Why the Next Wave of BFSI Technology RFPs Will Ask Different Questions

Key Takeaways

• Six 2026 regulatory developments - APRA's AI letter, CPS 230, CBUAE's guidance note, MAS's AI Risk Management Toolkit, EIOPA's AI opinion and HKMA's GenA.I. Sandbox++ - were written independently, for five different jurisdictions and financial subsectors, and still converge on the same four questions: who owns AI governance, can you prove your exit plan works, can you explain a decision, and how is the system monitored after go-live.

• Most BFSI technology RFP templates in circulation were last substantially rewritten before this convergence existed. They still ask 2019-era procurement questions - uptime, feature parity, unit price - and treat AI governance as a single yes/no compliance box rather than a scored, evidence-based category.

• Updating a shared RFP template is a genuine cross-committee coordination problem - CTO/CDO, Risk, Procurement and CFO each have a legitimate claim on it - and doing it badly (either ignoring the gap or over-correcting into a 40-question governance annex) creates its own risk.

• sourceCode is introducing The Proof Ladder, a framework for structuring the next generation of BFSI technology RFP questions across five categories and three tiers of evidence, moving evaluation from "do you have a policy" to "show us it was exercised."

• More governance questions are not free: they lengthen procurement cycles and can disadvantage smaller, genuinely capable partners who haven't yet built formal documentation. The honest answer is tiering the requirement to the risk of the use case, not asking every vendor for Tier 3 proof on day one.

Introduction

Most BFSI technology RFP templates in circulation this quarter were built before 2026's regulatory developments existed. They ask about uptime SLAs, feature parity, implementation timelines and unit pricing - the questions that mattered when the main risk in a technology decision was whether the vendor could deliver the thing on time. They ask, at most, one governance question, usually phrased as a checkbox: does your organisation have an AI governance policy? Yes/No.

That question is now close to useless. Every vendor answers yes. It measures the existence of a document, not the presence of a working control. And across five regulators - in Australia, the UAE, Singapore, the EU and Hong Kong - 2026 has produced a specific, converging answer to what a "working control" actually requires: a named owner, a tested exit path, an explainable decision, and monitoring that continues after the go-live date. None of that shows up in a template built to compare vendors on price and delivery speed.

This piece is the synthesis close to a month of research this content programme has run across those six regulatory developments and the procurement, contract and operating-model questions they raise. Rather than re-litigating any single regulator's requirements - six prior pieces this month already did that in depth - the job here is to show what happens when you lay all six side by side, what that means for the specific artefact a buying committee actually owns (the RFP template), and to offer a structure for updating it that a CTO, a Risk lead, a CFO and a Procurement lead could plausibly agree on in the same room.

The regulatory convergence: six regulators, one shared shape

Each of the following was written for a different institution type, in a different jurisdiction, by a regulator with no coordination mandate with the others. Re-verified directly against primary text as of this piece's publication date:

Strip away the jurisdiction-specific language and four questions recur in five of these six instruments (CPS 230's 2026 amendment is the one genuine exception, and it is worth being precise about that rather than folding it into the pattern):

1. Who owns this, specifically? Not a policy document - a named role, committee or escalation path.

2. Have you tested switching away from it? Not a termination clause - a rehearsed substitution.

3. Can you explain a decision? To a regulator, and separately, to the customer it affected.

4. What happens after go-live? Continuous, not point-in-time, monitoring - because a model's behaviour drifts and a contract's assumptions don't automatically update with it.

That four of five regulatory bodies converged on the same shape without coordinating is the evidence this piece leans on. It is also, not coincidentally, close to the ground three earlier pieces in this series already covered from a single-regulator angle: APRA's vendor-concentration expectations (The Vendor Concentration Blind Spot), CBUAE's consumer-impact requirements (CBUAE's AI Guidance Is a Preview of What Every Gulf Insurer Will Be Asked to Prove), and what a tested exit plan actually contains (What a Real AI Vendor Exit Plan Looks Like). What hasn't been done yet this month is asking what this convergence means for the one artefact every buying committee already owns and already has to update on some cadence regardless: the RFP template itself.

The buying committee's actual decision problem

Updating an RFP template sounds like a drafting exercise. It isn't. It's a coordination problem across four functions that each have a legitimate, partially conflicting claim on the document:

- Procurement owns the process and the vendor relationship, and is measured on cycle time and panel diversity - more questions, especially ones that are hard for vendors to answer quickly, work against both.

- Risk and Compliance owns the standard the questions should reflect, and is the function most likely to have actually read the six instruments above, but rarely owns the RFP document itself.

- CTO/CDO owns the technical evaluation criteria and is usually the most willing to add governance questions - but only the ones that map to systems they already have to defend to a regulator, not a generic checklist.

- CFO owns the weighting between cost and risk in the final scoring model, and is the function most likely to ask, reasonably, whether a longer RFP process actually reduces incident probability enough to justify its cost.

The failure mode isn't usually hostility between these four - it's diffusion of ownership. Everyone assumes someone else is responsible for updating the governance section, so the template survives another cycle unchanged; or, in overcorrection, one function (usually Risk) adds a battery of new requirements during a single review cycle without the other three signing off on the added cost and time, and Procurement or CFO quietly strips half of them out again before the next RFP goes to market.

The workable version of this, seen across institutions that have actually closed this gap, has three features: a single "evidence standard" section of the template that all four functions co-own and version explicitly (not four separate governance appendices bolted on by different functions); a fixed review cadence (annually, or triggered by a material regulatory development, not ad hoc); and - the part most templates skip - an explicit statement of which questions apply to which risk tier of AI use case, so a low-risk chatbot procurement and a core underwriting-engine procurement aren't run through the identical 40-question governance gauntlet.

What most institutions get wrong

Three patterns show up repeatedly in RFP templates that haven't caught up:

Governance as an appendix, not a scored criterion. A governance section exists, but it isn't weighted in the final vendor score - so a vendor can fail every governance question and still win on price and delivery timeline. If it isn't scored, it isn't actually a requirement.

Yes/no questions instead of evidence questions. "Do you have a model monitoring process?" gets a yes from every vendor in the room. "Show us the monitoring dashboard extract from your most recent production deployment" gets a genuinely differentiating answer - and is exactly the shift APRA, EIOPA and MAS are each independently pushing toward.

Templates that predate the institution's own regulatory obligations. KPMG's 2026 Global Third-Party Risk Management Survey found 83% of executives plan to expand their partner networks over the next one to three years, while only 5% have adopted an end-to-end managed third-party risk management model - a gap between vendor growth and governance maturity that mirrors, almost exactly, the gap between what RFP templates ask and what regulators now expect.

A short comparison makes the shift concrete:

The Proof Ladder: structuring the new questions

Rather than a single list of new questions - which would only restate the four-question pattern above without giving a buying committee a way to apply it consistently across dozens of vendor responses - The Proof Ladder organises evaluation across five categories, each assessed at three tiers of evidence.

The five categories, drawn directly from where the six regulatory instruments converge:

1. Governance Ownership - who is accountable, by name or role, across the system's lifecycle.

2. Lifecycle Monitoring - how performance, drift and weak-model behaviour are tracked after deployment, not only at go-live.

3. Explainability & Override - whether a decision can be explained to a regulator and a customer, and whether a human can actually intervene.

4. Vendor Chain & Concentration - which fourth parties and subcontracted model providers sit behind the vendor's own name, and how exposed the institution is to any single one of them.

5. Exit & Substitution Proof - whether switching away from this system has actually been rehearsed, not just written into a termination clause.

The three tiers, which is the part most templates never get to:

- Tier 1 - Policy Exists. A written policy, framework or contractual clause is in place. This is what nearly every current RFP already asks, and nearly every vendor already passes.

- Tier 2 - Named Ownership. A specific role, committee or escalation path is documented and can be produced on request. Few current RFPs ask this.

- Tier 3 - Demonstrated Proof. Evidence the process has actually been exercised - a dated internal audit, a completed exit drill, a logged override, a monitoring dashboard extract. Almost no current RFP asks this, and it is precisely what APRA, CBUAE, MAS and EIOPA are each now converging on in substance if not in identical wording.

A vendor scoring Tier 1 across all five categories looks, on paper, identical to one scoring Tier 3 - until the evaluator asks for the underlying artefact. That distinction is the entire point of the framework: it turns "different questions" from a slogan into something a scoring rubric can actually operationalise.

Business and technology implications

For CTO/CDO, this narrows the realistic shortlist. A vendor that can produce Tier 3 evidence on request has usually already built the internal discipline that a Tier 1-only vendor will need to build under contract, on the institution's timeline, after a regulator asks the same question the RFP should have.

For Procurement, it means the RFP process itself takes marginally longer per governance-relevant category, but shortlisting becomes faster: vendors who can't produce evidence self-select out earlier, rather than surviving three rounds of technical evaluation before the gap surfaces at contract negotiation.

For CFO, the calculus is a cost-of-delay one, similar to any other capital allocation decision: a longer RFP cycle has a quantifiable cost; a vendor governance failure discovered post-contract, under a live regulatory obligation, has a considerably larger and less predictable one.

For Risk and Compliance, the framework gives them a shared vocabulary with the other three functions instead of a governance appendix nobody outside Risk reads closely.

A fair counterargument: procurement friction is real

None of this is free, and a synthesis piece claiming otherwise wouldn't be credible. Adding Tier 2 and Tier 3 evidence requirements to every RFP line item does three things worth stating plainly:

It lengthens the procurement cycle. Evidence requests take longer to prepare and longer to verify than yes/no answers. For a genuinely time-sensitive procurement, that cost is real and should be weighed, not waved away.

It can disadvantage smaller, newer, genuinely capable vendors. A well-funded incumbent with a dedicated compliance function will produce Tier 3 evidence faster than a smaller insurtech or fintech whose engineering is excellent but whose governance documentation hasn't caught up to its product maturity. An RFP that demands Tier 3 proof from every vendor on every category, from round one, risks filtering out exactly the innovative, technically strong partners a buying committee should want in the room - and rewarding institutional polish over engineering quality.

It can become theatre if applied uniformly. Requiring Tier 3 evidence for a low-risk internal productivity tool procurement is disproportionate, and buying committees that apply the same 15-cell rigour to every vendor regardless of the AI system's actual risk classification will simply slow everything down without improving outcomes anywhere.

The honest response isn't to abandon the shift - the regulatory convergence is real and independently arrived at, not a single vendor's opinion - but to tier the requirement to the use case. A customer-facing underwriting or claims-decisioning system justifies the full Proof Ladder from round one. An internal drafting assistant does not. Committees that build this proportionality into the template from the start avoid both failure modes: the stale template that asks nothing, and the over-corrected one that asks everything of everyone.

What leaders should do next

1. Audit your current RFP template against the five categories, not the four regulators - the categories are jurisdiction-agnostic even where the specific regulatory citation isn't.

2. Assign explicit joint ownership of the governance section to Procurement, Risk, CTO/CDO and CFO together, with a fixed annual review cadence rather than ad hoc edits.

3. Build the risk-tiering layer before adding new questions, so Tier 3 evidence requirements apply where the AI system's decisions actually affect customers or regulatory obligations, and not uniformly.

4. Score governance, don't append it. If governance answers don't move the final vendor ranking, they aren't a real requirement.

5. Pilot the updated template on one live procurement before rolling it across the panel, and adjust based on how vendors - including your strongest incumbents - actually respond.

The sourceCode’s perspective

We've spent this month tracing what a single year of regulatory developments actually requires of a BFSI technology partner - vendor concentration and exit planning, Gulf consumer-protection principles, contract clause mechanics under CPS 230, operating discipline after vendor selection, and the mechanics of a real exit plan. This piece is the synthesis: laid side by side, six regulators writing independently arrive at the same four questions, and almost no RFP template in market asks them with any rigour.

Our own position is straightforward: a delivery partner that can answer these questions before being asked has already cleared the hardest part of the evaluation. That's not a claim about sourceCode specifically - it's a claim about what the evaluation should actually test for.

To make that operational rather than theoretical, we're compiling a BFSI AI-Readiness RFP Question Set, built from this year's research across all six regulatory developments and structured on The Proof Ladder above: five categories, three evidence tiers each, with guidance on which tier to require at which AI risk classification. It is a structural tool for updating your own template - organised by category and evidence tier - not a finished, one-size-fits-all script, because no responsible version of this could be.


If your buying committee is working through this update, we'd rather compare notes than sell you a document. Get in touch to request it here!

Conclusion

Regulatory guidance doesn't usually arrive as a single, obviously actionable instruction. It arrives, as it has this year, as six separate documents from five regulators in five jurisdictions, each addressed to a different institution type, none of them citing the others. The pattern only becomes visible when you lay them side by side - which is what this piece, and this month's research, has tried to do.


The practical consequence for a BFSI buying committee isn't abstract: it's a specific document sitting in a shared drive, last substantially revised before this convergence existed, still asking about uptime SLAs. Updating it is a smaller job than it looks, and a more urgent one than most procurement calendars currently treat it as.

Frequently Asked Questions

What exactly changed in 2026 that RFP templates need to catch up with? Six specific regulatory developments across five jurisdictions - APRA's AI letter and CPS 230 in Australia, CBUAE's AI guidance in the UAE, MAS's AI Risk Management Toolkit in Singapore, EIOPA's AI governance opinion across the EU, and HKMA's GenA.I. Sandbox++ in Hong Kong - each set out expectations for AI governance ownership, vendor exit planning, explainability, or lifecycle monitoring, largely independently of one another.

Do these requirements apply only to institutions in those five jurisdictions? Legally, yes - each instrument binds only the entities it regulates. Practically, the pattern they establish is a reasonable proxy for where global supervisory expectations on AI governance are heading, and institutions in adjacent APAC and Gulf markets without AI-specific guidance yet (much of Southeast Asia, Saudi Arabia, Bahrain) are likely to see similar principles adopted regionally within the next 12-24 months, as several pieces in this series have noted.

Isn't asking for Tier 3 "demonstrated proof" unrealistic in a first-round RFP? For every category, on every procurement, yes. That's why The Proof Ladder is explicitly paired with risk-tiering: Tier 3 evidence is proportionate for systems that make or materially influence customer-facing or regulated decisions, and disproportionate for low-risk internal tooling.

Will adding these questions disadvantage smaller or newer AI vendors? It can, if applied uniformly and without proportionality - a real risk this piece addresses directly rather than dismissing. A large incumbent's compliance department will produce Tier 3 evidence faster than a smaller, technically excellent insurtech whose documentation hasn't caught up to its engineering. Tiering the requirement to the AI system's actual risk classification, and giving genuinely promising smaller vendors a defined path to close specific evidence gaps rather than disqualifying them outright, mitigates this.

Who inside the buying committee should own updating the RFP template? No single function should own it alone. The workable pattern seen across institutions that have closed this gap is joint ownership across Procurement (process), Risk/Compliance (standard), CTO/CDO (technical criteria) and CFO (cost-risk weighting), reviewed on a fixed cadence rather than ad hoc.

What does sourceCode's BFSI AI-readiness RFP question set actually contain? It's structured on The Proof Ladder - five categories (Governance Ownership, Lifecycle Monitoring, Explainability & Override, Vendor Chain & Concentration, Exit & Substitution Proof), each with guidance on what a Tier 1, Tier 2 and Tier 3 answer looks like, and how to tier the requirement to an AI system's risk classification. It's a structural tool to adapt into your own template, not a finished, universal script.

Reference List

Australian Prudential Regulation Authority (2026) Letter to industry: Artificial Intelligence (AI), 30 April. Available at: https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai (Accessed: 30 September 2026).

Australian Prudential Regulation Authority (2026) APRA finalises targeted amendments to CPS 230 Operational Risk Management. Available at: https://www.apra.gov.au/news-and-publications/apra-finalises-targeted-amendments-cps-230-operational-risk-management (Accessed: 30 September 2026).

Central Bank of the UAE (2026) Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions in the U.A.E., issued 11 February. Available at: https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence (Accessed: 30 September 2026).

Clayton Utz (2026) APRA's AI letter: a shift from framework to targeted expectations. Available at: https://www.claytonutz.com/insights/2026/may/apras-ai-letter-a-shift-from-framework-to-targeted-expectations (Accessed: 30 September 2026).

European Insurance and Occupational Pensions Authority (2025) Opinion on Artificial Intelligence governance and risk management, EIOPA-BoS-25-360, 6 August. Available at: https://www.eiopa.europa.eu/document/download/88342342-a17f-4f88-842f-bf62c93012d6_en?filename=Opinion+on+Artificial+Intelligence+governance+and+risk+management.pdf (Accessed: 30 September 2026).

Hong Kong Monetary Authority, Securities and Futures Commission, Insurance Authority and Mandatory Provident Fund Schemes Authority (2026) Regulators launch GenA.I. Sandbox++ to foster A.I. innovation across financial services, 5 March. Available at: https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/03/20260305-3/ (Accessed: 30 September 2026).

Hong Kong Monetary Authority (2026) First cohort of GenA.I. Sandbox++, 27 August. Available at: https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/08/20260827-3/ (Accessed: 30 September 2026).

KPMG International (2026) Global Third-Party Risk Management Survey, 28 January. (Accessed: 30 September 2026, via prior sourceCode research verification).

Monetary Authority of Singapore (2026) MAS Partners Industry to Develop AI Risk Management Toolkit for the Financial Sector, March. Available at: https://www.mas.gov.sg/news/media-releases/2026/mas-partners-industry-to-develop-ai-risk-management-toolkit-for-the-financial-sector (Accessed: 30 September 2026).

Monetary Authority of Singapore (2026) Project MindForge. Available at: https://www.mas.gov.sg/schemes-and-initiatives/project-mindforge (Accessed: 30 September 2026).

Risk Awareness (2026) Operationalising Responsible AI in Finance: Key Takeaways from MAS' Project MindForge Toolkit. Available at: https://riskawareness.in/ai-risk-governance-financial-services-mas-mindforge/ (Accessed: 30 September 2026).

Timothy Loh LLP (2026) Joint Circular on the Expansion of Generative Artificial Intelligence Sandbox, 5 March. Available at: https://www.timothyloh.com/insights/latest-news/joint-circular-on-the-expansion-of-generative-artificial-intelligence-sandbox-20260305 (Accessed: 30 September 2026).