Vendor selection and management: choosing and controlling a payment supplier

Vendor selection starts with a request for proposal that states what the firm needs, not what the vendor sells. The RFP must state the payment types, the volumes, the corridors, the message formats, the screening requirements, the reconciliation requirements, the availability target, and the recovery time objective. A vendor that cannot meet the availability target, or that cannot support the message format, should be eliminated early, however good its demonstration is. The RFP must also state the evaluation criteria and their weights, so the decision is made on the criteria, not on the sales pitch. Due diligence is the investigation before the contract. The firm must check the vendor's financial standing, its customer base, its roadmap, its security certifications, and its incident history. The firm must ask for reference customers and must speak to them, not just read the case studies. The firm must check whether the vendor has ever had a major outage, how long it lasted, and what the root cause was. A vendor that will not provide references, or that will not discuss its outages, is a vendor to avoid. The contract is where the control is established. It must state the service levels, with the availability, the processing time, and the time to resolve a defect, and the service credits for breaching them. It must state the audit rights, so the firm can audit the vendor's controls, and the right to information, so the firm can see the vendor's incident reports. It must state the exit clause, with the notice period, the data export format, and the transition assistance. A contract without an exit clause is a trap, because the firm cannot leave without losing its data. Service level management is a continuing activity, not a one-time negotiation. The firm must measure the vendor's performance against the SLA every month, must review the service credits, and must hold a service review meeting. The review must cover the availability, the defect count, the time to fix, the incident count, and the roadmap. A vendor whose performance is declining must be challenged early, before the decline becomes an outage. The requirements must state the SLA metrics, the measurement method, and the review cadence. Fourth party risk is the risk the vendor introduces through its own suppliers. A payment hub vendor that runs on a cloud provider, or that uses a sub-processor for screening, introduces a dependency the firm does not control. DORA requires the firm to know its fourth parties, to assess their risk, and to include them in the register of third parties. The contract must therefore require the vendor to disclose its sub-processors, to notify the firm before changing them, and to allow the firm to object. A vendor that will not disclose its sub-processors is a risk the firm cannot manage. Exit planning is the discipline that most firms neglect. The exit plan must state how the firm will move from the vendor to another vendor or to an in-house solution, how long it will take, what it will cost, and what data will be transferred. The plan must be tested, at least by a desktop exercise, before it is needed, because an exit plan that has never been tested will fail when it is needed. The requirements must state the exit plan, the test frequency, and the owner. For a business analyst, vendor management is a set of requirements and a set of tests. The requirements must state the RFP criteria, the due diligence checklist, the contract clauses, the SLA metrics, and the exit plan. The acceptance criteria must include a test where the vendor's SLA report is checked against the firm's own measurement, and any discrepancy is investigated. Last reviewed 7 November 2026. Further reading: Regulation (EU) 2022/2554 (DORA), Articles 28 to 30; the European Banking Authority guidelines on outsourcing; the Prudential Regulation Authority Supervisory Statement SS2/21 on outsourcing and third party risk management; the Cloud Security Alliance guidance.