Selling into banks, insurers, payment companies and regulated fintechs breaks three assumptions that ordinary B2B outbound is built on.
Your champion cannot buy on their own. Your email is filtered harder than anywhere else. And at some point someone will ask how you got their contact details, and the answer becomes part of the evaluation.
Each of those changes what you do, so take them in order.
Your email is filtered harder
Start here, because it is the thing teams discover last after concluding their message is wrong.
Regulated organisations run aggressive inbound mail security: tenant-level filtering their own administrators configure, link rewriting and sandboxing, attachment stripping, and policies that quarantine unknown external senders by default. None of it appears in any sender-side dashboard (not Google Postmaster Tools, not Microsoft SNDS) because corporate tenant filtering is invisible from outside.
What this means practically:
No links in the first email. A link in a cold email to a bank is frequently rewritten, sandboxed or treated as a risk indicator. Say what you have to say in text and put the link in the reply.
No attachments, ever. A one-pager attached to a cold email will not arrive, and may harm your sender reputation with that tenant.
Plain text beats designed HTML. Image-heavy templates with tracking pixels and redirect links look exactly like the pattern these systems are tuned to catch.
Authentication must be perfect. SPF within the ten-lookup limit, DKIM signing, DMARC aligned. Marginal setups that pass at consumer providers get quarantined by corporate security policies.
Expect a lower reply rate and read it correctly. A sequence producing 4% in software and 1.5% into regulated accounts has not necessarily failed. Some of the gap is filtering rather than disinterest, and the right response is to add channels rather than to rewrite the copy again.
How deliverability tools compare covers what you can and cannot see. The short version: against corporate tenants, you are substantially flying blind, so make the mail as unremarkable as possible.
Your champion cannot buy alone
The second structural difference. In most B2B sales a champion builds consensus. In regulated buying, a champion assembles a submission that other functions can veto.
The functions with a veto, and what each one wants:
| Function | What they are assessing | What satisfies them |
|---|---|---|
| Information security | How you handle data, your controls | SOC 2 Type II or ISO 27001, completed questionnaire |
| Compliance / risk | Regulatory exposure of using you | Data residency, sub-processor list, audit rights |
| Procurement / vendor management | Contractual and concentration risk | Financial stability, exit provisions, insurance |
| Legal | Liability, DPA terms | A DPA you will actually sign |
| The business owner | Does it solve the problem | Everything ordinary selling addresses |
Only the last row cares about your product. The other four can stop the deal and none of them can start it.
Three consequences for outbound.
Multi-thread from the first week, not after the first call. The security and compliance stakeholders will be involved whether or not you have met them. Having already reached them means your champion is not explaining you from scratch to a sceptical audience. How to multi-thread properly covers the sequencing, and the fintech adjustment is that the extra threads are gatekeeping functions rather than additional buyers.
Arm the champion early. The single most useful thing you can send after a first positive call is not a proposal. It is the security pack, certifications, sub-processor list, data flow description, DPA. Your champion’s real job is getting you through internal review, and most vendors make them wait weeks for the documents that decide it.
Expect the cycle to be long and say so. Six to twelve months is normal. A sequence built on urgency reads as naive to someone who knows the review process takes a quarter on its own.
Your own compliance becomes part of the pitch
The reversal that catches people out, and the one worth internalising.
Ask a compliance officer at a bank how you obtained their mobile number and the answer matters. Not as a complaint, as a data point about whether your organisation handles personal data properly. You have just demonstrated your data practices to the person whose job is assessing data practices.
So:
Be able to answer plainly. “Your work email is in a business contact database we license, and our privacy notice covers prospect data, here it is.” Evasion is far worse than the fact.
Have a prospect-specific privacy notice. Not the customer-facing one. A page naming third-party sourced data and your lawful basis. In European markets you are required to tell people where their data came from no later than the first communication anyway. Selling into Europe from outside it covers that obligation.
Honour opt-outs instantly and across every channel. A compliance buyer who unsubscribes and then gets a LinkedIn message has learned something decisive about your systems.
Do not use personal mobile numbers for first contact. Technically available, frequently lawful, and it reads badly to exactly this audience. Work email and LinkedIn for the first touch.
Be careful with call recording. Several jurisdictions require all-party consent, and regulated buyers may have policies against being recorded. Ask, every time. The outbound compliance guide covers the landscape and is not a substitute for advice on your specific markets.
The upside: doing this properly is a differentiator with this buyer in a way it is not elsewhere. Most of their inbound vendor contact is sloppy.
Channel mix
Email, with the constraints above. Still the primary channel, with lower expectations.
LinkedIn, which works better than email here. It bypasses tenant filtering entirely and the audience is present, financial services professionals are active on LinkedIn, and a connection request from a named person at a real company carries more weight than an email that may never arrive. For regulated accounts, LinkedIn is often the highest-yield channel rather than the supporting one.
Phone, with the gatekeeper problem. Large institutions route through switchboards, direct dials are scarce and often unlisted, and compliance-conscious organisations do not hand out numbers. Mobile data coverage is poor for these titles. Workable for smaller fintechs, difficult for established institutions.
WhatsApp: no. In most regulated contexts, business conversation on consumer messaging is discouraged or prohibited by policy, several firms have been fined over off-channel communications. Approaching a regulated buyer there asks them to breach their own rules.
Events and referrals, which deserve a mention. In regulated sectors, a warm introduction clears several gates at once. Outbound’s realistic job is often to build enough familiarity that an introduction becomes possible, rather than to produce a meeting directly.
Signals that work
| Signal | Why it matters | Window |
|---|---|---|
| New CISO, CRO or Head of Compliance | New mandate, budget, and no ownership of prior vendor choices | 90 days |
| Regulatory deadline in their sector | Fixed date, known scope, often no internal capacity | Work backwards from the date |
| Hiring for a role they cannot fill | Demonstrated need plus allocated budget | 6 weeks |
| Enforcement action or public incident | Real budget follows, and timing requires care | Months |
| Funding round at a fintech | Capital plus a compliance build-out requirement | 6–12 weeks |
| New licence or market entry | New obligations in a new jurisdiction | 3–6 months |
Regulatory deadlines are the strongest signal in this sector, because they create non-discretionary spend on a known timetable. Knowing your buyers’ regulatory calendar and working backwards from it is more valuable than any list-building exercise.
On enforcement actions and incidents: budget genuinely does follow, and arriving with a pitch days after a public failure is the kind of approach people remember badly. Wait, lead with something useful, and never reference the incident as a reason they need you.
The message
Four rules.
Specificity about their regulatory context. “Teams dealing with [specific requirement] at [specific company type]” demonstrates you understand the environment. Generic risk language signals you do not.
Lead with your controls where it is credible. For a security-adjacent product, naming your certification in the first email can be the strongest line in it. For an unregulated-looking product it is noise.
No urgency. It does not work, and it marks you as someone who has not sold here.
Short, plain, link-free. For the filtering reasons above, not for style.
What to track differently
Reply rate by account type, separating regulated from unregulated. A blended figure hides both.
Security-pack-to-progression rate. Of deals where you sent the security documentation, how many advanced. If that number is poor, the gap is in your documentation rather than your selling.
Time in vendor review, measured separately from your sales cycle. It is the longest stage, it is where deals quietly die, and it is the one thing you can improve by being organised.
Channel yield on regulated accounts specifically. LinkedIn will usually outperform email here, which is the opposite of the general pattern, and you only find out by segmenting.
The short version
Regulated buyers filter mail at the tenant level, invisibly. Send plain text, no links, no attachments, with perfect authentication, and expect a lower reply rate that is partly filtering rather than disinterest.
Your champion assembles a submission that security, compliance, procurement and legal can each veto. Multi-thread into those functions in week one, and send the security pack as the first follow-up rather than a proposal.
How you obtained their data becomes part of the evaluation. Have a plain answer, a prospect-specific privacy notice, instant cross-channel opt-outs, and no personal mobiles or consumer messaging apps.
LinkedIn usually outperforms email here, because it bypasses the filtering entirely. Regulatory deadlines are the strongest signal, and new security or compliance leadership is next.
Next: how to multi-thread a target account, or the outbound compliance guide.
Frequently asked questions
Why do cold emails to banks and financial institutions underperform?
Regulated organisations run aggressive tenant-level mail filtering with link rewriting, attachment stripping and default quarantine for unknown external senders, none of which is visible in sender-side dashboards. Part of a low reply rate is filtering rather than disinterest.
How should you structure outbound for a regulated buyer?
Multi-thread into security, compliance and procurement in the first week, because those functions can veto the deal and will be involved regardless. Send your security pack (certifications, sub-processor list, data flows, DPA) as the first substantive follow-up.
What should you say when a compliance buyer asks how you got their details?
Answer plainly and accurately: name the licensed business contact database and point to a prospect-specific privacy notice covering third-party sourced data and your lawful basis. Evasion is far more damaging than the fact, since you are demonstrating your data practices to someone who assesses data practices.
Should you use WhatsApp to reach financial services buyers?
No. Business conversation on consumer messaging is discouraged or prohibited by policy at many regulated firms, several of which have been fined over off-channel communications, so the approach asks them to breach their own rules.