Sales Prospecting for Fintech Companies: Public Registries
Prospecting for fintech companies that sell to banks and credit unions: the public registries that list every account, the regulator triggers and the calendar.
Fintech companies that sell to financial institutions can build their prospect list from public registries. The FDIC lists every insured bank with assets and primary regulator, the NCUA publishes quarterly credit union data, and NMLS Consumer Access shows state licences. Enforcement actions and proposed guidance are dated triggers, and the data refreshes every quarter.
Key takeaways
- The FDIC institutions API returned 4,232 active insured institutions on September 18, 2026, with total assets, primary regulator, charter and web address on each row.
- The primary regulator field tells you where an institution's enforcement actions are published: the OCC, the FDIC, the Federal Reserve Board or the NCUA.
- On September 11, 2026 four agencies requested comment on proposed third-party risk management guidance that would replace the 2023 guidance once final.
- The FDIC says its Quarterly Banking Profile appears about 55 days after each quarter ends, which gives prospecting a quarterly rebuild cycle.
Reviewed and updated September 18, 2026
A sales lead at a fraud-tooling startup asks for a list of banks under ten billion in assets and gets a spreadsheet from a data vendor. Some of the rows are holding companies, others are branches, and nothing in it says who supervises each institution or when anything about it last changed. The same week, every field she needed was sitting in a free federal database, refreshed that morning.
This guide is for fintech companies that sell to financial institutions: software, infrastructure, fraud, compliance and payments vendors whose buyers are banks, credit unions and licensed non-bank lenders or money services businesses. It is about one part of the job, which is prospecting: where those accounts are listed in public, what each field lets a rep infer, which regulator publishes which trigger, and how the supervisory calendar sets the rhythm. The generic method is on our sales prospecting page. The argument that fintech is two markets, and that the vendor assessment is a pipeline stage, is on our fintech lead generation page, and this guide builds on it without repeating it. If you sell cards or treasury products to ordinary companies, your accounts are not in these registries, and filter and signal prospecting is the better starting point.
Your market is enumerated by its regulators
Most B2B sellers estimate their market. A fintech selling to banks can count it, because every insured institution is on a federal list.
Banks. The FDIC's data tools page describes BankFind Suite as the place to "Determine if a bank is FDIC-insured, locate bank branches, see a bank's mergers and acquisitions, and review a bank's history." (FDIC data tools, fetched September 18, 2026.) Behind it sits a public API whose documentation lists separate datasets for institutions, locations and branches, structure change events, failures, summary of deposits, financials and demographics (FDIC API documentation, fetched September 18, 2026). We queried the institutions dataset on September 18, 2026 for active institutions and asked for nine fields. The response reported 4,232 active institutions from an index created that morning, and each row carried the institution's name, city, state, total assets, primary regulator, bank class, charter, web address and the date it was established.
Credit unions. The NCUA publishes the equivalent for credit unions. Its call report data page says the quarterly files "consist of the quarterly Call Report financial and miscellaneous information from natural person credit unions available from March 1994", delivered as a zip of comma delimited text files (NCUA call report data, fetched September 18, 2026). The quarterly summary page listed June 2026 as the most recent quarter on the day we fetched it.
Licensed non-banks. Money transmitters, consumer lenders and mortgage companies are licensed state by state, and the shared record is NMLS Consumer Access. Its own page says it "Contains licensing/registration information on mortgage, consumer finance, debt, and money services companies, branches, and individuals licensed by state regulatory agencies participating in NMLS." It is just as clear about its limits: "Not all state agencies have all license types on NMLS", and it does not include applications a state has not yet approved. (NMLS Consumer Access, fetched September 18, 2026.) The page describes itself as a free service for consumers and says users are subject to its terms of use. Treat it as a place to look up a named company's licences, state by state. This article does not teach bulk extraction from it or from any other site.
None of the three holds a named contact or an email address. They give you the account, its size, its supervisor and its history. The person is a separate piece of work.
What each field lets a rep infer
A registry row is a set of filters, and a few of the fields do more work than they look like they do.
Your honest size band. Pick the institutions whose vendor assessment your company can pass today.
Which agency supervises the institution, and so which agency publishes its enforcement actions.
How the institution is chartered, which goes with who supervises it.
Mergers and acquisitions, each one a dated event that reopens system decisions.
The route to the institution's own site, where the search for a person starts.
Total assets is the field to start with, and the reason is on the fintech lead generation page: your own company's size decides which assessments you can clear. The regulators say the same from the other side. OCC Bulletin 2023-17, issued with the Federal Reserve and the FDIC on June 6, 2023, says the interagency guidance "clarifies that not all third-party relationships present the same level of risk or criticality to a bank's operations." (OCC Bulletin 2023-17, fetched September 18, 2026.) The agencies' 2021 guide for community banks evaluating fintech companies covers six common areas of due diligence and repeats that the scope and depth of that work depends on the risk of the relationship (OCC Bulletin 2021-40, August 27, 2021, fetched September 18, 2026). A list sorted by asset size is a list sorted by how heavy the door is.
The other fields are quicker to read. Bank class and charter describe how the institution is chartered, which goes with who supervises it. The structure history lists mergers and acquisitions, and each one is a dated event that reopens system decisions at the combined institution. The web address is the route to the institution's own site, where the search for a person starts. The primary regulator field tells you which agency supervises the institution, and so which agency publishes its enforcement actions. That is the next section.
Which regulator publishes which trigger
Enforcement actions are public, dated, and specific about what went wrong, which makes them the most precise trigger this market has. They are also published in four different places, and the split follows the charter.
The OCC's enforcement page sets it out. The OCC acts against national banks, federally chartered savings associations and federal branches and agencies of foreign banks. For everyone else it points elsewhere: the FDIC for state chartered banks that are not members of the Federal Reserve System, the Federal Reserve Board for state-chartered member banks and bank holding companies, and the NCUA for credit unions. (OCC enforcement actions, fetched September 18, 2026.)
An order against one institution is a reason to write to its peers as much as to the institution itself, which our fintech lead generation page lists among the regulatory triggers. What the registry adds is the peer set: same regulator, same asset band, same state.
Rule changes are the second trigger, and one is open now. On September 11, 2026 the FDIC, the Federal Reserve Board, the NCUA and the OCC jointly requested comment on proposed third-party risk management guidance. The release says the proposal "focuses on a principles-based approach and, as with all supervisory guidance, is non-binding", that comments are due 60 days after publication in the Federal Register, and that once it is final the agencies plan to rescind the existing guidance and replace it. The same release announced a statement on community banks' engagement with core service providers. (OCC News Release 2026-77, fetched September 18, 2026.) Risk and vendor management teams have a reason to read that proposal this quarter. It may change what they ask of you, and it is a legitimate subject for a first message.
The calendar is quarterly, and it is published
Financial institutions report on a quarterly clock. The first quarter ends in March, the second in June, the third in September and the fourth in December, and the public data follows each on a known lag. The FDIC says its Quarterly Banking Profile appears about 55 days after the end of each quarter, "around late May, late August, late November, and late February". Its August 25, 2026 release reported second quarter 2026 figures, including a return on assets ratio of 1.37 percent for FDIC-insured institutions. (FDIC Quarterly Banking Profile, fetched September 18, 2026.) The NCUA's call report files arrive quarter by quarter in the same way.
That gives a prospecting team a rhythm most markets lack. Four times a year the registry refreshes, the peer comparisons change, and the institutions that grew, shrank or merged show up as changed rows. Rebuild the list on that cycle, and write each campaign to what changed in that quarter's data.
What bankers say about fintech sellers
The objections in this market are on the record, from bankers, in the community banking trade press. Independent Banker, the ICBA's magazine, ran a piece on November 28, 2023 about negotiating fintech partnerships. Bob Fisher, president and CEO of Tioga State Bank, said of fintech companies: "They don't think about the due diligence that banks have to go through." Amy Foulks, chief operating officer of First Utah Bank, was more pointed: "The greener the fintech is, the less likely they are to understand regulatory requirements". (Independent Banker, fetched September 18, 2026.) The same article quotes a director of fintech partnerships at a bank holding company, which is worth noting as a title: some institutions have a named person whose job is to deal with you.
A second Independent Banker feature, dated February 1, 2026, asked fintech founders in ICBA's accelerator how bankers should evaluate new technology. One answer, from the head of community banking at Vertice AI: "Make sure you align tech with your top priorities and do your due diligence well, including talking to references." (Independent Banker, fetched September 18, 2026.)
Read as prospecting instructions, those quotes say three things. Show in the first message that you know an assessment is coming. Have references at institutions of a similar size, because the banker has been told to call them. And do not expect a reply to move faster than the process behind it.
Three reasons to write, each from a source
Each of these is a single email. We send one message per campaign and nothing underneath it, so the reason has to carry the weight. The institutions are unnamed and the senders are invented.
Invented example. Subject: the third-party risk proposal from September 11. The agencies' proposal would replace the 2023 guidance once final, and comments close 60 days after it reaches the Federal Register. We have mapped our security package to both versions. If your vendor management team is reviewing what it will ask of fraud vendors, we can send the mapping. No call needed unless it is useful.
The source is OCC News Release 2026-77. The reader can check every clause, and the offer is a document, which suits a buyer who assesses before talking.
Invented example. Subject: the second quarter profile. The FDIC published the second quarter profile on August 25. We build deposit operations tooling for banks in your asset band, and we are writing to institutions in your state this week. Is deposit operations cost on your list for the budget round, and if so, who owns it?
The source is the FDIC Quarterly Banking Profile and the institution's own registry row. It makes no claim about the reader's results and none about the sender's.
Invented example. Subject: the merger that closed last quarter. BankFind shows the combination as complete. If the two payment stacks are going to become one, we would like to be considered before that decision is made. Who on your side owns it?
The source is the institution's structure history in BankFind. It asks for a name, which is a fair thing to ask a stranger.
Reply behaviour for email into this market, for anyone who wants a reference point, is on our fintech cold email benchmarks page, and the writing itself is covered in cold email for fintech.
When cold prospecting is the wrong play
When your route to market is a partner. The September 11 release includes a statement on community banks' engagement with core service providers, so the regulators treat that relationship as significant in its own right. If your product is sold through a core provider's marketplace or a reseller, the prospect list that matters is the partner's, and direct outreach to the bank can cut across the partner's own sales team. That choice, and what the assessment does to a sale once a list has produced one, is the subject of our page on sales strategy for fintech companies selling to banks.
When you cannot yet pass the assessment. A registry makes it easy to build a list of institutions far larger than any you serve. Bankers have said what happens next. Start where your references are.
When the list is a few dozen accounts. A regional niche, such as credit unions above a given size in three states, may be forty institutions. That is a job for named research and introductions, and a campaign adds little.
When the buyer is a consumer. Everything here is business outreach to institutions. Lead lists of individual borrowers or investors fall under different rules, and none of this applies to them.
The short version
Fintech companies that sell to financial institutions have something most sellers lack: a complete, free, current census of their market, published by the FDIC, the NCUA and the state licensing system. Use total assets to pick the institutions you can pass assessment with, use the primary regulator to find where each one's public record lives, and rebuild the list when the quarterly data lands. Write once, about something dated the reader can check, and show that you know the diligence is coming.
If you would like that list built and the campaign run for you, see what a first campaign looks like.
Frequently asked questions.
Frequently asked questions- Where can a fintech company find a list of banks to prospect?
- The FDIC publishes every insured bank through BankFind Suite and a public API, with fields for total assets, primary regulator, charter, location and web address. The NCUA publishes quarterly call report files for credit unions. For state licensed lenders and money services businesses, NMLS Consumer Access shows licences company by company. None of these sources holds contact names or email addresses.
- What are good trigger events for selling to banks and credit unions?
- Public, dated events from the regulators. Enforcement actions are published by the agency that supervises the institution, and an order against one bank is a reason to write to its peers. Proposed rules and guidance, such as the September 11, 2026 third-party risk management proposal, change what buyers will ask of vendors. Mergers appear in an institution's structure history.
- How often should a fintech sales team rebuild its prospect list?
- Quarterly suits this market. Institutions report on a quarterly clock, the NCUA releases call report files by quarter, and the FDIC says its Quarterly Banking Profile is published about 55 days after each quarter ends, around late May, late August, late November and late February. Each refresh shows which institutions grew, shrank or merged since the last one.
- When is cold prospecting the wrong approach for a fintech company?
- When your product reaches banks through a core provider or reseller, because direct outreach can cut across the partner's own sales team. It is also wrong when your company cannot yet pass the vendor assessment at the institutions on the list, when the whole market is a few dozen accounts, and when the people on the list are consumers instead of institutions.
About the author.
B2B cold email experts helping companies generate qualified leads through done-for-you outreach campaigns.
RevenueFlow Team
Explore more.
Ready to scale your outreach?
We build GTM engines that book real meetings. See the receipts.
Related articles.
Sales Prospecting for Health Systems: The Public Record
Where health systems are written down in public: the Medicare cost report, the facility list a non-profit system files, and the two gates that follow qualification.
B2B Lead Lists for Travel Agencies: Registers and Gaps
The travel trade is written down in state consumer protection registers, not industry directories, and an exemption inside one decides who is missing from your file.
Cold Calling for PPC Agencies: What You Can See First
A paid media prospect is partly readable before the call and has already been told by the platform what to do when a stranger rings about its ads.
LinkedIn Lead Generation for Financial Services Firms
A LinkedIn message from a regulated firm is a communication the rulebook already defines, and the definition turns on how many people receive it within thirty days.
Cold Calling for Chemical Companies: Who Picks Up
A chemical cold call rarely arrives first. It reaches a formulator who has already been comparing suppliers on a screen, for one of three published reasons.
Sales Prospecting for Consulting Firms: Find the Event
Prospecting for a consulting firm: where triggers are published by practice, who inside the firm reads them, why alumni and referrals come first, when to skip it.