Marketing to the B2B Buying Committee in Fintech and SaaS Deals

By Yamm Labs · Updated October 2026 · 13 min read

The demo went well. The head of transaction banking at a mid-sized private bank asked for pricing, and the fintech’s sales lead marked the deal as likely to close this quarter. Three weeks later two emails arrive. One is a vendor risk questionnaire from the bank’s information security team, a spreadsheet that runs to several tabs. The other is from the bank’s compliance team, asking where the line “cuts reconciliation errors” on slide nine came from. Nobody at the fintech has met either team. That is the b2b buying committee showing up late, and most marketing plans never made room for it.

What is a B2B buying committee for a fintech or SaaS seller?

A buying committee is everyone at the buyer who has to say yes, or can say no, before the purchase goes through. Some of them never attend a demo. In a bank deal, the people who decide whether a vendor is safe to use often matter more than the person who liked the product.

Two terms come up throughout this guide. Your ideal customer profile (ICP) is the description of the firm you sell to best, by size, sector and need. Account-based marketing (ABM) is the practice of picking named target accounts and planning campaigns around the people inside each one, instead of chasing anonymous leads. Committee marketing is ABM with the full seat list written down.

The committee changes with the buyer. A payments company selling a collections dashboard to an Indian private bank will meet operations, technology, information security, risk, compliance, procurement and the budget holder. A SaaS firm selling an onboarding tool to a bank in Riyadh or Dubai meets a similar cast, with the bank’s own compliance team often reviewing anything that carries the bank’s name. A Bengaluru accounting tool sold to a fifty-person distributor may face one owner and one chartered accountant. As a contrast, a US mid-market software buyer often runs a committee of IT, finance and the user team, with fewer regulator-driven seats.

Analyst firms publish figures on how many people sit on a typical committee. Many of those figures sit behind paywalls and use different definitions, so this guide does not quote them. Count the seats in your own last five deals instead; that number is the one your plan needs. For how committee work fits a wider fintech plan, see our B2B fintech marketing playbook.

Why the buying committee is bigger when the buyer is regulated

A regulated buyer adds seats because its regulator holds it responsible for its vendors. The extra reviewers are doing a job the rules gave them, so they cannot be skipped, only prepared for.

In India, the Reserve Bank first set these duties out for IT vendors in its Master Direction on outsourcing of information technology services, issued in April 2023 and in force from October 2023. For commercial banks, the Reserve Bank’s outsourcing directions of November 2025 now carry them: the bank must carry out due diligence on a service provider, keep the right to audit it and give the Reserve Bank the right to inspect it. The directions also say outsourcing does not reduce the bank’s own obligations. When the bank’s information security team sends you a questionnaire, it is building the record that rule expects. You cannot market around that. You can make it faster to complete.

Data adds a legal seat. If your product handles the bank’s customer data, the bank will usually treat itself as the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and treat you as its processor. The government notified the DPDP Rules on 14 November 2025 with an eighteen-month period for phased compliance, according to the Press Information Bureau’s note on the Rules. Expect the legal seat to ask for data processing terms and to read your own privacy notice line by line.

Compliance also reads your marketing. ASCI’s code expects advertising claims in India to be truthful and capable of substantiation, and bank compliance teams tend to apply a similar test to any vendor claim that might reappear in the bank’s own material. “Cuts reconciliation errors” needs a source or a softer verb. A number with no method behind it will come back as a question, usually in the final week before signature.

Co-marketing brings the bank’s approvals into your calendar. In Saudi Arabia, the Saudi Central Bank’s rules for advertising financial products require a financial institution’s compliance department to review and approve advertising materials in writing before they are published. If your launch plan includes a joint campaign with a Saudi bank, its compliance team is a seat on your marketing plan, with its own lead time.

Your own lead capture is under review too. The DPDP Rules require a separate consent notice that is clear and explains the specific purpose for which data is collected. For leads in the European Union, the European Commission’s guidance on consent says pre-ticked boxes are not valid consent under the GDPR. A gated report that folds a newsletter opt-in into the download button is hard to defend under either regime. This is general guidance, not legal advice; your compliance team decides.

SIGNALNewsletter by Yamm Labs

The next piece, straight to your inbox.

New writing on BFSI brands, B2B and influencer marketing, and AI search.

Email *

Subscribe

Subscription form is not available at the moment

One click to unsubscribe. Privacy policy

How a bank buying committee works: six seats and the order they enter

A bank’s buying committee has six seats, and they enter in a rough order. The sponsor arrives first and the people who can stop the deal often arrive last, which is the root of most stalled fintech pipelines.

• Business sponsor. The head of cards, digital lending, transaction banking or operations who owns the problem. Wants a business case and a peer reference. Enters at first meeting.
• Daily users. Operations staff, collections teams or relationship managers. Want to see their own screen working on their own data. Enter at the demo or pilot.
• Technology and information security. The chief information officer’s team and the chief information security officer’s team. Want the architecture, the data flow, where data is stored and how incidents are handled. Enter after shortlisting.
• Risk and compliance. Operational risk, outsourcing risk and the compliance function. Want to know which rules apply, what you claim and who is accountable when something fails. Enter after shortlisting, sometimes later.
• Procurement and legal. Vendor onboarding, contract terms, data processing terms and liability caps. Enter near the end and control the timeline from there.
• Finance approver. The chief financial officer’s office or the budget holder above the sponsor. Wants total cost, payback and the cost of doing nothing. Signs last.

The table maps each seat against five criteria: the question that seat asks, the asset that answers it, when it usually enters, whether it can stop the deal and who on your side should own it. Score your current material against each row. A blank cell in the asset column is a delay you have already scheduled.

For a small business buyer, the sponsor, procurement and finance seats are often the same person, and the security seat may be a part-time IT vendor. For a large bank in the Gulf or India, the security and risk seats can each be a committee of its own. The table still works; only the number of names per row changes. The finance seat is where many fintech decks are weakest, and our note on positioning for the CFO covers how to write for it.

How to start marketing to a b2b buying committee

Start by writing down who blocked or slowed your last deals, then build one asset per seat before the next campaign goes out. Most of the work is documents, not ads.

1. Map the seats in your last five won and five lost deals. For each one, note who joined, at which stage, what they asked and how long their review took. This is your real committee, and it beats any industry average.
2. Ask your sponsor, at the first serious meeting, for the bank’s vendor onboarding checklist and a blank copy of its security questionnaire. Many sponsors will share them, and the request itself tells them you have done this before.
3. Build the security pack and the compliance pack before the shortlist stage. Pre-fill the questionnaire formats you see most often. List every claim in your deck with its source, or rewrite it.
4. Write one page on your website for each veto seat: how you handle data, how you support a bank’s outsourcing review, what your contract covers. These pages answer the questions reviewers search for when nobody has sent them anything.
5. Run account-based campaigns to the technology, risk and compliance functions of your named accounts, alongside the business sponsor. The aim is recognition: when the questionnaire lands, the reviewer has already seen your name and your security page.
6. Fix your own lead capture. Give each gated asset a clear purpose statement and a separate, unticked opt-in for anything beyond that purpose.

Take a hypothetical payments company chasing a ₹60 lakh annual contract with a mid-sized bank. If the security review starts after the demo and takes ten weeks, those ten weeks sit inside the quarter the sponsor promised. Sending the security pack at shortlist stage moves the review earlier. It rarely shortens it much. The lesson is that marketing mostly controls when a review starts, not how long it lasts, so the start date is the number to move.

The person who likes your demo can start the deal; the person who reads your security pack decides when it ends.

How to measure buying committee coverage and speed

Measure how many seats you reach and how long each review takes, because lead volume says almost nothing about a committee sale. Attribution across six people and nine months is hard, and no dashboard will settle it fully. These proxies are usable.

Seat coverage = seats engaged ÷ seats mapped, per account

• Seat coverage shows whether you are talking to the committee or only to the sponsor. Track it at each pipeline stage. An account at proposal stage with coverage of one in six is a forecast risk.
• Days to first veto-seat contact counts the days from first meeting to the first conversation with security, risk or compliance. Shorter is better, and it is the metric most directly under marketing’s control.
• Questionnaire first-pass rate is the share of security questions answered from your pack without a new call. It shows whether the security pack is doing its job.
• Claims queries per deal counts how often compliance asks where a claim came from. Each query points to a line in your material that needs a source.
• Review duration by seat records days spent in security, legal and procurement. Compare accounts that got the packs early with those that did not.
• Win rate by coverage band compares deals with low, middle and high seat coverage. After a few quarters, it shows whether committee work pays for itself in your market.

Report these to your CFO next to pipeline value. A short line works: the cost of the packs and the account campaigns, the change in review days, and the review date for the plan. If coverage rises and review days do not fall after two quarters, the packs need rewriting.

What goes wrong with buying committee marketing, and the early signs

The common failure is marketing that reaches only the sponsor, and it shows up weeks before the deal stalls. The table pairs each failure with the signal you can spot early and the fix.

Most of these failures look like sales problems in the forecast meeting. They start in marketing, because the material each seat needs was never written.

When a buying committee plan is the wrong choice

A full committee plan is wrong when one person buys, when the deal is too small to carry the effort or when your product cannot yet pass the review you would be inviting. In those cases, a lighter plan wins.

Choose a lighter plan if you sell a self-serve product to small businesses, priced so the owner can pay by card and the accountant can approve it in a day. A security pack and six seat pages would cost more than the deals return. A clear pricing page and a short trust page do the job. Our B2B marketing hub covers that kind of plan.

Wait if you cannot yet answer a bank’s security questionnaire truthfully. Marketing to the security seat before the product has the controls in place only brings the rejection forward. Fix the product, then market it.

Keep it small if you are still finding product-market fit with three or four design partners. Talk to their reviewers directly; you do not need campaigns for people you can call. Ask your sponsor whether the bank has a lighter route for a small, time-limited pilot, and plan the full committee work for the step after the pilot.

Choose the full plan if your average contract runs to several lakh rupees a year, your buyers are banks, insurers, lenders or large enterprises, and your last lost deals stalled in security, compliance or procurement. That pattern is the committee telling you where to spend.

People also ask

Who is on a B2B buying committee at a bank?

Usually a business sponsor, the daily users, the technology and information security teams, risk and compliance, procurement and legal, and a finance approver. Large banks may run security and risk as separate committees. The exact list varies by bank, so ask your sponsor who reviewed the last vendor they brought in.

How is a buying committee different from a buyer persona?

A persona describes one type of person and what they care about. A buying committee is the set of people inside one account who must all agree. You still write for personas, but you plan and measure by committee, seat by seat, account by account.

How long does a bank’s vendor security review take?

There is no reliable public figure, and it varies widely by bank and by how much customer data your product touches. Measure it in your own deals. The part marketing can change is when the review starts, by sending a security pack at shortlist stage.

Should a fintech gate content aimed at bank reviewers?

Mostly no. Security, data handling and compliance pages work best open, because reviewers search for them before they contact you. If you do gate a report, state its purpose on the form and keep any marketing opt-in separate and unticked, in line with India’s DPDP Rules and, for EU leads, the GDPR.