The verdict in three sentences
A lender that issues an RFP without a precise specification gets bids it cannot compare, from 15,000 to 120,000 CAD for the same need. With 40,000 to 70,000 CAD, a Toronto microfinance lender can demand a loan and savings calculator, a branch locator and a credible security baseline (WAF, backups, logging). The key is a weighted scoring grid published with the RFP, which forces every vendor to price the same work packages.
What the RFP must lock down
Priya, marketing director of a community microlender serving newcomers and small businesses across the Greater Toronto Area, starts from a simple observation: 65 % of applications still begin with a phone call to a branch. The new site must turn visits into qualified files routed to the right loan officer. The RFP is therefore split into separately priced work packages so the selection committee sees where the money goes.
| Work package | Expected scope | 2026 ballpark (CAD) |
|---|---|---|
| UX and design | Loan, savings and branch journeys, 25 to 35 pages | 7,000 to 11,000 |
| Loan and savings calculator | Rate, term, deferral, amortization table, PDF export | 9,000 to 15,000 |
| Branch locator | Map, hours, phone, directions, page per branch | 3,000 to 5,000 |
| Pre-application form | Document upload, routing to loan officer, SMS receipt | 6,000 to 10,000 |
| Security and hosting | WAF, TLS, backups, logs, light penetration test | 7,000 to 14,000 |
| CMS, training, QA | Back office, 2 training sessions, 2 weeks of QA | 5,000 to 9,000 |
| Indicative total | 37,000 to 64,000 |
The calculator deserves its own section. Specify the formulas (nominal rate or APR, as Canadian cost of borrowing disclosure rules expect), the products covered (small business loan, credit builder loan, term savings), input limits and the disclaimer stating that the simulation does not bind the lender. Without these details, two vendors will deliver two different calculations, and compliance will sign off on neither.
Security requirements for a financial website
A lender handles personal information and credit intent. In Ontario, PIPEDA applies to the commercial collection of personal data, and regulators expect documented safeguards. The marketing site is not the core banking system, but it remains an entry point for phishing and form hijacking.
| Requirement | Minimum level to demand | Evidence requested from the vendor |
|---|---|---|
| Web application firewall | Active OWASP rules, optional geo-blocking | Configuration screenshot and monthly report |
| Encryption | TLS 1.2 minimum, HSTS enabled | Grade A on a public SSL test |
| Backups | Daily, 30-day retention, off-site copy | Documented restore test before acceptance |
| Logging | Back-office logins and submissions kept 12 months | Anonymized log extract |
| Admin accounts | Mandatory two-factor authentication | Live demo during QA |
| Forms | Bot protection, rate limiting, scanned attachments | Written procedure |
| Updates | Critical patches within 72 h | Priced contractual clause |
Add a reversibility clause: source code, hosting access and domain name registered to the lender. It is the most underrated protection in website RFPs.
The bid scoring grid
Publishing the grid with the RFP changes the quality of responses. A realistic weighting for this kind of project: 35 % understanding of the need and functional proposal, 25 % security and hosting, 20 % price, 10 % references in finance or public services, 10 % schedule and team. Price weighs less than half, which avoids choosing the cheapest bid that forgets logging. Also require a 10-week plan: 2 weeks of discovery, 3 of design, 4 of development, 1 of QA and launch.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Priya estimates her 9 branches receive 600 loan enquiries per month. With a calculator and online pre-application, the goal is 120 extra qualified files per month. If 35 % are approved, 42 loans, with an average balance of 12,000 CAD and a net interest margin of 7 % per year, additional annual revenue reaches 42 × 12,000 × 0.07 = 35,280 CAD per monthly cohort over one year. A 55,000 CAD budget is recovered within the first year, even if only part of these files are truly new. Reduced data entry time at branches is not counted.
FAQ
What budget should a mid-size Toronto lender plan for its website?
For 25 to 35 pages, a calculator and a branch locator, a 2026 ballpark is 40,000 to 70,000 CAD. Below 25,000 CAD, security and QA are almost always cut.
Should the calculator connect to the core banking system?
Not in phase 1. A standalone calculator with rate tables updated from the back office is enough, and core integration can follow in a second package, often 20,000 CAD or more.
How long does the project take?
Ten weeks is realistic if compliance validates content and formulas within 5 business days per step. Each extra round adds roughly a week.
Must hosting be in Canada?
It is not mandatory for a marketing site, but the host must guarantee backup location and a contract compatible with PIPEDA. A CDN keeps load time under 2 seconds on mobile.
How do we avoid vendor lock-in?
Require ownership of code, access and domain, at least 20 pages of documentation and a half-day handover. Score these items in the grid.
Let's scope your project. We define the work packages, the calculator and the security baseline of your institutional website with you, on a custom quote, with a realistic launch schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
