outs | Continuous |
The universe is also finite. The FDIC's second-quarter 2026 release covered 4,238 insured commercial banks and savings institutions. You can know every bank in your segment by name, size and trajectory.
“It's not even just about saving time — it's about uncovering things we otherwise might not research. Salesmotion helps us connect Guild to what's already publicly important to the company.”
Derek Rosen
Director, Strategic Accounts, Guild Education
Which bank buying signals matter, and where do you find them?
The signals that matter are the ones that put a date on a decision. Sellers who work bank territories named the same handful repeatedly, and each has a public source.
| Signal | Where to find it | What it implies |
|---|---|---|
| Asset growth approaching a regulatory threshold | Quarterly call report totals, earnings call Q&A | New obligations on a fixed date. Compliance, reporting and data projects get funded ahead of it |
| New CFO | Press release, 8-K for listed banks | Cost base review. Vendor contracts and efficiency targets get reopened |
| New chief risk or compliance officer | Press release, LinkedIn, job posts for the team beneath them | Framework review, tooling changes, often after a supervisory finding |
| Enforcement action or consent order | Regulator enforcement databases | Remediation with milestones the regulator sets. Spend is not discretionary |
| Merger or acquisition | Announcement, regulatory application, earnings call | System consolidation, with one side's vendors displaced by a deadline |
| Spin-off or carve-out | Announcement, annual report | A new entity must stand up its own stack |
| Contract awarded to a systems integrator | Integrator press releases and case studies, job posts | A transformation program is funded. Adjacent purchases follow |
| Core modernization program | Earnings calls, job posts naming the platform | Multi-year integration work and a re-evaluation of everything attached to the old core |
| New product or market launch | Press release, hiring by location | Onboarding, compliance and servicing capacity must exist by launch |
| Cost-to-income language on earnings calls | Transcripts: "efficiency ratio," "expense discipline," "cost program" | A public target the CFO owns. Automation and consolidation cases get a hearing |
Two of these deserve a closer look.
Thresholds. US rules change with size, and the crossing date is predictable from public filings. The CFPB has supervisory authority over institutions with assets over $10 billion. The Federal Reserve's debit interchange rule exempts issuers with consolidated assets of less than $10 billion, measured at the end of the preceding calendar year.
Enforcement. A public order names the deficiency. That tells you which function has budget, who is accountable and roughly how long they have. It is one of the cleanest examples of a compelling event in sales: a date, an owner and a cost of inaction, all set by someone other than the seller.
For signals specific to the fintech side of the market, see the guide to fintech buying signals.
How do you pick 20 banks out of 200?
Filter on fit, then rank on events. A sales leader at a banking software vendor put the problem this way: "there's [roughly 200] banks ... How in God's name can we identify ... the ones that we should be going for?" The answer is a three-pass funnel that uses only public data.
Pass 1: Fit (200 to about 60). Cut on the attributes your product needs: asset size band, business mix (retail, commercial, wealth), charter and regulator, geography. Call report data gives you all of it. Remove banks that have just completed the kind of project you sell.
Pass 2: Pressure (60 to about 30). Score each bank on structural pressure:
- Efficiency trend: is noninterest expense growing faster than revenue over the last four quarters?
- Proximity to a threshold: within two years of a size-based rule at current growth?
- Regulatory standing: any open public order?
- Stated intent: has management named cost, modernization or AI as a priority on the last two calls?
Pass 3: Events (30 to 20). Rank what remains by dated events in the last 90 days: a leadership change in a role you sell to, an announced merger, an integrator award, a program being staffed. Banks with pressure and a recent event go to the top. Banks with pressure and no event stay on a watch list.
Re-run pass 3 monthly and passes 1 and 2 each quarter when new call reports land.
One refinement for sellers with an innovation story. A value-selling lead at a banking software vendor told us, "80% of my conversations are about cost [and] regulation," and wanted to find the banks ready for a different conversation. Add a fifth pressure criterion for that: evidence of AI or data investment in job posts, executive hires and earnings language.
“My ultimate goal is to know more about the company than they know themselves. Before, that took hours across multiple tools. With Salesmotion, I can get there in 30 minutes or less and walk into a Fortune 500 conversation fully prepared.”
Jeff Dalo
Senior Director Business Development, Analytic Partners
Who do you need to reach at a bank, and what does each care about?
You need five functions covered, and most stalled bank deals have two. One banking software team described the pattern: coverage limited to an economic buyer and a champion, no account plan, and deals that slip late.
| Stakeholder | What they care about | What to bring | Public evidence to cite |
|---|---|---|---|
| CFO | Cost-to-income (efficiency ratio), payback period, capital | A cost case in their units, with a payback date | Efficiency commentary on earnings calls, expense lines in call reports |
| CRO and chief compliance officer | Supervisory findings, control effectiveness, auditability | How the product reduces a named risk and how it is evidenced | Enforcement actions, risk factors, Pillar 3 |
| CIO or CTO | Integration with the core, resilience, architecture roadmap, concentration risk | Reference architecture, integration effort, exit plan | Job posts, modernization announcements, integrator awards |
| COO | Processing cost, error rates, headcount capacity, service levels | Operational before and after, in volumes they recognise | Restructuring announcements, operations hiring |
| Procurement and vendor risk | Due diligence completeness, contract terms, vendor viability | Completed questionnaire, audit reports, financials, named contact | The bank's supplier policies, where published |
Reach risk and vendor management before they reach you. Give each stakeholder their own reason: the CFO's cost case does nothing for the CRO. Write the plan down, even one page, so one contact changing roles does not reset the deal. The multi-threading guide covers the mechanics.
Getting the first meeting is its own problem. A prospecting lead at a software company serving banks and insurers said, "The problem is more around, you know, getting your foot into the door." The fix is the same data: a message that cites the bank's own efficiency trend or a newly posted program role gets read.
Worked example: a regional bank approaching $10 billion
The scenario is hypothetical. A regional bank reports $9.1 billion in total assets, up from $8.5 billion a year earlier. You sell compliance data and reporting software.
The event. At the current pace the bank passes $10 billion within two years. That brings CFPB supervision and the loss of the small-issuer exemption on debit interchange, both tied to published thresholds. The date is predictable, the CFO and CRO own the consequences, and the cost of being unprepared is supervisory and financial. It passes the compelling event test.
The corroboration. On the last earnings call an analyst asks about "crossing costs" and the CFO says preparation is "under way." Two job posts appear: a director of regulatory reporting and a head of compliance testing. The bank is staffing the program, so the vendor decisions are ahead, not behind.
The map.
- CFO: wants crossing costs contained and explained to investors.
- CRO: wants a first CFPB examination without findings.
- CIO: wants reporting built on the existing data platform, not beside it.
- Vendor risk: will classify regulatory reporting as critical.
The sequence. Open with the CRO's new director of regulatory reporting, who has the problem and no incumbent loyalty. Bring the CFO a cost view within two meetings. Send due diligence material before it is requested.
The first message.
Subject: Reporting readiness ahead of $10B
Your call report shows $9.1B in assets and about 7% growth, which puts the $10B line inside two years. The regulatory reporting role you posted suggests the build has started.
A common sequencing issue at this stage: data lineage for consumer compliance reporting takes longer than the reporting itself. Happy to share how to order that work, if useful before your planning cycle closes.
Doing this for 20 banks takes steady monitoring of filings, calls, hiring and leadership moves. Salesmotion is one way to run it: it tracks earnings calls, SEC filings, job postings, leadership changes and M&A per account and turns them into account briefs. The fintech and financial services page shows the setup. A spreadsheet with quarterly call report pulls also works at small scale.
One caution for vendors who sell to banks: your own tools get the same scrutiny your product does. If you bring a new research or AI tool into a bank-facing sales team, expect your vendor management group to review it. This guide to the sales intelligence security review covers what they ask.
The data is public, the deadlines are published, and the committee is knowable. Start with the 20 banks where all three line up.
Frequently Asked Questions
How long does it take to sell software to a bank?
It depends on how the bank classifies the product. Tools supporting critical activities go through full third-party due diligence, contract negotiation and often committee approval, which adds months to the commercial cycle. Non-critical tools move faster. Ask about classification early and plan backwards from the bank's own deadline.
Who makes the buying decision at a bank?
A committee does. The business owner sponsors the purchase, the CFO approves the cost case, the CIO or CTO approves the architecture, and risk, compliance and vendor management can each block it.
What are the best buying signals for selling to banks?
Dated events with a named owner: asset growth toward a regulatory threshold, a public enforcement action, a merger or carve-out, a new CFO or chief risk officer, a core modernization program and a systems integrator award. Each appears in public sources such as call reports, regulator databases, earnings calls and job posts.
Is selling to credit unions different from selling to banks?
The pattern is similar and the scale is smaller. Credit unions are supervised by the NCUA, which sets its own third-party guidance covering planning, due diligence and ongoing monitoring. Buying committees are leaner, and peer references from other credit unions carry significant weight.
How do you find which banks to target first?
Filter the market on fit using call report data, score the remainder on structural pressure such as efficiency trend, threshold proximity and regulatory standing, then rank by dated events in the last 90 days. That reduces a market of 200 banks to a working list of about 20.
