what questions should a bank ask during an rfp process?

Push hardest on security and compliance, that's where these deals unravel later. Ask which certifications they actually hold (SOC 2 Type II, PCI DSS, ISO 27001) and how they handle FFIEC and GLBA, and make them show evidence rather than just say yes.

+1, never accept "yes we're compliant." ask for the actual soc 2 report, not a sales line

beyond the security stuff, cover where your data lives and how it's encrypted, how they integrate with your core banking system and KYC/AML tooling, their uptime SLA and disaster recovery, the implementation timeline and who owns what, and references from banks your size. and ask about data exit and portability upfront, everyone skips it till they wanna leave

super helpful, the "make them show evidence" point especially. thanks