Insights · Choosing a fintech partner

How to select a fintech software development and AI innovation partner

Claude Certified Services Partner(Anthropic)

Short answer. Choose a fintech software and AI partner on evidence you can check, not on claims: delivery history in regulated financial services, security certificates and data location, an evaluation method and audit trail for any AI agent, a fixed-scope pilot with go/no-go criteria, references you can call, freedom to choose the model platform, and written ownership of code and prompts. For EU financial entities, add the ICT third-party rules of DORA, and for Swiss banks the FINMA outsourcing circular. The table below gives each criterion with how to verify it and the red flag. S-PRO, a Swiss international firm headquartered in Zurich, is one provider you can test against it.

Last updated: 21 October 2026 · S-PRO team

2014Founded, headquartered in Zurich

250+Engineers in Zurich and Łódź

ISO27001 and 27701 certified

CPNCertified partner in the Claude Partner Network

Which criteria separate a regulated-sector partner from a generalist?

Seven criteria cover most of the decision. Use the table as the scoring sheet for an RFP. Where another page on this site goes deeper, it is linked in the row instead of repeated here.

Swipe to compare →

Criterion	How to verify	Red flag
1. Financial-services delivery record	Ask for two or three references at regulated institutions that you can call, and for what the partner built (scope, your counterpart’s role), not only a logo	Only consumer apps or unregulated startups; references that cannot be contacted; “banking experience” with no named deliverable
2. Security certification and data location	Ask for the certificates (ISO 27001, ISO 27701 or equivalent) and the scope they cover; ask where code, data and test environments sit and which subcontractors or delivery centers touch them	Certificate “in progress”; no answer on subcontractors; residency promised verbally only
3. Evaluation and audit trail for AI	Ask to see a test set, measured accuracy, human-approval steps and the decision log of a real agent. See from pilot to production for the five gates	A demo with no evaluation; no log of what the agent did and why
4. Fixed-scope pilot	Ask for scope, duration, price basis and go/no-go criteria in writing before the pilot starts. See pilot-to-production cost	“It depends” at every stage; pilot with no exit criteria; open-ended time and materials
5. Named, checkable references	Ask for one production case with a measurable outcome and a contact, or a clearly anonymized description with the same detail	Metrics with no source; “case studies in progress”
6. Platform flexibility	Ask which models and clouds the partner has shipped on, and to justify the choice for your use case	One vendor’s platform proposed for every problem
7. Ownership and exit	Confirm in the contract that code, prompts and documentation belong to you, and agree hand-over and exit terms	Vendor keeps prompts or tooling; no documentation deliverable

For EU AI Act classification of an agent use case, see EU AI Act compliant AI agents for banks. For the supervisory view of AI governance, see FSB sound practices for AI agents in banks.

How do you verify a partner’s regulatory experience?

Ask for documents and calls, not adjectives.

Reference call at a regulated institution.Ask the reference what the partner delivered, how it handled the bank’s risk, security and compliance reviews, and what went wrong.
Sample artefacts.Ask for a redacted example of the documentation the partner has produced for a regulated client: architecture and data-flow description, test and evaluation report, access model, audit-log specification.
The named team.Ask who will work on your project and how many of them have worked in a regulated institution.
Certificate scope.A certificate covers a defined scope. Check that your delivery location and team are inside it.
Supervisory vocabulary.A partner who has worked with banks can explain, without prompting, how its delivery fits your outsourcing, ICT-risk and model-risk processes.

What do DORA and FINMA require when you outsource to a development partner?

These are the regulatory questions to put to every candidate. Confirm applicability to your institution with compliance and legal; this page is not legal advice.

DORA (EU). Regulation (EU) 2022/2554, the Digital Operational Resilience Act, covers ICT risk management for EU financial entities, including ICT third-party risk. It has applied since 17 January 2025. Chapter V sets out the rules for managing ICT third-party risk: general principles (Art. 28), preliminary assessment of ICT concentration risk at entity level (Art. 29) and key contractual provisions (Art. 30). In practice, a financial entity should be able to show:

Register of information.The partner is recorded in the entity’s register of information on all contractual arrangements for ICT services from third-party providers, which the entity maintains and updates (Art. 28(3)).
Exit strategies.For ICT services that support critical or important functions, exit strategies are documented, tested and reviewed periodically, so that the entity can leave the arrangement without disrupting its business (Art. 28(8)).
Contract terms.For every ICT arrangement, the contract includes at least a description of the services and the conditions for subcontracting, the locations where services are provided and data is processed (with advance notice of changes), data protection and return of data, service levels, assistance in ICT incidents, cooperation with authorities and termination rights (Art. 30(2)). For services supporting critical or important functions, the contract adds, among other points, full service levels with quantitative targets, unrestricted rights of access, inspection and audit, participation in the entity’s threat-led penetration testing, and exit strategies with a mandatory transition period (Art. 30(3)).

Ask each candidate whether it has agreed these terms with EU financial entities before, and who in its organization owns them. Do not accept “DORA compliant” as a label: DORA places obligations on the financial entity, and the partner supports them contractually. Swiss institutions with EU entities or EU group functions should check whether the EU group falls under DORA.

FINMA (Switzerland). FINMA Circular 2018/3 “Outsourcing” is listed by FINMA as a current circular (addressee overview, updated 22 April 2025), and FINMA’s list of pending regulatory projects of 1 September 2026 contains no revision of it. It applies to the institutions FINMA names as its addressees; check whether yours is one of them. FINMA Guidance 08/2024 (18 December 2024), “Governance and risk management when using artificial intelligence”, reports from supervision that, for outsourced AI, FINMA assessed whether institutions had implemented additional tests, controls and contractual clauses on responsibilities and liability, and whether the third parties had the necessary skills and experience. For the FINMA documents in context, see the Swiss banking software companies comparison.

What RFP questions should you ask?

Send the same questions to every shortlisted partner and ask for written answers before any call.

Delivery record.Which regulated institutions have you delivered for in the last three years, and which can we call?
Certificates and scope.Which security certificates do you hold, what is their scope, and which delivery centers and subcontractors would touch our code and data?
Data location and routes.Where do code, data and test environments sit? Which model deployment routes do you support (vendor API, regional cloud, bank-controlled tenant, on-premises)?
Evidence for AI.For an AI agent: show the evaluation set, the measured accuracy, the human-approval design and the audit log from a real project.
Pilot and production.What is in the pilot, how long does it take, what is the price basis, and what are the go/no-go criteria? What would the path from pilot to production look like, and who runs and monitors the system afterwards?
ICT third-party terms.Which contract terms have you agreed before for ICT third-party requirements (DORA Art. 30 or the FINMA outsourcing circular): audit and access rights, subcontractor transparency, termination, exit?
Ownership.Who owns the code, prompts and documentation, and what is the hand-over on exit?
Platforms and fallback.Which models and platforms have you shipped on, why would you choose one for this use case, and what is the fallback if the model or cloud provider has an outage?

Score the answers, then run a scored pilot. Weight criteria 1 to 3 and 7 highest for a regulated use case, and use a fixed-scope pilot with agreed go/no-go criteria as the final selection step, not as a free demo.

Do you need one partner for software and AI, or two?

One partner suits a project where the AI agent is part of a product or platform you are building, because integration, security and ownership then sit under one contract. Two make sense when a systems integrator or consultancy owns the enterprise-wide programme and a specialist builds individual agents or products. Large integrators bring breadth and capacity; specialists bring focus and a named team. Either way, apply the same table. If you also license a core platform, such as a vendor product, the development partner builds around it through APIs. For the build-or-buy decision on a specific use case, see should a bank build or buy AML AI.

How does S-PRO fit these criteria?

S-PRO was founded in 2014, is a Swiss international firm headquartered in Zurich, has 250+ engineers, R&D centers in Zurich and Łódź, and is ISO 27001 and ISO 27701 certified. It builds software and AI agents for banks, wealth and asset managers and fintechs (fintech software development). Published cases include a mobile banking constructor for Treezor’s fintech clients and a VC AI platform for Earlybird, which the case describes as an AI-powered platform for data-driven investment insights. On AI, S-PRO is a Certified partner in the Claude Partner Network. Our team includes Claude-certified engineers and architects. Model and cloud route are chosen per use case, with residency options per project. Code and prompts built for your project belong to your institution, as stated on the AI agent development page. See AI agent development for banks and AI agents for AML transaction monitoring.

Comparing partners for a fintech platform or an AI agent at a bank or wealth manager? Send us the brief: we will answer the seven criteria above in writing, with the references, certificates and pilot proposal you can check. Contact S-PRO, Löwenstrasse 45, 8001 Zürich.

Book a discovery call (45 min)

FAQ

Questions buyers ask us

Do I need a specialist partner, or can my systems integrator do this?

A systems integrator or consultancy can run an enterprise-wide AI programme. A specialist engineering partner is often the better fit for a single agent or product and for hands-on delivery inside a regulated environment. Many institutions use both. Apply the same criteria to either.

How do I verify a partner's regulatory experience?

Ask for references at regulated institutions that you can call, for redacted documentation from past projects (architecture, evaluation report, audit-log specification), and for the certificate scope. Ask what the reference's risk and compliance teams asked for and how the partner responded.

What does DORA mean for choosing a development partner?

For EU financial entities, DORA sets rules for managing ICT third-party risk, including a register of contractual arrangements, exit strategies for critical or important functions and mandatory contract provisions (Arts. 28 to 30). The obligation sits with the financial entity, so ask each candidate which of these terms it has agreed before and who owns them.

Which FINMA rules apply when a Swiss bank outsources software or AI development?

Documents to check are FINMA Circular 2018/3 "Outsourcing" and, for AI, FINMA Guidance 08/2024 on governance and risk management when using artificial intelligence. Whether and how they apply depends on the institution and the service; confirm with compliance and legal.

Should the partner be tied to one AI model vendor?

Not necessarily. The right model can differ by use case, so ask the partner to justify its choice for yours and to show it has shipped on more than one route. A partner with a vendor certification can still be a sound choice if the choice is justified and your exit is protected in the contract.

What can a first AI pilot cost and how long does it take?

It depends on scope, data access, integrations and the model route. Ask every partner for a fixed-scope proposal with duration, price basis and go/no-go criteria before the pilot starts. The main cost drivers from pilot to production are explained on our pilot-to-production cost page.

What are you building?

Contact

You will talk to engineers who build for banks, not to a sales script. Fill out the form and get an answer within one business day.

Security and privacy firstISO 27001 and ISO 27701 certified.
Claude Partner NetworkS-PRO is a Certified partner in the Claude Partner Network. Our team includes Claude-certified engineers and architects.
Proven in regulated financeBanks, wealth managers and fintechs in Switzerland, the EU and the US.

Who you’ll talk to

Michael BarskyiHead of Banking & Fintech

Dustin SchulzeSenior Business Analyst

Prefer email or phone?

hi@s-pro.ioEmail +41 41 588 22 54Switzerland +31 20 323 61 46Netherlands