Remitech | Your Trusted Technology Partner

How TrueLayer Turned Security Reviews from a Bottleneck into a Commercial Asset

TrueLayer is Europe's leading Pay By Bank network. Moving money for millions of customers across regulated markets, every prospective partner wants to look inside your security programme before committing to a partnership. For TrueLayer's security team, that scrutiny had turned into speedbump in the sales cycle.

A Bottleneck the Business Could Feel

Every new partnership came with a questionnaire, and every questionnaire pulled time from the people who could least spare it. Sahra Henry, Head of Security GRC, remembers one due diligence questionnaire that hit 999 questions. “I worked on it two to three hours a day for two weeks straight, to keep one deal moving.” Requests landed in the Governance, Risk & Compliance (GRC) inbox and as Sahra describes it, ended up “needing input from multiple teams without much warning”.

“We would be asked questions that didn’t make sense in the context that we work in, so you have to translate the equivalent of what you do in a way everyone can understand to help speed up the process."

Liam Williamson

Senior IT Manager

IT, Security Engineers and DevOps were pulled in to translate questions about backup tapes and on-prem domain controllers, infrastructure that TrueLayer hasn’t ever used. It was costing them vital time and was making a process that was already lengthy, even longer.

The team needed change and began looking at the names everyone knows when it came to GRC, but they kept hitting the same wall. Each one bundled a Trust Center inside a much larger compliance suite, something TrueLayer didn't need for their security programme. Their controls, audits and processes already worked. They needed the missing piece, not the full stack and none of the obvious vendors would sell it that way.

"Having Jack there was an extra layer of support for us. He understands and knows the nuance whereas for us we are going in with a much higher level view … Working with Remitech has really changed my mind about working with Third-Party resellers.”

“We've now just got a little bit more time to spend doing some actual proper thinking about things. It's giving us more headspace because we're not worrying about our MDM.”

Lauren Smith

Senior GRC Specialist

The Conversation That Changed It

The breakthrough happened when Remitech hosted a DORA roundtable, where Sahra and Lauren Smith, Senior GRC Specialist, had come to speak on the panel about how to be regulatory ready. The questionnaire pain came up and Jack from Remitech knew something TrueLayer didn't: SafeBase could be bought standalone, no GRC suite attached.

One piece of industry knowledge, shared in the right room, collapsed a year of vendor evaluation into a matter of weeks.

From the introduction onwards, Remitech took on the work the GRC team didn't have capacity for:

Ran the vendor comparison so Sahra and Lauren didn't have to build the matrix from scratch
Led the commercial negotiation and landed a price that fit their budget
Supported the implementation by constantly checking in with the Truelayer team to manage any issues and chasing SafeBase directly through integration questions
Brought feedback back in the other direction by surfacing TrueLayer's nuanced requirements to SafeBase's product team

The Results

Within weeks of SafeBase going live, the questionnaire process stopped being something the team dreaded.

1

50% reduction

in questionnaire workload across IT and Security

2

Faster approval process

partners now self-serve through a Trust Center link instead of waiting on a hand-written spreadsheet

3

Cleaner document control

outdated policies stop circulating; everyone sees the current version

4

Better capacity planning for the team

capacity that used to vanish into questionnaires now goes to projects that were never going to get done otherwise

And the impact goes well beyond time saved. The prospective partner's experience has become noticeably cleaner, as Lauren puts it, "they don't have to go through manual back-and-forth over email... They can self-serve and gain automatic access based on whether they've signed the right documents."

The impact on their reputation has been just as significant with Truelayer being able to demonstrate security maturity from the outset. As Sahra Henry explains, "having a Trust Center in place shows our customers that we take security seriously." That signal lands with procurement teams, security reviewers, and prospective partners long before a sales conversation even starts, shortening cycles and strengthening TrueLayer's position in deals where due diligence is heavy.

Why the relationship didn't stop at the deal

The SafeBase introduction wasn't a transaction, it was the start of a working relationship. TrueLayer's team are now regulars at Remitech's Fintech Dinner Club, where security and IT leaders from across fintech come together to compare notes off the record.

It's an opportunity for peers (and sometimes competitors) to share the same regulated reality and daily problems. People bring the big wins they're proud of, and just as importantly, they share the lessons they wouldn't put on a public stage.Recommendations come up the way the best ones always do, over dinner, from someone who's actually used the thing in production.

“I have met quite a few amazing people through the dinner. I got to learn more about phishing attacks that others were seeing at the Doppel dinner…you don’t get access to information like this on online forums”

Shwetang Barot

Senior Security Operations Analyst

“The networking element is great, you get to sit around a table with a bunch of people and you float ideas around of what you would have done and what they have done.”

Maruf Ahmed

IT Engineer

Conclusion

TrueLayer started with a security questionnaire problem and a team running out of hours in the day. What they ended up with was a faster commercial engine, a calmer GRC function, and a partner who's still in the room when the next hard problem comes up.

Part of why the relationship has lasted comes down to how Remitech shows up in the first place. Maruf puts it best “I enjoy the personal touch and organic conversations I have with them”. That's the difference between buying software and finding the right people to help you choose it, as Liam shares “They come with questions of what our challenges are, rather than pushing a new tool they want to sell.” For TrueLayer, it's why the partnership keeps growing past the deal that started it.

"If another fintech company asked me if they should work with Remitech I'd tell them to go to their Fintech Dinner first. You'll get to meet them and build that personal connection with them as they aren’t cold callers."

Liam Williamson

Senior IT Manager

Got a security stack that's draining your team?

If you're a fintech leader staring down a stack of questionnaires, a procurement cycle that keeps stalling, or a security function that needs more capacity than it has hours, the SafeBase story isn't unusual. It's the kind of problem Remitech helps solve every week. The dinner is usually a good place to start the conversation.