A commercial method can provide a framework. It does not produce the same results from one institution to the next, one geography to the next, one market to the next. Technology companies, advisory firms and investors approaching a bank or an insurer with their usual method (demonstration, trial period, volume of outreach) soon find this out. In financial services, purchasing decisions take place in an environment where governance, risk management and compliance requirements directly shape selection and approval processes.
Interest is not a contract
Take a hypothetical example. A fintech offers a payment solution to a bank. It convinces the innovation team of the product's value. That interest is not approval: agreement is still needed from security, risk management, procurement and a sponsor who carries the budget. Each judges the same solution through a different risk.
Buying is a process, not a single decision
How far control and support functions are involved depends on the materiality of the service, the type of supplier and the institution's procedures. For an important or critical service, risk, information security, compliance, procurement and legal are generally involved. For a lower-risk service, the approval process may be simpler.
A commercial strategy that addresses only the business sponsor leaves the most serious objections unanswered. The process (who approves, who can block, in what order) has to be mapped before choosing whom to meet, not afterwards.
Regulation shapes commercial priorities
In the Union, DORA has applied since 17 January 2025 and puts the control of ICT third-party providers at the centre of resilience requirements. In the United Kingdom, the critical third parties regime became operational with the designation of the first providers in July 2026, and new rules on reporting operational incidents and certain third-party arrangements will apply from 18 March 2027. AI governance and regulatory requirements fall under a different framework.
These regimes are not interchangeable: their scope and timetables differ. An offer that answers an obligation the institution has already identified finds a sponsor more easily than one presented as one more innovation. And the supplier must anticipate what it will be asked: oversight, audit, exit, subcontracting.
Proof before promise
One of the first questions is almost always: "Who else uses it?". For a new entrant to a market, credibility does not rest only on local references. It is also built through the quality of the documentation, an understanding of institutional requirements and the ability to show that the proposed solution is relevant. Promises of quantified gains, hard to verify, damage credibility more than they build it.
One market, different realities
France, the United Kingdom, Benelux, Switzerland: supervisors, calendars, languages and purchasing habits differ. The same words (resilience, critical third party, high-risk AI) cover neither the same obligations nor the same counterparts from one country to the next.
What this changes for the commercial approach
- Start from the counterpart's agenda (regulatory, risk, transformation) before describing the offer.
- Map the decision process and prepare an answer for each function involved in the approval process.
- Prepare due diligence before it is requested.
- Prefer a few high-quality conversations to a volume of approaches.
- Adapt the approach market by market.
In financial services, commercial performance does not come from repeating one method from one market to the next. It depends on understanding how decisions are made, the constraints of each organisation and the real conditions of market access.
This understanding sits at the heart of Tyros Group's approach: combining market intelligence, commercial strategy and knowledge of organisations to turn growth ambitions into concrete opportunities.
Organisations preparing their arrival in a market can draw on Tyros Private.
References
- Regulation (EU) 2022/2554 (DORA), EUR-Lex; ESMA, Digital Operational Resilience Act
- HM Treasury, designation of the first critical third parties (GOV.UK)
- FCA, PS26/2: operational incident and third party reporting
This text offers a general analysis. It is neither legal advice nor regulatory advice.