Guide 02 · Vendor selection
How to write a loyalty program RFP
A good loyalty program RFP describes your program and the problems it must solve, lists requirements by priority, asks the same security, privacy and cost questions of every vendor, and scores answers with weights agreed before responses arrive. Scripted demos built on your own scenarios then test what the written answers claim.
A loyalty platform runs close to your revenue. At Starbucks, Rewards members drove nearly 60% of US company-operated revenue in fiscal year 2025, and McDonald’s says loyalty members drive about 30% of its sales. Choosing the system behind a program like that deserves a structured process, and the request for proposal (RFP) is its core document.
Know what it is for
What is a loyalty program RFP for?
An RFP turns a sales conversation into a comparison. Every vendor answers the same questions, in the same format, about the same program. That makes three things possible: comparing vendors on your needs rather than on their demo, holding the winner to written answers, and explaining the decision to finance and leadership later.
Before you write it, agree internally on the program you are buying for. Write down the model (points, tiers, member pricing, paid membership or offers), your channels, your expected member count and the goal the program serves. Vendors answer better when they know what you are trying to do.
Write the overview
What goes in the program overview?
Open the RFP with two or three pages that any vendor can read in ten minutes. Describe your business and channels, the loyalty program you run today or plan to launch, the goal it serves, and the systems it must connect to. Add your expected member count and transaction volume as ranges, so vendors can size their answer and their price. Close the overview with the timeline, the contact person for questions and the format you expect answers in. A clear overview saves days of clarification calls later.
List the requirements
What should the requirements section cover?
List requirements by area and mark each one as must have, should have or nice to have. Vague requirements get vague answers, so describe each one as a task the platform must perform.
| Area | What to ask for |
|---|---|
| Program rules | Earn and burn rules, tiers, offers, expiry and how your team changes them without a developer |
| Member data and consent | Profile fields, consent records, preference data and privacy request handling |
| Integrations | Point of sale, e-commerce, app, customer data platform, email and data warehouse, with the method for each |
| Reporting and finance | Standard reports, data exports and how the platform supports valuing points you owe |
| Security and compliance | Certifications, audit reports, data location, access control and incident response |
| Service and support | Implementation team, support hours, response times and the account model after launch |
Finance deserves its own question. Points that members earn are an obligation: Starbucks, for example, defers revenue for the Stars members earn toward free products and records a liability for them. Ask each vendor how its reports help your finance team value that obligation and track redemptions.
Ask about security
Which security and privacy questions matter most?
Ask the same security and privacy questions of every vendor, and ask for evidence, not only yes or no answers.
Payments come first. PCI DSS applies to entities that store, process or transmit cardholder data, including merchants and service providers. If the loyalty platform touches card data, for example in card-linked offers, ask how it meets that standard and who is responsible for which controls.
Privacy is next. The GDPR allows fines of up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher, for breaching its basic processing principles, including the conditions for consent. In California, the Consumer Privacy Act gives consumers the right to know what personal information a business collects about them, to delete it with some exceptions, and to opt out of its sale or sharing. Ask how the platform records consent, answers access and deletion requests, and supports opt-outs, and in which countries member data is stored.
Finish with operations: who at the vendor can see your member data, how access is logged, and what happens in an incident.
Score the answers
How should you score vendor responses?
Agree on the scoring before responses arrive. Give each requirement area a weight that reflects your goal, share the weights with the scoring panel, and score each answer on a simple scale with a short written reason.
Then test the answers. Scripted demos test those answers: send the shortlisted vendors three or four scenarios from your own business, such as “a member returns an item bought with points” or “marketing launches a double points weekend for one region”, and ask them to show each one live in their product. Score the demo against the same weights.
Reference calls come last. Ask to speak with customers of a similar size and industry, and ask them what took longer than planned.
Ask the hard questions
What do vendors prefer not to answer?
Some questions get short answers unless you ask them directly. Put them in the RFP in writing:
- Total cost. One-off implementation fees, recurring fees and what changes the price as members and transactions grow, all priced on one common scenario that you provide.
- The implementation team. Who will actually build your program, and whether they are employees or partners.
- Changing the program later. Which rule changes your team can make alone, and which need paid work from the vendor.
- Leaving. How you export member data, point balances and transaction history if you end the contract, in what format and at what cost.
- Roadmap promises. Which features in the demo exist today, and which are planned.
Run the process
How do you run the process end to end?
Most selections follow the same order:
- Prepare. Agree the program, the goal, the budget range and the scoring panel.
- Screen. Build a long list and narrow it with a short questionnaire.
- Send the RFP. Give the shortlist the full document and a fixed deadline, and answer vendor questions in writing to all of them.
- Demo. Run scripted demos with your scenarios.
- Check. Call references and review security evidence.
- Decide and negotiate. Choose with the scores in front of you, then negotiate the contract with the written answers attached.
If you would rather not run the process yourself, our RFP management service runs it with you and stays vendor-neutral.
More answers
Frequently asked questions
What is a loyalty program RFP?
It is a request for proposal: a document that describes your loyalty program, lists what the platform must do and asks vendors to answer the same questions in the same format. It lets you compare vendors on your requirements instead of on their sales presentations, and it creates a written record of what each vendor promised.
How many vendors should receive a loyalty platform RFP?
Enough to compare, few enough to evaluate properly. Most teams send the full RFP to a short list chosen after a first screening, because every response takes time to read, score and follow up with demos and reference calls. Screen broadly first, then go deep with the vendors that fit.
Should the RFP include pricing?
Yes. Ask every vendor to price the same scenario, with your member count, transaction volume and integrations, and to separate one-off implementation fees from recurring fees. Ask what changes the price as the program grows. Without a common scenario, the quotes cannot be compared.
What security certifications should a loyalty platform have?
Ask which independent reports and certifications the vendor holds and request the latest reports under a non-disclosure agreement. If the platform will store, process or transmit payment card data, PCI DSS applies to it. Also ask how the vendor handles privacy requests and where member data is stored.
Who should score the RFP responses?
A small panel that includes marketing or loyalty, IT or data, finance and whoever runs stores or customer service. Each scorer rates the sections they know best against the weights agreed before responses arrived, and the panel discusses large differences before the shortlist is final.
Sources
- F-GDPR-01Regulation (EU) 2016/679, Article 83(5) (EUR-Lex)
- F-PCI-01PCI DSS (PCI Security Standards Council)
- F-CCPA-01California Consumer Privacy Act (CCPA) (oag.ca.gov)
- F-SBX-02Starbucks reimagines its Rewards program with new levels and exclusive perks (about.starbucks.com)
- F-SBX-04Starbucks Corporation Form 10-K, fiscal 2025 (sec.gov)
- F-MCD-01McDonald's to create tiered loyalty program to lure repeat visitors (Reuters)