# How do core banking vendors sell to regional and large banks?

> **The short answer:** Enterprise core banking vendors sell to regional and large banks through long, formal selections. Each runs through an RFP, a proof of concept, parallel risk reviews, DORA contract terms in the EU and approval by several committees and the board. Migration risk weighs more than features, so vendors win by proving the migration path before the demo.

- Page: https://panelhop.com/industries/banking/enterprise-core-banking-platforms
- Section: Home › Industries › Banking › Enterprise core banking platforms for regional and large banks
- Updated 5 October 2026 · Based on Panelhop research, October 2026
- Written for: Vendors of enterprise core banking platforms selling to banks and credit unions
- Publisher: Panelhop (https://panelhop.com/)

**You win on features. The bank keeps its old core.** You sell core banking platforms to regional and large banks, challengers and DACH private banks. They are replacing the system that holds every account, so migration proof outweighs features. Deals that survive the RFP then stall in a greenfield pilot, in audit and exit clauses or between committees.

- Typical deal: €250k or more a year (Illustrative)
- Sales cycle to signature: often over 12 months (Illustrative)
- Buying panel: 12 or more people (Illustrative)

## Enterprise core banking platforms for regional and large banks · How a deal really moves

**Core banking deals rarely lose on features. They stall on migration fear, pilots, exit terms and committees.** (Illustrative)

With Panelhop: The same deal, with every committee mapped. Migration owner, exit terms and every committee date tracked.

One regional bank or banking group, 12 or more people and, by our estimate, more than 12 months to signature.

What opens a deal:

- **End of support or vendor sold** (Technology)
- **Banking group merger** (Consolidation)
- **DORA re-papering and register** (Regulation · EU)
- **Core contract nearing its end** (Contract)
- **New charter or digital brand** (Regulation)

The buyer: **A regional bank or group**. Also challengers and DACH private banks. 158 US banks over $10bn · 110 ECB groups.

Who decides:

| Seat | What worries them | Can veto |
|---|---|---|
| COO, CFO or Vorstand | A multi-year programme that misses its objectives. | Yes |
| Boards and committees | Reputational and regulatory damage from a failed migration. | Yes |
| CIO or CTO | Implementation overruns and weak vendor support. | Yes |
| Business line heads | Customers disrupted during the migration. | No |
| Procurement and legal | A vendor that won’t accept unrestricted audit rights. | Yes |
| Outsourcing officer | Supervisory findings and concentration risk. | Yes |
| Information security | Examiner findings on third-party controls. | Yes |
| Internal audit | Signing off a programme they never reviewed. | Yes |

How the deal moves:

| Stage | Typical time | Where it stalls today | With Panelhop | Service |
|---|---|---|---|---|
| Strategy and RFI | – | – | – | – |
| Long list | 4–8 weeks | – | – | – |
| RFP and demos | 1–3 months | Banks like the features, fear the migration | IT, outsourcing, security and audit named before the RFP closes | Leak Fix (We build the fixes): https://panelhop.com/services#build |
| Proof of concept | – | The pilot goes live; the main book stays | A named owner for the main migration before the proof of concept | Leak Fix (We build the fixes): https://panelhop.com/services#build |
| Risk review | – | – | – | – |
| Contract terms | 1–3 months | Audit and exit redlines outlast price talks | Outsourcing officer mapped at the RFP; audit and exit terms a stage gate | Leak Fix (We build the fixes): https://panelhop.com/services#build |
| Board approval | 2–8 weeks each | Each committee meets on its own calendar | Forecast tracked monthly against each committee’s dates | Panel Ops (We run it monthly): https://panelhop.com/services#run |
| Migration | 12–24 months, US | – | – | – |

With Panelhop across the deal: Signal Desk · weekly on what opens a deal (in-market accounts, scored and mapped); Panel Check on the buyer (coverage baselined); Panel Ops · monthly from the last stage back to the next trigger (scores and plays tuned against the baseline).

*Source: Stages, seats, triggers and stalls from Panelhop research, October 2026; [Nelson Mullins, for the Georgia Bankers Association](https://resources.gabankers.com/PD%20Dept.%20Links/2020%20Ops%20Tech%20Conference/Negotiating%20Core%20Contracts%20-%20Brad%20Rustin%20UPDATE.pdf); [FDIC](https://www.fdic.gov/quarterly-banking-profile/quarterly-banking-profile-second-quarter-2026.pdf); [ECB Banking Supervision](https://www.bankingsupervision.europa.eu/framework/supervised-banks/html/index.en.html); the services as described on the Services page.*
*Note: Durations, panel sizes and cycle lengths are Panelhop estimates from our research, not measurements.*

## At a glance

| Fact | Value |
|---|---|
| Typical deal | €250k or more a year (Illustrative) |
| Sales cycle to signature | often over 12 months (Illustrative) |
| Buying panel | 12 or more people (Illustrative) |
| Motion | Formal RFP, shaped by integrators and advisers |

*Source: Panelhop research, October 2026.*
*Note: Values marked Illustrative are Panelhop estimates from our research, not measurements.*

## Where do core banking deals at large banks stall?

**Core deals stall between the pilot and the board.**

Core banking deals at regional and large banks stall at the proof of concept, contract terms and board approval. In Panelhop’s October 2026 sample of 20 vendors, 3 sell enterprise core banking platforms to larger banks and fintechs. Our analysis flags integration with the systems around the core and committee cadence as likely stall points for all 3, and stalled pilots and slow go-lives for 2 of the 3.

**Exhibit 1: Where the pipeline leaks: 5 points across 8 stages.**

1. **Migration proof arrives after the bank has decided** (stage: RFP and demos). What you see: Strong feature scores, then a decision to stay with the incumbent core. Why it happens: Integration and migration proof is assembled late, after the bank has formed its view of the risk.
2. **Your core runs a new brand, never the main book** (stage: Proof of concept). What you see: The greenfield brand is live and stable, but the bank sets no date for moving the main book. Why it happens: No executive owns the main migration decision before the proof of concept starts.
3. **Audit and exit redlines outlast the commercial talks** (stage: Contract terms). What you see: Legal redlines on audit rights and exit terms run for weeks after price is agreed, and each EU bank adds its own DORA addendum. Why it happens: The standard contract lacks unrestricted audit rights and an exit plan, and the outsourcing officer joins only at contract stage.
4. **You forecast one approval; the bank has several** (stage: Board approval). What you see: Forecasts assume one approval; the deal then meets a risk committee, the management board and the supervisory board in turn. Why it happens: The approval route isn’t captured per account during discovery.
5. **Your best references are still mid-migration** (stage: Migration). What you see: Prospects ask for a live reference of their size, and the newest clients are still migrating. Why it happens: Core migrations run for years, and references only appear after go-live.

*Source: Panelhop research, October 2026.*

## What makes a regional or large bank replace its core?

**End-of-support notices and mergers reopen the core.**

A regional or large bank reopens its core decision when the core contract nears its end, the incumbent’s support or ownership changes or a merger forces one platform. New rules and new charters reopen it too, and most of these events are announced in public.

**Exhibit 2: The 5 events that open or close the window for a deal.**

- **Legacy core end of support or incumbent sold** (Technology). What happens: The incumbent core’s vendor announces end of support or is acquired, and the bank reviews its roadmap. Where to spot it: Trade press, analyst commentary and the bank’s own investor materials. Window: From the announcement until the incumbent contract can end.
- **Banking group merger** (Consolidation). What happens: Merging banks usually move to one core, so the acquirer chooses which platform survives. Where to spot it: Merger announcements, regulators’ approvals and acquirers’ filings. Window: From announcement to systems conversion, while the combined stack is decided.
- **DORA re-papering and register season** (Regulation). What happens: EU banks must hold DORA Article 30 clauses in every ICT contract and report their register of information once a year. Where to spot it: National supervisors’ DORA notices and BaFin’s DORA guidance for German banks. Window: Renewals with incumbents turn into renegotiations of audit and exit terms.
- **Core contract nearing its end** (Contract). What happens: Core contracts run for years, and banks start evaluating well before expiry, reconsidering the systems around the core at the same time. Where to spot it: Discovery questions, the bank’s investor materials and integrators’ networks. Window: Opens well before expiry; the renewal negotiation itself can take months.
- **New bank charter or digital brand** (Regulation). What happens: A new bank, digital brand or specialist lender needs a core from day one and has no legacy data to migrate. Where to spot it: Charter approvals from banking regulators and launch announcements. Window: From licence application to launch, when the core is the first system chosen.

*Source: Panelhop research, October 2026.*

## Who signs off on a core banking replacement at a regional or large bank?

**Several committees and the board must all agree.**

A core banking replacement at a regional or large bank needs the executive sponsor, IT, the business lines, procurement and legal, outsourcing and third-party risk, information security, internal audit and the board. Audit and control functions can stop a project months in, so they belong in the plan from the start. Integrators and selection advisers often shape the RFP, but they hold no veto.

**Exhibit 3: At a regional bank or ECB-supervised group, 12 or more people sit on the panel and 7 seats can stop the deal.** (Illustrative)

At a regional bank or ECB-supervised group: 12 or more people.

| Seat | Typical titles | Cares about | Worries about | Can veto |
|---|---|---|---|---|
| Executive sponsor | Chief Operating Officer, Chief Financial Officer, Vorstand member (DACH) | A migration that protects the bank’s regulatory standing and reputation. | A multi-year programme that misses its objectives. | Yes |
| Technology and architecture lead | Chief Information Officer, Chief Technology Officer, Leiter IT/Organisation (DACH) | Integration and migration risk across the systems around the core. | Implementation overruns and weak vendor support. | Yes |
| Business line heads | Chief Retail Officer, Chief Lending Officer, Head of Fachbereich (DACH) | New products launched faster on the new core. | Customers disrupted during the migration. | No |
| Procurement and legal | Procurement Manager, General Counsel, Einkauf (DACH) | Comparable bids, liability caps, exit rights and annual fee increases. | A vendor that won’t accept unrestricted audit rights. | Yes |
| Outsourcing and third-party risk | Outsourcing Officer (Auslagerungsbeauftragter), Third-Party Risk Manager, Outsourcing and Third-Party Risk Lead (UK) | Critical-function classification, DORA Article 30 clauses and the register entry. | Supervisory findings and concentration risk. | Yes |
| Information security | Chief Information Security Officer, Informationssicherheitsbeauftragter (DACH) | Security testing, incident response and data location. | Examiner findings on third-party controls. | Yes |
| Internal audit | Head of Internal Audit, Revision (DACH) | Control evidence across the whole migration. | Being asked to sign off on a programme they never reviewed. | Yes |
| Management and supervisory boards | Board of Directors, Board Technology or Risk Committee, Aufsichtsrat | Strategic fit and the risk of the programme. | Reputational and regulatory damage from a failed migration. | Yes |

*Source: Panelhop research, October 2026.*
*Note: The panel size is a Panelhop estimate from our research, not a measurement.*

## What do enterprise core banking vendors sell, and to whom?

**You sell the system of record for a whole bank.**

Enterprise core banking vendors sell deposit, lending and ledger platforms to banks large enough to buy their own stack, often module by module alongside a legacy core. In the euro area, 110 banking groups are supervised directly by the ECB. German Sparkassen and cooperative banks run on their group IT providers’ cores, so in Germany the independent private, specialist and regional banks are the direct buyers.

**What vendors of this type sell**

- Core banking systems for deposits, lending and the general ledger
- Composable core modules deployed alongside a legacy core
- Greenfield cores for new digital banks and brands
- Country localisation, including regulatory reporting
- Migration services delivered with integrator partners

**Which banks and credit unions buy it**

- US regional and large banks: 158 with over $10bn in assets
- ECB-supervised banking groups in the euro area
- Challenger, digital and specialist lending banks
- DACH private and specialist banks, among them 129 German regional and other commercial banks

## How does a core banking deal move at a regional or large bank?

**A core decision runs on several calendars at once.**

A core banking deal moves from strategy and RFI through an RFP, a proof of concept, parallel risk reviews, contract terms and board approval, then into a migration measured in years. Each committee works to its own calendar.

**Exhibit 4: Stage by stage: what you do, what the bank does, and what changes at the 4 stages where deals stall.** (Illustrative)

| Stage | Typical time | What you do | What the bank does | Today | With Panelhop | Service |
|---|---|---|---|---|---|---|
| Strategy and RFI | – | Publishes gated research and webinars on replacing legacy cores. | Sets a multi-year modernisation plan and issues an RFI. | The vendor hears about the programme when the RFI arrives. | Accounts scored weekly on dated triggers such as an end-of-support notice, a merger or a new CTO. | Signal Desk (In-market accounts, weekly): https://panelhop.com/services#signal |
| Long list | 4–8 weeks | Relies on integrator and partner introductions and analyst recognition. | Builds a long list with integrators and advisers. | Target banks chosen by size alone. | A draft fit model from your own won and lost deals, by bank size, region and incumbent core. | Panel Check (GTM audit · 2–3 weeks): https://panelhop.com/services#audit |
| RFP and demos | 1–3 months | Responds to a formal RFP across many modules. | Scores vendors across business, IT and risk criteria. | IT, risk and audit appear after the demo. Stalls: Integration outweighs features. In Bank Director’s 2026 Technology Survey of US banks under $100bn in assets, 69% of respondents name integration as a top concern, and 58% of those whose project fell short blamed it. | A role map per tier that names IT, outsourcing, security and audit before the RFP closes. | Leak Fix (We build the fixes): https://panelhop.com/services#build |
| Proof of concept | – | Runs a proof of concept, or a greenfield launch for one brand or product. | Tests the core on a limited scope before committing the main book. | The proof of concept has no owner for what comes next. Stalls: A greenfield pilot that stays small. A new brand or product goes live on the new core, and the main migration never gets a named owner or a date. | A mutual action plan that names the executive owner of the main migration before the proof of concept starts. | Leak Fix (We build the fixes): https://panelhop.com/services#build |
| Risk review | – | Answers security, resilience and exit questions for a critical function. | Security, outsourcing and audit review the vendor in parallel. | The risk review starts after the vendor is chosen. | A risk review stage with exit criteria, started in parallel with the RFP. | Leak Fix (We build the fixes): https://panelhop.com/services#build |
| Contract terms | 1–3 months | Negotiates liability caps, audit rights and exit terms, plus a DORA addendum for EU banks. | Legal and the outsourcing or third-party risk officer redline each clause. | Legal and the outsourcing officer first see the deal at contract stage. Stalls: Audit and exit clauses arrive late. In the EU, contracts supporting critical functions must grant unrestricted access, inspection and audit rights, and redlines on audit and exit terms can outlast the commercial talks. | The outsourcing officer and legal named on the role map from the RFP, and a contract stage whose exit criteria include sending your audit and exit terms, with a DORA addendum for EU banks. | Leak Fix (We build the fixes): https://panelhop.com/services#build |
| Board approval | 2–8 weeks per approval; longer when several committees sit in turn | Prepares material for the management and supervisory boards. | Approves the programme at a scheduled board meeting. | Close dates assume a single sign-off. Stalls: Committees meet on separate calendars. Risk committees, the management board and the supervisory board each meet on their own dates, so approval can span quarters. | Forecast tracked monthly against each committee’s dates and the baseline. | Panel Ops (We run it monthly): https://panelhop.com/services#run |
| Migration | 12–24 months at a US regional bank; longer at large banking groups | Migrates products and customers in phases with integrator partners. | Moves the book across and logs the contract in its register of information. | What sales promised lives in one rep’s notes. | A handoff document built from the deal, so the migration team inherits what each committee was promised. | Leak Fix (We build the fixes): https://panelhop.com/services#build |

*Source: Panelhop research, October 2026; [Nelson Mullins, for the Georgia Bankers Association](https://resources.gabankers.com/PD%20Dept.%20Links/2020%20Ops%20Tech%20Conference/Negotiating%20Core%20Contracts%20-%20Brad%20Rustin%20UPDATE.pdf); [Bank Director](https://www.bankdirector.com/wp-content/uploads/2026/09/2026TechReport-Open-Version.pdf).*
*Note: Typical times are Panelhop estimates from our research, not measurements.*

## How does Panelhop change the way core banking vendors sell to large banks?

**Every committee and clause is tracked on the deal.**

Panelhop puts the approval route, the risk seats and the contract clock on every core banking deal, then fixes the stages where those deals stall. A Panel Check (GTM audit · 2–3 weeks) baselines each stage before anything changes, and Panel Ops (we run it monthly) tracks core deals against that baseline.

What we baseline and report:

1. Days from verbal yes to signature on EU deals, against the baseline
2. Seats engaged per open deal across IT, risk, audit and the board
3. Qualified pipeline from in-window Tier 1 banks

## What other vendors sell to banks and credit unions?

**Other vendor types in banking.**

The same banks and credit unions buy from these vendor types too, through different panels and pipelines.

- [Digital banking and core platforms for community banks and credit unions](https://panelhop.com/industries/banking/digital-banking-core-community-institutions): Core, online and mobile banking and account opening platforms sold to US community banks and credit unions.
- [Risk, compliance and GRC software for banks and credit unions](https://panelhop.com/industries/banking/risk-compliance-grc-software): Enterprise risk, compliance management, vendor risk and audit software sold to community banks, credit unions and regional banks.
- [Fraud prevention, AML and KYC software for banks](https://panelhop.com/industries/banking/fraud-aml-kyc-software): Fraud detection, transaction monitoring, sanctions screening and KYC software sold to banks, credit unions and building societies.

[The whole banking market: segments, panel and pipeline →](https://panelhop.com/industries/banking/)

## What do terms like “Composable core” and “Greenfield launch” mean?

**The words your buyers use, defined.**

Plain definitions of the terms that come up when you sell enterprise core banking platforms to banks and credit unions.

- **Composable core**: A core banking system built from separate modules, such as deposits or lending, that a bank can deploy alongside its legacy core and replace step by step.
- **Greenfield launch**: Starting a new bank, brand or product on a new core with no legacy data to migrate. Banks often use one to prove a core before moving the main book.
- **Critical or important function**: A DORA term for a function whose disruption would materially impair a bank’s performance or continuity. ICT contracts supporting one must meet the fuller Article 30 requirements.
- **Outsourcing officer**: In German banks, the Auslagerungsbeauftragter: the person responsible for outsourcing risk. Core banking contracts cross this desk or the bank’s DORA ICT third-party risk function before signature.
- **Exit strategy**: The plan DORA requires for contracts supporting critical or important functions, covering how the bank leaves a provider, including a transition period in which the provider keeps delivering the service.
- **Significant institution**: A bank the ECB supervises directly because of its size or importance in its country. The largest euro-area banking groups are significant institutions.

## What do vendors of enterprise core banking platforms ask about selling to banks and credit unions?

**Answers before your next bank deal.**

### How long does it take to sell a core banking system to a regional bank?

Selling a core banking system to a regional bank often takes more than 12 months to sign, and up to 36 months by Panelhop’s research estimates. The migration that follows takes 12–24 months at a US regional bank, and longer at large banking groups. The RFP, a proof of concept, parallel security and outsourcing reviews and board approval each add time. In the EU, negotiating DORA audit and exit terms can extend the close further.

### How does DORA affect selling core banking software to EU banks?

DORA adds a contract stage to every core banking deal with an EU bank. The bank must put Article 30 clauses into every ICT contract and log each contract in a register of information reported once a year. A core banking contract usually supports critical or important functions, so it must also grant unrestricted access, inspection and audit rights and include an exit strategy. Expect the bank’s outsourcing officer and legal team to redline these terms.

### Who signs off on a core banking replacement at a large bank?

A core banking replacement at a large bank needs many sign-offs: the executive sponsor, IT, procurement and legal, the outsourcing officer, information security and internal audit. Several risk committees and the board then approve it. Panelhop estimates buying panels of 12 or more people at large banks. Business line heads champion the change but rarely hold a veto.

### Why do core banking pilots and greenfield launches stall?

Core banking pilots and greenfield launches stall when nobody owns the decision that comes after them. A new brand or product goes live on the new core and the technology works, but the bank’s main migration still has no executive owner or date. Agree success criteria and name the owner of the main migration before the proof of concept starts.

### Can core banking vendors sell directly to German Sparkassen and cooperative banks?

Core banking vendors rarely sell directly to German Sparkassen and cooperative banks. These banks run on cores provided by their group IT providers, so a core banking vendor reaches them, if at all, through the group. The direct buyers in Germany are independent private, specialist and regional banks, whose management board can decide without group sign-off. Check an account’s group membership before adding it to a target list.

### How do core banking vendors get on a regional bank’s long list?

Core banking vendors get on a regional bank’s long list through integrator partnerships, analyst recognition and live references at banks of similar size. Regional and large banks build those long lists with integrators, advisers and analysts. Tracking dated triggers such as an end-of-support notice, a merger or a core contract nearing its end shows which banks are about to reopen the core decision.

## Sources

**Where the numbers come from.**

Sourced figures link to their source below. Figures marked Illustrative, and figures given as estimates, are inferred from Panelhop research. Vendors appear only as types, never by name.

1. [FDIC, Quarterly Banking Profile, Second Quarter 2026 (2026)](https://www.fdic.gov/quarterly-banking-profile/quarterly-banking-profile-second-quarter-2026.pdf)
2. [ECB Banking Supervision, List of supervised banks (2026)](https://www.bankingsupervision.europa.eu/framework/supervised-banks/html/index.en.html)
3. [Deutsche Bundesbank, Bankstellenstatistik 2025: Bestand an Kreditinstituten am 31. Dezember 2025 (2026)](https://www.bundesbank.de/resource/blob/942020/cb6ce7a15d7e3cbbd30d85a89f110260/472B63F073F071307366337C94F8C870/bankstellenstatistik-2025-data.pdf)
4. [Bank Director, 2026 Technology Survey (2026)](https://www.bankdirector.com/wp-content/uploads/2026/09/2026TechReport-Open-Version.pdf)
5. [Nelson Mullins, for the Georgia Bankers Association, Fear of Commitment: Negotiating core contracts (2020 Ops and Tech Conference presentation) (2020)](https://resources.gabankers.com/PD%20Dept.%20Links/2020%20Ops%20Tech%20Conference/Negotiating%20Core%20Contracts%20-%20Brad%20Rustin%20UPDATE.pdf)
6. [BaFin, Guidance notes on the implementation of DORA for ICT risk management and ICT third-party risk management (2024)](https://www.bafin.de/SharedDocs/Downloads/EN/Anlage/dl_2024_07_08_Aufsichtsmitteilung_Umsetzungshinweise_DORA_en.pdf?__blob=publicationFile&v=3)
7. [De Nederlandsche Bank, DORA: Reporting DORA registers of information in March 2026 (2026)](https://www.dnb.nl/en/sector-news/supervision-2026/dora-reporting-dora-registers-of-information-in-march-2026/)
8. [Panelhop, Services (2026)](https://panelhop.com/services)
- Panelhop research, October 2026: our analysis of the vendors, buying panels, pipelines and triggers for enterprise core banking platforms in banking, from public sources. Vendor names are not published.

## Next step

Find where your pipeline to banks and credit unions leaks.

[Book a GTM audit](https://panelhop.com/book) · [What the Panel Check covers](https://panelhop.com/services#audit)