Outbound to fintech companies: a data-first playbook

This playbook on selling to fintech starts from one assumption: a regulated buyer asks about data handling before anything else. So the first email answers that question before it is asked.

The rest of the page covers who to write to, what to check before you send, and a sample email you can adapt. Where there is no source for a claim about fintech buyers, the page says less rather than guess.

Who buys

Regie.ai's outbound page uses "Head of RevOps Fintech 50–500" as a targeting example. [[1]](#sources) That is one vendor's example of a segment, not a finding about who buys your product.
People Data Labs lists fintech and credit among the segments that use its data, and its customer stories include "How PDL helps Fintechs fight fraud." [[2]](#sources)

Anything finer should come from your own won and lost deals. You can import past deals from a CSV or your CRM and get a win/loss analysis that proposes ICP hypotheses. [[3]](#sources) Three rules apply to that analysis:

It counts companies, not deals. [[4]](#sources)
It labels small samples, and fewer than 10 won companies is very low confidence. [[4]](#sources)
Segments proposed by AI are labelled experimental until a person approves them. [[4]](#sources)

If you have won only a few fintech accounts, treat what the analysis says about them as a hypothesis.

On geography, Outlevo asks which countries you sell into and never proposes markets. [[4]](#sources) This playbook does the same. The choice of markets is yours.

Roles to reach

The roles are your call. Two things from the sources can help you decide.

First, the targeting example above names a Head of RevOps at a fintech company. [[1]](#sources) If your buyer sits in revenue operations, our playbook on outbound to RevOps leaders at SaaS companies covers that role in a different industry. If your buyer is on the security side, see cold email to CISOs.

Second, job titles are available in your own data. When you connect HubSpot, contact import is optional. It brings in email, name, job title and email opt-out, and only after an admin turns it on with a stated purpose. [[5]](#sources) That opt-out field is worth keeping: a contact who has opted out should not reach your sequence.

Finding contacts at a company you have chosen costs 4 credits for contact discovery, and 1 credit for email verification. [[6]](#sources) Verify before you send.

Triggers to watch

No source lists fintech-specific buying events, so this guide does not invent a list. Two signals are documented, and both come from Outlevo.

Company visits to your site. One script on your website shows which companies visit, which pages they read and whether they fit your ICP. It never identifies a person. [[7]](#sources) It costs 1 credit per company identified per day, however many pages that company reads. [[7]](#sources) A company that reads your security or pricing page tells you something about what to lead with.
Competitor signals. Competitor tracking records quoted facts from competitors' public pages, changes, win/loss by competitor and competitor signals on accounts. [[8]](#sources)

Whatever you watch, write it down in a form someone can check. A Readiness Card needs at least three observations, each with a source and a date. [[9]](#sources) Facts read from a website are kept only when their quote is found on the page, and guesses are labelled as hypotheses, never presented as findings. [[9]](#sources) Hold your own notes to the same standard. A trigger you cannot source should not appear in an email to a regulated buyer.

What to say about data handling

Put the answer in the email. A short block, three or four lines, is enough. It should cover:

Where you got the contact's details.
What you hold about them.
How to be removed.
Where to read more about your security.

Your prospect may also ask which tools in your stack touch their details. If you run outbound with Outlevo, this is what is documented, and each point is checked against the security page and the how it works page.

Approval and control

Nothing is sent outside a policy that a person approved. [[10]](#sources)
Policies set who can be contacted, on which channels, how often and with what budget. [[10]](#sources)
Every external action is checked against the approved policy before it runs, and recorded in a ledger. [[10]](#sources)
Kill switches pause a campaign, a channel or the whole workspace at once. [[10]](#sources)

Storage and access

Every customer table is protected by row-level security in the database. [[11]](#sources)
Personal data such as email addresses is encrypted at the field level. [[11]](#sources)
Staff support access is time-limited and shown in your activity feed, with the reason and the number of changes made. [[11]](#sources)

CRM and ads

HubSpot writes go to Outlevo-owned properties only, and standard HubSpot fields are never edited. [[5]](#sources) Nothing is written until an owner or admin approves the field mapping. [[5]](#sources)
The Salesforce connection writes only Outlevo's own fields, Readiness Cards and tasks, through the Outlevo package. [[12]](#sources) It is a pilot: the connection needs the Outlevo package in your org, which Outlevo installs with you, and there is no AppExchange listing. [[12]](#sources)
A Google Ads audience holds SHA-256 hashes of verified email addresses, never the addresses themselves. [[13]](#sources)

Website visitors

The visitor script looks up the organization behind a network, never identifies a person and sets no cookie. [[7]](#sources)
Browsers that send Do Not Track or Global Privacy Control, and automated browsers, send nothing at all. [[7]](#sources)

Do not claim more than this. If a prospect asks about a certification, a data location or a retention period, answer from your own documents, or say you will come back with the answer.

Rules to check before you send

Four outside texts matter here. Read them yourself, and have your own counsel decide what applies to the markets you sell into.

CAN-SPAM. The FTC says: "The law makes no exception for business-to-business email." [[14]](#sources)
GDPR. Article 6(1)(f) allows processing "necessary for the purposes of the legitimate interests pursued by the controller or by a third party." [[15]](#sources) Recital 47 adds: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." [[16]](#sources) Neither line settles your case.
UK PECR. The ICO says: "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)." [[17]](#sources)
LinkedIn. Its User Agreement prohibits: "Use bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages". [[18]](#sources)

The LinkedIn text matters because Outlevo can send invitations and follow-ups from your own account where you turn it on, within daily limits. [[19]](#sources) Each person connects their own account. [[19]](#sources) Automatic sending comes with Growth and Managed, or with a LinkedIn seat on Builder. Otherwise the invitations and messages are drafted for you to send by hand. [[19]](#sources) If you want to keep clear of the automation risk in the agreement, choose the draft-and-send-by-hand mode and send the messages yourself. Whichever way you run it, read the agreement first.

Set up sending before the first email

A data-handling answer means little if the email lands in spam or comes from a domain that looks careless. Our deliverability glossary entry gives the background. Here is what is documented.

With Smartlead, Outlevo writes and schedules the emails, and Smartlead sends them from the mailboxes in your Smartlead account. [[20]](#sources) Before a campaign sends, every mailbox must be connected and warmed up. Its domain must also have SPF, DKIM and DMARC checked in the last 7 days. [[20]](#sources)

If you would rather not use your main domain, Outlevo can buy sending domains, create the mailboxes through Zapmail, set up DNS and warm them up. [[21]](#sources) A new mailbox sends nothing until it is warm, which takes at least 14 days and usually about 3 weeks. [[21]](#sources) Plan that wait into your launch date. Builder includes 1 domain and 2 mailboxes, and Growth includes 2 domains and 4 mailboxes. [[21]](#sources)

Google's sender guidelines say: "email senders who send more than 5,000 messages per day to Gmail accounts must meet the requirements in this section. Set up SPF and DKIM email authentication for your domain." [[22]](#sources) If you send fewer than 5,000 a day, you are below that line, and the checks above apply either way.

Sending, follow-ups and the mailboxes your plan includes use no credits. [[20]](#sources)

Sample first email (example)

Example only: written for this playbook, not sent to anyone.

Subject: How we handle your details

Hi [First name],

I'm [Your name] at [Your company]. We make [one-line description of the product] for [role] teams at [type of company].

Before anything else, here is how we handle your details:

- We found your work email on [public source] and hold only your name, work email address, title and company.

- Our outreach runs only inside a policy a person on our team approved.

- If you want to be removed, reply "remove" and we will not write again.

- Our security notes are here: [link].

I'm writing because [one observation from their public site, with the page it came from]. If that is a live question for you, I can send a short summary of what we would do. If not, no reply needed.

[Your name]

[Your company, postal address]

How to adapt it:

Replace every bracket with something you can check. The observation line should come from a Readiness Card observation, which carries a source and a date. [[9]](#sources)
Delete any line you cannot back up. Do not promise a retention period, a certification or a data location that your own documents do not state.
Keep the removal line working. If you use HubSpot contact import, the email opt-out field comes in with the contact. [[5]](#sources)
Leave out the pitch until a reply asks for it. The first email has one job.

After the first email

Plan the follow-up before you send the first message. A sequence is the ordered set of emails and steps a lead receives. Keep it short and keep every step inside the policy you approved: who can be contacted, on which channels, how often and with what budget. [[10]](#sources)

If you use LinkedIn alongside email, Outlevo sends a connection invitation with a short note, then one message after the person accepts. [[19]](#sources) The note is at most 300 characters. [[19]](#sources) A reply stops that lead's emails. [[19]](#sources)

When someone replies with interest, Outlevo can answer with your Calendly or Cal.com link, with their name and email filled in. [[23]](#sources) [[24]](#sources) On autopilot the answer goes at once. Otherwise it waits in Replies for you to send. [[23]](#sources) If your buyers are regulated companies, you may choose the second path, so that you review each answer before it goes out. For the wider case against fully autonomous sending, see our SDR comparison.

What it costs

Plans from the pricing page:

Free: USD 0 per month. [[6]](#sources)
Builder: USD 29 per month, with 320 credits a month. [[6]](#sources)
Growth: USD 149 per month, with 1650 credits a month. [[6]](#sources)
Managed: from USD 999 per month, on a contract. [[6]](#sources)

Credit costs to plan around:

Qualification costs 3 credits. [[6]](#sources)
Light qualification costs 1 credit. [[6]](#sources)
Contact discovery costs 4 credits. [[6]](#sources)
Email verification costs 1 credit. [[6]](#sources)
Deep research costs 30 credits. [[6]](#sources)

One qualified account with one discovered and verified contact comes to 3 + 4 + 1 = 8 credits. [[6]](#sources) Connecting and syncing a CRM uses no credits. [[5]](#sources) [[12]](#sources) The same applies to CSV import and export. [[25]](#sources)

Metered API calls quote their credit cost first and run only when confirmed. [[26]](#sources) If you build on the API, test keys run against a sandbox with fake companies and contacts and are not charged. [[26]](#sources)

Next step

Start with the ICP, because everything above depends on it. The free assessment reads up to 5 public pages of a website. [[27]](#sources) It returns facts labelled as verified observations or AI inferences, and up to 5 experimental segment hypotheses. [[27]](#sources) It also asks which countries you sell into. [[28]](#sources)

Run the free assessment and check the fintech segment, if one appears, against your own won deals before you write the first email.