Only One Firm Can Quote for Your System. A Second Quote Starts With a Document.
When only your vendor can change your system, it sets the price and the timetable. Here is what that dependence costs, what a second quote opens up, the four ways forward, and the benchmark for the decision.
The business wants one new field on the loan application screen. A regulator’s circular requires it by the end of the quarter.
The request goes to the vendor. The reply comes a week later: forty working days, and a price that makes the finance head look twice.
Procurement policy asks for three quotes. The form is filled in the way it always is. Reason for exception: single source. No other firm is able to work on this system.
The paradox: You are the customer, and you have no choice of supplier.
What We Found
We looked at two things: what the public record says about firms tied to one supplier, and how work on a vendor-built system is usually bought.
The vendor can set the timetable, not only the price. A group of credit unions shared one heavily customised core system. Its vendor scheduled it to be retired in 2024. Replacing the system meant rebuilding hundreds of screens and hundreds of interfaces to other systems.
The RBI cited vendor risk management. On 24 April 2024 the RBI barred Kotak Mahindra Bank from taking new customers online and from issuing new credit cards. Vendor risk management was among the areas it cited. The restrictions lasted about ten months.
A second firm needs a document before it can quote. No supplier will price work on a system it has never seen described. Even a willing one would spend longer learning the system than making a small change to it, so nobody bids for small changes.
A price nobody inside can judge cannot be tested. Without a second quote, or someone inside who understands the work, forty days may be fair or far too many. The firm cannot tell, and the single-source form records that it did not ask.
What our review does not show: The first two findings come from a vendor’s case study and press reports of the RBI’s action. The last two are our own reasoning about how the work is bought. We found no public case of a lender overcharged by a vendor, so we do not say vendors overcharge. Everything this article says about price is our reasoning, not a finding.
What the Single Quote Costs, and What a Second One Opens Up
The single-source form records one price. Two other things decide the question, and neither is on the form. This section is our reasoning.
The cost of one supplier. It is more than the price of each change. Work waits in another company’s queue, behind its other clients. Each change the vendor makes is another piece of the system nobody else has seen, so the next change is harder for anyone else to quote. And a procurement rule that asks for three quotes and gets one, every time, has stopped protecting anyone.
What a second quote opens up. A firm that holds a written record of its system can give a piece of work to whoever can do it well and soonest. It can check an estimate against what the record says the work touches. A vendor who knows another firm could quote is in a different position from one who knows nobody can. And the regulatory change or the new product stops waiting for one supplier’s calendar.
The gap we see: the single-source exception is usually treated as a fact about the system. In our reading it is a fact about what has been written down. The opportunity is to write it down once, and turn an exception into a choice.
This is our reading of the evidence. It is not a measured market figure, and we do not put a rupee value on it here. That figure has to come from your own spending on changes.
Four Ways to Get a Choice of Supplier Back, Weighed
| Option | When it fits | What it risks |
|---|---|---|
| Negotiate harder with the current vendor | The vendor is good and the firm wants better terms | Without a credible second firm, the vendor knows the firm cannot leave. The price may move; the dependence does not |
| Switch everything to a new vendor | The current vendor is failing, leaving or retiring the product | The new vendor starts from nothing, and in a few years the firm can be just as tied to it |
| Bring the work in-house | The firm can hire and keep people for this system | The team must learn the system from the vendor, and the knowledge can leave again with them |
| Own a written specification first, then get a second quote or move in stages | The system is old, customised and understood only by its vendor | The record costs money before any quote changes. A second supplier’s first piece of work will be slower than the vendor’s |
Our recommendation: own the specification first, then test it. Offer a small, well-defined piece of work to a second supplier, with acceptance terms written before it starts. Where the system has to be replaced, move it in stages. Many firms will keep their vendor, and should. IOanyT is itself a supplier, so the specification we write is yours whether or not you continue with us.
Where You Are Now, and Where You Should Be
Before the next single-source exception is signed, we would set a benchmark for the decision itself.
| Measure | Typical starting point | Where it should be | How it is checked |
|---|---|---|---|
| A specification held by the firm | None | A written record of the system that any competent supplier could quote from | The specification, confirmed by the firm’s own experts |
| Suppliers able to quote | One | More than one, from the same specification | Quotes received for the same piece of work |
| How an estimate is checked | It is not | Against what the record says the work touches | The specification beside each estimate |
| The firm’s access to its own code | Not known | Read-only access arranged, or the gap stated in writing | The firm’s own check of its contract and its access |
| Acceptance for each piece of work | Screens checked by eye | Written terms before the work starts, and evidence it met them | Signed acceptance |
| The exit plan for the vendor | ”To be developed” | One another firm could carry out | Reviewed by the risk committee |
The starting points above are what we expect to find. In an engagement they are replaced by your own position, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a lender.
How We Work With You
- We listen: a free Reliability Review. A first conversation about the system, the vendor, and the work that is waiting. You leave with a short written note of what we found. You can start with a conversation about the system; we ask for read-only code access only when the assessment begins.
- We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This article is an example of that work.
- We read the system and propose: the Legacy System Specification Assessment. It produces a written specification of what the system does, a risk register, a cost comparison between keeping and replacing the system, and a staged plan with a fixed quote. AI does a first pass, our senior engineers review it and trace it to the code, and your own experts confirm it. Code access is read-only and logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage. The specification is portable: you can give it to any supplier, including your current one.
- If you approve, we build. Where a system has to be replaced, we replace a system one module at a time while the old one keeps running. We never do a single cutover. The work is billed by milestone, each milestone tied to a module you accept, and you can pause after any accepted module.
- We review against the benchmark. Before work starts we set the benchmark. After each step we show you where each measure stands, and the filled-in benchmark is yours at the end.
The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The assessment fee is credited in full against the first build stage if it starts within 90 days of the report.
What you need to bring: read-only access to the code once the assessment begins (where your vendor holds the code, arranging that is your firm’s own job), and a few hours from the people who know the system. We give no legal advice on who owns the code, and we do not take over running the system from your vendor.
What changes for the business:
| Role | What they gain |
|---|---|
| CEO | New products and regulatory changes are no longer held to one supplier’s queue. |
| CTO or CIO | A supplier can be chosen for each piece of work, and the vendor’s estimates can be checked. |
| CFO | Quotes that can be compared, a stronger position in negotiation, and payment for work once it is accepted. |
| COO | Changes operations needs stop waiting behind another company’s other clients. |
| Risk and compliance | Less reliance on a single supplier, and an exit plan that could actually be carried out. |
The cases in this article, and what IOanyT does about that kind of problem:
| The case | What IOanyT does |
|---|---|
| A group of credit unions had to replace their shared core system on its vendor’s timetable. | Our staged plan lets a firm start leaving on dates it sets, one module at a time, before a vendor sets them. |
| The RBI cited vendor risk management among its reasons for restricting Kotak Mahindra Bank. | Our specification is portable, so a second supplier can quote from it. How the firm uses it with its regulator is for its compliance team. |
IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. The specification we write is yours, so the next quote does not have to be the only one.
Sources
- A vendor's case study
- RBI press release, 24 April 2024
- RBI press release, 12 February 2025
In this issue
Dependence on one vendor or shared provider
Research note 1
Only Your Vendor Understands the System. Here Is What the Public Record Shows.
What the public record shows on lenders that depend on one vendor or shared provider, what it leaves out, the options, and the benchmark we would set.
Research note 3
A Supplier Runs Your System. Here Is the Benchmark for Overseeing It.
Supplier oversight often rests on the supplier's own evidence. The benchmark we would set for overseeing a critical supplier with your own evidence.
Issue study
When a Supplier Holds the System: Dependence in Financial Services
How supplier dependence plays out in financial services: a shared-provider attack, oversight findings, a retired core, the options and our benchmark.
More from Banking
Regulator restrictions and penalties
A Replacement Plan Needs Stages Someone Can Check. Here Is the Benchmark We Would Set.
Weak patch and change process
The Regulator Now Looks at How You Change Your Systems. Most Old Systems Cannot Show a Change Was Safe.
Business rules buried in code