Key Takeaways:
- Most BFSI technology-partner RFP scorecards weight cost and feature coverage heavily because those are the easiest things to score on day one. Exit readiness, surge capacity and resilience - the things that matter when the relationship is six months from ending, badly or well - are rarely scored formally at all.
- Australia's prudential standard for operational risk management, CPS 230, already requires regulated entities to hold a tested exit plan for every material service provider, not just an informal assumption that one could be written if needed. A procurement process that doesn't test for exit readiness up front is building a relationship it will later have to retrofit against that obligation, under worse conditions than a calm RFP evaluation.
- APRA's 2026 letter to industry on AI, and the law-firm commentary responding to it, mark a shift the sector should read carefully: from accepting a governance framework on paper toward testing whether specific controls - including third-party and vendor exposure - actually hold up (MinterEllison, 2026; Clayton Utz, 2026). Exit planning for AI-capable delivery partners sits squarely inside that shift.
- This is not an AI-specific problem. The same scoring gap - cost and features scored formally, exit and surge capacity assessed informally or not at all - applies to any technology delivery partnership, insourced engineering arrangement or ODC relationship, whether or not AI is involved.
- A five-criterion scorecard - exit readiness, surge capacity, regulatory evidence production, local empowerment, and time-zone/cultural fit - closes that gap before contract signature, when it is cheapest and easiest to negotiate, rather than during an exit, when it is neither.
The RFP That Scores Everything Except What Happens When It Ends
A typical BFSI technology-partner RFP is a genuinely rigorous document. It asks for case studies, security certifications, architecture diagrams, reference calls, commercial terms down to the clause. Procurement teams spend weeks building weighted scorecards, and by the time a shortlist reaches a steering committee, every vendor on it has been tested hard on whether it can do the work.
What most of those same scorecards do not test, formally or at all, is what happens when the relationship needs to end - whether because the partner underperforms, the institution's strategy changes, or a regulator asks a question nobody budgeted time to answer. That is not an oversight born of carelessness. It is a structural feature of how RFPs get built: cost and feature coverage are easy to score, because they can be compared line by line against a specification. Exit readiness and surge capacity are hard to score, because they describe a hypothetical future state nobody wants to spend scarce evaluation time imagining. Easy-to-score criteria dominate the weighting by default, not by decision.
The cost of that default is not evenly distributed over the life of a contract. It is backloaded, concentrated in exactly the moment an institution has the least leverage to fix it - mid-relationship, when the partner is already embedded, the data is already flowing, and the institution discovers, usually under some kind of pressure, that nobody ever actually tested whether this partner could leave cleanly.
What CPS 230 Already Requires That Most RFPs Don't Test
This is not a hypothetical governance gap. Australia's prudential standard for operational risk management, CPS 230, already requires APRA-regulated entities to identify material service providers, assess the criticality of what they do, and - specifically - maintain exit plans for those arrangements that are proportionate to their criticality, not merely assumed to be writable on demand (APRA, as summarised in MinterEllison, 2026, on the standard's finalisation). The standard's underlying logic is that an institution's operational resilience cannot depend on a service provider relationship it has never stress-tested against its own departure.
A grace period for existing, pre-CPS 230 contracts to be brought into compliance closed in mid-2026, which means institutions are no longer in a planning phase on this obligation; they are expected to be able to demonstrate it now, across their existing service-provider estate, not only for new agreements (allitservices.com.au, 2026, reporting on the CPS 230 grace period's close).
Here is the practical disconnect: CPS 230 governs the relationship once it exists. The RFP process governs which relationship gets created in the first place. A procurement scorecard that doesn't test exit readiness as a selection criterion is not violating CPS 230 - the obligation to build an exit plan still technically gets met, eventually, after signature - but it is choosing a partner, then discovering after the fact whether that partner can actually support the exit plan the institution is now obligated to hold. That is backwards. The easier, cheaper and more honest place to test exit readiness is before signature, when a partner that cannot support a credible exit plan can simply be scored lower and not selected, rather than after signature, when the institution is contractually and operationally committed regardless of what the exit-planning exercise reveals.
Why the AI Letter Makes This Harder to Ignore
APRA's 2026 letter to industry on AI, and the law-firm commentary that followed it, both point toward the same shift: from APRA accepting that a regulated entity has an AI governance framework on paper, toward testing whether specific controls hold up under scrutiny - including, notably, the entity's management of its third-party AI suppliers (MinterEllison, 2026; Clayton Utz, 2026, both commenting on the letter's framework-to-targeted-expectations shift). We were not able to independently retrieve the letter's full primary text or specific statistics on this run - that limitation is logged in full in this article's reference list - but the direction of travel, confirmed independently across multiple law-firm readings of the same letter, is unambiguous: third-party and vendor exposure is a named area of regulatory attention, not a background assumption.
For a procurement team, the practical implication is specific. An RFP for an AI-capable delivery partner - whether the engagement is an insourced AI product build, an ODC with AI tooling embedded in its delivery pipeline, or a vendor platform with an AI component - now needs to test for a few things a generic technology RFP has never had to test for: who owns the training data and model artefacts if the relationship ends, whether retraining or model continuity can transfer to another provider or in-house team, and whether the regulatory evidence the institution will eventually need to produce (model documentation, decision logs, governance records) is something the partner can hand over cleanly, not something that exists only inside the partner's own systems. None of that fits neatly into a generic Material Service Provider exit-plan template built for a payments processor or a data-centre vendor. It has to be asked for specifically, in the RFP, before the relationship starts.
The Honest Counter-Argument
The obvious objection is that this is already covered - CPS 230 requires exit plans for material service providers, so adding exit-readiness scoring to the RFP is redundant work procurement teams don't need, on top of an obligation they already have to meet regardless.
That objection has a real point and a real limit. It is true that the exit-plan obligation exists independently of how the RFP was scored. It is not true that meeting the obligation after signature is equivalent, in cost or quality, to selecting a partner who was already tested for exit readiness before signature. A partner chosen on cost and features alone, who then turns out to resist a clean data handover, charge punitive off-boarding fees, or hold model artefacts in a format nothing else can ingest, still has to produce an exit plan under CPS 230 - but that exit plan will describe a harder, slower, more expensive exit than one built with a partner selected, in part, for being able to support a clean one. The RFP doesn't remove the obligation either way. It determines how expensive meeting that obligation turns out to be.
A Practical Framework: The Partner Fit Scorecard
Weighting these five criteria formally - even at a modest 20-25% of total score, alongside cost and feature coverage - changes what wins an RFP. It does not remove cost and capability from the decision. It removes the structural bias toward partners who look strongest on day one and weakest on the day the relationship has to change.
What This Means by Buying-Committee Role
For Procurement and Vendor Management, the practical change is immediate: add exit readiness, surge capacity and regulatory evidence production as scored line items in the next RFP template, not as a reference-call impression, and require evidence - a described handover process, a named past capacity event - not just a promise.
For the CTO or CDO, the useful reframing is that exit readiness is an architecture question as much as a contractual one: a partner cannot support a clean exit if the engagement's data model, access controls and documentation were never built to be portable in the first place. That is worth specifying in the technical requirements, not only the commercial terms.
For Risk and Compliance, this RFP change is one of the more direct, low-cost ways to improve the institution's actual CPS 230 posture, because it prevents the exit-plan exercise from starting at a structural disadvantage with every new material service provider relationship.
For the CFO, the relevant number is the one nobody puts in the business case: the cost difference between an orderly, planned exit and a forced, unplanned one. A partner selected in part for exit readiness is, almost by construction, cheaper to leave - and cheaper to credibly threaten to leave, which is itself commercial leverage during the life of the contract, not only at its end.
The sourceCode Perspective
We are ourselves a technology delivery partner to banks and insurers across the region, including through insourced engineering and ODC models, so we have a direct commercial interest in how institutions evaluate partners like us - which is also why we think the argument above is worth making plainly rather than only when it's convenient for us.
In our experience sitting on the other side of RFPs, exit readiness is one of the few criteria a serious delivery partner should want to be scored on, not avoid. A partner that cannot describe, concretely, how a handover would work - what it would take to extract data, documentation and institutional knowledge back to the client or to a successor - is not a partner that has thought seriously about the engagement's long-term discipline. We would rather lose an RFP to a competitor who scored better on a genuine exit-readiness test than win one where the criterion was never asked, because the second scenario just moves the same conversation to a worse moment, with a client who has less reason to trust us by then. Nothing here implies a specific scorecard weighting is the only correct one - the five criteria above are a starting framework, to be adjusted to the institution's own risk appetite and the materiality of the specific engagement.
Conclusion
A technology-partner RFP that scores cost and feature coverage in detail, and assesses exit readiness and surge capacity informally or not at all, is not a balanced evaluation. It is a decision optimised for day one of a relationship that a prudential standard already requires the institution to be able to exit cleanly on any day. CPS 230 does not wait for procurement to catch up with it, and APRA's 2026 AI letter signals that third-party and vendor exposure specifically is moving from a background assumption to a tested expectation. The fix does not require a new regulatory obligation or a slower RFP process. It requires five criteria, scored formally, before signature - when choosing a different partner is still the cheapest option on the table.
If your next technology-partner RFP doesn't currently score exit readiness, surge capacity or regulatory evidence production, the useful next step is not a vendor demo. It is a short working session to adapt the Partner Fit Scorecard above to your institution's own risk appetite and the specific engagement's materiality, before the RFP goes out rather than after the shortlist comes back.
>> Explore more: The insourcing delivery model
FAQ
What does CPS 230 require regarding exit plans for technology vendors? APRA's CPS 230 operational risk management standard requires regulated entities to identify material service providers, assess the criticality of what they do, and maintain exit plans for those arrangements proportionate to their criticality. A grace period for bringing existing contracts into compliance closed in mid-2026, so institutions are expected to be able to demonstrate this now across their existing service-provider estate, not only for new agreements.
Why don't most BFSI RFPs formally score exit readiness? Because cost and feature coverage can be compared line by line against a specification, while exit readiness and surge capacity describe a hypothetical future state that is harder to evaluate and easy to defer to a reference call or an informal impression. Easy-to-score criteria dominate scorecard weighting by structural default, not by deliberate decision.
Is this an AI-specific concern, or does it apply to any technology delivery partner? The underlying scoring gap applies to any technology delivery, insourcing or ODC relationship, AI or not. AI-capable partnerships add specific new questions - data and model-artefact ownership, retraining continuity, and whether the partner can hand over the regulatory evidence (model documentation, decision logs) the institution will need - that a generic exit-plan template was not built to cover.
What is the Partner Fit Scorecard? A five-criterion evaluation framework - exit readiness, surge capacity, regulatory evidence production, local empowerment, and time-zone/cultural fit - intended to be scored formally alongside cost and feature coverage in a technology-partner RFP, closing the gap between what RFPs currently test and what institutions are already obligated to be able to demonstrate under standards like CPS 230.
What should a procurement team change in its next technology RFP? Add exit readiness, surge capacity and regulatory evidence production as scored, weighted line items - even at a modest 20-25% of total score - and require evidence rather than assurance: a described handover process, a named past capacity event, a sample of the documentation the partner could actually produce on request.
Reference List
APRA (Australian Prudential Regulation Authority) (2026) Letter to industry on artificial intelligence (AI). Available at: https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai (Accessed: 9 November 2026).
allitservices.com.au (2026) APRA's CPS 230 grace period ends 1 July: what it means for financial firms and the businesses that supply them. Available at: https://allitservices.com.au/apras-cps-230-grace-period-ends-1-july-what-it-means-for-financial-firms-and-the-businesses-that-supply-them/ (Accessed: 9 November 2026).
Clayton Utz (2026) APRA's AI letter: a shift from framework to targeted expectations. Available at: https://www.claytonutz.com/insights/2026/may/apras-ai-letter-a-shift-from-framework-to-targeted-expectations (Accessed: 9 November 2026).
MinterEllison (2026) APRA's AI letter: a wake-up call for managing your third-party suppliers - what banks and insurers must fix before enforcement. Available at: https://www.minterellison.com/articles/apra-ai-letter-third-party-suppliers (Accessed: 9 November 2026).