Key takeaways
- Pick one segment; a building society and a global bank buy in very different ways.
- Expect a business sponsor plus risk, compliance, security and procurement in every deal.
- Third-party risk rules lengthen the cycle, so start vendor review early.
- Prepare the due diligence pack before you need it.
Which bank and insurer prospects should you target first
Target first the segment where your product solves a problem the regulator or the board already cares about, and where the firms are a size you can serve. Banks, building societies, insurers, brokers, asset and wealth managers, and payments firms are all regulated, but they buy differently.
A large bank runs a vendor management office with formal stages and assessments. A small broker or wealth manager may let the owner decide after one meeting, with an outsourced compliance consultant checking the paperwork. Decide which of the two you are built to sell to, and start there.
Who are the financial services decision makers
Financial services decision makers are a group: one sponsor who owns the problem and several reviewers who can stop the deal. Name all of them at each target, because a sponsor without the reviewers rarely gets a contract signed.
- Sponsor: chief operating officer, head of operations, or head of change and transformation
- Technology: chief information officer, chief technology officer or head of architecture
- Security: chief information security officer or head of information security
- Control functions: chief risk officer, head of compliance and the data protection officer
- Buying: procurement, plus third-party risk or vendor management in larger firms
Why do financial services firms take longer to buy
Financial services firms take longer to buy because regulators expect them to manage the risk that comes from suppliers. In the EU, the Digital Operational Resilience Act (DORA) sets rules on how financial entities manage information and communication technology risk, including risk from third-party technology providers. In the UK, the PRA and the FCA expect regulated firms to manage outsourcing and third-party risk and to keep important business services running through disruption.
In practice this means questionnaires, a check on how critical your service is, contract clauses on audit, access and exit, and sign-off from risk and compliance. Ask early which of these apply to you, and confirm with your own adviser what the rules mean for your service.
What should a vendor due diligence pack contain
A vendor due diligence pack contains every document a reviewer will ask for, so the review starts the day the sponsor says yes. Keep it current and give it an owner in your company.
- Security policies and the results of recent penetration tests
- Certifications held, such as Cyber Essentials or ISO 27001, and the target date for any still pending, such as a SOC 2 Type II report
- A data processing agreement and your list of sub-processors
- Business continuity, incident notification and exit plans
- Insurance certificates and recent financial statements
How do you start prospecting financial services clients
Start prospecting financial services clients from a trigger, not a list: a regulatory deadline, a new COO or head of change, a merger, a system replacement or a priority named in the annual report. A trigger gives the sponsor a reason to talk this quarter.
Write a different message for each role at the same firm and send them in parallel. The COO hears about the operational problem, the security lead about how data is protected, and procurement about how your contract handles audit and exit.
How to find financial services leads, step by step
Work on a short list of firms in one segment at a time.
- Choose one segment and size band, such as mid-sized insurers or wealth managers.
- List firms in that segment with a current trigger from their reports or news.
- Name the sponsor and the reviewers at each firm: operations, technology, security, risk and procurement.
- Prepare the due diligence pack before the first meeting.
- Write one message per role and contact them in parallel.
- Ask in the first call which vendor review steps and contract clauses apply.
Where Pebbles Ai fits
- CapabilityProspecting & customer recordsName up to ten insurers or banks with roles such as head of change or information security and a location, and Find fresh leads returns work emails where found, each with a confidence score.
- CapabilityResearch & analysisAsk an assistant to read a firm's annual report and public website and list its stated priorities, with numbered citations to each source.
Common questions
Is it worth selling to small financial services firms?
Often, yes. Small brokers and wealth managers decide faster and the owner is easy to reach, though each deal is smaller and they still ask the same security and data questions.
Do you need certifications to sell to banks?
Most banks ask for evidence of security controls, and a recognised certification or audit report makes the review faster. Without one, expect a longer questionnaire and more evidence requests.
What does DORA mean for suppliers?
DORA is an EU regulation on digital operational resilience for financial entities, and it asks them to manage risk from their technology suppliers. Suppliers can expect contract terms and questions on resilience, incidents and exit; confirm with your adviser whether your service is in scope.
About this page. Written by the Pebbles Ai team for people who run sales, marketing and growth. Last updated .
