All Articles
TechnologyOct 28, 202616 min

CCM Software for Banks: How to Shortlist Vendors When You Replace a Legacy Document Composition System

Almost everything written about customer communications management is written by CCM vendors. This is the buyer's side: how a bank or an insurer turns a twenty-year-old composition platform and a few thousand templates into a shortlist of three, a scored proof of concept and a decision it can defend — with the European Accessibility Act and DORA now part of the selection criteria.

Michele Cimmino

CEO & Founder · Lasting Dynamics

If you are replacing a legacy document composition system in a bank or an insurer, the right customer communication management software is not the one with the best demo. It is the one that can reproduce your worst fifty templates, produce accessible output your regulators now expect, survive a DORA exit test, and be maintained by people you can actually hire. You find it in three moves: inventory your template estate before you talk to any vendor, score a shortlist of three against seven criteria weighted for your situation, and run a paid proof of concept with your own documents, not the vendor's samples.
The order matters more than the vendor names. Most CCM replacements that go wrong were decided in a vendor meeting, sized on a brochure and discovered in migration, when the team finds that the old platform held three thousand templates, half of them unused and a fifth of them carrying business logic nobody had documented. The selection below is designed to surface that before the contract, not after.

Who this guide is for

You are a CIO, a head of operations or the owner of customer communications at a bank, an insurer or a payments company. Your statements, contracts, policy documents and regulatory notices come out of a platform installed ten or twenty years ago, the specialists who built the templates are retiring or gone, and someone has asked you for a shortlist. I have worked on legacy modernisation for banks and insurers for years; what follows is the method I use, with no vendor to sell you.

What CCM Software Is — and What It Is Not

Search for CCM software and half of the results are live-chat and help-desk tools. That is a different category. In banking and insurance, customer communications management means the platform that composes, personalises and delivers regulated, high-volume, mostly outbound documents across print and digital channels. It usually covers five jobs:
  • Composition: merging data from core banking, policy administration or billing systems into templates, in batch (millions of statements at month-end) and on demand (a contract generated while the customer waits).
  • Authoring and content management: templates, reusable clauses, legal text and brand assets, with versioning, approval workflow and effective dates.
  • Multichannel output: print streams for the mailroom, PDF, HTML email, web and app delivery, SMS, from one source of content.
  • Interactive documents: letters and contracts that an agent or underwriter completes with guided edits inside controlled limits.
  • Archive and evidence: what exactly was sent to whom, when, in which version — the record you need for complaints, disputes and audits.
CCM is not e-signature, not marketing automation and not a contact-centre tool, although it integrates with all three. Keeping that boundary clear is the first shortlist filter: if a vendor's strongest story is campaign journeys or chat, it is answering a different question from the one your statements and contracts pose.

Why 2025 Changed the Selection Criteria

For twenty years a composition platform was judged on throughput, print-stream quality and template flexibility. Two pieces of EU regulation that started applying in 2025 added criteria that most legacy platforms were never designed for. National rules on periodic communications and, in the Gulf, on Arabic disclosure add more. This is what each one changes in a CCM selection:
RuleApplies fromWhat it changes in a CCM selectionSource (date)
European Accessibility Act, Directive (EU) 2019/88228 June 2025; existing contracts may run up to 5 years; some Member States postponed to 28 June 2030Contractual documents, terms and conditions and disclosures for consumer banking services must be accessible and perceivable; key information must not exceed CEFR level B2 (upper intermediate)Legal500 / Oxford Business Law Blog (2025)
Italy — D.Lgs. 82/2022 (EAA transposition)28 June 2025; services already provided before that date have until 28 June 2030AgID supervises; accessible output becomes a procurement requirement for Italian consumer servicesPortolano Cavallo
Spain — Ley 11/2023 (EAA transposition)Title I in force 28 June 2025; existing services until 28 June 2030Same accessibility duties for consumer banking services in SpainCuatrecasas (2025)
DORA, Regulation (EU) 2022/255417 January 2025A hosted or SaaS CCM platform is an ICT third-party service: it goes in the register of information, its contract must carry the Article 30 terms, and if it supports a critical or important function you need a documented exit strategyFMA Austria; William Fry
Italy — Art. 119 TUB and Banca d'Italia transparency provisionsIn forcePeriodic communication at least once a year (rendiconto plus documento di sintesi): one of the largest recurring batches the platform must produceEC News (art. 119 TUB commentary)
UAE — CBUAE Consumer Protection Regulation (Circular 8/2020) and Standards31 December 2020Consumer information in Arabic, other languages in addition: bilingual, right-to-left composition is a core requirement, not a localisation extraTrowers & Hamlins; Pinsent Masons
Read the table as a list of things your current platform probably cannot do well. Twenty-year-old composition engines produce print-optimised PDFs with no tags, no reading order and no alternative text, and their templates were written by specialists in a language far above B2. ING Luxembourg, for example, has published B2 versions of its terms and conditions developed with the national banking association — a sign of the rewriting work the accessibility rules imply. DORA, meanwhile, turns the vendor decision into a supervisory topic: the platform that prints your statements is now a contract your supervisor can ask to read.

Accessibility is a composition problem, not a PDF fix

The cheap answer to the EAA is a post-processing tool that tags PDFs after they are produced. It works for a few static documents and breaks at statement volume, because tagging quality depends on structure the template never had. Ask every shortlisted vendor to produce a tagged, accessible PDF and an equivalent HTML version of one of your statements from the same template, and have someone who uses a screen reader test it. That single test separates the platforms built for accessible output from the ones retrofitting it.

Start With Your Template Estate, Not the Vendor List

Before any RFP, spend four to six weeks building a template inventory. It is the single document that sizes the migration, exposes hidden business logic and lets you compare vendors on your reality rather than theirs. For every template or document family, record:
  • Identity and volume: name, business owner, documents produced per year, peak batch size and the deadline it runs against.
  • Channel and trigger: batch, on demand or interactive; print, PDF, email, portal, app.
  • Data sources: which systems feed it, through which extracts or APIs, and who owns each feed.
  • Embedded logic: conditional clauses, calculations, tables that change shape, regulatory text by product or jurisdiction. Logic that lives in the template rather than in the source system is the costliest thing to migrate.
  • Regulatory exposure: which rules the document satisfies (transparency, pre-contractual information, accessibility, language), and the retention period of its archive.
  • Status: live, rarely used or dead — with the date it last produced a document.
In my experience the inventory changes the project before the first vendor call. A large share of the templates turn out to be duplicates or variants that can be consolidated, a meaningful slice has produced nothing in a year, and a small core of complex documents — statements, policy schedules, credit agreements — carries most of the risk and most of the volume. Those complex documents become your proof-of-concept set. The consolidation becomes your business case.

The CCM Vendor Landscape in 2026

The market has consolidated through acquisitions, which matters to a bank because lineage tells you where the codebase, the skills market and the roadmap come from. These are the platforms that come up most often when European banks and insurers ask for a shortlist. The lineage column is factual and dated; the fit and caution columns are my own reading, to be verified in your proof of concept:
PlatformLineage (dated)Usually shortlisted forCheck carefully
OpenText ExstreamFormerly HP Exstream; OpenText agreed to buy HP Inc.'s CCM assets for about USD 315 million in June 2016 and closed in August 2016Very high-volume batch and complex, multi-section statementsSkills availability, licence structure, which deployment options the roadmap really favours
Quadient InspireFormerly GMC Software, acquired by Neopost in 2012; renamed Quadient in 2017, and the group became Quadient in 2019Omnichannel design and business-user tooling; named a Leader in four 2025 Aspire Leaderboard segmentsEffort of migrating very large legacy estates; module scope in the quote
Smart Communications (SmartCOMM)Spun off from Thunderhead in 2016 as an independent company backed by Accel-KKR; headquartered in LondonCloud-delivered CCM, interactive documents and digital formsHigh-volume batch performance on your statement run; data residency options
Precisely EngageOneFormerly Pitney Bowes Software & Data, acquired by Syncsort in December 2019, which then rebranded as PreciselyEstates already on Pitney Bowes tools; combination with data-quality softwareProduct roadmap investment relative to the vendor's data business
MessagepointNamed a Leader in the Aspire CCM Technology Vendors Leaderboard for the seventh consecutive year in 2025Content management and template rationalisation, often layered over existing composition enginesWhether you need a content layer or a full replacement engine
DoxeeFounded in 2001 in Modena, Italy; listed on Euronext Growth MilanItalian market, cloud delivery, digital statements and dematerialisationScale references comparable to your volumes outside Italy
Adobe Experience Manager FormsPart of Adobe Experience CloudBanks already running AEM for web and formsBatch composition depth compared with specialist engines
Two remarks on reading lists like this. First, analyst rankings — the Aspire Leaderboard, Gartner Peer Insights reviews — are useful to build a long list and useless to choose between the top three, because they score general capability, not your templates. Second, the AI assistants many executives now ask for a shortlist are unreliable here: when I tested the question in October 2026, one answer recommended an e-signature company and a vendor whose CCM business was sold in 2019, with no sources cited. Use them to brainstorm, never to decide.

Seven Criteria That Actually Separate CCM Platforms

Every vendor will tick every box in a feature checklist. These seven criteria are the ones that still differ in practice, and each comes with a test that only real evidence can pass.

1. Composition power and batch performance

Can the engine reproduce your most complex statement — multi-account, multi-currency, tables that break across pages, conditional regulatory text — and produce your peak month-end volume inside the window your operations team actually has? Ask for the run on your data and your infrastructure profile, with the time measured end to end, including print-stream generation and archive indexing. Throughput claims made on vendor hardware with a sample letter tell you nothing.

2. Who authors templates — specialists or the business

Legacy platforms concentrated template work in a few specialists, which is why change requests from legal or marketing took weeks. Modern platforms promise business-user authoring. The honest version of that promise is a split: specialists build the structure and the logic once, business users change text, clauses and layout inside guardrails, with approval workflow and effective dates. Test it by giving a compliance officer a real regulatory text change to make during the demo, and time it.

3. Deployment model, data residency and the DORA exit

On-premise, private cloud, vendor-hosted or multi-tenant SaaS is no longer only an IT preference. Under DORA, a hosted platform is an ICT third-party arrangement that must be in your register of information and carry the contractual terms of Article 30, and where it supports a critical or important function you need an exit strategy that has been thought through rather than filed. Put these questions in the RFP:
  • In which countries are our data, our templates and our archive stored and processed, including backups and support access?
  • Which subcontractors and cloud providers sit underneath, and how are we notified before they change?
  • Can we export every template, content asset and archived document in documented, non-proprietary formats, and has any customer actually done it?
  • What are your incident notification times, and do they fit our own regulatory reporting clocks?
  • Will you accept audit and inspection rights for us and our supervisor, and support an exit transition period?

4. Accessible and plain-language output

Since the EAA started applying, the platform must produce accessible documents natively: tagged PDF with a logical reading order, alternative text, real tables rather than drawn ones, and an HTML rendition of the same content for digital channels. The second half of the duty is language: content management that lets you maintain a B2 version of key clauses, and ideally readability checks at authoring time. Score both on your own statement, tested with assistive technology.

5. Languages, scripts and right-to-left layout

Multilingual is a checkbox; bidirectional composition is not. A bank serving Gulf customers, or migrant communities in Europe, needs Arabic and Latin text mixed on the same page, numbers and IBANs that stay left-to-right inside right-to-left paragraphs, mirrored layouts, correct Arabic shaping in tagged PDF, and dates in the calendar the customer expects. If any of that matters to you, put a bilingual Arabic–English document in the proof of concept. It eliminates platforms faster than any other test.

6. Migration tooling and the partner ecosystem

Ask what the vendor provides to convert templates from your current platform, what share of your inventory it expects to convert automatically, and which named partners have done a migration of your size from your source platform. Then ask for a reference you can call. Automatic conversion rates are where sales optimism concentrates; a reference customer who migrated from the same legacy product is the only evidence that counts.

7. Commercial model and total cost

CCM pricing ranges from server or core licences to per-document or per-volume subscriptions, with authoring seats, channels and environments sometimes priced separately. The same platform can be cheap at your current volumes and expensive after you move paper customers to digital and multiply on-demand documents. Model five years with your volume forecast by channel, include non-production environments and the partner services for migration, and ask what happens to the price if you exit early.

Scoring the Shortlist

Turn the seven criteria into a scoring matrix before the vendors present, so that the demo cannot rewrite the weights. The weights below are an example for a mid-sized EU retail bank with a large statement run and a growing digital channel; change them to fit yours, but fix them in writing first:
CriterionExample weightWhat a 5 out of 5 looks likeEvidence to demand
Composition and batch performance20%Your hardest statement reproduced; peak volume inside the window with marginTimed run on your data in the proof of concept
Authoring model15%Regulatory text change made by a business user in minutes, with approval trailLive exercise by your compliance officer
Deployment, residency and DORA exit15%EU residency, named subcontractors, Article 30 terms accepted, documented exportDraft contract and export sample
Accessible and plain-language output15%Tagged PDF and HTML from one template, passing assistive-technology testingYour statement tested by an assistive-technology user
Languages and RTL10%Bilingual Arabic–English document correct in print, PDF and HTMLBilingual document in the proof of concept
Migration tooling and partners15%Converter for your source platform; partner with a reference of your sizeReference call with a migrated customer
Five-year commercial model10%Predictable cost under your channel-shift forecast; fair exit termsPriced five-year model on your volumes

The Proof of Concept That Decides

Pay for the proof of concept. A free one is a sales exercise run on the vendor's terms; a paid one, with two or three finalists in parallel over four to six weeks, buys you evidence and the right to set the rules. Keep the scope small and hostile:
  1. Pick ten documents from your inventory: your most complex statement, a credit agreement or policy schedule, an interactive letter, a regulatory notice, a bilingual document if relevant, and five ugly ones the business complains about.
  2. Provide real, anonymised data extracts in the formats your systems produce today, not cleaned files built for the test.
  3. Define pass criteria in advance: visual fidelity against the current output, accessibility test results, batch timing, the authoring exercise, export of everything at the end.
  4. Make your own people do the authoring change on day one and again at the end, so you measure the learning curve, not the vendor's consultants.
  5. Score against the matrix the same week, with operations, compliance, IT and procurement in the room, before the commercial negotiation starts.

“A CCM vendor that will not let your own people touch the templates during the proof of concept is showing you exactly how the next ten years will go.”

— Michele Cimmino · Fractional CTO & Digital Transformation Advisor

When Not to Buy a Full CCM Suite

Not every bank needs an enterprise CCM platform. A digital-only lender with a handful of document types, all generated on demand from a modern core, may be better served by a document-generation service or an engine built into its own stack, with a fraction of the licence cost and no proprietary template language. The test is the same one I apply to any build-vs-buy decision: if documents are a commodity output of your product, rent or build the smallest thing that works; if they are a regulated, high-volume, multi-channel operation in their own right, buy the platform and invest in using it well.

Migration: Where the Real Risk Sits

Selection is three months. Migration is the next one to three years, and it is where budgets break. Treat it as a strangler-fig programme, not a cutover: new platform for new and redesigned documents first, the legacy engine kept running for the rest, document families moved in waves ordered by risk and value — the same approach I describe in the decision-maker's guide to legacy modernisation. The risks that recur:
  • Undocumented logic in templates: calculations and conditions nobody remembers, discovered when the new output differs from the old. Automated visual and data comparison of old versus new output, document by document, is the only reliable control.
  • Archive continuity: years of sent documents must stay retrievable for complaints and audits, under their original retention periods, after the old platform is gone.
  • Print and mailroom dependencies: print-stream formats, inserter barcodes and postal sorting that the new platform must reproduce exactly.
  • Parallel-run cost: two licences, two skill sets and two operations teams for longer than planned. Put the decommissioning date in the business case and in the contract.
  • Content governance: without an owner for clauses and legal text, the new platform recreates the old sprawl within two years.

Mistakes Worth Avoiding

  • Running the RFP before the inventory. Vendors size the migration on your template count; if you do not know it, they will guess low and bill high later.
  • Judging on the demo. Every platform looks good on its own sample documents. Only your statement on your data is evidence.
  • Migrating every template. Retire and consolidate first; migration cost scales with what you carry over.
  • Treating accessibility as a later phase. Templates redesigned once for the new platform should be redesigned accessible and in plain language at the same time, not twice.
  • Signing without a tested exit. DORA asks for it, and it is the only leverage you keep after go-live.
  • Buying AI features before fixing content. Generative authoring on top of thousands of inconsistent clauses produces faster inconsistency. If you do add AI, govern it like any other system, as I describe in the AI governance framework for mid-market companies.

Your First 90 Days

  1. Weeks 1–2 — appoint and frame. One accountable owner for customer communications, a steering group with operations, compliance, IT, procurement and the mailroom, and the regulatory drivers written down.
  2. Weeks 2–6 — build the template inventory, with volumes, channels, data sources, embedded logic, regulatory exposure and last-used dates. Mark retire, consolidate and migrate.
  3. Weeks 6–7 — fix the criteria and weights in a scoring matrix signed off by the steering group, and pick the ten proof-of-concept documents.
  4. Weeks 7–9 — long list to shortlist: RFP to five or six vendors with the DORA and accessibility questions included; down-select to two or three on written answers and reference calls.
  5. Weeks 9–13 — paid proof of concept in parallel, scored the same week it ends, followed by a five-year commercial model and contract negotiation that includes the Article 30 terms and the exit plan.

The Bottom Line

Choosing CCM software for a bank is less about picking the best platform than about refusing to choose on anything except your own evidence. Inventory the templates, write down what the European Accessibility Act, DORA and your national rules now require of every document, weigh the seven criteria before anyone presents, and let a paid proof of concept with your ten hardest documents decide. Teams that do this end up with a shorter migration, a platform their business users can actually change, and a contract they can exit. Teams that skip it buy a new version of the system they were trying to leave. The architecture principles behind it — audit trails, data residency, controlled change — are the ones I cover in building compliance-first software for regulated industries.

If you want an independent second opinion

I help banks and insurers run exactly this kind of selection: the template inventory, the criteria and weights, the RFP questions on DORA and accessibility, and a proof of concept designed so the vendors cannot grade their own homework. I have no reseller agreement with any CCM vendor. Through Lasting Dynamics we also build the integrations and custom components around these platforms when the standard product stops short.

AI-ready answers

Frequently Asked Questions

How should a bank shortlist CCM vendors when replacing a legacy document composition system?+

Start with a template inventory (volumes, channels, data sources, embedded logic, regulatory exposure, last-used date) before talking to any vendor. Then score three to six vendors against seven weighted criteria fixed in advance: composition and batch performance, authoring model, deployment and DORA exit, accessible and plain-language output, languages and right-to-left layout, migration tooling and partners, and the five-year commercial model. Decide with a paid proof of concept run on ten of your own hardest documents, with your own staff doing the authoring changes.

What does the European Accessibility Act require from banks' customer documents?+

Directive (EU) 2019/882 has applied since 28 June 2025 to consumer banking services such as payment accounts, consumer credit and e-money. Contractual documents, terms and conditions and disclosures must be accessible and perceivable, and key information must not exceed level B2 (upper intermediate) of the Common European Framework of Reference for Languages. Existing contracts may continue for up to five years, and some Member States postponed application to 28 June 2030. For a CCM platform this means tagged accessible PDF and HTML output and plain-language content management.

Does DORA apply to a CCM platform?+

Yes, when the platform is hosted or delivered as SaaS by a third party. Under Regulation (EU) 2022/2554, applicable since 17 January 2025, it is an ICT third-party service: it must be recorded in the register of information, the contract must include the Article 30 provisions (service levels, data location, audit and access rights, incident assistance, termination), and if it supports a critical or important function the bank needs a documented exit strategy. Ask vendors to prove you can export every template, content asset and archived document in documented formats.

Independent CCM selection

Replacing a legacy document composition platform?

I help banks and insurers inventory their template estate, set the selection criteria — accessibility, DORA, languages, migration — and run a proof of concept that decides on evidence. No vendor to sell you, just a shortlist you can defend.

Let’s Talk