A practical checklist of questions every bank or credit union should ask a financial tool vendor — covering mobile design, analytics, SEO, ADA compliance, and security architecture.
Choosing a financial tool vendor is a decision that touches your customer experience, your brand, your analytics, your compliance posture, and your security surface — all at once. That's a lot to evaluate. The challenge is that most vendor conversations are shaped by the vendor, which means the questions that would reveal the most tend not to get asked.
What follows is a practical checklist organized by category. These are not trick questions — they're the ones that confident, prepared vendors can answer clearly and specifically. Vendors who can't, or who redirect, are telling you something important.
More than 60% of financial site visits happen on a phone. A tool adapted for mobile after the fact typically shows it — in cramped tap targets, overflow issues, and layouts that weren't designed for thumbs. Ask to see it on an actual phone, not a browser preview.
Responsive design is a claim almost every vendor makes. Watching it in action takes thirty seconds and reveals more than any demo deck.
Some vendors implement your brand once at onboarding and leave it there. Others manage it actively. The difference matters when you refresh your design system, update your color palette, or roll out new typography.
Screenshots can be curated. A live client implementation is harder to fake. If a vendor hesitates here, that's information.
A calculator showing generic rates forces customers to do mental math, creates distrust, and undermines the entire purpose of having the tool. Find out who owns the update process, how often it happens, and what the lag is when rates change.
Without deliberate instrumentation, embedded tools are black boxes — clicks, drop-off points, and conversion events are invisible. Ask specifically what events are tracked: field interactions, funnel progression, CTA clicks, completion rates.
A vendor who has done this work can walk you through it in under five minutes. If they can't demonstrate it live, the capability may exist only on paper.
The canonical link element resolved this problem over fifteen years ago. A vendor who can explain their implementation specifically — and who monitors it as search algorithms evolve — has done the work. Vague reassurances haven't.
WCAG 2.1 AA is the standard most financial institutions should be targeting. "Accessible" without a specific conformance level is not a meaningful answer. Ask for documentation — a VPAT, an accessibility statement, or a third-party audit report.
How is keyboard navigation and screen reader compatibility handled in the tool?
These are the two most common failure points in financial tool accessibility. Ask to see a keyboard-only walkthrough of the tool during the demo.
This is the question most evaluations never ask. JavaScript running directly in your page inherits access to everything on that page — form fields, session data, cookies. A sandboxed container limits the tool to its own context. The architecture determines your exposure, regardless of vendor intent.
A vendor who has thought carefully about this can answer it directly. The answer should describe a structural containment — not a statement about their security practices or uptime record. What matters is what the architecture prevents, not what the vendor intends.
Watch for these responses
A vendor who answers "can you do X?" with "yes" but can't show you is describing a roadmap, not a product. A vendor who redirects security questions to their SOC 2 certification is conflating their internal security practices with your customers' exposure. The right answers are specific, demonstrable, and architectural — not aspirational.
Confident vendors welcome these questions. The ones who don't are telling you something.
None of these questions are designed to be difficult. They're the questions any institution should be able to get clear, specific answers to before committing to a vendor relationship. If a vendor can answer all of them — with evidence, not just assertions — you have a much stronger basis for confidence in your decision.
In the final post in this series, we go deeper on the security architecture question — the one that almost never comes up in vendor evaluations, but probably should.
Get a guided tour of the Solution Suite tailored to your institution's lines of business — typically 30 minutes, with the team that would run your implementation.
.svg)
.svg)