Judge on fit and risk before price. The big ones are regulatory and security fit (SOC 2 Type II, PCI DSS, ISO 27001 with real FFIEC and GLBA alignment and evidence), proven integration with your core system and payments, and reliability like a contractual uptime SLA with RTO and RPO.
then weigh total cost of ownership over 3-5 years not just year one, plus vendor financial stability and references from similar banks. put it all in a weighted scoring matrix so ur comparing like for like. the cheap bid never stays cheap once integration and support land tbh