Who This Plan Is For (and What "In ING" Means Here)

People who type "artificial intelligence in ING" are usually trying to find out what ING Group, the Dutch bank, is doing with AI. That is a fair question, and the answer is on this page. But a business plan template has a different job. It is for a founder who wants to build a company that sells AI to banks of ING's scale, and who needs a plan that a bank's procurement, risk and compliance teams will read without wincing.

So this template treats ING as the reference account. It is one of the largest retail and wholesale banks in Europe, it publishes more about its AI programme than most of its peers, and its buying behaviour is a useful stand-in for any tier-1 or tier-2 bank in the Netherlands, Belgium, Germany, Poland, Spain or the UK. We make no claim that ING is a customer of Avvale or of any startup mentioned here. Where we cite what ING has done, the source is linked.

The plan fits four kinds of founder:

• Process-automation founders building agents or copilots for KYC, customer due diligence, transaction monitoring or mortgage file handling.
• Risk and credit-decision founders building scoring, early-warning or explainability tools that land inside a bank's model-risk framework.
• Customer-service and personalisation founders building contact-centre assist, next-best-action or marketing-content tools.
• Engineering-productivity founders building testing, code-review or legacy-migration tools for a bank's own software teams.

If you are an ING employee or a student looking for the bank's own AI strategy, jump to the market and ING section. If you are a founder, read on from the top. The order of the page follows the order in which a founder runs into problems: time first, then money, then tools, then regulators, then pricing.

An 18-Month Launch Timeline for a Bank-Facing AI Company

Selling to a bank is slow, and the slowness is predictable. The timeline below is the one we put in most plans for this category. It assumes two or three founders, one design-partner bank and a target of a first signed production contract by month 15 to 18. It is a planning assumption drawn from Avvale's client work, not a benchmark published by any bank.

Months 1 to 3: Pick one process and one buyer

Choose a single workflow with a measurable unit: a KYC case, a mortgage file, a suspicious-activity alert, a customer chat contact. Interview 15 to 20 people who do the work today, not only the senior sponsors. Ask how many minutes a case takes, how many are rejected for missing documents, and which system the analyst opens first. These interviews produce the number your whole plan rests on: the cost of one case today.

ING's own public numbers show why this step matters. Its chief operating officer has said that introducing AI into an operations process delivers about a 25% productivity gain. A founder who walks in with a credible estimate of cost per case, and a believable path to that kind of reduction, is speaking the buyer's language.

Months 4 to 6: Build the thin version and the evidence pack

Build only what proves the claim: a working agent on synthetic or anonymised data, an evaluation set with at least 500 labelled cases, and a one-page description of failure modes. Start the model documentation now. A bank's model-risk team will ask for training data lineage, performance by segment, drift monitoring and human-override rules. Writing it after the pilot costs two to three times more than writing it as you go.

Months 7 to 9: Security and procurement readiness

Start the SOC 2 Type II observation window or ISO 27001 certification, put a data processing agreement template in place, and prepare answers to the standard bank vendor questionnaire. If you want to sell in the EU, read the DORA contract provisions covered later on this page and write your standard terms to match them. Banks cannot sign without these clauses, so a vendor who offers them unprompted saves the legal team weeks.

Months 10 to 13: The paid pilot

Push for a paid pilot, even a small one. A free pilot gets deprioritised; a paid pilot has a budget code, a named owner and an end date. Typical pilot fees in this category run from €60,000 to €250,000 for three to six months. In the pilot, measure three things: cases handled per analyst hour, error rate against a human baseline, and the share of cases that needed escalation. ING's mortgage pilot is a useful public template here. It started in March 2026 with an AI agent that reads documents and moves files between systems, while human staff keep the final decision.

Months 14 to 18: Production contract and second logo

Use pilot results to negotiate the production licence. At the same time, start the second bank. Banks talk to each other through industry groups and consortia, and a reference from one mid-size lender often shortens the next sales cycle by one to two quarters. The plan should show the second logo as a funding milestone, not an afterthought.

What It Costs to Start an AI Company That Sells to Banks

A lean build with a team of four to six people and one design partner costs $180,000 to $900,000 to reach a signed production contract, or £140,000 to £700,000 in the UK. These are Avvale planning ranges, not published statistics. The spread is wide because two decisions swing the figure: whether you train or fine-tune your own models rather than orchestrating third-party foundation models, and whether you need to hold bank data inside a dedicated environment during the pilot.

Line-by-line budget

• Engineering team (4 to 6 people, 12 months): $140,000 to $420,000 (£110,000 to £330,000). Two ML or LLM engineers, one backend engineer, one person who has worked inside a bank's operations or compliance function. The last hire is the one founders skip and regret.
• Cloud and GPU spend: $18,000 to $90,000 per year. Fine-tuning and evaluation runs dominate. If you call a hosted foundation model, budget for per-token fees during the pilot, because a bank will test with real volume.
• Security certification (SOC 2 Type II or ISO 27001): $20,000 to $70,000 (£15,000 to £55,000) including tooling and the audit. Allow 9 to 12 months.
• Model validation pack and one independent review: $25,000 to $90,000. This covers documentation of data lineage, bias testing, back-testing and an external reviewer's sign-off. Banks ask for it; few startups price it.
• Legal and contract work: $15,000 to $45,000. Master services agreement, data processing agreement, DORA-ready clauses, IP and liability caps. Hire a lawyer who has negotiated with a bank before.
• Pilot support and travel: $40,000 to $150,000 including a part-time solutions engineer embedded with the bank, and the sales runway while procurement takes its time.
• Insurance: $6,000 to $30,000 for professional indemnity and cyber cover. Banks will ask for evidence of cover with limits that often start at €5 million.

The runway line deserves one more sentence. Bank sales cycles stretch, and a plan that shows only 12 months of cash is a plan that dies mid-procurement. Show 18 to 24 months and explain what milestone each tranche of funding is meant to reach.

Where the money comes from

• Founders' own savings and consulting income: many bank-facing startups begin as a consultancy to one bank and productise later.
• Angel and pre-seed rounds: €250,000 to €750,000 is a normal first round for a team with a design partner and a working prototype.
• Grants: described in the next section.
• Revenue-funded pilots: a paid pilot of €100,000 can cover a quarter of the burn on its own.

SBA, Grant and Start-Up Loan Numbers for an AI Software Company

An AI software company in the US usually registers under NAICS 541511 (custom computer programming services) or 541512 (computer systems design services). According to PeerSense's SBA lending data for NAICS 541512, about 9,190 SBA loans have been approved in that code with an average size of around $226,000, and 94% of them were 7(a) loans. For NAICS 541511, the same type of search shows roughly 10,000 SBA loans with an average near $242,000. Both figures sit well below the roughly $340,000 national average SBA loan, which tells you something useful: lenders in this code finance people and software, not buildings, and they size loans to match.

Two practical points follow. First, SBA lenders want collateral or a strong guarantor, and software startups rarely have either, so for most pre-revenue AI founders the 7(a) route is a second-stage tool, used after the first contract. Second, the SBA size standard for both codes is $34 million in average annual receipts, so a startup is comfortably small for any programme that uses the standard.

UK and EU routes

• UK Start Up Loans: up to £25,000 at a fixed 6%, with mentoring. Small, but useful for covering legal and certification costs in the first year.
• Innovate UK grants: competitive awards, typically £25,000 to £500,000, for R&D-heavy technology. A bank-facing AI product with a clear technical risk, such as explainable credit decisions, fits the criteria better than a thin wrapper around a hosted model.
• SEIS and EIS: UK tax-relieved equity routes for angel rounds, up to £250,000 under SEIS and up to £5 million under EIS. A plan with a clear use of funds and eligibility notes converts UK angels faster.
• The FCA's testing programmes: not funding, but valuable. See the regulation section for details on AI Live Testing.
• Netherlands: Dutch startups can combine WBSO R&D wage-tax relief with regional innovation programmes. Check eligibility with an adviser before you count on it. The Amsterdam AI hub called The Stack, scheduled to open in September 2026 in a 4,500 square metre building, lists ABN AMRO, Google, Deloitte, Prosus, Miro and ClickHouse among its corporate partners, and is worth a visit for anyone selling to Dutch banks (Techzine, 2026).

The Working Stack: Tools Bank-Facing AI Teams Actually Use

Your plan should name the tools. A bank's architecture reviewers read tool names the way a chef reads an ingredient list: they tell the reviewer what you will cost them in integration effort. Below is the stack we see most often, grouped by the job it does.

Models and orchestration

• Hosted foundation models through a cloud private endpoint (Azure OpenAI Service, Amazon Bedrock, Google Vertex AI). Banks usually prefer a model reached through a cloud contract they already hold, because the vendor is already in their DORA register.
• Open-weight models self-hosted for cases where data cannot leave the bank's tenancy. Expect an additional two to three months of engineering for deployment and tuning.
• LangGraph, Semantic Kernel or a plain state machine for agent orchestration. For regulated processes, a deterministic workflow with model calls at defined steps is easier to audit than a free-roaming agent.

Evaluation, monitoring and explainability

• MLflow or Weights & Biases for experiment tracking and model versioning. A model-risk reviewer will ask which version made which decision on which day.
• Arize, Fiddler or Evidently for drift and performance monitoring in production.
• SHAP or similar attribution libraries for explaining scoring outputs; for LLM outputs, source citation and retrieval logs serve the same purpose.

Data, security and compliance

• Snowflake, Databricks or the bank's own lakehouse: match the buyer's platform rather than asking them to adopt yours.
• Vanta or Drata to automate SOC 2 evidence collection, which typically trims audit preparation by weeks.
• HashiCorp Vault or a cloud key management service with customer-managed keys, which most bank security teams will require.

Integration targets

In KYC and AML, the integration points are case management tools and entity-resolution platforms. ING selected Quantexa's Decision Intelligence Platform for risk detection, starting with trade finance in Hong Kong and Singapore in early 2023 and expanding towards financial markets and correspondent banking (Quantexa, ING announcement). A new vendor therefore has two choices: plug into that kind of platform or beat it in a narrow task. For contact-centre tools, the targets are the telephony and chat platforms already in place. For mortgage processing, they are the document stores and origination systems.

The common stack mistake is building the clever model first and the connectors last. Banks buy workflows that fit their systems. A modest model with a clean connector to the analyst's case tool beats a stronger model that needs a copy-paste step.

Regulation: What a Bank Will Ask You About in the US, UK and EU

An AI vendor to a bank does not usually need its own banking licence. It does need to survive the bank's regulatory obligations, which flow down to you through contracts and questionnaires. The sections below list the rules that cause the most questions in procurement.

European Union and the Netherlands

• EU AI Act, Annex III point 5(b): AI systems used to evaluate the creditworthiness of natural persons or to establish their credit score are classed as high-risk. Obligations include data governance, technical documentation, human oversight, record-keeping and post-market monitoring. Sources differ on timing: many published guides cite 2 August 2026, while other coverage of the EU's simplification proposals and the Dutch implementation bill points to 2 December 2027 for high-risk obligations (RegulatoryAI.eu summary). Plan to the earlier date and treat any delay as extra time.
• Dutch supervision: the Dutch draft AI Act implementation law, published for consultation on 20 April 2026, proposes AFM and DNB as the competent supervisors for AI used by financial institutions in areas such as creditworthiness assessment (Bird & Bird, 2026). For a vendor selling to ING or ABN AMRO, that means your documentation could end up in front of the same people who supervise the bank's capital.
• DORA (Digital Operational Resilience Act): financial entities must keep a register of information on all ICT third-party arrangements and meet contract requirements under Articles 28 to 30. AI and LLM providers can be ICT third-party service providers. The first 19 critical ICT third-party providers were designated in November 2025 and include AWS, Microsoft Azure, Google Cloud, IBM and Oracle (DeepInspect summary). If your stack depends on one of them, say so up front and explain your exit plan.
• GDPR: a data processing agreement, a lawful basis for any personal data, and clear rules on automated decisions. Cost to set up properly: €5,000 to €20,000 in legal fees.

United Kingdom

• FCA AI Live Testing: the second cohort, announced in April 2026, includes Barclays, Experian, Lloyds Banking Group (Scottish Widows), UBS, GoCardless, Aereve, Coadjute and Palindrome. Testing runs to the end of the year, with an evaluation report due in Q1 2027, and Advai acts as technical partner (FCA press release). A startup can apply in a later round, or join the Supercharged Sandbox, which offers synthetic data for early experiments.
• PRA SS1/23 (model risk management for banks): sets expectations for model inventories, validation and governance, and applies to vendor models a bank uses.
• UK GDPR and ICO registration: fees from £40 a year for small controllers.
• Operational resilience rules: UK banks have to map important business services and their suppliers, so expect similar questions to DORA.

United States

• Federal Reserve SR 11-7 and OCC Bulletin 2011-12: the model risk management guidance that US banks have applied to AI and vendor models for over a decade. Some 2026 commentary reports that US agencies have issued an updated interagency version, so check the current text before drafting your validation pack (Federal Reserve SR 11-7).
• ECOA and Regulation B: adverse action notices must give specific reasons for credit denials, which constrains opaque models in credit decisions.
• State privacy laws such as CCPA: apply where you process California residents' data.

What this means for your plan

Put a "regulatory readiness" row in your milestone table with a cost and a date for each item above. Banks read that row as a sign that you understand who is accountable for what. A founder who says "we will deal with the regulators later" is usually told the same thing about the contract.

Pricing and Unit Economics: How These Companies Charge Banks

Three pricing structures cover most of the market. Which you pick depends on whether the bank can count the thing you improve.

1. Per-case or per-transaction pricing

The cleanest model for KYC, document review, mortgage file handling and alert triage. The bank already knows how many cases it processes and what each costs, so your price is a fraction of the current cost. A typical range is €1.50 to €8.00 per case depending on complexity. Worked example: a KYC analyst-assist tool priced at €3.10 per case, running on 400,000 cases a year, produces €1.24 million in annual revenue. If an analyst currently spends 40 minutes on a case costing the bank about €26 in loaded labour, your tool needs to remove only 12% of that cost to pay for itself. At 25% productivity, matching the gain ING's COO has quoted for AI in operations, the bank saves roughly €6.50 per case against your €3.10 fee.

2. Platform licence with usage tiers

A fixed annual licence for a defined process, with tiers by volume. Typical enterprise contracts run from €300,000 to €3 million a year. The bank gets budget predictability, you get a clean ARR line. Gross margins reach 65% to 80% once pilot-specific work is behind you. The catch is that procurement will ask for a three-year price lock and a termination-for-convenience clause, so your plan should model churn explicitly.

3. Outcome-linked fees

A share of measured savings or of loss avoided, usually 10% to 20% in year one. It appeals to cost-conscious sponsors but needs agreed measurement and tends to attract more audit attention. Use it for fraud and collections products, where the outcome is a cash figure.

Margins and cost to serve

The cost lines that surprise founders are not compute. They are the solutions engineer who sits with the bank for two quarters, the validation updates when the bank changes a policy, and the audit support when the second-line risk team reviews you. Budget one solutions engineer per three live bank customers and include their salary in cost of revenue, not in sales.

One more number to put in the plan: customer concentration. With two or three bank customers, one cancelled contract can remove half your revenue. Investors will ask for the top-customer share on day one. State it, and show the plan to bring it under 40% by year three.

Market Size, Competitors and What ING Has Actually Done

Published estimates of the AI in banking market disagree, and the disagreement is worth understanding before you quote a number. Research and Markets puts the market at about $33.0 billion in 2025, growing at 17.96% a year to $75.4 billion by 2030. A publisher press release gives $26.7 billion in 2025 and $339.1 billion by 2034. Other firms report 2025 figures anywhere from roughly $15 billion to $43 billion. The spread comes from definitions: some count only software, some include services and automation hardware, some cover only generative AI. The narrow generative-AI slice is reported at $1.43 billion in 2025 and $4.09 billion by 2030 (GlobeNewswire, July 2026).

For a business plan, use a bottom-up number instead. Take the number of target banks, multiply by the processes you serve, and multiply by the annual spend per process. A tier-1 European bank might spend €1 million to €3 million a year on a single AI-enabled process. The top 50 banks in Europe by assets therefore give a serviceable market in the low billions for one process, without relying on any analyst's top-down forecast.

What ING has publicly done with AI

ING reported a 2025 net result of about €6.3 billion on income of €23.0 billion, with nearly 41 million customers and more than 60,000 employees (ING FY2025 results). At that size, small gains in a process turn into large sums, which is exactly why its AI programme is useful to study. The bank's public record includes:

• Five generative AI focus areas: contact centres, hyper-personalised marketing, KYC, software engineering and wholesale banking lending, with risk, technology, people and governance treated as enablers (Computer Weekly interview).
• Customer-facing chatbot: a generative AI chat pilot launched in September 2023 to a share of Dutch customers, built with McKinsey and QuantumBlack. Within seven weeks it had served about 20% more customers than the previous support set-up, and the bank has described plans to extend it across ten markets (Econsultancy).
• KYC and customer due diligence: the bank says it can answer up to 80% of the data points needed for regulatory checks from public data, behavioural patterns and internal information, without involving the customer, shrinking due diligence from days or weeks to seconds in the cases covered (Computer Weekly).
• Agentic AI in operations: projects in transaction monitoring, customer due diligence and mortgage processing, with ING's chief operating officer Marnix van Stiphout quoting a 25% productivity gain when AI enters an operations process.
• Mortgages: a pilot began in March 2026 and the bank extended it to live use. Around 80% of ING's mortgage applications fall outside standard policy criteria, for example self-employed applicants or borrowers within ten years of retirement age. The AI agent reads documents and moves files between systems, while staff keep the final decision (NL Times, June 2026).
• Software engineering: more than 5,000 engineers are reported to use AI as a pair-programming tool.

Three lessons follow for a founder. First, ING buys against a named process and a measured gain. Second, it keeps a human at the point of decision, so a plan that promises full automation of a credit decision will be read as naive. Third, it uses both outside partners (McKinsey, Quantexa) and in-house teams, so you are competing against a build option as well as other vendors. Your plan has to show why a bank would rather buy from you than assign the job to its own centralised AI group.

The vendor field and the money behind it

Investors benchmark bank-facing AI companies against a small set of well-funded names. Your competitor table should include them and say, honestly, where you are narrower.

• Quantexa: raised a $175 million Series F in March 2025, passed $100 million in annual recurring revenue, and reported revenue growth of 49% to £126 million for the year to March 2025 (Quantexa profile). It is already inside ING's risk stack.
• Feedzai: raised $75 million in October 2025 at a valuation above $2 billion, for AI-native fraud and financial-crime prevention (FinTech Global).
• Hawk: raised a $56 million Series C in April 2025 for AI-powered AML and fraud screening, bringing its total raised to about $87 million (FinTech Global).
• ComplyAdvantage: has raised about $108 million and serves more than 3,000 enterprises across 75 countries.
• McKinsey QuantumBlack and the large consultancies: not startups, but the incumbents for custom builds, which makes them a competitor and a possible channel.

The takeaway from the funding figures is that the large rounds go to companies with multi-bank revenue. A seed-stage plan should therefore aim at depth in one narrow workflow, such as trade-finance document checks or mortgage file review for non-standard borrowers, where an incumbent platform is too general to serve well. McKinsey's own estimate of the value gen AI could add to global banking, in the range of $200 billion to $340 billion a year, is a useful top-line context figure, but your plan should lead with your own bottom-up case (McKinsey).

Questions People Ask About ING and AI, Answered for Founders

How is ING using artificial intelligence?

In five main areas: contact centres, personalised marketing, KYC, software engineering and wholesale lending, plus agentic projects in transaction monitoring and mortgages. The bank has been using AI for about a decade and has centralised development so one team can scale a product across several countries. For a founder, the practical point is that the bank thinks in processes and countries, not features.

Does ING use AI for KYC and anti-money laundering?

Yes. It uses machine learning to flag suspicious activity and generative AI to help analysts extract, summarise and contextualise case data, and it works with Quantexa on risk detection. Human analysts remain in the loop. If you build in this area, your plan needs a clear statement of which decisions stay with people and why.

What AI vendors does ING work with?

Publicly named partners include Quantexa for decision intelligence and McKinsey with QuantumBlack for the generative AI chatbot. The bank also relies on large cloud platforms. We are not aware of public statements naming other vendors for specific processes, and you should not infer a relationship from the fact that a vendor sells to banks generally.

Can a startup sell AI software to a bank like ING?

Yes, but through a path that looks nothing like consumer software sales. You usually start with a business sponsor in an operations function, pass a security and third-party risk review, sign a paid pilot, and then face model-risk validation before production. The whole route takes 12 to 24 months. Startups that treat it as a 3-month sale run out of cash. The timeline section above sets out the sequence we plan for.

Sample Plan Extract: A KYC Analyst-Assist Startup

The extract below shows the level of detail that a bank sponsor or seed investor expects in the executive summary. The company is a composite, not a real client.

Inside the Template: Sections Written for a Bank-Facing AI Company

The template follows the standard Avvale plan structure, with prompts changed to match what bank buyers, model-risk teams and seed investors look for:

• Executive Summary: the process you improve, the cost per case today, your measured gain from a pilot, and the funding ask.
• Problem and Process Map: a step-by-step view of the workflow, time per step, error rate and who owns the budget.
• Solution and Human Oversight: what the system decides, what it only suggests, and where a person signs off.
• Market Analysis: bottom-up sizing by bank, process and country, with a place for the top-down figures cited above.
• Competitor Analysis: table templates for platform incumbents (Quantexa, Feedzai, Hawk, ComplyAdvantage), consultancies and in-house build.
• Regulatory Readiness Plan: EU AI Act, DORA, FCA and model-risk milestones with dates and costs.
• Security and Third-Party Risk: SOC 2 or ISO 27001 timeline, hosting choices and exit plan.
• Go-to-Market and Sales Cycle: pilot structure, sponsor map, procurement steps and a second-logo plan.
• Team and Advisers: founders, bank-operations adviser and compliance adviser.
• Financial Plan: pricing by case or licence, cost of revenue including solutions engineers, 5-year forecast, and customer concentration.

The $300 / £250 and $1,000 / £800 packages add a financial model built from your own volumes, with pilot, licence and churn scenarios, and cash runway by funding tranche.

Related guides: see our AI in fintech business plan template, the fintech startup business plan template, the digital lending platform business plan template and the AI governance business plan template. The wider free business plan template library covers more than 30 industries, and our business plan writer service connects you to the consulting team directly.

Frequently Asked Questions