Bank website tender in London: evaluation criteria and budget in 2026

The verdict in three sentences

To rebuild the public website and calculators of a retail bank with 120 branches in London, plan a budget of EUR 140,000 to 370,000 excluding VAT, a tender process of 8 to 12 weeks and 6 to 9 months of delivery. The criterion that separates bidders is rarely design: it is the ability to prove application security, UK GDPR compliance and the integration of calculators with core systems. A scoring grid that puts at least 35% on technical and security criteria avoids picking the cheapest bid that will fail penetration testing.

The regulatory frame that shapes the specification

A UK bank does not publish a website like a small business. FCA and PRA expectations on operational resilience and outsourcing require controls on hosting, logging and supplier management. The FCA Consumer Duty requires clear, fair communications, including what a loan calculator displays. UK GDPR covers any personal data: a mortgage calculator that captures name, income and phone number needs a lawful basis, a clear privacy notice and consent where marketing is involved.

The specification must state requirements clearly so bidders price the same thing:

A scoring grid that selects the right supplier

The classic trap is a grid where price weighs 50% or more. On a banking project, the gap between the best and worst bid lies in security and method, not in 15% of price. Here is a weighting that works for a contract of this size.

Ask for a 3-year price, not just the build: a EUR 175,000 bid with EUR 5,500 a month of maintenance costs more than a EUR 240,000 bid at EUR 2,800 a month. Require a 90-minute presentation with the project lead and architect who will actually work on the account.

A typical 8 to 12 week process: 2 weeks of drafting and internal sign-off, 3 to 4 weeks of consultation with clarification questions, 2 weeks of bid analysis, 1 to 2 weeks of presentations and negotiation, then 1 to 2 weeks of contracting with procurement and compliance.

Mini case study

Emma, head of communications at a retail bank with 120 branches in London, compares two shortlisted bids. Bid A: EUR 175,000 build, EUR 5,100 a month maintenance, pentest not included. Bid B: EUR 240,000, EUR 2,800 a month, one penetration test at EUR 11,000 included.

Over 3 years, A costs 175,000 + 183,600 + 33,000 (three pentests to add) = EUR 391,600. B costs 240,000 + 100,800 + 22,000 (two extra yearly pentests) = EUR 362,800. The more expensive bid at signature is EUR 28,800 cheaper over the period and scores best on security. A 3-year weighted grid makes this choice defensible before the procurement committee.

FAQ

What budget should a UK bank plan for its website in 2026?

Between EUR 140,000 and 370,000 for the build depending on the number of calculators, languages and integrations. Add EUR 2,300 to 5,500 a month for maintenance and secure hosting.

Should the agency run the penetration tests?

No, use an independent firm to avoid a conflict of interest. Allow EUR 7,500 to 18,500 per campaign, and one campaign before every major release.

Is a loan calculator subject to UK GDPR?

Yes as soon as it captures identifying data (name, phone, income). You need a lawful basis, a clear notice, a retention period and often a DPIA.

How many bidders should we invite?

Between 4 and 6 agencies shortlisted on references. Beyond 6, analysis takes more than 3 weeks and the best agencies hesitate to bid.

How long from award to launch?

6 to 9 months for a public site with calculators and 120 branch pages, including 6 to 8 weeks of acceptance and security testing.

Let's scope your project. Share your specification or scope: we propose an architecture, an indicative 3-year budget and a delivery plan that fits your security requirements. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.