A bank just sent you a 300-question security questionnaire. Now what?
keliuotis.io is lean IT security and compliance advisory for EU fintechs: just enough real security to pass a bank’s scrutiny and close the enterprise deal, without hiring a compliance team.
- Q 017 Outsourcing & subprocessor register
- Q 042 Encryption at rest and in transit
- Q 118 Access control & leaver process
- Q 203 Incident notification timelines
- Q 236 Business continuity & exit plan
- Q 291 DORA ICT third-party requirements
The deal was going well.
Then procurement showed up.
The questionnaire lands.
A vendor risk assessment. ISO-flavoured questions. A spreadsheet with fourteen tabs, due in two weeks. Easy enough: you’ll feed it to AI.
The reviewer digs.
The answers come back polished. So does everyone else’s. Reviewers read AI-drafted “we take security seriously” all day now, so they ask for evidence instead: exports, screenshots, a call with whoever owns your security. The prose stops working.
The deal stalls.
Your champion inside the bank goes quiet. The quarter closes. A deal you had already counted slips away, not because the product failed, but because there was nothing behind the paperwork.
AI can fill in your questionnaire. It can’t make the answers true.
Reviewers read machine-polished answers all day, so scrutiny has moved behind the prose: evidence requests, system walkthroughs, a technical interview with whoever owns your security. What clears a review now is a security setup that actually exists, sized to what the bank checks and cheap enough that you stay a startup, plus a credible voice beside you when they look. Compliance is still a sales problem. The answer just isn’t paperwork anymore.
Whose word is the bank relying on?
Reviewers grade every answer by who they have to believe. Take one row of the questionnaire, “Is stored data encrypted?”, and walk it up the ladder.
-
Hidden Nobody looked
Your cloud provider encrypts stored data by default, but nobody on your team has checked, so the row says “in progress”. The protection is real. It earns you nothing.
-
Claimed Your word
You found out, and you write “yes”. That clears the floor, but it’s your word, and AI just made everyone’s word sound the same.
-
Attested An auditor’s word
An auditor’s report says the control exists and was tested. Now it’s the auditor’s word, not yours.
-
Observable Your instruments
You show it: every data store encrypted, with evidence that updates every day. The reviewer relies on your instruments, not your word. This is where security starts paying back.
-
Independently observable Their own instruments
The bank holds the keys. Every access lands in the bank’s own logs, and they can switch it off.
-
Enforced by architecture No one’s word
Nobody has to watch you, because you can’t get in, even if you wanted to.
Higher isn’t automatically better. Evidence only counts if the reviewer can consume it in tools they already run. Anything that adds work on their side gets ignored. For most bank reviews today, B is the rung that pays, and it’s where “just enough” aims.
What “just enough” actually looks like.
Seven of the bank’s 300 questions
You don’t need an enterprise security programme. You need the specific controls a bank’s reviewer actually checks, implemented at a cost a startup can carry. A sample:
-
“How do you secure access to your systems?”
A zero-trust setup at startup size: one identity provider in front of everything, device checks before access, no magic “safe” office network. Fewer moving parts than the VPN it replaces.
-
“Is multi-factor authentication enforced?”
Phishing-resistant MFA: passkeys or hardware keys on email, code and cloud admin. Days to roll out, and it retires the whole password conversation.
-
“How is privileged access managed?”
Admin accounts separated from everyday accounts, least-privilege by default, reviewed quarterly. Boring, nearly free, and exactly what the reviewer checks.
-
“How are changes to production controlled?”
Real change control on the systems the bank cares about (approval trails, rollback steps) and none where it just slows you down. You keep shipping daily; no CAB meeting required.
-
“How do you stop customer data from leaking?”
A data-loss-prevention baseline at startup size: managed devices, controlled sharing, alerts on the few flows that matter, not a 200-rule enterprise engine.
-
“How is customer data backed up?”
Everyone has backups. The bank asks when you last restored one. So: a scheduled restore test with the result on record. An afternoon per quarter.
-
“Can we schedule a call with your head of information security?”
Yes. I prep the answers with you and join the interview, so a twelve-person startup turns up with senior security cover.
Every row is days of setup, not quarters, and none of it is theatre. That’s a mature security posture at startup size. The other 293 questions? That’s the intro call.
Minimum Viable Compliance
The compliance industry sells maximums. Banks check specifics. MVC is the smallest set of controls, policies and evidence that clears a bank’s review, built for the deal in front of you, not an audit you may never face.
The over-engineered way
- Full ISO 27001 certification before the first bank deal
- A 240-page ISMS nobody has read
- Policies for departments you don’t have
- A GRC platform with 31 unused modules
- A risk committee for a 12-person company
- Consultants billing by the binder
9 months · six figures · still gets follow-up questions
Minimum Viable Compliance
- The controls this bank’s review actually checks
- Policies that describe what you really do
- Evidence you can produce on request
- A DORA-ready ICT third-party register
Weeks · scoped to the deal · clears the review
How an engagement works
-
The intro call
Bring the questionnaire, the deadline and the deal it’s blocking. You leave knowing exactly where you stand and what the bank will push on.
-
Questionnaire Rescue
We answer the live questionnaire together, honestly. Where an answer isn’t true yet, we make it true with the smallest control that closes the gap, and attach the evidence.
-
Ongoing advisory
Security-by-design as you build, a review before every questionnaire goes back. And when the bank books a technical interview, you don’t take the call alone.
I failed this spreadsheet before I ever sent one.
Fourteen years ago I was a sales manager at a startup. The demos went great: people leaned in, and sometimes someone said “this is exactly what we need.” Then the vendor questionnaire arrived: three hundred rows about things we hadn’t built yet. We never passed one.
Since then I’ve worked both sides of it: compiling the answers for a Fortune 500 vendor, writing procurement specifications in energy, and for the last eight years reviewing vendors for banks. I’ve read the vague answers that stall deals, written the follow-up questions that stall them further, and closed the files that were written in the bank’s own language.
keliuotis.io is my independent advisory practice, deliberately small, a few founders at a time. It isn’t a platform, by the way. Keliuotis is my surname; the .io is just where it lives.
Independent means independent: keliuotis.io doesn’t speak for any institution. Advice draws on public frameworks (DORA, ISO 27001, EBA outsourcing guidelines) and years of pattern recognition, never on anyone’s confidential process.
DORA changed whose problem you are.
Selling to EU financial institutions? Under DORA’s ICT third-party risk rules, your security posture is now your customer’s regulatory problem. Banks answer to their supervisor for you, so their questionnaires got longer and their patience got shorter.
A bank that sends you three hundred rows isn’t being difficult. It’s collecting what the law requires it to be able to prove: that it assessed you before signing, can monitor you throughout, and has a real plan for leaving you. So make leaving easy: a tested export, documented schemas, a rehearsed exit. The vendors that are easiest to leave turn out to be the hardest to replace.
The spreadsheet isn’t an obstacle. It’s a specification, written by someone with a budget.
Prefer email? hello@keliuotis.io