Selling into financial services changed in a way most lead generation advice has not caught up with. Since January 2025, EU financial entities have operated under a regulation that makes their software and service suppliers a documented, assessed, register-recorded category of risk. Your prospect now has a compliance obligation attached to buying from you, and that obligation sits inside the sales cycle whether or not anyone mentions it on the first call.

This covers what that actually changes in practice, how the buying committee differs from a normal B2B deal, and how to sequence outreach so the compliance workstream runs alongside the commercial one rather than ambushing it at the end.

TL;DR

The Digital Operational Resilience Act entered into force on 16 January 2023 and has applied since 17 January 2025 across 21 types of financial entity. If you supply ICT services to any of them, your buyer has to hold policies covering contractual arrangements for services supporting critical or important functions, assess your subcontracting, and record you in a register of information that supervisors collect. None of that stops you selling, but it does mean the deal contains a workstream your champion does not control and cannot shortcut. The practical consequences are consistent: the buying committee includes people who can only say no, the security review starts earlier than your commercial process expects, and the question that actually gates the deal is whether you can answer a due-diligence pack without a scramble. So build outreach around removing that friction rather than around your feature set. Lead with what you can evidence, get your security documentation to a state where you can send it the same day it is asked for, and expect a longer cycle with fewer, better-qualified opportunities. The firms that win here are not the ones with the best cold email. They are the ones that are already easy to approve.

What actually changed, and what it means for you

DORA has applied since 17 January 2025. It entered into force on 16 January 2023 and covers 21 different types of financial entity. That is a wide net: banks, insurers, investment firms, payment institutions and more.

Your prospect must manage you as third-party ICT risk. Financial entities are required to hold policies on contractual arrangements covering ICT services that support critical or important functions, and to assess what happens when those services are subcontracted. If your product touches something the buyer considers critical, you are inside that scope.

There is a register of information. DORA establishes standard templates for a register that financial entities maintain on their ICT third-party arrangements, and supervisors collect. Your contract becomes a supervisory data point rather than a private commercial matter.

Which changes who has to be satisfied. The commercial buyer wants the outcome. Risk, compliance and security functions need to be able to justify the arrangement to a supervisor. Those are different questions and they are answered by different evidence.

And it changes when the friction arrives. In an unregulated B2B deal, procurement appears at the end. Here the assessment can start as soon as the deal looks real, which is earlier than most sales processes are prepared for and is why deals that felt strong go quiet in month two.

None of this is a reason to avoid the sector. It is a reason to build the answer before you need it, because the vendors who can produce documentation the same week are visibly easier to approve than the ones who cannot.

The sequence that survives a compliance workstream

Before any outreach, assemble the pack. Security documentation, subprocessor list, data residency, incident response, business continuity, and whatever certification you hold. If a prospect asks for this in week three and you take three weeks to produce it, you have told them what working with you looks like.

First contact leads with evidence, not features. In this sector the strongest opener is frequently a fact about your posture rather than a claim about your product. It is unusual, it is verifiable, and it speaks directly to the thing the buyer is worried about.

Ask about the assessment process on the first call. Who reviews vendors, how long it takes, and whether the service you provide would be classed as supporting a critical or important function. Champions almost always know, are rarely asked, and the answer tells you the real timeline.

Send the pack before it is requested. Offering documentation unprompted moves you from a risk to be assessed into a vendor who has done this before, and it starts the workstream while the commercial conversation is still warm.

Expect the quiet period, and plan for it. There is usually a stretch where the champion has gone to compliance and has nothing to report. That is not a lost deal, and chasing it commercially during that window makes you look like you do not understand their world.

Close on both tracks. The deal completes when the commercial terms and the contractual provisions are both satisfied. Treating the second as paperwork at the end is how a signed-in-principle deal slips a quarter.

Where the leads actually come from

Large deals into regulated entities: account-based, and slowly. A small number of named institutions, multi-threaded across the commercial buyer and the risk function, worked over quarters. The arithmetic that decides this is in our ABM versus demand generation piece, and fintech sits firmly on the ABM side when the buyer is a bank.

Smaller deals into regulated entities: outbound with an evidence-led opener. The cycle is still long but the committee is smaller. Volume outreach works provided the first message speaks to posture rather than features.

Selling to fintechs rather than to banks: this is normal B2B again. A payments startup buying a marketing tool is not running a DORA assessment on you. Do not import the heavyweight process into deals that do not need it, because it slows you down for nothing.

Selling infrastructure to fintechs who sell to banks: your buyer inherits the scrutiny. They will pass their obligations down to you contractually, so you face the same requirements one step removed. Prepare as though you were selling to the bank.

Events and peer credibility carry unusual weight here. Regulated buyers ask each other who they use. Being present where they gather is worth more in this sector than in most, and our professional services lead generation piece covers the event-anchored mechanics that apply directly.

What does not work

Feature-led cold email. The person who cares about your features is not the person who can stop the deal, and the person who can stop it is not moved by a feature list.

Pressure during the assessment window. Nothing damages credibility faster than commercial urgency applied to a compliance process the champion cannot accelerate.

Vague answers on data. Where it lives, who processes it, who you subcontract to. Any hesitation on these is read as a red flag rather than as a detail to follow up.

Promising a certification you are working towards. Say what you hold today. "In progress" is a legitimate answer and an inflated one is discovered during exactly the process designed to discover it.

Treating every financial services prospect the same. A tier one bank and a twelve-person payments startup share an industry label and nothing else about how they buy.

Ignoring the incumbent's switching cost. Replacing a recorded ICT arrangement is more work for the buyer than adding a new one. Positioning as an addition rather than a replacement often shortens the path considerably.

FAQ

How is lead generation for fintech different from other B2B?

The buying committee includes functions whose job is to say no, and since January 2025 EU financial entities have had explicit regulatory obligations covering their ICT suppliers, including contractual policies and a register of information that supervisors collect. That means the deal contains a compliance workstream running in parallel with the commercial one, and it usually starts earlier and lasts longer than sellers expect.

Does DORA apply to us if we sell software to a bank?

If your service supports what the financial entity classes as a critical or important function, you fall inside the scope of their third-party ICT risk obligations. The regulation applies to the financial entity rather than to you directly, but the requirements reach you through the contract and the assessment. Whether your service is classed that way is a question worth asking on the first call.

What is the best channel for fintech lead generation?

It depends on deal size more than on the industry. Large institutional deals need an account-based motion multi-threaded into both the commercial and the risk side. Smaller deals respond to outbound with an evidence-led opener. Events and peer referral carry more weight in financial services than in most sectors, because regulated buyers actively ask each other who they use.

How long is a fintech sales cycle?

Longer than the equivalent unregulated deal, and the extra time is mostly the assessment rather than the decision. Plan for a quiet period after the commercial conversation goes well, and judge pipeline health on whether the compliance workstream is progressing rather than on how recently the champion replied.

What should be ready before you start outbound into financial services?

Security documentation, a subprocessor list, data residency and processing detail, incident response and business continuity documentation, and an honest statement of what certifications you actually hold. If a request for these takes you three weeks to fulfil, you have answered the buyer's real question before they finished asking it.

Should you say you are working towards a certification?

Say what you hold now, and be straightforward about what is in progress and when. The assessment process exists specifically to verify claims like these, so an inflated one gets found, and it gets found by the function least inclined to give you the benefit of the doubt.

Bottom line

Financial services buyers have had documented obligations about their software suppliers since January 2025, and those obligations sit inside your sales cycle whether anyone names them or not. Build the evidence pack before you send the first email, lead with posture rather than features, ask on the first call who assesses vendors and how long it takes, and send documentation before it is requested. Expect a quiet stretch while compliance does its work and do not apply commercial pressure to it. Then sort your targeting by deal size rather than by the fintech label, because a tier one bank and a twelve-person payments company buy in completely different ways.

Want the pipeline built for a regulated buyer rather than a generic one? Book a call with GROU. We run lead generation and outbound for fintech and financial services clients, and the case studies show the campaign shapes behind the work.

We are GROU, a B2B pipeline agency that runs lead generation, outbound, and LinkedIn content for clients across manufacturing, fintech, iGaming, software, and professional services. The sequencing and targeting guidance reflects our deployments between 2024 and 2026, anonymized to protect client confidentiality.