Operations

How to evaluate an early-stage compliance vendor without getting burned

Including the questions we would rather you did not ask us. Ask them anyway.

May 16, 2026  ·  The Renny team

Buying compliance infrastructure from a young company is a real risk, and the usual advice — buy from the incumbent — is often wrong in a market where the incumbents are the subject of the enforcement actions. So here is how to run the evaluation properly, including the parts that are uncomfortable for us.

Make them demonstrate, not describe

Every claim in this category is a behavior, so every claim can be shown. Ask them to attempt the thing their platform forbids while you watch. Ask them to produce a complete file for a loan you pick. Ask what happens when a required credential expires, and then watch it happen in a test account.

A vendor who reaches for a slide when you ask for a demonstration is telling you something.

Ask what is not built

The single most useful question, and the answer is diagnostic either way. A vendor with a specific, unprompted list is a vendor whose other claims you can weigh. A vendor who says everything is complete is either not listening or not telling you the truth, and you will find out which during implementation.

"What have you not built?" is the highest-information question in a vendor evaluation. Vagueness is the answer, not the absence of one.

The questions specific to early stage

• What happens to our record if you fail? Ask for exportability in a format you can read without them, and put a wind-down arrangement in the contract. A vendor who has not thought about this has not thought about your risk.
• Who else has access to our data? Including their own staff. Ask whether support actions appear in your record, attributed.
• What is your certification status, precisely? "SOC 2 in progress" spans a range from a signed engagement letter to a report next month. Ask which, and ask for the letter.
• Show us a penetration test report. Under NDA. If none exists, that is a fact about maturity, not necessarily a disqualification — but you should know it before signing, not after.
• What does the pilot actually cost us if it fails? The right answer involves one program and a small number of merchants, not a platform migration.

And weigh the alternative honestly

The risk of a young vendor is real. So is the risk of continuing to originate against a record that cannot answer an examiner's questions. Both belong in the comparison, and only one of them is usually written down.