# How to cross-sell when each new module needs board approval

- Page: https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval
- Publisher: Panelhop (https://panelhop.com/)

> **The short answer:** Treat each module as a new deal: the board, vendor management, IT security and finance approve it again. Score your existing customers and work only those with fit and a live buying signal. For each, mark who approved the first purchase and who has changed, then give every approver an owner and a date before you pitch.

Published 30 October 2026 · By Saksham Baliyan, Co-founder

## Key numbers

- **30%** of US bank leaders say their board is directly involved in major technology decisions. Source: [Bank Director, 2026](https://www.bankdirector.com/wp-content/uploads/2026/09/2026TechReport-Open-Version.pdf).
- **6 of 8** approval roles at a bank or credit union can veto a purchase, by Panelhop’s estimate. Source: [Panelhop, 2026](https://panelhop.com/industries/banking/).
- **6** board meetings a year: the floor since July 2026 for well-rated federal credit unions. Source: [U.S. Government Publishing Office, 2026](https://www.govinfo.gov/content/pkg/PLAW-119publ101/html/PLAW-119publ101.htm).
- **90** FDIC-insured institutions absorbed by mergers in the first half of 2026, of 4,238. Source: [Federal Deposit Insurance Corporation, 2026](https://www.fdic.gov/quarterly-banking-profile/quarterly-banking-profile-second-quarter-2026.pdf).

## Why does a cross-sell to existing customers restart the approval?

Because your customer buys each new module as a new purchase. Someone writes a business case, vendor management reviews what the module changes and a committee or the board says yes again. The buying group that approved the first contract decides the second, and some of its members have changed since.

Bank regulators point the same way. The OCC, the Federal Reserve, the FDIC and the NCUA published proposed third-party risk guidance on 15 September 2026. ([OCC, Federal Reserve, FDIC and NCUA, 2026](https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm)) It lists “an expanded or a renegotiated contract” among the signs that “a third-party relationship’s risk has changed since the banking organization’s initial assessment”. ([OCC, Federal Reserve, FDIC and NCUA, 2026](https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm)) The proposal covers insured credit unions too. It says the due diligence warranted “depends on the risk presented by the third-party relationship”. ([OCC, Federal Reserve, FDIC and NCUA, 2026](https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm)) So the review grows with what the module adds: new data, new integrations, new subcontractors.

The yes rarely belongs to the person who championed the first deal. In Bank Director’s 2026 Technology Survey of 136 US bank leaders, 65% said a management team or steering committee gives final approval on technology investments. ([Bank Director, 2026](https://www.bankdirector.com/wp-content/uploads/2026/09/2026TechReport-Open-Version.pdf)) And 30% said their board is directly involved in major technology decisions. ([Bank Director, 2026](https://www.bankdirector.com/wp-content/uploads/2026/09/2026TechReport-Open-Version.pdf))

**Exhibit 1: At 65% of US banks surveyed, a management team or committee gives the final yes on technology.**

| Item | Value |
|---|---|
| A management team or steering committee has final approval | 65% |
| A C-level executive other than the CIO or CTO has final approval | 40% |
| The board is directly involved in major technology decisions | 30% |
| IT and business line leaders decide jointly | 28% |
| The IT department leads the decisions | 11% |
| Decided ad hoc within business lines or functions | 7% |

Source: Bank Director, 2026 Technology Survey (2026). 136 directors, CEOs, COOs and technology executives of US banks below $100 billion in assets, June–July 2026; respondents could choose more than 1 answer.

Panelhop’s research on banks and credit unions finds the same: 6 of the 8 roles that decide can veto, by Panelhop’s estimate. ([Panelhop, 2026](https://panelhop.com/industries/banking/)) Vendor management often starts its review after the business line says yes. ([Panelhop, 2026](https://panelhop.com/industries/banking/)) A module pitched to the champion first meets the other approvers late. The pattern holds outside banking: the average B2B buying decision involves 13 people. ([Forrester, 2024](https://www.forrester.com/press-newsroom/forrester-the-state-of-business-buying-2024/))

## Account scoring: pitch customers with fit and a live signal

Score every customer on fit for the next module and a live buying signal, and work only those with both. Leave the rest in a watch tier. Each customer you push brings a full set of approvals to win. A pitch to the whole base spreads your team across hundreds of conversations that have no reason to happen now. Yet the default is to wait. In Panelhop’s stage map of bank software deals, the vendor’s expansion step reads “Waits for the renewal date or a request for another module.” ([Panelhop, 2026](https://panelhop.com/industries/banking/))

The 3 tests, each backed by evidence you can link to:

1. **Fit.** The customer has the problem the module solves, today. The work is manual or runs on a system whose contract ends within 2 years, and the systems the module connects to are in place. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#remap-the-first-deal-s-buying-group-and-date-every-approval))
2. **A live buying signal.** A dated event from the last 90 days gives the customer a reason to act. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#remap-the-first-deal-s-buying-group-and-date-every-approval)) It can be a new executive over the module’s area, a plan or budget line that names the problem, the current system’s notice date, an acquisition or a request from its own team.
3. **A known approval path.** You can name who approved the first purchase, and you know the date of the next board or committee meeting.

Tier 1 is fit plus a live signal, and gets the full plan below. Tier 2 is fit without a signal: no pitch, a current vendor file and a watch on its signals. Tier 3 has no fit evidence yet: serve the product it bought and score it again next quarter. The third test sets the first task, not the tier. A Tier 1 customer whose approvers you can’t name starts with mapping, not a demo. A signal that gets no human action within 90 days sends the customer back to Tier 2. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#remap-the-first-deal-s-buying-group-and-date-every-approval))

## Remap the first deal’s buying group and date every approval

Start from the record of the first sale: who held each approval role then, who holds it now and which role the new module adds. A new module often belongs to another business line, so its business owner was never in the first deal. Vendor management, information security, finance and the board are the same roles, and some have new people in them.

Mark every role kept, new person, new role or left. Then give each one 3 things:

- **An owner on your side** who can answer the role’s first question: a value lead or your CFO for finance, a solutions engineer for information security, customer success for vendor management and your executive for theirs.
- **A first ask** that costs the approver little, such as 20 minutes on the process the module replaces. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#remap-the-first-deal-s-buying-group-and-date-every-approval))
- **An engage-by date** counted back from the meeting that approves the module.

Send vendor management a change file before the pitch, not after the yes. It says what the module adds in data, integrations and subcontractors, and what stays as already reviewed. The review can then be sized to what changed.

The approval date anchors the plan. Boards and committees meet on a calendar. In Panelhop’s research on banks and credit unions, a case that misses the committee or board pack waits a month or a quarter. ([Panelhop, 2026](https://panelhop.com/industries/banking/)) So count each engage-by date back from the day the pack closes, not the day of the meeting.

Keep the module out of the forecast until the business owner, the executive sponsor and finance are engaged: a two-way exchange in the last 90 days. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#remap-the-first-deal-s-buying-group-and-date-every-approval)) Every other approver needs an owner and a date by then. The customers that can expand this year are the Tier 1 accounts past that gate whose approval meeting falls inside the year. Each week, report coverage for each one: approvers engaged ÷ approvers required.

- **01. Step 1: Score every customer** Fit for the next module, a live buying signal from the last 90 days and whether you can name the approvers of the first purchase.
- **02. Step 2: Work Tier 1 only** Fit and a live signal get the full plan. Fit without a signal waits, with the vendor file kept current.
- **03. Step 3: Remap the approvers** Mark each role from the first purchase kept, new person, new role or left, and add the business owner the module brings.
- **04. Step 4: Date every approver** An owner on your side, a small first ask and an engage-by date counted back from the day the board or committee pack closes.
- **05. Step 5: Gate and measure** Forecast the module once the business owner, sponsor and finance are engaged. Report coverage weekly against the baseline.

## How does the cross-sell plan run for 120 credit unions?

It runs on the few customers with fit and a live signal: 15 of 120 in this illustration. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) It starts about 14 weeks before the board meeting that approves the module. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) A fictional vendor sells an account opening product to 120 credit unions and launches a loan origination module. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) The counts and dates are made up to show the method.

Of the 120, 44 show fit: they originate consumer loans on paper or on a system whose contract ends by 2028. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) Of those, 15 have a live signal from the last 90 days. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) They are 6 new chief lending officers, 4 strategic plans that name digital lending, 3 lending-system notice dates and 2 acquisitions of another credit union. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) That makes 15 customers Tier 1, 29 Tier 2 and 76 Tier 3. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions))

| Tier (illustration) | Rule | Customers | What they get |
|---|---|---|---|
| Tier 1 | Fit and a live buying signal from the last 90 days | 15 | The full plan: every approver remapped, owned and dated |
| Tier 2 | Fit, no live signal yet | 29 | No pitch; a current vendor file; signals watched |
| Tier 3 | No fit evidence yet | 76 | Good service on the current product; scored again next quarter |
| All | 6 approvers per customer | 120 | Tier 1 alone: 15 × 6 = 90 approver plans. All 120: 720 |

With 2 account managers, that is 7 or 8 Tier 1 credit unions each. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) Each needs 6 approvers engaged: the chief lending officer as the new business owner, the CEO, the CFO, vendor management, information security and the board. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) That is 15 × 6 = 90 approver plans; pushing the module to all 120 would mean 720. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) The digital banking lead who championed account opening introduces the chief lending officer but doesn’t approve lending software. In all, expect 5–12 people in a credit union’s buying group, by Panelhop’s estimate. ([Panelhop, 2026](https://panelhop.com/industries/banking/))

The board calendar sets the dates. Since July 2026, a federal credit union past its first 5 years may meet as few as 6 times a year, with at least 1 meeting a quarter. ([U.S. Government Publishing Office, 2026](https://www.govinfo.gov/content/pkg/PLAW-119publ101/html/PLAW-119publ101.htm)) That applies when its composite and management ratings are 1 or 2; the rest still meet monthly. ([U.S. Government Publishing Office, 2026](https://www.govinfo.gov/content/pkg/PLAW-119publ101/html/PLAW-119publ101.htm)) This credit union’s next meetings fall on 18 February and 15 April 2027. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) The plan starts in the first week of January, so February is too close: its pack closes on 4 February, before vendor management could finish a review. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) The plan aims at 15 April instead, with the pack closing on 1 April, and counts back. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions))

We assume vendor management needs 6 weeks for this module’s change file, so the file goes in by 11 February. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) Information security walks through the new data flows that week, and the new CFO hears what the business case must prove. The chief lending officer agrees the problem and the success test by 28 January, 3 weeks after the first calls. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions)) A pack that misses 1 April waits for the meeting on 17 June. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions))

| Approver (illustration) | At the first purchase | Now | Owner on our side | First ask | Engage by |
|---|---|---|---|---|---|
| Chief lending officer, business owner | Not involved | New to the decision | Account manager | 20 minutes on how loans are originated today | 2027-01-28 |
| CEO, executive sponsor | Signed the business case | Same person | Our CEO | Sponsor the module at the 2027-04-15 board meeting | 2027-02-04 |
| CFO, finance | Tested the business case | New person | Value lead | Say what the business case must prove | 2027-02-11 |
| Vendor management | Ran the full vendor review | Same person | Customer success lead | Review the change file: what the module adds | 2027-02-11 |
| Information security | Reviewed the integration | Same person | Solutions engineer | Walk through the new data flows | 2027-02-11 |
| Board | Approved the first contract | 2 new directors | Our CEO briefs their CEO, who presents | A short summary in the board pack | 2027-04-01, when the pack closes |

## Your champion can’t carry the cross-sell: plan the buying group

We think the champion who bought the first module should open the doors for the second, not carry it through them. Multi-threading happens reliably only when the plan names who talks to whom and by when. Left to the champion, it is left to chance.

We have 3 reasons. First, the champion rarely holds the approvals alone: only 7% of the bank leaders in Bank Director’s survey said technology decisions are made ad hoc within business lines. ([Bank Director, 2026](https://www.bankdirector.com/wp-content/uploads/2026/09/2026TechReport-Open-Version.pdf)) Second, the new module may sit in another business line, where the champion has no standing. Asking them to re-sell it spends their credibility on a decision they don’t own. Third, a champion who changes jobs takes an unwritten plan with them. A written plan stays.

The research on multi-threading points the same way. In Gong’s analysis of 1.8M deals, multi-threading lifted win rates by 130% on average in deals over $50k. ([Gong, 2025](https://www.gong.io/blog/data-shows-top-reps-dont-just-sell-they-orchestrate-with-ai)) The same reasoning sets the tiers: we think a short list worked properly beats a module pitched to every customer, because your account managers’ attention is the scarce resource. We don’t say every approver needs equal time, or that coverage alone wins the yes. We say no approver should first hear about the module from the board pack.

## How do you lift NRR when customers keep merging?

Count merger losses apart from product churn. Then run each business line a customer doesn’t buy from you yet as its own expansion opportunity. Re-score every customer that acquires another on the day the deal is announced: the acquisition is a live buying signal.

Mergers can cancel out the expansion you win. In the first half of 2026, 90 FDIC-insured institutions were absorbed by mergers, out of 4,238 at the end of June. ([Federal Deposit Insurance Corporation, 2026](https://www.fdic.gov/quarterly-banking-profile/quarterly-banking-profile-second-quarter-2026.pdf)) At that pace, about 4% of bank charters disappear in a year (2 × 90 ÷ 4,238 ≈ 4.2%). ([Panelhop, 2026](https://panelhop.com/blog/route-merger-signals-to-acquirer-and-target#how-the-play-runs-when-a-credit-union-you-sell-to-merges)) Illustration: take a vendor that sells 1 data product per charter. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-do-you-lift-nrr-when-customers-keep-merging)) If each absorbed customer’s contract ends, it loses up to about 4 points of net revenue retention (NRR) a year to mergers. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-do-you-lift-nrr-when-customers-keep-merging)) With 4 points lost that way, an NRR of 98% means expansion already makes up at least 2 of them. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-do-you-lift-nrr-when-customers-keep-merging)) To get above 100%, expansion has to outgrow those 4 points; new business lines and acquiring customers are the places to look. ([Panelhop, 2026](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-do-you-lift-nrr-when-customers-keep-merging))

A business line you don’t sell to yet is a new deal at a customer you know. It has its own business owner and its own reason to buy, with the same vendor management, security and board behind it. Score lines the way you score customers, on fit and a live signal, and map each line’s owner before you pitch.

A merger works both ways. When your customer is the acquirer, the institution it absorbs brings new volume and new business lines, and the acquirer’s integration lead joins the approvers. When your customer is absorbed, the acquirer is a new account to map before it decides which systems to keep.

Report 4 numbers each quarter against last year’s baseline: modules per customer, expansion’s share of pipeline, days from proposal to approval and NRR with merger losses on a line of their own. Each week, show coverage for every open expansion opportunity, with the next approver to engage, their owner and the date.

## How we do it at Panelhop

Panelhop is an account-based marketing (ABM) and GTM consultancy for B2B companies selling deals of €25k or more. In a Panel Check, our 2–3 week GTM audit, check H4 scores whether expansion runs as a motion with its own pipeline, triggers and targets, and we baseline expansion’s share of pipeline from your CRM data.

In a Leak Fix, where we build the fixes in your own CRM, the retention module turns expansion triggers into proposals your account manager reviews before anything reaches the forecast. The buying-group module records the approval roles each module needs and reports coverage, engaged roles against required ones, every week. With Panel Ops, we run it monthly with your team: a report against the baseline every month and a re-tier of your customers every quarter.

## Questions buyers ask about this

### Can a master agreement stop each new module from going back to the board?

It can shorten the paperwork, but whether a module goes to the board is the customer’s policy, not your contract’s. Bank and credit union regulators’ 2026 proposal treats an expanded contract as a sign that a vendor’s risk may have changed. So plan for the review and keep it small: a change file for vendor management and a short summary for the board pack.

### Which buying signals show an existing customer is ready for another module?

Dated events that give the customer a reason to act now: a new executive over the module’s area, a plan or budget line that names the problem, the notice date on the system the module would replace or an acquisition. A signal nobody acts on within 90 days goes stale, and the customer returns to the watch tier until the next one.

### How do we build an expansion motion into business lines our bank customers don’t buy from us yet?

Treat each business line as its own expansion opportunity with its own business owner, scored on fit and a live buying signal like any target account. Map that owner and the approvers behind them before the pitch. Report net revenue retention with merger losses on their own line, so charters that disappear don’t hide the expansion you add.

### Who should own a cross-sell: the account manager or a new-business rep?

One person owns each expansion opportunity, usually the account manager who knows the customer. Each approver also gets a named owner on your side who can answer that role’s first question, such as a solutions engineer for information security or a value lead for finance. The account manager runs the weekly review of who is engaged and who is next.

### How many existing customers should we pitch a new module to at once?

Only the ones with fit and a live buying signal. Each of them needs every approver engaged, so the limit is what your account managers can cover with an owner and a date per approver, not the size of your customer base.

## Sources

1. [2026 Technology Survey](https://www.bankdirector.com/wp-content/uploads/2026/09/2026TechReport-Open-Version.pdf): Bank Director, 2026
2. [Proposed Third-Party Risk Management Guidance](https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm): OCC, Federal Reserve, FDIC and NCUA, 2026
3. [How do software vendors sell to banks and credit unions?](https://panelhop.com/industries/banking/): Panelhop, 2026
4. [The cross-sell plan: 3 tests, tiers, the approval remap, engage-by dates, the forecast gate and coverage](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#remap-the-first-deal-s-buying-group-and-date-every-approval): Panelhop, 2026
5. [Worked example of a cross-sell plan for 120 credit unions, Illustrative](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-does-the-cross-sell-plan-run-for-120-credit-unions): Panelhop, 2026
6. [Merger losses and NRR for a vendor selling 1 product per charter, Illustrative](https://panelhop.com/blog/cross-sell-when-each-new-module-needs-board-approval#how-do-you-lift-nrr-when-customers-keep-merging): Panelhop, 2026
7. [Forrester, The State of Business Buying, 2024](https://www.forrester.com/press-newsroom/forrester-the-state-of-business-buying-2024/): Forrester, 2024
8. [Gong, 2025 analysis of 1.8M deals](https://www.gong.io/blog/data-shows-top-reps-dont-just-sell-they-orchestrate-with-ai): Gong, 2025
9. [Public Law 119-101 (21st Century ROAD to Housing Act), section 904: Credit Union Board Modernization Act](https://www.govinfo.gov/content/pkg/PLAW-119publ101/html/PLAW-119publ101.htm): U.S. Government Publishing Office, 2026
10. [Quarterly Banking Profile, Second Quarter 2026](https://www.fdic.gov/quarterly-banking-profile/quarterly-banking-profile-second-quarter-2026.pdf): Federal Deposit Insurance Corporation, 2026
11. [Panelhop calculation of merger signals on a list of US banks and credit unions, Illustrative, 14 October 2026](https://panelhop.com/blog/route-merger-signals-to-acquirer-and-target#how-the-play-runs-when-a-credit-union-you-sell-to-merges): Panelhop, 2026