NIGP 94676: Smartcards, Limited and Standard Use Proximity Integrated Circuit Card (Lu-PICC and PICC)

NIGP 94676, Smartcards, Limited And Standard Use Proximity Integrated Circuit Card (LU-PICC and PICC), Item code, encompasses the procurement of prepaid and debit card management systems and related services by state and local government agencies. The scope of work currently being solicited includes end-to-end card management platforms that support participant enrollment, card issuance, transaction processing, funding mechanisms, compliance monitoring, and real-time fraud detection, typically delivered as either an integrated database solution paired with a City-approved financial institution or as a turnkey banking and financial services offering. Issuing bodies under this code include city procurement offices; the source reflects activity from municipal government seeking comprehensive card management solutions to support specific programs such as transportation stipends or benefit distribution.

The City of Alexandria, Virginia posted RFP 2017 on July 10, 2026, requesting Transportation Stipend Card Management Services with sealed proposals due August 20, 2026 at 5:00 PM EST under competitive negotiation. The solicitation calls for a scalable solution supporting approximately 750 participants in Year 1, expanding to 827 by Year 3, with mandatory PCI DSS v4.0 compliance, AES-256 encryption at rest, TLS 1.3 in transit, multi-factor authentication, OAuth 2.0 API security, 99.9% uptime with defined recovery objectives, and real-time fraud monitoring. The contract term runs three years with three optional one-year renewals capped at six years total, with price adjustments on renewal limited to the Consumer Price Index for the Washington-Arlington-Alexandria region. Evaluation criteria span card management functionality, reporting, implementation and project management, program flexibility, IT and data security compliance, contractor qualifications and references, staffing, and cost competitiveness. Offerors must provide SOC 2 Type II compliance documentation or complete the City's Cloud Vendor Assessment Tool, demonstrate SWaM or DBE status for first-tier subcontractors, and carry cyber liability insurance of at least $1 million. An optional pre-proposal conference was held July 23, 2026, with written questions due July 30, 2026 and City responses issued by August 6, 2026.