Loyalty Platform RFP: 30 Questions That Expose Real Vendor Capability

The most useful loyalty platform RFP questions ask vendors for specific evidence (named people, past delays, reference clients, full costs and exit terms) rather than confirmation of features that every credible vendor will claim to support.

Many loyalty RFPs read as feature checklists. They ask whether a vendor supports tiers, APIs, mobile wallet passes and gamification, and every credible vendor says yes. The shortlist then depends on who gives the best demo rather than who delivers best. The questions that separate vendors are about what happens after the contract is signed: who does the work, what has gone wrong before, what it all costs and how you leave. This guide covers five common RFP mistakes, 30 questions in six categories, how to score the answers and ten questions for reference calls. For how RFPs work in general, see the guide to the RFP process.

Key Takeaways

What are the most common loyalty platform RFP mistakes?

The most common mistakes are issuing an RFP before requirements are defined, weighting features over service, accepting timeline claims untested, skipping ownership and contract questions, and comparing license fees instead of total cost.

Issuing the RFP before requirements are defined. Without a written program outline (objectives tied to business metrics, member journeys, must-have versus nice-to-have requirements, integration needs and the team available after launch), vendors fill the gaps with their own assumptions, and their proposals describe different programs at different prices. The loyalty platform buyer's guide covers the options to consider first.

Weighting features over service. Most established platforms support tiers, APIs and gamification, so confirming them eliminates no one. The differences are in who provides strategy, creative, analytics and compliance, whether that work is in-house or outsourced, and what support looks like after launch.

Accepting timeline claims untested. "Ninety days to launch" can mean a minimal configuration, a soft launch or a full production program. Ask what scope the timeline assumes, what has caused delays before and what your team must provide. The implementation timeline guide covers what realistic plans include.

Skipping ownership and contract questions. Ownership can change during a multi-year contract, whatever the vendor's current structure. Ask every vendor the same questions about ownership, change-of-control terms and data portability early, not at contract review.

Comparing license fees instead of total cost. License fees leave out implementation, integration, internal staff time and ongoing services. As an illustration, a platform licensed at $180,000 a year that needs a $400,000 implementation and $200,000 a year of internal management totals $1.54 million over three years before any outside services; compare that with each vendor's all-in figure for the same scope. Ask every vendor to complete the same cost model.

What questions should a loyalty platform RFP ask?

A strong loyalty platform RFP asks 30 questions across six categories: company and ownership, implementation, integration and architecture, post-launch service, vertical experience and compliance, and total cost.

Company and ownership

These questions matter for any multi-year relationship. Judge the answers on how directly and completely each vendor responds, and on the contract protections offered, rather than on the type of owner.

1. Who owns the company (founders, private equity, public shareholders or a strategic parent), and when did ownership last change?
2. What is your client retention rate, how do you measure it, and what is the average tenure of your current clients?
3. Which senior executive will be accountable for our account, and how long have they been with the company?
4. What does your 24-month product roadmap include, and how much development goes to existing client needs versus new products?
5. If ownership changes during our contract, what terms protect our data portability and program continuity, and what cyber liability and errors-and-omissions coverage do you carry?

Implementation and delivery

Look for named causes of past delays, stated scope assumptions and specific resource requirements.

6. What is your implementation timeline for a full production program of our scope, not a minimal version or soft launch, and what scope does it assume?
7. What are the three most common causes of programs running late in your delivery history, and how do you reduce each?
8. What must our team commit during implementation, and what happens to the timeline if those people are part-time or unavailable?
9. Is the timeline a contractual commitment or a target, and what remedies apply if it is missed?
10. Provide a week-by-week plan for the first 90 days, showing your deliverables and our inputs at each stage.

Integration and technical architecture

A prebuilt connector that the vendor maintains is very different from a custom integration you pay for and support. The guide to integrations to look for and the composable architecture guide cover the technical background.

11. For each of our named CRM, commerce, point-of-sale and customer data systems, is the integration a maintained connector or custom development, and what data flows in each direction?
12. What is your API design (REST, GraphQL, webhooks), and what rate limits, uptime commitments with service credits, support response times and versioning policies apply?
13. How do members sign in, and does it work with our existing identity provider, and to what WCAG level do member-facing experiences conform?
14. Are earn and redeem events processed in real time or in batches, and what is the maximum delay between a purchase and the points appearing?
15. In what format can we export our complete member database, transaction history and program analytics, how often, and at what cost?

Post-launch service and account management

"Dedicated customer success" can mean one person covering many accounts. Ask who, how many and what is included.

16. Who will manage our account after launch, what is their experience, and how many other accounts will they manage?
17. Who does the analysis that identifies improvements, who produces creative for program refreshes, and who makes the technical changes?
18. Are quarterly business reviews included or priced separately, and what does a typical agenda cover?
19. How are post-launch changes handled, such as new tier thresholds, a new earn rule or a new promotion, and what do they cost and how long do they take?
20. Which services (strategy, creative, analytics, legal, fulfillment) are outsourced, to whom, and how is quality managed? Provide your current list of subprocessors that handle member data and how you notify clients of changes.

Vertical experience and compliance

Vertical experience is best tested through references in your industry, and compliance claims through documents rather than descriptions.

21. How many active clients do you serve in our industry, and can you provide three references who have run programs of similar scope for at least 12 months?
22. Can you provide a current SOC 2 Type II report, which Trust Services Criteria it covers and the period it covers, a bridge letter if that period ended several months ago, and, if you store, process or transmit cardholder data, your current PCI DSS compliance documentation?
23. For regulated categories such as alcohol, tobacco or lottery, how do you handle age verification, state-by-state eligibility and promotions compliance, and who reviews the rules?
24. Where is member data hosted, how do you support US state privacy requests such as access, deletion and opt-out, and will your contract include the processor or service-provider terms that applicable state privacy laws require, including California's where the CCPA applies to us? Will member data be used to train AI models, yours or a third party's, and can we prohibit that by contract?
25. What types of fraud can your platform detect, and what happens when a fraud pattern appears in a live program?

On question 22, a SOC 2 report evaluates controls against one or more of the AICPA's five Trust Services Criteria categories (security, availability, processing integrity, confidentiality and privacy), so the categories and period matter. The PCI Security Standards Council says PCI DSS applies to "all entities that store, process, or transmit cardholder data," as well as entities handling sensitive authentication data or able to affect the cardholder data environment. On question 24, California's regulations at 11 CCR 7051 list the terms a contract with a service provider must include, such as limiting use of personal information to the specified business purposes, and other states set their own processor-contract terms, such as Virginia (Va. Code 59.1-579). On question 13, programs for state and local government clients, such as lotteries and transit agencies, fall under the Justice Department's ADA rule, which requires their web content and mobile apps to meet WCAG 2.1 Level AA. This is general information, not legal advice.

Total cost

A general request for pricing produces a license schedule. A structured cost model produces answers you can compare.

26. Complete a three-year cost model for a program of our scope: license fees by year, including per-member or per-transaction charges; implementation and integration; the internal time our team must provide; ongoing services such as analytics, creative, campaign management and compliance; reward fulfillment; and any other usage-based costs.
27. What annual price increase applies at renewal, and is it capped?
28. Which changes are covered by the contract, and which trigger a change request and extra cost?
29. How does pricing change if we add markets, members or new program mechanics?
30. What does it cost to leave at the end of the contract, including data export fees, transition support and any limits on data portability?

How should you score loyalty platform RFP responses?

Score each response on how specific and verifiable it is, using category weights you set before any demos, so the best presentation does not outweigh the strongest evidence.

Agree on the categories and weights with stakeholders before responses arrive. Adjust them to your priorities: a brand with complex integrations should weight technical architecture more heavily, and a regulated brand should weight compliance more heavily. Score each category on a simple scale, multiply by its weight and total the results, then use demos built around your own scenarios as a second check rather than the main one. The RFP scorecard and vendor evaluation guide provides a weighted scorecard and a process for running the evaluation. A B2B channel program should add questions on partner eligibility, tax reporting for incentive payouts and distributor data.

What should you ask vendor references?

Ask references specific questions a satisfied client can answer in detail, and that expose any gap between what the vendor promised and what it delivered.

• How long did implementation actually take, and what caused any difference from the original estimate?
• What was harder to deliver than the vendor indicated during the sale?
• Is your account managed by the people described in the sales process, or a different team?
• Has service quality or responsiveness changed since you signed?
• What creative, analytics and strategic support do you receive, and how does it compare with what was proposed?
• How has the vendor handled changes you needed after launch?
• Would you choose this vendor again, and what would you do differently in the selection process?
• How did the vendor respond when something went wrong?
• Are there promised capabilities that have not yet been delivered?
• Has ownership, leadership or your account team changed, and how did it affect your program?

Vendors choose their own references, so ask for a client that has been with them for several years and, if possible, one that has left, or choose references yourself from the vendor's client list and your own network.

How do these questions apply to Brandmovers?

Buyers should ask Brandmovers the same 30 questions as every other vendor and verify the answers the same way.

Some answers are on record now; buyers should still test them with the same questions. Brandmovers was founded in 2003 and is independent and founder-controlled, with no private equity ownership. Its client retention rate is 94% (disclosed by Brandmovers), and its implementation benchmark to build and launch a program is 90 to 120 days (disclosed by Brandmovers); ask how retention is measured (question 2) and what scope the benchmark assumes (question 6). Brandmovers holds SOC 2 Type II and PCI DSS attestations (auditor: Hancock Askew & Co., LLP), and buyers should still request the current report, its criteria and its period, as question 22 asks. Brandmovers runs consumer loyalty programs on BLOYL™, its B2C enterprise loyalty platform, and B2B channel incentive programs on BENGAGED™. BLOYL integrates with systems including Salesforce, HubSpot, Adobe Marketo, Microsoft Dynamics, Shopify, Adobe Commerce, SAP and Epicor. Promotions work includes in-house legal support. The rest, including named account staff, references and a full cost model, should come in the response itself. If a vendor switch is involved, the platform migration guide covers what to ask about moving data.

Conclusion

A loyalty platform RFP should reveal which vendor can deliver the program, not which one presents it best. Define your requirements first, ask all 30 questions of every vendor, insist on specific and verifiable answers, set scoring weights before demos and use reference calls to test the claims. Vendors that answer specifically are showing you how they work; vendors that answer vaguely are showing you something too.

Sources

• AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022)
• PCI Security Standards Council, Standards
• Code of Virginia, section 59.1-579 (processor duties)
• US Department of Justice, ADA.gov, rule on web content and mobile app accessibility for state and local governments (2024)
• California Code of Regulations, title 11, section 7051 (service provider contract requirements)