RFP question bank: banking-as-a-service

Use these as written or adapt them. The value is not in any single question — it is in asking every shortlisted provider the same set, in the same order, and getting the answers in writing. Sales conversations are steered towards strengths; a fixed question set is the only reliable defence.

If you run your RFP on Finlane, the guided template already collects most of this in a structured form, and responses arrive requirement by requirement so they can be compared side by side.

1. Licensing and entity structure

• Which legal entity would we contract with, and where is it authorised?
• What type of authorisation does it hold, and what activities does that permit?
• For each market we named: is the service provided under a passported licence, a locally authorised entity, or a partner's licence?
• Would we operate as your agent, your distributor, or under our own authorisation?
• If we are your agent, what is the registration process and how long does it take?
• Have you had any regulatory enforcement action, restriction or undertaking in the last five years?

2. Safeguarding and client money

• Which entity holds customer funds, and under which safeguarding method?
• At which credit institutions are safeguarded funds held? How concentrated is this?
• How frequently is the safeguarding position reconciled, and who audits it?
• What would happen to our customers' balances if your entity failed, and on what timeline?
• Is any part of the balance covered by a deposit guarantee scheme, or is it safeguarding only?

3. Accounts and IBANs

• What account types are available, and in which currencies?
• Are IBANs issued in our customer's name or in ours?
• Which countries can issue local IBANs, and which would issue a foreign IBAN?
• Are virtual IBANs supported? Are they receive-only or also send-capable?
• What are the limits per account and per customer, and how are they raised?
• Can balances be sub-ledgered per end customer, and is that record exportable?

4. Payment rails

• Which schemes do you support directly, and which through an intermediary? Name the intermediary.
• What are the cut-off times and settlement timings per scheme?
• Are instant payments supported in each market, both send and receive?
• How are returns, recalls and rejections handled and notified?
• What happens to a payment that fails screening — what is the process and who resolves it?

5. Onboarding: ours

• From signed contract to first live transaction, what is the realistic timeline for a company like ours?
• What are the gating steps, and who owns each one?
• What has most commonly delayed onboarding for clients similar to us?
• What do you require from us at each stage — documents, policies, security review, testing?

6. Onboarding: our customers

• Which KYC and KYB flows are available, and which vendors sit behind them?
• What straight-through processing rates do you see for our customer profile and markets?
• What happens to a referral — who reviews it, in what time, and can we see the queue?
• Can we configure risk thresholds, or are they fixed?
• Who owns the KYC records, and can we export them if we leave?

7. Integration and engineering

• Is there a sandbox that reproduces failure modes, not just happy paths? Can we have access before contracting?
• How are webhooks delivered — at-least-once, idempotency keys, replay on failure?
• What are your published uptime figures for the last twelve months, and how are incidents communicated?
• What is your policy on breaking changes and deprecation windows?
• How do we reconcile your ledger against ours daily, and what tooling exists for it?

8. Support and service levels

• What are the contractual response and resolution times for a payments incident?
• Is support available in our timezone and our language, and on what hours?
• Do we get a named technical contact, and how many clients do they cover?
• What is the escalation path outside business hours?
• What service credits apply if SLAs are missed?

9. Compliance and oversight

• What ongoing oversight will you perform on us, and what reporting will you require?
• What transaction monitoring is applied, by whom, and can we see the rules or only the outcomes?
• Who files suspicious activity reports, and what is our role?
• What are our obligations for complaints handling, and how do they interact with yours?
• Which sectors are outside your risk appetite? Is our model and our customer base inside it?

10. Commercials

• Set out all fees: platform, minimum, per account, per transaction by type, per card, FX spread, disputes, professional services.
• What is the minimum commitment, and what happens if we miss it?
• How does pricing change at three times and at one third of our projected volume?
• Which fees are fixed for the contract term and which can change on notice?
• Is any revenue shared back to us, and on what basis?

11. Term, exit and data

• What is the contract term and the notice period, both ways?
• Under what circumstances can you terminate or suspend service, and with how much notice?
• On exit, what data can we export, in what format, and over what period is it available?
• Do we own the customer relationship and the KYC records, or do you?
• Have clients migrated off your platform before? What did that involve in practice?

12. References

• Can we speak to two clients with a comparable model, volume and market footprint?
• Can we speak to a client who has been through an incident with you?

How to score the answers

Decide your must-haves and nice-to-haves before reading any response, and score against that list rather than against the responses relative to each other. A single failed must-have removes a provider regardless of how strong the rest of the answer is; that discipline is the whole point of writing the list first.