How Banks and Credit Unions Shortlist a Cleaning Vendor

For financial facilities, the conversation about hiring a cleaning vendor often begins with price per square foot. That is the wrong first question. A more appropriate starting point is this: how does a commercial cleaning company prove it can operate inside a regulated environment without adding risk to your institution?

Across Lancaster County and Central Pennsylvania, banks and credit unions face a vendor selection process that demands far more than a reliable vacuum and an eye for detail. Outsourcing does not transfer responsibility. Federal banking agencies are clear that engaging a third party does not diminish your institution's obligation to operate in a safe and sound manner, just as if the work were performed in-house. Reliance on vendors reduces direct operational control and can introduce operational, compliance, financial, and strategic risk.

This post sets out the shortlist criteria unique to financial facilities. You will learn why price per square foot is the wrong starting point, what your third-party risk framework already requires, and five criteria to evaluate: documented vetting of every person who enters the building, key control and access code handling, after-hours protocol and logs, rules for working near cash handling and secure areas, and audit-ready service records. We will also explain why a competent general office cleaner does not automatically meet these conditions, and provide shortlist questions for your RFP. The goal is a vendor relationship built on documented trust, not assumptions.

Why Price Per Square Foot Is the Wrong Starting Point

Most shortlists for commercial cleaning companies start with a square-footage quote. That number measures floor area, not who will walk your lobby after closing. For a branch or credit union office, the real cost of a failed vendor relationship is an unlogged visitor, an unaccounted key, or a vendor file that cannot answer an examiner's simple request. Searching commercial cleaning companies near me returns dozens of providers with near-identical websites, so price becomes the only visible difference. That is a sorting failure, not a value comparison. A local cleaning services provider can excel in open-plan offices and still be the wrong fit for teller lines, cash-handling rooms, vault access, and after-hours entry. The risk scope differs, so the shortlist criteria must too. The five criteria below matter more than rate: documented vetting, key and code control, after-hours protocol, secure-area rules, and audit-ready records. Treat each as a question to verify in writing before you sign, not an assumption. For context on where contracts fail, see why most commercial cleaning contracts go wrong.

What Your Third-Party Risk Framework Already Requires

That is why the next step is naming the standard you are already held to. Federal banking agencies have been clear that engaging a third party does not diminish or remove a bank's responsibility to operate in a safe and sound manner, just as if the bank performed the service itself. That principle covers a janitorial contract as much as a core processor. The 2024 community bank third-party risk management guide notes that vendor reliance reduces direct operational control and can add operational, compliance, financial, and strategic risk. An after-hours cleaning crew fits that description. The guide organizes vendor work into planning, due diligence and selection, contract negotiation, ongoing monitoring, termination, and governance. Your cleaning vendor should move through those stages with matching documentation. The guide also says it is not a checklist and does not prescribe specific practices. The criteria in this article are your institution's application of that framework, not a regulator's cleaning standard. The framework covers fraud and money laundering laws too, which is why an access-holding vendor draws more scrutiny than a typical office. For local context on those access rules, see The Regulatory Framework Behind Vendor Access at Banks.

Criterion 1: Documented Vetting of Every Person Who Enters the Building

Your framework sets the expectation. This criterion makes it specific: every person who enters the building must be documented before arrival, not described verbally after a question. Ask the vendor to put its screening process for employees and subcontractors in writing, including how those files are updated over time. If the answer is verbal, you have nothing to put in your vendor file.

Ask who actually performs the work. In-house staff, subcontractors, and temporary labor are three different risk profiles, and a commercial cleaning company that sends an unannounced substitute crew changes yours overnight. Confirm how a new hire or replacement is cleared before reaching your branch, and whether clearance happens the same day as assignment. Same-day clearance on a shared master key is the scenario to design against. Require a named account contact and a current roster so the people who show up can be reconciled against the people you approved.

No regulator publishes a cleaning-specific screening standard, so your risk appetite and examiner expectations set the bar. The vendor's job is to show, in writing, how it meets it. Expect documented cleaning standards, not verbal promises, and require them before the first shift.

Criterion 2: Key Control and Access Code Handling

Screening establishes who may enter; key control determines what they can open once inside. Start with the vendor's written key inventory: who holds each key, how many sets exist, where they are stored between shifts, and how often the count is reconciled. An uncounted key is an unowned control.

Then ask how access codes, alarm codes, and badges rotate when a cleaner leaves, is reassigned, or is removed from your account. Turnover on a commercial cleaning service is where access failures cluster, so the rotation procedure matters more than the initial issue. Require individual credentials tied to named people, never a shared code passed among a crew, because a shared code makes an access log meaningless. If sharing cannot be avoided, require that one credential is never issued to multiple people.

Ask how credentials are returned or disabled at the end of an assignment, and whether you receive written confirmation. A vendor that cannot confirm destruction of a code has not closed the loop. Finally, ask where access changes are recorded; documentation and accountability should make the answer to who held a key last quarter a lookup, not a reconstruction.

Criterion 3: After-Hours Protocol, Escorting, and Logs

Locked-down keys mean little if nobody knows who used them. Financial facilities are typically cleaned after closing, so the crew is on site when no branch staff are present to observe. That is the operating condition your protocol must account for.

Ask whether cleaners sign in and out, what the log captures, who reviews it, and how long it is retained. A sign-in sheet nobody reviews is paperwork, not a control.

Ask which spaces may be entered unaccompanied and which require an escort or approved staff presence, and get that list in writing before the first service date rather than after the first question.

Ask how schedule changes are communicated. A crew arriving two hours outside the expected window, unannounced, is a protocol failure even when the cleaning itself is fine.

Ask how the vendor handles a lone worker, a lockout, or an alarm trigger, including who they call and in what order. The contact tree should exist before anyone needs it, documented to the standard that protects your handoff.

Criterion 4: Rules for Working Near Cash Handling and Secure Areas

After-hours protocol governs when crews are on site; secure-area rules govern where they go once inside. Define the restricted spaces for your facility in writing, typically the vault, teller line, cash-handling rooms, and night deposit area, and state plainly where the cleaning scope stops.

That written list belongs in the request for proposal. Ask the vendor what cash-handling protocol means in practice, and whether crews are trained to stay out of these areas during cash operations rather than simply told not to touch anything. Prohibit unaccompanied cleaning of secure spaces, and confirm who supervises any cleaning that must happen inside them. If no one does, the scope needs to change.

Ask how the vendor documents exceptions, such as a crew unable to complete scheduled work because a secure area was in use. Unrecorded exceptions become invisible gaps in your oversight.

Treat the scope as a control map, not a task list. Experience across the facility types that actually require it matters because knowing which doors a crew opens, and when, tells you more than knowing how many square feet they cover.

Criterion 5: Audit-Ready Service Records

Your secure-area boundaries mean nothing without a paper trail proving they were followed. Before you sign, ask to see a sample service report. At minimum, it should capture the date, arrival and departure times, areas completed, and the name of the person who performed the work.

Then ask how quality is documented over time: signed checklists, inspection notes, corrective actions, and who at the vendor reviews them. A commercial cleaning company that reports quality verbally is handing you nothing to file. Confirm whether screening attestations, insurance certificates, and contact updates arrive proactively when they change, or only when you remember to request them. For a sense of how documentation fits a fully specified program, see what a well-specified cleaning program actually looks like.

Map the vendor's records to your own third-party monitoring file, so an examiner request becomes a retrieval exercise rather than a scramble across email threads and invoices. Finally, ask what the vendor keeps, for how long, and in what format, and confirm records stay available after the account ends or the assigned crew changes.

Why a Good Office Cleaner Is Not Automatically the Right Fit

Those records matter because they reveal the operating model behind the work. A capable commercial cleaning company built for general offices is optimized for open workspaces, predictable hours, and low-sensitivity traffic. That is a different operating model, not a lower standard of cleaning.

The gap is not scrubbing skill. It is documentation, access discipline, secure-area boundaries, and the habit of writing down what happened and who was there. A strong referral from another business is useful context, but it does not translate directly into a qualified financial-facility vendor. Success in a law office or retail suite says nothing about key custody or after-hours sign-in.

So stop treating a positive reference as completed due diligence. Even for vendors you already like, ask the access and screening questions in writing. Our guide to How to Evaluate a Commercial Cleaning Company Before Signing a Contract can help you structure that review.

Shortlist Questions to Put in Your RFP

Turn those criteria into questions vendors answer in writing, not in conversation. Add these six prompts to your RFP and require a response for each.

1. Assigned staff and screening: Who will clean our site? Are they employees, subcontractors, or temporary workers? What screening is completed before their first shift, and how do you notify us when the roster changes?

2. Key, code, and badge control: How are credentials issued, tracked, and stored? How are they rotated when a cleaner leaves or is reassigned? What written confirmation do we receive when access is returned or disabled at the end of the assignment?

3. After-hours protocol: What are your sign-in procedures, escort requirements, and escalation contact tree? Who reviews the log, and how quickly are schedule changes communicated?

4. Restricted areas: Which spaces will your crews never enter unaccompanied? How do you record exceptions, such as work deferred because a secure area was in use?

5. Service records: What fields does your monthly report include? Can we see a sample now? Ask for dates, times, areas completed, crew names, and corrective actions.

6. Account contact: Who is our named point of contact? What response time do you commit to when we raise an issue, and how is that tracked?

Score the written answers before you compare rates.

Next Step: Build a Plan Around Your Facility

Score the shortlisted vendors against the five criteria before you look at a single rate. Access control, screening, secure-area boundaries, after-hours protocol, and documentation will still matter in year three, when the invoice price is long forgotten and the access log is what your examiner wants.

Haley's Cleaning Service works with banks and financial institutions and provides a commercial cleaning service built around each facility's size, schedule, priorities, and operational needs rather than a fixed square-footage formula. We are a locally owned company serving Lancaster, Landisville, East Petersburg, Mountville, Rohrerstown, Centerville, and nearby Lancaster County communities, and we consider select commercial opportunities in the York and Harrisburg areas.

If your institution is rebuilding a shortlist, request a quote or consultation and a walkthrough. We will map the plan to your building, your hours, and the areas your crews can and cannot enter.

Conclusion

A cleaning vendor for a bank or credit union should be evaluated like any other third-party risk: start with documented screening, key control, secure-area rules, after-hours protocol, and audit-ready records, then compare rates. A good office cleaner may not have the controls your examiners expect.

The five criteria in this post give your team a consistent scoring framework for every shortlisted vendor. Score the written answers first and the pricing second.

Haley's Cleaning Service builds a commercial cleaning plan around each facility's size, schedule, priorities, and operational needs, and serves Lancaster, Landisville, East Petersburg, Mountville, Rohrerstown, Centerville, and nearby Lancaster County communities.

If your institution is rebuilding a shortlist, request a quote or consultation and a walkthrough. We will map the plan to your building, your hours, and the areas your crews can and cannot enter, so your team can move forward with confidence.