Loyalty Program RFP Scorecard & Vendor Evaluation Guide

A loyalty program RFP scorecard is a weighted set of criteria used to compare loyalty platform vendors on the same terms, so the choice rests on fit with the program's strategy rather than on the most polished demo or the lowest headline price.

A loyalty platform is hard to replace once it is live. Switching means migrating members, points balances and years of transaction history, so a poor choice tends to stay in place longer than anyone intended. That makes a structured evaluation worth the effort. This guide covers preparing before the RFP, building a shortlist, a 25-criterion weighted scorecard, demo scenarios that test beyond the standard walkthrough, reference questions that surface problems, the contract terms to insist on, how to calculate the final score, the most expensive mistakes, and when a full RFP is more process than you need. For a bank of detailed vendor questions, see the companion guide to 30 questions that expose real vendor capability.

Key Takeaways

What should you do before issuing a loyalty platform RFP?

Before issuing a loyalty platform RFP, define the program you intend to run, because requirements written without a strategy become a feature checklist that rewards breadth over fit.

A feature checklist invites vendors to highlight what they do well, and the process drifts toward the best demonstration rather than the best fit. Start with the program: the behaviors it should drive, the member experience, the economic model and the two-to-three-year roadmap. Then weight each scorecard criterion against that plan. The build vs. buy framework covers the decision that comes before choosing a vendor, and the guide to the RFP process covers RFP mechanics in general.

How many vendors should be on the shortlist?

A shortlist of three to five vendors is usually enough, because meaningful differences only appear when each finalist goes through scenario testing, reference calls and cost modeling.

Build a longlist from independent analyst coverage, category research, peer recommendations and existing relationships. Then narrow it to the vendors that plausibly fit your strategy, scale and industry. A thorough evaluation of a few vendors tells you more than a quick look at many.

What belongs on a loyalty platform RFP scorecard?

A loyalty platform RFP scorecard should cover program design, data architecture, AI and personalization, operations, financial terms and vendor viability, with each criterion weighted by how much it matters to your program.

Score each criterion from 1 to 5 (1 does not meet, 3 meets with gaps or workarounds, 5 fully meets, proven in your scenario test or by references) and multiply by its weight. The weights below sum to 100 and split by category as Program Design 20, Data Architecture 20, AI and Personalization 15, Operations 20, Financial 15 and Vendor Viability 10. Treat them as a balanced starting point: a data-heavy enterprise and a fast-launch mid-market program should not weight the categories the same way. If your email platform, CDP or marketing automation tool already handles journeys, templates or send-time optimization, mark those criteria not applicable and move their weight to integration depth, rather than rewarding a vendor for duplicating tools you already own.

For B2B channel programs, add criteria for claim and sales validation, distributor data feeds and reward tax reporting.

On criterion 10, a SOC 2 report evaluates controls against one or more of the AICPA's five Trust Services Criteria categories (security, availability, processing integrity, confidentiality and privacy), so ask which categories the report covers and for what period. The PCI Security Standards Council says PCI DSS applies to "all entities that store, process, or transmit cardholder data," and to entities that "could impact the security of the cardholder data environment," which matters if the platform touches payment cards or connects to systems that do.

How do you test vendors beyond the standard demo?

Test vendors by giving them your own scenarios to configure live, or to configure yourself in a sandbox, because a standard demo uses sample data chosen to show the product at its best.

Four scenarios separate real capability from a polished walkthrough:

1. A conditional promotion. Gold members earn triple points in one category for 14 days, capped at 500 bonus points per account, excluding members who joined in the last 30 days. This shows whether marketers can build complex rules without engineering.
2. A lifecycle journey. A welcome message at enrollment, a balance update after the first purchase, and a tier-progress nudge 30 days later for members close to the next tier. This tests journey logic, not just single sends.
3. Reporting with a control group. During a simulated double-points offer, show results for members who received it against a control group, plus the points liability issued. This shows whether the platform measures incrementality or only activity.
4. A full data export. Export the complete member database, including identity, tier, lifetime points earned and redeemed, and 24 months of transactions, in a standard format. Ask for the export specification and a sample file, and put the format and timeline in the contract; a clean demo export is a good sign, not a guarantee.

What should you ask vendor references?

Ask references questions designed to surface problems, because vendors choose references who are happy with them and a call that only confirms the pitch tells you little. Where you can, also speak to a former client or a peer found through your own network, not only the references the vendor supplies.

1. "Walk me through the implementation, specifically what went wrong and how it was resolved." Every implementation has problems; what matters is how the vendor responded.
2. "What was the biggest gap between what was promised in the sales process and what was delivered?" This surfaces gaps in features, timeline or support.
3. "Which change requests are still open, and for how long?" The age of open requests is a hard signal of responsiveness.
4. "What would you do differently in your own selection process?" This often reveals the test the reference wishes they had run.
5. "How did the vendor respond to serious bugs or outages that affected members?" Incident response cannot be judged from a demo.
6. "If you were starting over today, would you choose this vendor again?" This asks for a current view rather than a defense of a past decision.
7. "What roadmap items are you waiting for that matter to your program?" The gap between current capability and the reference's needs may be your risk too.

What contract terms should a loyalty platform agreement include?

A loyalty platform agreement should guarantee your ownership of member data, complete export at termination, clear notice periods and migration support, and, for businesses covered by California's CCPA, the service-provider terms state regulations require.

California's regulations at 11 CCR 7051 require the contract between a business and a service provider or contractor to, among other things:

• Prohibit the vendor from selling or sharing the personal information it receives.
• Identify the specific business purposes for which the data is processed, and limit the vendor's use to them.
• Require the vendor to comply with the CCPA and provide the level of privacy protection the CCPA requires of businesses.
• Give the business the right to take reasonable steps to confirm proper use, such as assessments or audits.
• Require the vendor to notify the business if it can no longer meet its obligations, and give the business the right to stop and remediate unauthorized use.
• Require the vendor to help the business respond to consumer privacy requests.
• Bar use outside the relationship, including combining the data with personal information from other sources, except as the regulations allow.
• Flow the terms down to any subcontractor the vendor uses, under a contract that meets the same requirements.

Other states set their own processor-contract terms. Virginia, for example, requires contracts that let the business assess the processor and require subcontractors to meet the same obligations (Va. Code 59.1-579), so have counsel review the agreement against every state where members live. Beyond privacy, confirm in writing the export format and timeline at termination, who pays for migration help, and what happens to points liability data. The value of these terms shows when a vendor changes course: when Aquatrols' previous loyalty vendor shut down, Brandmovers migrated and relaunched its program on BENGAGED, and the data a program can take with it affects how smooth that kind of move is. This is general information, not legal advice.

How do you calculate the final vendor score?

Calculate the final score by multiplying each criterion's 1-to-5 score by its weight, adding the results, and dividing by the maximum possible score of 500 to get a percentage. Have each evaluator score independently against written definitions for every point on the scale, then meet to discuss wide gaps before agreeing a final score.

Before adding up scores, set pass/fail gates for your non-negotiables, such as data ownership and export, security evidence and required privacy terms. A vendor that fails a gate is out, whatever its total.

For example, a vendor whose weighted average score is 3.8 earns 380 of 500 points, or 76%. Treat the number as a decision aid: a small gap between two finalists is a reason to look harder at the highest-weighted criteria and the reference calls, not to defer to the higher score automatically. The scorecard's job is to make the trade-offs explicit and defensible, not to remove judgment.

What are the most expensive loyalty platform selection mistakes?

The most expensive mistakes are choosing on headline price, overlooking data ownership, buying for today's needs only, trusting the demo, and bringing IT, finance and legal in too late.

1. Choosing on headline price. Loyalty costs include implementation, change requests, data and API overages, professional services and internal staffing. Model three-year total cost of ownership for every finalist, because the license fee alone tells you little.
2. Overlooking data ownership and export. If you cannot take your data with you, you are locked in, and the cost shows up when you most need leverage.
3. Buying for launch requirements only. A platform that fits launch but not the two-to-three-year roadmap forces a replatform just as the program matures.
4. Trusting the vendor-led demo. Scenario testing and sandbox time show what you need to know; the demo shows what the vendor wants you to see.
5. Bringing in IT, finance and legal late. Late vetoes over integration, cost or contract terms restart the process at the worst moment.

When is a full RFP more than you need?

A full RFP is more than you need when the program is small, the requirements are standard and the cost of a wrong choice is low, or when an existing contract or platform already constrains the choice.

• Small or pilot programs. A focused comparison of two or three vendors against the highest-weighted criteria may be enough, with a short contract term to limit risk.
• Constrained choices. If an existing platform contract or technology standard narrows the field, spend the effort on contract terms and scenario testing rather than a broad RFP.
• Public agencies. State and local government programs usually must follow their own procurement rules whatever the program's size, and under the Justice Department's ADA rule their web content and mobile apps must meet WCAG 2.1 Level AA, by April 26, 2027 for governments serving 50,000 or more people and April 26, 2028 for smaller ones.
• Urgent replacements. If a current vendor is shutting down, prioritize data export, migration support and time to relaunch over breadth of evaluation.

Even then, keep the core disciplines: own your data, test your own scenarios and check references. The replatforming checklist covers the migration side.

Conclusion

A loyalty platform decision lasts for years, so the discipline you bring to the evaluation pays off for years. Define the strategy before the requirements, weight the scorecard to your priorities, test vendors on your own scenarios, structure reference calls to surface problems, secure data and privacy terms in the contract, and involve IT, finance and legal from the start. A weighted scorecard does not replace judgment, but it makes the trade-offs clear. If your current vendor disappeared tomorrow, how much of your member data could you take with you?

Sources

• AICPA & CIMA, 2017 Trust Services Criteria (with revised points of focus, 2022)
• PCI Security Standards Council, Standards overview
• California Code of Regulations, title 11, section 7051 (service provider contract requirements)
• Virginia Code section 59.1-579 (processor duties)
• US Department of Justice, ADA.gov, rule on web content and mobile app accessibility for state and local governments (2024)
• Brandmovers, Aquatrols B2B loyalty case study