Market scan template
Market scan report template and requirements register example
The sections a market scan report needs, each with a note on what it is for and a worked example from a credit union choosing a loan origination system, then a requirements register example with fourteen rows. Copy the headings, replace the example. The PDF copy follows the text; leave an address for the editable Word file.
The report template
What each section is for, and the worked example under it.
Market scan report template
A market scan report answers one question for a financial institution: which vendors could meet this need, and which few are worth the time of a request for proposal, a demonstration or a pilot. The sections below are the ones a decision maker reads in order. Each has a note on what it is for and a worked example from Example Mutual, a credit union of 180,000 members choosing a loan origination system. A consultancy or a procurement team copies the headings and replaces the example with its own words.
1. Purpose and scope
What it is for. One paragraph on the need, the system or service in scope, the decision the report supports and who makes it. A reader who gets no further should know why the scan was run.
Example. Example Mutual originates home and personal loans through its branches, its contact centre and 240 accredited brokers. Its loan origination system reaches end of support in June 2028. This scan identifies the vendors able to replace it for all three channels, and recommends which to invite to a request for proposal. The decision is the Transformation Steering Committee's, in March 2027.
2. Method and sources
What it is for. How the longlist was built, what counted as evidence, when the market was read and what was left out. Credibility rests here: say which vendor claims were checked against a public source, a reference customer or a demonstration, and which stand only on the vendor's word.
Example. The longlist was drawn from the Vederca vendor registry (lending and origination, vendors operating in Australia), two analyst reports and the committee's own list of vendors already met. Each vendor's product pages, published customer announcements and regulatory filings were read between 1 and 20 October 2026. Capabilities count as confirmed only where the vendor confirmed them in writing or demonstrated them; a mention on a website is recorded as a mention. Vendors with no deployed customer in a deposit-taking institution were noted and kept, but not scored on the operational criteria.
3. The market in brief
What it is for. Four to six short paragraphs a board member can read in two minutes: how many vendors serve this need, how they differ (delivery model, size, home market, who they serve), what has changed in the last two years and what that means for the choice.
Example. Twenty-six vendors sell loan origination software to Australian lenders; eleven operate from Australia and the rest from the United States, the United Kingdom, India and Singapore. Nine are cloud native and sold as a subscription; the others license software the institution hosts, or offer both. Six name a credit union or mutual as a customer. The newest four entered the market since 2021 and sell to brokers and non-bank lenders first. Over the last two years the leading vendors have added broker portals, open banking data for serviceability and AI-assisted document checking; the smaller ones compete on speed of change and price.
4. Longlist
What it is for. Every vendor considered, in one table, so nobody can later ask why a name is missing. Say in one line why each was included or set aside.
Example.
| Vendor | Product | Headquarters | Delivery | Named customers like us | Included because |
|---|---|---|---|---|---|
| Vendor A | A Originate | Sydney | Cloud, subscription | Two mutuals | Broker and branch in one system |
| Vendor B | B Lend | Melbourne | Cloud, subscription | One mutual | Open banking serviceability built in |
| Vendor C | C LOS | London | Cloud or hosted | None in Australia | Strong in the United Kingdom, entering Australia |
| Vendor D | D Core Lending | New York | Licensed, self hosted | None | Part of a core banking suite the institution does not run |
| Vendor E | E Platform | Bengaluru | Cloud, subscription | None | Low cost, no local support team |
| Vendor F | F Broker | Brisbane | Cloud, subscription | Three non-bank lenders | Broker channel only |
5. Requirements and evaluation criteria
What it is for. The requirements the institution set before reading any vendor material, with their priority (must have, should have, could have), the evidence asked for and how each was assessed. The full list is the requirements register (appendix B and the example below); this section summarises it and states the weights.
Example. Thirty-one requirements were set in the register: twelve must-haves (any vendor failing one is excluded), fourteen should-haves scored 0 to 3 and five could-haves scored 0 to 1. Functional fit carries 50 percent of the score, integration and data 20 percent, security and regulatory compliance 20 percent, commercial and delivery 10 percent. Must-haves are not weighted; they are gates.
6. Evaluation
What it is for. How each longlisted vendor met the must-haves and scored on the rest, with the evidence beside each judgement. A table first, then a paragraph per vendor on what the score hides.
Example.
| Vendor | Must-haves met | Functional (50) | Integration (20) | Security and regulatory (20) | Commercial (10) | Total |
|---|---|---|---|---|---|---|
| Vendor A | 12 of 12 | 41 | 15 | 17 | 7 | 80 |
| Vendor B | 12 of 12 | 38 | 18 | 16 | 8 | 80 |
| Vendor C | 11 of 12 | Not scored | Excluded | |||
| Vendor D | 12 of 12 | 34 | 12 | 18 | 4 | 68 |
| Vendor E | 10 of 12 | Not scored | Excluded | |||
| Vendor F | 9 of 12 | Not scored | Excluded |
Vendor A's functional score rests on a demonstration of the branch workflow and a written confirmation of broker accreditation handling; its hardship module was described but not shown. Vendor B's integration score reflects a live open banking connection at its existing mutual customer. Vendor C failed the Australian hosting must-have; it hosts in the United Kingdom and offered an Australian region in 2028, which the committee did not accept as a commitment.
7. Shortlist and rationale
What it is for. The vendors to take to the next stage and why, and the vendors set aside and why, in plain words. This is the section the committee quotes.
Example. Vendors A and B go to a request for proposal. Both meet every must-have, both run in deposit-taking institutions of similar size, and they differ on the question the committee most needs answered: Vendor A's branch and broker workflow against Vendor B's data and decisioning depth. Vendor D is held in reserve: it meets the must-haves but would mean running a second core vendor's suite, which the architecture principles discourage. Vendors C, E and F are set aside for the must-haves they failed, recorded in section 6.
8. Risks and open questions
What it is for. For each shortlisted vendor, what the scan could not settle and what the next stage must test. Risks the institution carries whatever it chooses belong here too.
Example. Vendor A: the hardship module and the collections handover have not been seen; ask for a scripted demonstration. Vendor A has 90 staff; ask how support is staffed in Australian hours. Vendor B: the broker portal is new in 2026; ask for a reference broker and the roadmap for accreditation management. Both: confirm the sub-contractors that deliver any part of the service, and the exit and data return terms, before contract.
9. Indicative commercials
What it is for. How each shortlisted vendor prices (subscription, licence, usage, quote on request) and the ranges quoted, if any, with the basis. Never a number the vendor did not give in writing.
Example. Vendor A prices a subscription per active loan account with an implementation fee; it gave a range on request. Vendor B prices a subscription in tiers by originated volume; it gave an indicative annual figure and a separate implementation estimate. Neither figure is binding and both will be tested in the request for proposal.
10. Recommended next steps and timetable
What it is for. What happens next, who does it and by when.
Example. Issue the request for proposal to Vendors A and B by 14 November 2026 with the requirements register attached; scripted demonstrations in the week of 8 December; reference calls with one mutual customer of each by 19 December; recommendation to the Transformation Steering Committee on 10 March 2027.
Appendix A. Sources
What it is for. For each vendor, the pages, documents, demonstrations and conversations the judgements rest on, with dates. A reader should be able to check any claim.
Appendix B. Requirements register
What it is for. The full register, in the form shown in the requirements register example that accompanies this template.
The requirements register example
Must-haves as gates, should-haves and could-haves scored, the evidence and the method beside each.
Requirements register example
A requirements register is the list the institution sets before it reads any vendor material: what the system must do, what it should do, and what evidence will show it. Vendors answer the register in a request for proposal; the evaluation scores against it and nothing else. The example below is Example Mutual's register for a loan origination system, cut to fourteen rows. A full register usually runs to thirty to sixty.
Priorities: a must have is a gate (a vendor failing it is excluded), a should have is scored 0 to 3, a could have 0 to 1. Evidence names what the vendor is asked to produce; how assessed says how the team will read it. The regulatory rows name the regime that applies to Example Mutual as an Australian deposit-taking institution; a lender in another country replaces them with its own regimes.
| ID | Area | Requirement | Priority | Evidence requested | How assessed |
|---|---|---|---|---|---|
| F1 | Functional | Originate home, personal and car loans from branch, contact centre and broker channels in one application record | Must have | Scripted demonstration of one application across two channels | Seen in demonstration |
| F2 | Functional | Serviceability assessment using open banking transaction data, with the institution's own policy rules | Must have | Demonstration; reference customer using it in production | Seen and confirmed by a reference |
| F3 | Functional | Broker accreditation, commission and clawback management | Should have | Written description; demonstration | Scored 0 to 3 on completeness |
| F4 | Functional | Hardship and arrears handover to the collections system | Should have | Interface specification | Scored on the specification |
| F5 | Functional | Electronic signing of loan documents | Could have | Named signing provider and integration | Scored 0 or 1 |
| I1 | Integration | Published, documented APIs for customer, account and document data | Must have | API documentation, sandbox access | Documentation read, sandbox tried |
| I2 | Integration | Connectors to the institution's core banking system and credit bureau | Should have | List of live connectors with customers using each | Scored on live connectors |
| S1 | Security | Independent security assurance: SOC 2 Type II or ISO 27001 certificate current within twelve months | Must have | The report or certificate | Document checked for date and scope |
| S2 | Security | Customer data hosted and processed in Australia, with any disclosure outside Australia stated | Must have | Hosting regions; data flow description | Statement checked against the hosting contract |
| R1 | Regulatory | Material service provider terms meeting APRA CPS 230: business continuity plans with tested recovery objectives, incident notification, sub-contractor disclosure, audit rights, exit assistance | Must have | Draft contract schedule; last continuity test report | Terms read by legal; test report checked |
| R2 | Regulatory | Information security capability assessable under APRA CPS 234, with control testing evidence and 72-hour incident notice | Must have | Control testing summary; incident notification clause | Checked by the security team |
| R3 | Regulatory | Handling of personal information under the Australian Privacy Principles, with Notifiable Data Breaches cooperation | Must have | Privacy clause; breach notification procedure | Read by legal and privacy |
| C1 | Commercial | Pricing model stated (subscription, licence, usage or quote on request) with what drives the price | Must have | Pricing schedule | Present and clear |
| C2 | Commercial | Implementation timeline with the institution's responsibilities set out | Should have | Project plan from a comparable implementation | Scored on realism and detail |
Download the template and the register
One PDF and one Word file, both documents in each. The PDF is yours straight away. For the editable Word file, leave an address; it joins the Vederca newsletter, the Monday market overview, once you confirm it.
The privacy policy says what happens to the address. Nothing else is sent.
Next
- What a market scan is and how to run one
- Fintech Market Scan 2026: the landscape in numbers
- Have Vederca run the scan: a fixed fee, a report recommending a shortlist