A stablecoin API RFP template is a document that sends every vendor the same numbered questions and scores the answers on one scale. A usable one has seven question groups, weights that add up to 100 and are set before replies arrive, a 0 to 5 score where a 5 needs proof, and four pass or fail gates.
Vendors describe "global coverage" in different ways, and a fixed list shows which one means a rail you can use. If you are still deciding what you are buying, read what a stablecoin API is first.
What goes into a stablecoin API RFP template?
Seven groups cover what payments and security leads compare.
Seven question groups and their starting weights.
Group | Weight |
1. Licensing and authorization | 15 |
2. Custody and flow of funds | 15 |
3. Rails and stablecoins | 15 |
4. Pricing and liquidity | 15 |
5. Compliance operations | 10 |
6. API and webhooks | 15 |
7. Security and operations | 15 |
The weights are our judgment. Set them before anyone replies. Lumx publishes its coverage page and an OpenAPI 3.1 spec, so groups 3 and 6 can be checked early.
The four pass or fail gates
A gate is a requirement where a strong score elsewhere cannot offset a weak answer. A vendor that fails one is out before points are added.
Licensing for your flow: the registration or authorization for the role the vendor plays, in each market you pay into, findable on a public register.
Sanctions screening and Travel Rule controls (sender and recipient details travel with the transfer), described in writing, with who runs KYB (know your business, the check on a company and its owners) and KYC (know your customer, the check on an individual) on your customers.
A written custody model: who holds the stablecoins, the fiat and the keys at every step, and what happens to funds in a payment that cannot complete.
Launch corridors live in production, in the direction you need. A roadmap date does not pass.
You can test gate 1 yourself. In the United States a money services business files FinCEN Form 107 within 180 days of being established and renews every two years, per FinCEN's registration page, read on November 1, 2026. The registrant should be the entity on your contract, so ask for the register, not the badge. For borderline answers, see provider red flags.
How do you score a stablecoin API RFP from 0 to 5?
Score each of the 30 questions from 0 to 5 and average each group. Take group score x weight / 5 for each group and add them up, for a total out of 100. A 4 and a 5 differ by evidence, not by writing.
Scoring anchors. Each question below says whether it can reach a 5 or caps at 4.
Score | Meaning | Evidence needed |
0 | No answer, or a refusal | None |
1 | Vague, or a sales claim | None |
2 | Covers part of your flow | A written answer |
3 | Meets the requirement | A clear written answer for your flow |
4 | Meets it, documented | A clause, policy, report or public docs page |
5 | Meets it and you checked it yourself | A register lookup, a sandbox test or a reference call |
Points that only paper can prove, such as a security report, are marked "Cap 4".
A made-up Vendor A scoring 4, 5, 3 and 4 in group 1 averages 4.0 and earns 4.0 x 15 / 5 = 12.0 points there.
Score one question across all vendors before the next, because reading one vendor end to end inflates its marks. Engineering scores group 6, compliance 1, 2 and 5, and finance 4. When two scorers differ by two points or more, they discuss it, and the owner of the sheet takes the lower score unless the higher scorer attaches evidence.
The 30 questions, in seven groups
Send them numbered, with a deadline and your volume. The last column shows how a 5 is reached, or "Cap 4" when only a document can prove it.
Group 1: licensing and authorization
# | Question | Evidence to attach | Top score |
1 | Which legal entity signs the contract, and which holds the funds? | Structure diagram, registrant entry | Lookup |
2 | Which licences cover our flow in each market, and where do we look each up? | Numbers on the register | Lookup |
3 | If an authorization is pending or held by a partner, what happens if it is refused? | Compliance statement | Cap 4 |
4 | Which countries and business types do you decline? | Published prohibited list | Cap 4 |
Group 2: custody and flow of funds
# | Question | Evidence to attach | Top score |
5 | Who holds the coins, the fiat and the keys at each step, and are customer balances kept apart from operating funds? | Flow-of-funds diagram | Cap 4 |
6 | How is the vendor financed, and what happens to our funds and data if it stops? | Financial statements, exit sequence | Cap 4 |
7 | May we pool our users in one balance, or must each be onboarded? | Nested-payments policy | Cap 4 |
Group 3: rails and stablecoins
# | Question | Evidence to attach | Top score |
8 | Which currency and rail pairs are live in production today, in which direction? | Dated coverage page | Test |
9 | Into whose name does each local payment arrive or leave? | Account details per rail | Test |
10 | What are the cut-off and settlement window per rail, and what happens on a holiday? | Cut-off table | Call |
11 | Which stablecoins and networks do you support, and what happens if one loses its peg? | Pairs table, depeg policy | Cap 4 |
12 | What limits apply to us per payment, day and month, and how do we raise them? | Limits table | Test |
Group 4: pricing and liquidity
# | Question | Evidence to attach | Top score |
13 | What do you charge on these three payments, itemized by fee, exchange rate and amount received? | Same-payment quotes | Test |
14 | How long is a quoted rate valid, and does locking it cost anything? | Lock terms in writing | Test |
15 | Which fixed charges apply (minimum, platform fee, setup), and how are fee changes announced? | Order form, contract clause | Cap 4 |
16 | Where does conversion liquidity come from, and who sets the rate? | Written rate method | Cap 4 |
Group 5: compliance operations
# | Question | Evidence to attach | Top score |
17 | Who runs KYB and KYC on our customers, and how long is a review? | Target per verification level | Call |
18 | Who screens transactions and wallets, and with which tools? | Named providers | Cap 4 |
19 | When a payment is held, who is told and how fast do we hear? | Sample notice | Call |
20 | What data must travel with each payment, and what rejects it? | Field list, error codes | Test |
Group 6: API and webhooks
# | Question | Evidence to attach | Top score |
21 | Where are the API reference and spec, and how do we test without a sales call? | Reference, spec, sandbox | Test |
22 | How do write requests stay safe to retry, and for how long are keys kept? | Idempotency rules | Test |
23 | How are webhooks signed and retried, and can events arrive twice or out of order? | Signature scheme, retry schedule | Test |
24 | What are the statuses, which are final, and what does an error contain? | Status list, error catalog | Test |
Group 7: security and operations
# | Question | Evidence to attach | Top score |
25 | Which attestations do you hold (SOC 2 or ISO 27001), when was the last penetration test, and how are keys protected? | Report, test summary | Cap 4 |
26 | How do you handle personal data under LGPD and GDPR, and who are your sub-processors? | Data terms, sub-processor list | Cap 4 |
27 | What uptime do you commit to, and where do we see incidents? | SLA clause, status page | Lookup |
28 | What are the support hours, and who owns a stuck payment? | Support terms | Call |
29 | What reconciliation data do we get per payment? | Sample export | Test |
30 | How long from signed contract to first live payment? | Onboarding plan | Call |
Questions 8 to 12 pair with payout limits and cut-offs by rail, 13 to 16 with how stablecoin payout pricing works, and group 6 with how to integrate a stablecoin API. The contract comes later: provider contract terms.
Who scores, and when the weights get fixed
I would fix the weights and the gates in a sheet before the RFP goes out, and I would give that sheet to someone outside the evaluating team. Once a favorite vendor replies, every team finds a reason to raise the weight where that vendor shines. I would keep the criteria that only paper can prove, such as a security report, but cap them at 4, so the score does not measure the writing.
How long does an RFP take, and how many vendors should get it?
Plan four to six weeks, and send the RFP to three to five vendors: fewer gives no comparison, and more than five gets skimmed. Both numbers are our judgment. Weeks two and three are written replies, with every clarification sent to all vendors at once. Week four applies the gates and picks two finalists, and weeks five and six are a sandbox test and contract review.
Spend them in the sandbox, not on calls. The 30-day API trial structures it. A bank partner will ask how you picked, so keep a scored file: OCC Bulletin 2023-17 (June 6, 2023) treats third-party risk as a life cycle. For the same choice as a narrative, read choosing a stablecoin infrastructure provider. At Lumx, production starts with a call with the team.
When an RFP is the wrong tool
An RFP measures what vendors say and show, not production. It is the wrong tool when you cannot name your flow and currencies, when one provider is the obvious fit, or when volume is so small the process costs more than the gap between vendors.
How Lumx answers the questions with public answers
Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, Bre-B, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.
These answers come from the public docs, read on November 1, 2026. Send the other questions in the RFP and Lumx replies in writing through operations@lumx.io.
Lumx answers by question number, from the public docs and the Lumx site.
Questions | Lumx answer |
1 and 2 | Two entities: Lumx US OP LLC, in Wyoming, registered with FinCEN as a money services business, and Lumx Sociedade Prestadora de Serviços de Ativos Virtuais Ltda (Lumx SPSAV Ltda), the virtual asset service provider in Brazil |
2 and 3 | In Brazil, Lumx SPSAV filed its application for the SPSAV authorization, Brazil's company type for virtual asset service providers, and operates under the transition regime of Resolution BCB 520 of 2025, Art. 88 |
2 and 3 | Clients in Hong Kong, Singapore and the United Kingdom are onboarded by reverse solicitation, without a local licence (HKMA, MAS or FCA). Lumx does not market or prospect there |
2 and 3 | EUR and GBP run through a banking partner |
5 and 7 | Wallets are held in custody by BitGo, which carries insurance. Each customer has its own wallets, with no omnibus account and no mixing of balances. The balance is a stablecoin, not a deposit, because Lumx is not a bank. A payout debits that wallet to a destination registered under the customer, or transfers to another onboarded customer. Pooling funds for parties Lumx has not onboarded is not allowed |
6 | The standard contract covers the sequence for returning funds on exit, an export of history and addresses, and a liability cap |
9 | BRL accounts are named, so a Pix recipient sees the customer as the payer, effective November 2026. SPEI payouts go out in the customer's name |
10 | Pix and SPEI have no cut-off and run every day. Faster Payments is instant, up to GBP 1M per payment. ACH cuts off at 2:00 PM ET, FEDWIRE and SWIFT at 3:00 PM ET |
8 and 11 | USDC on Ethereum, Polygon and Base; USDT on Ethereum, Polygon and Tron; Stellar carries USDC for the BRL on-ramp only. Circle, a GENIUS Act-compliant issuer, issues the USDC, and Lumx holds its own mint account there. The coverage page lists live pairs, and SWIFT is USD only |
13 and 15 | Monthly platform fee plus usage-based per-transaction fees, transparent FX on locked quotes, no pre-funding; no published plans |
14 | Locked rates last 30 seconds, one minute or five minutes. The 30-second lock has no fee |
15 | No setup fee. The standard agreement has a monthly minimum, waived during ramp-up, and volume tiers are reviewed quarterly |
16 | Liquidity is Lumx's own plus institutional counterparties, BTG Pactual among them |
17 and 18 | KYB targets one business day; KYC runs through Sumsub. Every transaction is screened before it executes. Chainalysis KYT covers blockchain activity for every type of wallet, and fiat uses Lumx's own systems plus banking-partner oversight |
20 | Every on-ramp and off-ramp carries a purpose field; a mismatch can trigger an RFI (request for information, a hold that asks for a document) |
21 | An OpenAPI spec is published, and new accounts start in sandbox |
22 | Write requests take an Idempotency-Key kept for 24 hours; the same key with a different body returns a 409 |
23 | Webhooks are signed with HMAC-SHA256 and delivered up to eight times. Deduplicate on the webhook-id header; failed events are replayed from the Dashboard |
24 | The onramp., offramp. and transfer.* events end in success or failed, and an on-ramp can also expire. Errors carry a code and a requestId |
25 | Compliant with SOC 2 and ISO 27001, not yet certified. Penetration tests are run |
27 | A public service level agreement |
30 | API integration takes two to three weeks to go live |
Against gate 1, ask Lumx US OP LLC for its FinCEN registration details. Three things will not show on a public register in Lumx's name: the Brazilian application, filed but not an authorization, the EUR and GBP legs, which run through a banking partner, and Hong Kong, Singapore and UK clients, onboarded by reverse solicitation without a local licence.
Rails are on the coverage page and the global payments page, custody in what a custodial wallet is, and verification in what KYB is.
Methodology and sources
Lumx claims come from the docs.lumx.io pages read on November 1, 2026, and the FinCEN and OCC rules from their own pages. The weights, the anchors, the timeline and the vendor count are our judgment, and Resolution BCB 520 of 2025 links to the BCB's official page, which serves its text through a script.
Verified on November 1, 2026. Operational context, not legal, tax, or investment advice.
Cover photo: Patrick Federi on Unsplash.
What is a stablecoin API RFP template?
It is a reusable request for proposal that gives every vendor the same numbered questions, so replies can be scored side by side. Lumx publishes its API reference and OpenAPI spec.
How do you score stablecoin API vendors?
Score each question from 0 to 5, average each group, then take group score x weight / 5 and add the groups up for a total out of 100. A 4 needs a document, and a 5 a lookup, a test or a reference call. Lumx's sandbox lets you test the API questions.
Which requirements should be pass or fail gates?
Licensing, sanctions and Travel Rule controls, a written custody model and live launch corridors. A vendor that fails one is out. Lumx answers in writing: FinCEN registration, a custodial model with BitGo-held wallets per customer, KYC (know your customer) through Sumsub and Chainalysis KYT monitoring.
What is the difference between an RFP, an RFI and an RFQ?
An RFI (request for information) asks what a vendor offers, an RFQ asks for a price on a defined scope, and an RFP asks for capability, with terms and price. Lumx quotes through its exchange-rates endpoint.
Should you share your volumes in a stablecoin API RFP?
Yes, as ranges, because the quote depends on volume and payment size. Lumx prices with a monthly platform fee plus usage-based per-transaction fees.
