Chapter 36: Key Takeaways — Vendor Selection, Due Diligence, and Implementation Management

Core Insights

• Vendor selection is a regulated activity, not a procurement event. DORA Articles 28-30, the FCA operational resilience framework, and the UK CTP regime all attach legal obligations to the process, documentation, and contractual outcomes of ICT vendor selection. Compliance must own this process, not merely approve it at the end.

• Requirements must be complete before vendor conversations begin. Every conversation with a vendor before requirements are finalized is a conversation in which the vendor shapes your requirements in its own interest. Requirements define evaluation criteria; evaluation criteria without underlying requirements are preferences, not standards.

• The contract signed on the way in is the contract lived with on the way out. The Procurement Trap is not set by malice but by asymmetric information. The vendor has executed the contract dozens of times; the compliance team, under deadline pressure, may be executing it for the first time. The provisions that cause the most pain — missing audit rights, absent exit assistance, uncapped price escalation — are the provisions least attended to in a rushed signing.

• SLA remedies must include termination rights, not just credits. A service credit compensates the vendor for its own failure at a fraction of the actual cost. The right to terminate for persistent or material SLA failure is the only remedy that creates an enduring incentive for the vendor to perform.

• Implementation budget should equal the license budget. Compliance teams consistently underestimate implementation costs. Integration, data migration, configuration, training, and testing for a Tier 1 platform typically cost as much as the first year's license fee. Budget for it explicitly or the implementation will be underfunded and the go-live will be compromised.

• Post-implementation governance is not optional. The vendor relationship must be actively managed through formal quarterly reviews, annual assessments, and continuous SLA monitoring. The compliance capability built through a successful implementation deteriorates without deliberate ongoing governance.

• Exit planning is implementation planning. The firm's ability to exit a vendor relationship cleanly — with its data, its documentation, and sufficient transition time — is a compliance risk management matter. It must be planned before the contract is signed, not when the vendor relationship has become untenable.

Vendor Evaluation Framework — Summary Table

Contract Non-Negotiables — Rafael's Framework

The following provisions are non-negotiable for any Tier 1 RegTech vendor contract. Their absence is a red flag; their inadequacy is grounds for continued negotiation.

Vendor Due Diligence Checklist

Technical Due Diligence

• [ ] Current SOC 2 Type II report (reviewed, not just attested)
• [ ] ISO 27001 certification (current certificate)
• [ ] Most recent third-party penetration test report and remediation status
• [ ] Data security architecture documentation
• [ ] Data residency and processing location confirmation
• [ ] Sub-processor list (current, complete)
• [ ] BCP/DRP documentation with last test date and results
• [ ] Incident history (material security incidents in past 3 years)

Regulatory Due Diligence

• [ ] Regulatory enforcement action history (vendor and clients)
• [ ] DORA/FCA CTP status or assessment
• [ ] Regulatory reporting output format validation (XBRL, MiFIR, etc.)
• [ ] Regulatory change management process documentation
• [ ] Audit right acceptance confirmed (in writing, pre-contract)

Financial Due Diligence

• [ ] Financial statements or funding documentation (last 2 years)
• [ ] Revenue concentration analysis (top 10 client %)
• [ ] Ownership and corporate structure (parent entities, investors)
• [ ] Change of control provisions reviewed
• [ ] Key person dependency assessment

Reference Due Diligence

• [ ] Three references at comparable size and regulatory profile
• [ ] References contacted independently (not only vendor-curated)
• [ ] Reference questions include: go-live timeline vs. plan; SLA performance; audit right experience; contract flexibility; data export experience

Implementation Phase Milestones Reference

Rafael's Ten Rules — Quick Reference

1. Requirements before conversations
2. Three bids minimum
3. Three references at comparable scale
4. Read every word of the contract
5. Audit rights are a must-have, not a nice-to-have
6. Plan the exit before you sign the entry
7. Own your data — verify the export capability
8. SLA remedies must include the right to terminate
9. Implementation budget equals the license budget
10. Day-1 post-go-live governance is as important as implementation

Key Regulatory References