7. PWS (updated 6.04.20).pdf

(Attachment # 7)

REQUEST FOR QUOTE

CRYPTOCURRENCY MANAGEMENT AND DISPOSAL SERVICES

SOLICITATION NO.: 15M50020QA4400006

Source Selection Information—See FAR 2.101 and 3.104

1.0 GENERAL

1.1 Introduction

The United States Marshals Service (USMS), a principal law enforcement agency within the United States Department of Justice (DOJ), is a key component within the Department's Asset Forfeiture Program (AFP). The primary mission of the DOJ AFP is to employ asset forfeiture authority in a way that enhances public safety and security. This is accomplished by dismantling organized crime and removing financial incentives from criminals through the seizure and forfeiture of assets that are either the proceeds of, or were used to facilitate, federal crimes. To that end, the USMS, in conjunction with the United States Attorney’s Office (USAO) and Investigative Agencies (IA) scrutinize hundreds of virtual currency assets each year.

The Treasury Executive Office for Asset Forfeiture (TEOAF) administers the Treasury Forfeiture Fund (TFF). The TFF is the receipt account for deposit of non-tax forfeitures made pursuant to laws enforced or administered by it participating Treasury and Department of Homeland Security agencies. The Fund was established in 1992 as the successor to what was then the Customs Forfeiture Fund. The TFF participating agencies are:

• Internal Revenue Service Criminal Investigations Division (IRS-CI), U.S. Department of the Treasury;

• U.S. Immigration and Customs Enforcement (ICE), Department of Homeland Security;

• U.S. Customs and Border Protection (CBP), Department of Homeland Security;

• U.S. Secret Service (USSS), Department of Homeland Security;

• U.S. Coast Guard, Department of Homeland Security.

Orders will be funded from the USMS Asset Forfeiture Fund to support the Department’s Asset Forfeiture Program. However, TEOAF components or Government agencies with related law enforcement missions may fund and issue separate orders approved in advance by the USMS COR.

1.2 Objective

As the departmental custodians of all seized or forfeited assets, the USMS has a duty to ensure that the services of this contract provide maximum quality while minimizing the expense to the USMS. As such, the USMS expects the Contractor, as its agent, to take prudent action in good faith on the USMS’s behalf with the same duty of care while augmenting our capacity and efficiency with regard to the management and disposal of virtual currency.

The USMS expects to improve its current custodial operations through this contract in several ways.

Primary among these is to ensure the security and accuracy of all virtual currency transactions. To that end, the Contractor shall ensure that a complete and accurate accounting of USMS and TEOAF virtual currency inventory is maintained and available at all times from the point the Contractor is given custody through disposal. This accounting should include standardized reports commonly found in the financial services industry and the ability for the USMS to reconcile such reports and balances against the public blockchain ledgers. The USMS understands that in the case of some Digital Assets, specifically privacy tokens, reconciliation against public blockchain ledgers may not be technically feasible.

In addition, the Contractor shall comply with the provisions of this PWS in the most cost effective manner possible, without sacrificing quality or security, while adhering to recognized business standards in the industry. The USMS feels that meeting these expectations will dramatically increase our ability to meet our customers’ needs and auditors’ requirements.

1.3 Scope of Work

The purpose of this contract is to provide the full range of virtual currency management and disposal services. This includes but is not limited to such activities as accounting, customer management, audit compliance, managing blockchain forks, wallet creation and management, private encryption key generation and safekeeping, backup and recovery of private encryption key material, airdrops, etc., as well as future actions associated with the virtual currency forfeiture process.

The main currencies currently seized are: Bitcoin (BTC), Bitcoin Cash (BCH), Bitcoin Gold (BTG), Ethereum (ETH), and Litecoin (LTC). The average number of coin seizures in the past three years is as follows:

BTC,BCH,BTG,ETH,LTC 3-Year Average Bitcoin 6,754.8977649900 Bitcoin Cash 5,539.6248285367 Bitcoin Gold 2,224.4017693733 Ethereum 40,015.1099770333 Litecoin 7,519.5209126800 62,053.5552526133

The USMS took custody of about 15,280 BTC, BCH, BTG, ETH, and LTC total in 2017. The USMS took custody of about 152,033 BTC, BCH, BTG, ETH, and LTC total in 2018. In 2019, the USMS took custody of about 18,847 BTC, BCH, BTG, ETH, and LTC total.

The USMS has district offices in all 50 States and the territories of Puerto Rico, US Virgin Islands, Guam, and the Northern Mariana Islands. Some States have more than one local District office. The contract awarded for this PWS is not exclusive and the USMS reserves the right to exclude any asset or district at any time from this contract at its sole discretion. This same range of virtual currency management and disposal services will be utilized by TEOAF. The three year average and 2018-2019 statistics referenced above include the virtual currency the USMS took into custody for TEOAF.

1.4 Type of Contract Contemplated

Indefinite Delivery Indefinite Quantity

1.4 Period of Performance

The period of performance (PoP) shall be twelve months from the date of award with four (4) twelve month option periods.

1.5 Place of Performance

The primary place of performance will be the Contractor’s facilities with occasional visits to the U.S.

Marshals Service Headquarters at 1215 South Clark Street, Arlington, VA.

1.6 USMS furnished Property/Equipment

The Contractor shall provide all services, materials, supplies, supervision, labor, technology, and equipment, necessary to meet the requirements of this contract.

1.7 Hours of Operation

Contractor employees shall generally perform all work between the hours of 8:00 am and 6:00 pm EST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this PWS.

1.8 Travel

Contractor travel may be required to support this requirement. All travel required by the USMS outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval for all reimbursable travel in advance of each travel event.

1.9 Post Award Conference

The Contractor shall attend a Post Award Conference with the CO and the COR no later than 30 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the CO, is to discuss technical and contracting objectives of this contract and finalize the Contractor's draft project plan. The Post Award Conference will be held at the USMS’s facility, located at 1215 South Clark Street, Arlington, VA.

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 Management

It is impossible to determine which of the assets under investigation will be taken into USMS or TEOAF custody and ultimately referred to the contractor. However, in order to realize the increased capacity and efficiencies expected from this contract, the Contractor shall remain capable of taking custody of all types and quantities of virtual currency without limitation, throughout the performance of this contract. This includes both coin and token types of currency. The contractor will create a case file system to encompass all stages of the asset lifecycle (custody, management, storage, and disposal) which will be shared with the USMS as requested for review. This system must meet the minimum technical specifications for DOJ/USMS on data. The technical design of the system must be sufficient to support the four stages of the asset lifecycle.

The contractor must note if there are any known issues with DOJ or flags with OCIO for technical services and per Attachment 11: Security of Information and Information systems DOJ Procurement Guidance Document (PGD) 15-03.

2.1.1 Custody

Without delay and where technically feasible, the Contractor shall take custody of and provide secure management and disposal services for any type or quantity of virtual currency deemed necessary by the USMS. The contractor shall provide all aspects of the secure storage and management of virtual currency in its custody from the time of receipt until disposal. Virtual currencies not supported by the Contractor (with known private keys or mnemonics) at the time of custody will be allowed a period of five (5) business days for custody. All Digital Assets must be backed up in redundant geographically separate logical locations and in a manner that prevents compromise by internal collusion, third-party collusion, remote or local cyber-attacks, physical loss, fire or acts of nature.

2.1.2 Storage

The Contractor shall maintain complete and accurate accounting of USMS and/or TEOAF inventory at all times, while ensuring that USMS and/or TEOAF inventory is never comingled with any other wallets or addresses of different types or owners.

The Contractor shall take prudent steps to prevent the loss of USMS and/or TEOAF inventory by all means including but not limited to theft, human error, system failures, and acts of nature. The Contractor shall hold digital assets in USMS account in cold storage. Hardware used to store private keys associated with USMS accounts shall not be connected to any local or external networks at any time.

2.2 Disposal

The Contractor shall dispose of forfeited virtual currency assets in the manner specified by the USMS.

These methods include but are not limited to:

• Direct exchange from virtual currency into USD where markets exist.

• Exchange into a more liquid form of virtual currency and then exchanged into USD where markets exist.

• Exchange to USD and/or sale via a sealed-bid auction.

• Return to third party.

Disposal of virtual currency will take place subsequent to a court order. The Contractor shall dispose of the specified asset upon request by the USMS. The contractor shall make recommendations with regard to the most prudent method of disposal for the amount and/or particular type of virtual currency that is forfeited, however the ultimate decision with regard to disposal method rests solely with the USMS.

2.2.1 Standard Disposal

Once a virtual currency asset has been forfeited or approved for disposal by the federal courts or the Seizing Agency, the USMS will notify the contractor’s PM and specify which asset under custody can be disposed of and provide the written authority to dispose of the asset to the PM. The USMS, at the time of notification, will either request a recommendation by the contractor or direct the contractor which method to dispose of the asset. If the directed method chosen by the USMS is determined to not be feasible, the contractor must provide a written explanation of the mitigating factor and provide an alternative method and explanation of the choice, and any change in pricing.

Standard disposals of all types of virtual currency shall be completed within five (5) business days of notification. A standard disposal is 0-500 coins.

- The five day disposal deadline will be considered complete when all proceeds are in the Treasury Account. This may require approval from the COR to extend the disposal timeframe depending on exchange-based disposal restrictions.

2.2.2 Large Disposal

The USMS and/or TEOAF may be directed or may determine that a large seizure that has been forfeited will be sold separately via a sealed-bid auction, rather than on an exchange. Large disposals of all types of virtual currency shall be completed within forty five (45) calendar days of notification.

A large disposal is 501 coins or more.

Know Your Customer (KYC) will be required for the contractor to hold an auction. The registered bidders will need to provide the auctioneer their PII to enable the USMS to perform adequate background investigation on each control person of each bidder. This will need to be part of the auction timeline.

- The sealed-bid is constructed such that bidders are to submit bids for the assets. The prevailing bids are determined by the highest bid and for competing bids, the first bid received.

The USMS sealed-bid auctions do not have a minimum bid and the auctions are conducted as a pure market. The contractor can determine if they want to adjust the rules/structure and submit these requested changes and logic for the change to the USMS COR for consideration and approval.

2.2.3 Return to Third Party

In instances where the USMS and/or TEOAF must return virtual currency to a third party, the Contractor shall process these requests in a timely and efficient manner. Although the return of virtual currency is considered a type of disposal with regard to the asset itself, the process of doing so is a function of the management requirement NOT the disposal requirement. Therefore, in the event an asset is disposed of in this manner the Contractor shall NOT be entitled to a commission, rather it shall be entitled to its regular monthly management fee only.

The return of assets to a third party shall be completed within five (5) business days of notification.i

2.3 Quality Assurance

2.3.1 General

Processes which are fundamental to providing the data critical to achieving USMS goals will change throughout the period of this contract due to advancements in technology, the USMS adoption of new technology, evolving state and federal regulations, and to ensure alignment with organizational and Federal policy. The Contractor shall work in good faith to accommodate such changes as necessary to ensure USMS requirements are met, and to the extent any such changes are necessary to the contract.

The Contractor shall maintain a close and cooperative working relationship with the USMS and make appropriate recommendations. The Contractor shall perform his/her functions in accordance with all applicable Federal, State, and local laws and regulations applicable to the services being provided as well as any policies as specified by the USMS. The Contractor shall obtain and keep current throughout the duration of the contract all licenses, insurance policies, permits, and related documents common within the industry and necessary as established by any regulations to operate this type of business.

The Contractor shall immediately report all emergencies to the COR. Examples include but are not limited to: natural disasters affecting the storage facility, loss of currency, any transfer discrepancy, any compromise in cold storage or security. The contractor will notify the USMS and/or TEOAF of any data breach or loss of cryptocurrency within 24 hours, and within two weeks, the Contractor must provide a recommended remediation for recovery to ensure future risk mitigation of a similar event.

2.3.2 General Reporting

The Contractor shall provide system access to meet the needs of the USMS. At a minimum access shall include ad hoc reporting capabilities, and the real-time ability check and monitor the assets being held in storage where technically feasible. System shall provide four nines (99.99%) continuous availability throughout the duration of the contract where technically feasible.

In addition, Contractor shall provide the USMS with ad hoc reports.

All written reports provided in electronic format shall have read/write capability using applications that are compatible with USMS workstations as specified by the USMS during the post award conference.

2.3.3 Progress Reports

The Contractor shall provide a monthly progress report to the COR via electronic mail on the first business day following the last day of each month. This report shall include a summary of all work performed, including a reconciliation of the book inventory with the physical inventory, all direct costs by line item, any travel conducted, an assessment of overall progress, projected activity for the following month, and any identified risks, issues, or concerns and plans for their mitigation.

2.3.4 Progress Meetings

The Contractor shall be responsible for keeping the COR informed about Contractor progress throughout the performance period of this contract and ensure Contractor activities are aligned with

USMS objectives. For all meetings, the contractor shall be responsible for providing meeting materials, and administrative and facilitation support. At a minimum, the Contractor shall review the status and results of Contractor performance with the COR on a monthly basis via telephone.

At the sole discretion of the USMS, intermittent project status reviews may be conducted by telephone/teleconference or in person as deemed necessary by the COR.

2.3.5 Project Plan

The Contractor shall provide a Proposed Project Plan. The Proposed Project Plan will be finalized with the USMS at the Post Award Conference. The Contractor shall provide a final Project Plan to the COR not later than 30 days after the Post Award Conference.

The Project Plan should include a detailed Phase-In plan for contract transition (including time period for transition, security, facility, equipment, personnel) as well as a detailed Phase-Out plan should the services need to be transferred at the end of the contract.

2.3.6 Contractor Quality Assurance Surveillance Plan

The Contractor shall submit a proposed QASP for consideration. The draft QASP should include proposed performance standards and “Acceptable Quality Level (AQL), as well as suggested price adjustment or other action.

Please note, the QASP is the internal USMS plan for implementing measurable performance standards for the purposes of monitoring and evaluating the performance of the contractor.

Therefore, although the USMS will consider alternatives proposed by the contractor, the final decision on the contents of the QASP rests solely with the USMS.

2.3.7 Liability

The Contractor shall be liable for any act, omission, negligence, or lack of performance on their part which results in the damage, devaluation, destruction, or loss of any and all property, parts, items or derived portion that the Contractor handles during the performance of this contract. Insurance will be 50% of the commensurate value of the inventory, and will be adjusted and reviewed quarterly. The USMS will cover the remaining 50% as the United States Government is self-insured. Bonding is required at the same percentage all times, and shall make the USMS whole in the event of any losses.

In the event insurance cannot be obtained, the USMS will require an escrow of funds for the duration of the contract.

2.3.8 Performance Requirements Matrix

This contract includes a Performance Requirements Matrix (PRM) in Section 5.0. The PRM plays an integral role in the administration of the contract. In addition to any applicable inspection clauses or other related terms and conditions contained in the contract, the PRM shall serve as a primary tool for inspection and acceptance of services as facilitated by the COR. Evaluation of the Contractor’s overall performance shall be in accordance with the performance standards set forth in the PRM, and will be conducted by the COR. The PRM constitutes a material aspect of the contract and will not be changed or otherwise modified without prior written approval of the CO.

3.0 Deliverables

Item PWS Deliverable/Event DUE DIST.

1 1.9 Post Award Conference Within thirty (30) business days after date of award

Contracting Officer

2 2.3.5 Final Contractor Project Plan Within thirty (30) days of Post Award Conference

Contracting Officer, COR

3 4.3 Final Business Continuity Plan Within thirty (30) days of Post Award Conference

Contracting Officer, COR

4 4.3 Updated Business Continuity Plan Annually Contracting Officer, COR

5 2.3.3 Progress Reports Monthly Contracting Officer, COR

6 2.3.4 Progress Meetings Monthly Contracting Officer, COR

4.0 CONSTRAINTS

4.1 Compliance

4.1.1 External Audits

To the extent deemed necessary by the USMS to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, accuracy, and confidentiality of any non-public USMS data collected and stored by the Contractor, the Contractor shall afford the USMS access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases at any time during the performance of the contract.

Additionally, the contractor shall remain available to respond and assist the USMS with responding to inquiries by our auditors, both internally and externally. The USMS and/or the Office of the Inspector General (OIG) may periodically contract for the services of an Independent Public Accountant (IPA) to perform a review of the program. The contractor shall allow and provide as follows:

a. Contractor shall make facility and USMS records accessible to the USMS and or OIG/IPA upon request.

b. Contractor shall provide ample work space for USMS and or OIG/IPA during visits.

c. Contractor shall provide onsite representative to assist USMS and or OIG/IPA during visits.

4.1.2 Internal Audits

The CFO Act of 1990 requires an annual audit of the Asset Forfeiture Fund (AFF) annual financial statements. As part of this audit, the Contractor is mandated to conduct a one hundred percent (100%) annual inventory reconciliation for all assets in the custody of the Contractor, including assets which may have become forfeited and/or unblocked based on a Disposition Order but which are still in the custody of the Contractor. The contractor shall provide their internal audit report to the USMS within five (5) business days of completion. Deficiencies identified by any audit findings shall be cured by the Contractor within twenty (20) business days of such identification or as approved by the CO.

4.2 Data

The USMS owns the rights to all data/records produced as part of this contract and shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. The Contractor shall not create or maintain any records containing any USMS information that are not specifically tied to or authorized by the contract. Further, disposition and destruction of records is EXPRESSLY PROHIBITED unless authorized by the USMS. The Contractor shall prevent the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage, or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

All information related to this contract created or produced in part or in whole, regardless of type of media, is to be maintained for the duration of the contract, made available upon request, and upon termination of the contract shall be turned over to the USMS. This includes but is not limited to all electronic files, hard copy files, data contained in electronic information systems, databases, etc., and all supporting documentation. The Contractor must deliver sufficient technical documentation with all data deliverables to permit use of the data by the USMS.

All data at rest shall reside within the contiguous United States, the District of Columbia, and Alaska (CONUS) with a minimum of two data center facilities at two different and distant geographic locations.

Contractor access to privileged information is required under this PWS. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the Privacy Act, OMB M06-16 (PII) and other pertinent laws and regulations governing the confidentiality of privileged information and Safeguarding Sensitive But Unclassified (SBU) (For Official Use Only) Information.

Contractor access to classified information is not currently required under this PWS. However, the USMS at a later date may require all Contractor personnel to have higher clearances. Accordingly, at a minimum all Contractor employees provided for this requirement must be eligible for a Secret Clearance.

4.3 Continuity of Service

The Contractor shall prepare and submit a Business Continuity Plan (BCP) to the USMS. The BCP Plan shall be due at the post award conference, and will be updated on an annual basis. The BCP shall document Contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, shall include the following:

• A description of the Contractor’s emergency management procedures and policy

• A description of how the Contractor will account for their employees during an emergency

• How the Contractor will communicate with the USMS during emergencies

• A list of primary and alternate Contractor points of contact, each with primary and alternate:

o Telephone Numbers o E-mail addresses

Individual BCPs shall be activated immediately after determining that an emergency has occurred, shall be operational within 24 hours of activation or as directed by the USMS, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the contract is terminated, whichever comes first. In case of a life-threatening emergency, the COR shall immediately make contact with the Contractor’s Project Manager to ascertain the status of any Contractor personnel who were located in USMS controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the Contractor’s Project Manager and the COR shall promptly open an effective means of communication and verify:

• Key points of contact (USMS and contractor)

• Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

• Means of communication available under the circumstances (e.g., email, webmail, telephone, FAX, courier, etc.)

• Essential Contractor work products expected to be continued, by priority

The USMS and Contractor’s Project Manager shall make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances.

Contractors shall obtain approval from the Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

4.4 Section 508 Compliance

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194.

The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

4.5 Conflicts of Interest

http://www.section508.gov/

In order to avoid a conflict of interest, or the appearance of a conflict of interest, the Contractor, subcontractor (s), associated employees and their immediate family/household members, any entity in which the Contractor has any financial interest; or any agent or representative for such party, are prohibited from bidding on or buying any forfeited property, either directly or indirectly.

In the event that the mere appearance of conflict of interest might arise, the Contractor shall notify the COR immediately.

4.6 Contractor Personnel

4.6.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this PWS. Qualified personnel is defined as having a high school diploma and a minimum of two years recent experience and familiarity with virtual currency. Qualified personnel are required to have proficiency in using spreadsheet and word processing software. An undergraduate degree is preferred. Management of similar projects under Federal Government sponsorship is preferred.

4.6.2 Key Personnel

Before replacing any individual designated as Key by the USMS, the Contractor shall notify the CO no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement. Note: The USMS may designate additional Contractor personnel as Key at the time of award.

4.6.2.1 Project Manager

The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this PWS. The Project Manager shall be a single point of contact for the CO and the COR. The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the USMS as part of the Contractor's proposal.

During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager must be fully available during the established hours of operation for the duration of the contract, and shall respond to all requests for discussion or resolution of problems within two hours of notification. The Contractor shall not replace the Project Manager or alternate without prior approval from the Contracting Officer.

4.6.4 Employee Conduct

Contractor’s employees shall comply with all applicable USMS regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, etc.) when visiting or working at USMS facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect poorly upon the United States or the USMS. The Contractor shall ensure its employees understand and abide by USMS established rules, regulations and policies concerning safety and security.

4.6.5 Employee Removal

The USMS may, at its sole discretion (in coordination with the CO where practical), direct the Contractor to remove any Contractor employee for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The CO will provide the Contractor with a written explanation when a determination is made to remove an employee.

4.7 Security Of Information and Information Systems

In order to avoid a any issues with internal guidance for IT systems, you must comply with applicable guidance in Attachment 11: Security of Information and Information systems DOJ Procurement Guidance Document (PGD) 15-03.

5.0 Performance Requirements Matrix (PRM)

The PRM establishes key elements of Contractor performance that represent “mission essential” service requirements, which are identified in the table below in the “Required Service” column, which point to different sections in the PWS. The “Performance Standards” column represents the standard against which Contractor performance will be measured in relation to accomplishment of the corresponding service output. The performance objective or “standard” describes the acceptable level of service by the Contractor for satisfactory performance. The performance standards are the only acceptable levels of service and if these are not met, we will evoke the negative incentive specified in the table below.

Required Service Performance Standards Incentive (Negative)

2.1.1 Custody

Takes custody within five (5) business days. Invoice deduction of $500 for each instance.

2.1.2 Storage

Accurate and segregated inventory. Invoice deduction of $500 for each instance.

4.6.2.1 Project Manager

(or designee)

Available within two hours of request between 8 AM EST – 6 PM EST, Monday through Friday. Federal holidays and weekends excluded, using agreed upon contact methods.

Invoice deduction of $500 for each late instance or unavailability.

2.2.1 Standard Disposal

Completed within 5 business days

Invoice deduction of $500 for each disposal completed late

2.2.2 Large Disposal

Completed within 45 calendar days

Invoice deduction of $500 for each disposal completed late

2.2.3 Return to Third

Party

Completed within 5 business days

Invoice deduction of $500 for each disposal completed late

2.3.1 General

Compliance within 24 hours of loss or breach, two weeks for remediation plan

Per PGD-1503, Contractor is responsible for damages and costs related to loss. Invoice deduction of $500 for each day remediation plan is late.

2.3.2 General Reporting

System Downtime (not including blockchain networks) Invoice deduction of $500 for each instance

2.3.3 Monthly Progress

Reports

Reports are complete and submitted within the prescribed timeframes.

Invoice deduction of $500 for each report delivered late

2.3.4 Monthly Progress

Meetings

Contractor is fully prepared for meetings and they are conducted within prescribed time period

Invoice deduction of $500 for each late/missed meeting.

4.1.1 External Audits

Audits are fully supported ensuring access to data and efficiency of audit process.

Invoice deduction of $500 for each audit conducted late

4.1.2 Internal Audits

Audit is conducted fully and within the prescribed timeframes.

Invoice deduction of $500 for each incomplete or late audit.

4.3 Continuity of Service

Updated BCP is complete and submitted within the prescribed timeframes.

Invoice deduction of $500 for each incomplete or late BCP.

6.0 Glossary of Acronyms and Terms

BCP Business Continuity Plan CDR Contract Discrepancy Report CLIN Contract Line Item Number CO Contracting Officer CONUS Contiguous United States COR Contracting Officer’s Representative IPA Independent Public Accountant OIG Office of the Inspector General POP Period of Performance PRS Performance Requirements Summary PWS Performance Work Summary USMS United States Marshals Service QASP Quality Assurance Surveillance Plan

For the purposes of this contract, the forfeiture process consists of the following two primary phases:

Pre-seizure: This phase seeks to identify and address critical title, financial, property management and disposal issues prior to making the decision to proceed with a forfeiture action.

Asset Management: This phase covers the asset life cycle from the point of seizure, to the ultimate disposal of the property and can be further broken down into the following processes:

• Seizure: During this stage the U.S. Marshals Service takes custody of the asset based on a federal court order and serves as the responsible steward of the asset until such time as a forfeiture order has been entered against the asset.

• Forfeiture: The asset has been forfeited to the United States based upon the issuance of a federal court order directing the USMS to sell or otherwise dispose of the asset. The USMS will continue to maintain the asset until such time as its final disposal has been completed.

• Disposal: Pursuant to a federal forfeiture order, the USMS will dispose of the property accordingly.

i For reference, between 2014 and 2019 the USMS returned about 182.37 BTC.