Are you only authenticating or also other stuff? You might also need smartcards.
Are you sure you only need SMS or do you also need to choose from a vast variety of tokens?
You might want to choose a solution, which is not provided by a token vendor. The thing behind this is: You can keep the software system but easily mix and switch tokens (no vendor lock).
In theory you could do this with all OATH tokens... But you know theory and real life.
Where to install the authentication system?
The other question is, what are the applications or operating systems where you want to authenticate.
No solution should be restricted in this way, that it can not be virtualized!
Out of band delivery
You might think this is cute at the moment. But you may realize in a year, that it is total crap and unsecure. You may also need to extend the usage scenarios. So do not only look for out of band but also look for a system with maximum token support and extensibality.
Flexibility & Usability
API API API.
Can it be easily automated.
E.g. Can it be integrated into your existing customer portal?
Do you get the Source Code? I.e. can you ask s.o. to enhance it more quickly than the vendor would respond to a feature request?
Can you still use it, when the successful vendor is merged with a bigger shark and the old product is ceased end of life?
Especially in the IT Security we saw this often during the last years!