Re-Tendering Against the Incumbent: A Fair Fight Has to Be Designed, Because It Will Not Happen by Itself

Most re-tenders in financial crime technology are not competitions. They are renewals wearing a competition's clothes. The incumbent knows the estate, the data, the politics and the bodies buried in the integration layer; the challengers are bidding against a brochure version of the bank. When the incumbent then wins, everyone involved can tell themselves the market was tested. Usually it was not.

TrustSphere's house view, from running and observing selection processes on both sides of the table, is that an incumbent victory is a perfectly legitimate outcome, but only from a process constructed so that the incumbent could credibly have lost. That construction does not happen naturally. Incumbency advantage is structural, not sinister: it flows from information asymmetry, from switching costs that nobody wants to state honestly, and from evaluators who have unconsciously defined the requirement as the incumbent's product with the irritations removed. Left alone, these forces decide the outcome before the first response is scored.

The opposite failure is just as real and less discussed. Some institutions, embarrassed by the optics of renewal, quietly handicap the incumbent, discounting its scores or withholding context a stranger would be given. That is not rigour, it is a different unfairness, and it produces migrations the business did not need. The discipline is symmetry: neutralise the incumbent's informational head start without punishing it for the sin of having done the job.

How incumbency actually wins

The advantage rarely shows up as bias anyone could name. It shows up in the requirements document, which describes the current operating model in the incumbent's vocabulary, so challengers spend their page budget translating while the incumbent simply agrees with itself. It shows up in the data room, where the incumbent knows the real transaction volumes, alert rates and data-quality defects, and challengers size their bids against sanitised numbers. It shows up in risk scoring, where the incumbent's known weaknesses are priced as familiar irritations while a challenger's unknown weaknesses are priced as dangers.

It also shows up in the economics. The incumbent can bid thin on implementation because there is none, and recover margin in the out years; challengers must carry migration cost into their price. If the evaluation compares total contract value without separately examining run-rate competitiveness, the incumbent wins on an artefact of the comparison, not on merit.

Designing the asymmetry out

The correctives are concrete. Write the requirements from the target operating model, not the current one, and have someone with no history with the incumbent hold the pen. Build a data room that gives every bidder the same operational truth: real volumes, real alert and false-positive rates, the honest state of data quality, the integration inventory. If that feels uncomfortable to share, that discomfort is a measure of how unfair the process would otherwise have been.

Separate the cost comparison into migration cost and steady-state run cost, and score them separately. State the switching cost as an explicit, board-visible number rather than letting it lurk inside every evaluator's gut feel, then decide in advance how much measurable capability improvement would justify paying it. We advise clients to set that threshold before responses arrive, in writing, because deciding it afterwards means deciding it backwards, with the preferred answer already in the room.

A recent TrustSphere engagement, anonymised, shows what the threshold discipline changes. A mid-tier bank re-tendering its transaction monitoring estate minuted, before issue, that migration would be justified by a 20 per cent detection uplift at equal alert volume, or equivalent run-cost saving, against a switching cost it estimated honestly at a mid seven-figure sum over two years. One challenger beat the detection threshold in a scripted evaluation on the bank's own data; the incumbent responded with a materially improved commercial and roadmap offer. The bank renewed, but the decision was arithmetic rather than inertia, the board saw both numbers, and the exit plan now references a tested, executable alternative. Every part of that outcome depended on the threshold existing before the first response was opened.

Then equalise access. Scripted demonstrations on the buyer's scenarios, identical briefing sessions, a rule that any question answered for one bidder is answered for all, and an evaluation panel that includes at least one senior scorer with no operational relationship with the incumbent. None of this is exotic. It is simply never done unless someone designs it in.

The incumbent deserves a fair fight too

Symmetry cuts the other way. The incumbent should be scored on what it has actually delivered, including the delivery failures, but also including the accumulated configuration and tuning that a challenger will take two years to replicate. Pretending that institutional knowledge is worth nothing is as dishonest as pretending it is decisive. Put it in the model explicitly: score it, weight it, and let the challengers see that it was scored, so a losing challenger can understand the mathematics rather than suspecting the fix.

And if the incumbent wins a process built this way, say so loudly, internally and to the losing bidders. A fair process that renews the incumbent produces something valuable: renegotiated commercials, a refreshed roadmap, documented alternatives, and a vendor that has been reminded it is replaceable.

What the second line should demand

For the second line and for operational resilience owners, an incumbent win is not a non-event to be waved through; it is a decision to extend a concentration, and it should be evidenced like one. The EBA Guidelines on outsourcing arrangements expect institutions to maintain a register of outsourcing arrangements, to reassess critical or important functions, and to hold credible exit strategies, migrating to another provider or reintegrating the function, for exactly this dependency. A re-tender is the one moment when the exit plan can be tested against live market evidence rather than theory. If the process produced no genuine alternative bid that the institution could actually have executed, the exit plan is fiction, and the second line should record it as such.

The same logic runs through UK operational resilience. Under the FCA's PS21/3 operational resilience framework, firms must identify important business services, set impact tolerances and be able to remain within them; where fraud screening or monitoring sits inside an important business service, the realistic substitutability of the vendor is part of staying within tolerance, not a procurement nicety. A default renewal that never tested substitutability has quietly weakened the resilience case while appearing to change nothing.

Our practical standard: the second line should sign off the process, not just the outcome. That means reviewing the scoring model before responses arrive, confirming the switching-cost threshold was set in advance, checking the data room was symmetrical, and seeing evidence that at least one challenger bid was assessed as executable. Where the process fails those tests, the right response is not to veto the incumbent but to refuse the label of competition and require the renewal to be governed as a sole-source decision, with the scrutiny that carries.

Each side of the table

For the buyer, the prize is leverage and truth: even a renewal priced against genuine alternatives typically lands materially better commercial terms, and the institution finally learns what moving would really cost. For challenger vendors, the message is to qualify ruthlessly; if the data room is thin and the requirements read like the incumbent's manual, the competition is theatre, and bidding into theatre is a cost with no expected value. Challengers should ask directly whether a switching-cost threshold has been set, and walk away from buyers who cannot answer.

For incumbents, the temptation to lean on relationships and fear of migration is understandable and self-defeating; the durable play is to win the capability argument and concede the commercial reset a real competition forces. And for the second line, the role is the one described above: guarantor of the process, indifferent to the outcome.

A re-tender run this way costs more in design effort than a renewal. It repays that cost in commercial terms, in a tested exit plan, in evaluators who can defend the decision to a supervisor, and occasionally in the discovery that the market has genuinely moved past the incumbent. The institutions that never make that discovery are not the ones with the best vendors. They are the ones that stopped looking.

Suggested Next Steps

• Before issuing the RFP, set and minute a switching-cost threshold: the capability and commercial improvement that would justify migration, agreed by the business, finance and the second line.

• Build a symmetrical data room with real volumes, alert rates and data-quality findings, and apply a rule that every answer given to any bidder is published to all.

• Split evaluation economics into migration cost and steady-state run cost, scored separately, with the incumbent's institutional knowledge scored as an explicit weighted line.

• Require the second line to attest to process fairness against the EBA outsourcing exit-strategy expectations, and to record a sole-source governance route where no executable alternative emerged.

Sources: EBA Guidelines on outsourcing arrangements; FCA PS21/3, Building operational resilience; TrustSphere Risk Index, April 2026.

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai