The MLRO or Head of Financial Crime chooses a KYC or AML vendor, and four other functions must approve it: information security, third-party risk management, model risk for any scoring model, and procurement with legal. When a bank classes the service as critical, senior management takes the decision under board oversight. Any one of these functions can stop the deal.
Who are the signers, and what does each one check?
Each signer reviews a different risk, and most work from their own questionnaire. The table shows who they are at a mid-size bank. A smaller fintech may give two or three of these roles to one person, and that person still asks every question in the table.
| Signer | What they check | What they ask the vendor for | Can they stop the deal? |
|---|---|---|---|
| MLRO or Head of Financial Crime | Fit to the firm's risk assessment, detection quality | Test results on the firm's own cases, rule and model documentation | Yes, they own the choice |
| Information security | Data protection, access, hosting | Certifications, penetration test summary, data residency, subprocessor list | Yes |
| Third-party risk management | Vendor health, subcontractors, exit | Financial statements, business continuity plan, exit plan | Yes |
| Model risk management | Whether scoring and screening models work as claimed | Model design, data used to build it, validation evidence | Yes, for any model |
| Data protection officer | Lawful processing of customer data | Data processing agreement, impact assessment inputs | Yes, in the EU and UK |
| Procurement and legal | Price, liability, audit rights, termination | Contract redlines, insurance certificates | Yes, on contract terms |
| Senior management and board | Whether a critical activity is safe to hand to a third party | A summary from the functions above | Yes, for critical services |
Map every one of these people before the commercial proposal goes out. A champion in compliance cannot answer the security questionnaire for you.
What process does a US bank follow?
US banks follow the interagency guidance on third-party relationships that the Federal Reserve, the FDIC and the OCC issued on 6 June 2023. It replaced each agency's earlier guidance and sets five stages for every relationship: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination (Federal Reserve, 6 June 2023). The agencies said the guidance covers relationships with fintech companies.
Prepare for the termination stage before the first security review. The bank has to know how it would leave you, so bring a written exit plan: how data comes back, in what format, and how long the old and new systems can run together.
Model risk adds a second review for any vendor whose product scores customers or transactions. The Federal Reserve's model risk guidance, SR 11-7 (4 April 2011), says vendor products "should nevertheless be incorporated into a bank's broader model risk management framework following the same principles as applied to in-house models" (SR 11-7 attachment). It also expects validation by people independent of the model's development. A machine-learning screening model therefore waits in the bank's validation queue, and that queue sits outside the compliance team's control.
What changes at an EU bank or fintech?
Two rule sets apply, and the split depends on what you deliver.
Software delivered as an ICT service falls under the Digital Operational Resilience Act, which has applied since 17 January 2025 (EIOPA, 2025). Most KYC and AML software arrives this way, so the firm records the contract in its DORA register of information and checks it against DORA's contract terms.
Services delivered by people fall under a different text. On 18 September 2026 the European Banking Authority published final guidelines on third-party risk for non-ICT services. They replace its 2019 outsourcing guidelines, focus on arrangements that support critical or important functions, and require a register of all third-party arrangements. The date of application was still to be confirmed at publication, and firms then get two years to review existing arrangements (Arthur Cox, September 2026).
A vendor that sells software plus a managed alert review team may sit under both. Tell the buyer's third-party risk team which parts of your service are software and which are people, in writing, in the first week.
Why does a fintech's sign-off take longer than its size suggests?
A fintech that runs on a partner bank's licence answers to that bank as well. The bank reviews the fintech's controls, and the fintech's KYC vendor is one of those controls. Expect the partner bank to ask for some of the same documents the fintech asked for.
Ask the fintech's compliance lead three questions on the first call:
- Does your partner bank review your compliance vendors, and does it need to approve a change?
- Will your partner bank's model risk team validate our model, or will yours?
- Which of your licences or registrations lists your KYC provider by name?
The answers tell you how many reviews stand between a verbal yes and a signed contract.
How do you find the right people before the first call?
Use the bank's own documents first, and contact databases second. Annual reports, regulatory filings and conference speaker lists name the MLRO, the Chief Risk Officer and often the head of third-party risk.
Treat titles in contact databases with care. In October 2026 we found a "Co-Founder, RunReveal" title stored on a ClickHouse employee record, so the person's real employer was unclear (our data, October 2026). We now drop any title that names a different company. Check each signer against a second source before you write to them.
For selling into larger institutions from the crypto side, see how crypto infrastructure firms book meetings with institutions.
What should a vendor prepare before the proposal?
Use this decision rule: send the commercial proposal only after you hold a named contact in at least four of the seven signer roles, and the documents below are ready.
- A security pack: certifications, penetration test summary, hosting regions, subprocessors.
- A model document: what the model scores, what data trained it, how you tested it, and how often you retest.
- A written exit plan with data return format and a parallel-run period.
- A one-page split of your service into software and people, for DORA and non-ICT review.
- Answers to the partner bank questions above, for any fintech buyer.
To map the signers at your target banks and fintechs before you pitch, start with The Diagnostic at $2,500.