Before you go
One sharp email on procurement markets — what moved, why it matters, what to do about it. Daily or weekly. Unsubscribe anytime.
Zinit Industries Finance
Guidance from the US banking agencies asks a bank to plan how it would move a critical activity to another provider, and DORA asks EU firms to report whether they have found one. Zinit's AI agents put the contract out to qualified providers early enough that the plan names a reviewed provider, with a price and a time to take over, before the contract renews.
Bank expense outside payroll and premises is growing fastest
Second quarter of 2019 and of 2026, all FDIC-insured institutions, $ billions
The example bank's print-and-mail contract over its next three-year term
$562k between renewing as proposed and renewing at the price the bids set
Postage is passed through at USPS rates, so every line prices composition, printing, inserting and presort, and postage is left out. Today's price, held for three years, would cost $172,800 more than the renewal after the bids.
The rules differ by charter and by country, and the ones that bite all come back to three questions about a critical provider: who could take over, how long the move would take, and what the contract lets you do on the way out.
June 2023, in force
Contingency plans for moving an activity to another third party or in-house; at termination, potential alternate third parties, the time frame to transition and the costs and fees; contracts with reasonable time frames for an orderly transition.
September 15, 2026, comments due November 16
Would replace the 2023 guidance with tailoring by risk, and names alternative back-up providers that can take over easily as one way to show resilience in a higher-risk relationship.
September 11, 2026
The agencies will weigh contract terms that make it hard to compare or leave a core provider, undefined deconversion fees among them, when they decide how closely to examine that provider.
Applies from January 17, 2025
Tested exit plans for ICT services that support critical or important functions, alternative solutions identified, and a mandatory adequate transition period in the contract; the register of information records whether an alternative provider has been identified.
September 18, 2026, two-year transition
Exit strategies across ICT and non-ICT arrangements that support critical or important functions.
NAIC model 2017, enacted state by state
Due diligence in selecting a third-party service provider and periodic assessment of its security; neither text asks for an exit plan.
Larger firms from December 2025, smaller from June 2026
A firm's policies must make its service providers report a breach of a customer information system within 72 hours of becoming aware of it. The SEC withdrew its 2022 outsourcing proposal in June 2025, so no SEC rule asks for an exit plan.
Summaries of each text, with the sources at the foot of the page. Your counsel and your supervisor decide how each one applies to your firm.
A critical contract crosses more desks than an ordinary purchase, and each desk needs something from the market before it can sign.
Owns the service: volumes, mailing dates and quality
Gets from the event Bids priced on the real volume and on the mailing dates the rules set.
Owns the event and the price
Gets from the event Leveled bids on price, onboarding and transition terms well before the notice date.
Owns due diligence and the exit plan
Gets from the event Each bidder's SOC reports, financial statements and continuity test results with its bid, so the review runs while the bids are priced.
Owns access to customer data
Gets from the event The bidder's SOC 2 report and how files would reach it, early enough to send follow-up questions.
Owns the contract
Gets from the event Termination, transition-help and data-return terms priced inside every bid.
Owns approval for a critical activity
Gets from the event A recommendation with the alternative already reviewed and the plan's empty lines filled.
ICBA told the OCC in January 2026 that the average community bank keeps about 160 vendor relationships, roughly 20% of them critical, which puts about thirty contracts like the one in the example on a community bank's desk.
What Zinit doesIt is invited to bid on your requirement alongside other qualified providers, so the name in the plan comes with a price and a date.
What Zinit doesEach invited provider is asked for the documents your third-party risk team reviews as it accepts the invitation, so the review runs while the bids are priced.
What Zinit doesTransition help is a priced line in every bid and in the renewal, so the next exit does not depend on the incumbent's goodwill.
What Zinit doesBids from reviewed providers in the same weeks give your team the market price to negotiate the renewal against.
What Zinit doesBids are leveled over the whole term with onboarding, parallel runs and the weeks each provider needs to take over.
A 103M+ supplier and company database, AI agents that read the contract and run the bidding, and procurement people who work beside your team.
Zinit reads the term, the notice period, the renewal price and any transition clause, then counts back from the end date by the time a new provider needs, which often lands before the notice date.
The date the decision is really due.
Zinit finds providers that already serve regulated firms, screened on the reports, the second production site and the capacity your team requires, and asks each one for its due-diligence documents as it accepts. The first RFP is drafted in under an hour, and the bids take the time they take.
A reviewed alternative before the notice date.
Every bid is leveled over the term with onboarding, parallel runs, the weeks to take over and the transition help it offers, so the award and the exit plan come from the same table.
The renewal priced by the market, and the plan filled.
Sometimes the incumbent is still the right provider, and then your team renews at the price the bids set and keeps the runner-up in the plan. Zinit does not perform your due diligence, approve providers or send notices, and your team directs and approves every step.
Every figure belongs to the example bank, a fictional regional lender whose event was never run, and every money line shows how it was worked out. Zinit is connected to your contract repository, your third-party risk system and accounts payable, so nothing is uploaded.
Read from your systems
From the agreementThis Agreement renews for successive three-year terms unless either party gives written notice at least 120 days before the end of the then-current term. Provider has no obligation to perform Services after the end of the term.
The date that decides it is not the notice date
| Date | What happens | How it is counted |
|---|---|---|
| October 1 | Today | |
| December 30 | Last day to choose a new provider | June 30 less 26 weeks to take over, with no help owed after June 30 |
| March 2 | Notice date | June 30 less 120 days |
| June 30 | Term ends, then renews for three years | The agreement |
90 days from today to December 30, so the event starts now: bids are due October 29, and your third-party risk team's review of each bidder's papers, which starts as the bidder accepts the invitation, ends December 10.
Qualified providers, screened and invited
Screens your team set
Asked for as each provider accepts
Nobody was contacted until your team approved the list.
Three bids, leveled over the three-year term
| Incumbentrenewal proposal | Bid Anational provider | Bid Bregional provider, found by Zinit | |
|---|---|---|---|
| Price per piece | $0.113 | $0.098 | $0.096 |
| Three years at 14.4M pieces a year | $4,881,600 | $4,233,600 | $4,147,200 |
| Onboarding and two parallel cycles | None | +$240,000 | +$210,000 |
| Leveled three-year cost | $4,881,600 | $4,473,600 | $4,357,200 |
| Weeks to take over | In place | 26 | 22 |
| Second production site | Yes | Yes | Yes, in another region |
| SOC 1 and SOC 2 Type II reports | On file | Received with the bid | Received with the bid |
| Transition help it offers at exit | None after the end date | 180 days | 270 days |
Incumbentrenewal proposal
Bid Anational provider
Bid Bregional provider, found by Zinit
Postage is left out because it is passed through at USPS rates, and each bid states the presort discounts it qualifies for. Your third-party risk team finished its due diligence on both new bidders by December 10, so either could have been chosen by December 30.
Best and final, and the award
Asked for its best and final offer, the incumbent came back at $0.100 a piece with 270 days of transition help after any termination, the lowest leveled cost of the three.
The lowest leveled new provider, cleared by your third-party risk team, becomes the plan's alternate. Its price holds for twelve months, though no capacity is reserved, so the plan carries the date to refresh it.
The award went to the board risk committee at its December 17 meeting, thirteen days before December 30. Where capacity has to be held, the same event can also bid a standby agreement with the alternate.
The exit plan after the event
A print-and-mail or contact-center contract reads much the same at a bank, an insurer or a fund manager, while the rules around it change with the charter. Pick the kind of firm you are buying for.
Who decides: Procurement and third-party risk management with the business owner, and the board or its risk committee for a critical activity.
What sets the date
Where bidding moves it
Bids from reviewed providers before the notice date, with transition and termination terms priced into the renewal.
Who decides: Procurement and vendor management with claims, operations and information security.
What sets the date
Where bidding moves it
Claims, policy-document and contact-center contracts bid with the documents your security team asks for, before the renewal locks them in.
Who decides: The COO's office and vendor management, with the chief compliance officer.
What sets the date
Where bidding moves it
Statement, tax-form and shareholder-report production bid before the season that tests it.
Who decides: Procurement and the ICT third-party risk function, with the management body for critical or important functions.
What sets the date
Where bidding moves it
An identified alternative backed by a priced, reviewed bid, ready for the register.
Summaries, not legal advice: your counsel and your supervisor decide how each rule applies.
Bank and supervisor sources first, then the vendor-run surveys, each marked as such, and beside them what printing and postage cost since January 2020.
of bankers in ABA's 2024 core platforms survey named termination or deconversion fees among the two most problematic terms in their core contract.
American Bankers Association, February 2025
were likely to stay with their core provider at the next renewal, and 19% were likely to convert.
American Bankers Association, February 2025
or more of notice is what banks report giving a core provider before leaving, although some contracts say 180 days.
ABA letter to the OCC, January 27, 2026
of the critical functions euro-area significant banks outsource are difficult or impossible to substitute, and 95% of those are hard to bring back in-house.
ECB Banking Supervision, February 2025, end-2023 data
of financial professionals surveyed said they had adequate stressed exit plans for their critical ICT vendor agreements.
CeFPro survey commissioned by Escode, an escrow vendor, August 2024
of third-party risk programs at banks, credit unions and other financial firms run with one or two dedicated staff.
Ncontracts, a TPRM software vendor, March 2026
Printing and postage since January 2020
January 2020 to the latest reading
Survey samples are in the sources. Postage is passed through at USPS rates, which is why the example levels the bids without it, and printing is the part of a statement contract that bidding can move most.
The services where a provider's failure reaches customers first, what makes each one critical, where bidding moves the price, and established suppliers in each market.
Why it is criticalMailing dates set by Regulation Z and E, the IRS and state insurance law.
Price per piece, transition help and a reviewed second provider.
Why it is criticalA reissue that slips leaves customers without a working card.
Unit price, reissue capacity and a standby bureau.
Why it is criticalBranches and ATMs that run out of cash.
Route prices by region, with regional carriers in the bid.
Why it is criticalCustomers' calls, disputes and complaints.
Price per hour against service levels and the weeks to move in.
Why it is criticalRetention periods and the disposal of customer information.
Storage and destruction prices, chain of custody and a second provider.
Why it is criticalPolicyholders' claims adjusted and paid by another firm's staff.
Fee schedules and surge capacity, bid with the documents your claims team asks for.
Established suppliers in each category, shown to illustrate the market, not as a list of Zinit's customers or partners.
A mining customer's result across its recent RFPs and the logo row from the homepage, both as the rest of the site shows them. We have no financial-services case to show yet.
Saved over 12% across 28 recent RFPs
A mining customer's recent RFPs, across its categories. The customer is not named.
RFPs published from
As shown on the homepage.
Zinit is supplier-funded and free to buyers: only the supplier your team selects as the winner pays a commission, the losing bidders pay nothing, and nothing is owed until you award. The commission rates are published openly on our site, and because the fee is tied to the award your team makes rather than to who competes, Zinit earns the same whichever qualified supplier you choose.
No. Your third-party risk team decides whether a provider passes. Zinit asks each invited provider for the documents your team reviews, such as its SOC 1 and SOC 2 reports, financial statements, continuity test results and subcontractors, as it accepts the invitation, so the review can run while the bids are priced.
Zinit does not decide that, and nothing on this page says a program meets any regulator's expectations. What the event gives your team is a reviewed alternative with a price, a time to take over and contract terms, dated and on file, which is the material your exit plan and your register ask about.
Because some renewals do switch, and the runner-up is the first call if the incumbent fails. Some buyers also contract the alternate as a standby: Pennsylvania's Treasury put a standby print-to-mail provider out to bid in 2024, with its recovery site at least 50 miles from the Treasury's headquarters and disaster tests twice a year.
Zinit's AI agents run the event and Zinit's procurement people work alongside your team. Your team approves every invitation and decides the award, and nobody, the incumbent included, is contacted until your team approves the list.
Only the requirement your team approves: volumes, document types, mailing dates and service levels. Contracts, invoices and customer files stay with your team.
The core is the hardest case, since ABA's members report giving a year or more of notice before leaving one. The same event still prices the renewal and the exit terms and puts a reviewed alternative in the plan, which is worth starting well before that notice is due.
Yes, with different rules setting the dates: statutory notice periods for policy mail, Regulation S-P's 72-hour notice from service providers, and DORA if you are regulated in the EU. The tabs above set out each one.
Bring the contract and the exit plan behind it. Zinit reads the dates, counts back to the last day a new provider can still be chosen, and runs the event, with your team directing and approving every step.
