Draft_Solicitation_No._2032H5-19-R-00005.pdf

Draft Solicitation No. 2032H5-19-R-00005

PART I - THE SCHEDULE

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 NO COST FIXED CONVENIENCE FEE RATE

(a) This is a no cost fixed convenience fee rate contract. All fees authorized for use under the terms of this contract will not be paid by the government. The contractor is liable for all costs related to performance under this contract and the government is not liable for payment of any services provided under this requirement.

(b) The contractor shall not charge an amount that exceeds the fees as set forth in the price schedule as stated below. During the performance of this contract, the contractor shall ensure the fee charged to the tax payer is minimized. Therefore, the contractor may submit discounts and/or lower fee rates throughout the life of the contract for review and approval by the CO. The fees designated in Section B.2 below shall not increase over the life of the contract.

B.2 CONTRACT PRICING (CONVENIENCE FEE)

BASE YEAR – DATE OF AWARD THROUGH 12 MONTHS*

CLIN DESCRIPTION CONVENIENCE FEE EXTENDED FEE

0001 Debit Card Payment Services $0.0000 $

0002 Credit Card Payment Services 0.0000% $

Total Debit and Credit Card Payment Services $

*The base year of the contract consists of an eight (8) month phase-in period; the remaining four

(4) months include collection of credit and debit card collection fees (see Section C.1.5 below).

OPTION YEAR 1 - 12 MONTHS FROM DATE OF EXERCISE

Total Debit and Credit Card Fees $

OPTION YEAR 2 - 12 MONTHS FROM DATE OF EXERCISE

0002 Credit Card Fee 0.0000% $

OPTION YEAR 3 - 12 MONTHS FROM DATE OF EXERCISE

OPTION YEAR 4 - 12 MONTHS FROM DATE OF EXERCISE

SECTION C – DESCRIPTION/SPECIFICATIONS/PEFRORMANCE

WORK STATEMENT

C.1 PERFORMANCE WORK STATEMENT

C.1.1 INTRODUCTION

According to the Internal Revenue Service (IRS) 2017 Data Book, the IRS is one of the largest processors of information in the world, collecting more than $3.4 trillion annually. As described in the IRS Strategic Plan, the IRS is planning to improve service to taxpayers by improving service options for the taxpaying public, facilitating participation in the tax systems by all sectors of the public and simplifying the tax process. This will be accomplished as the

IRS increases the scope and accessibility of electronic payment services and simplify the paying experience for all taxpayers. The IRS will continue to launch new and enhanced filing and payment programs to create an environment where electronic interaction is the preferred option for our customers. Electronic payment options will be enhanced allowing for greater flexibility for the taxpayer through more choices. To do so, the IRS will continue to partner with private industry to develop products that will encourage taxpayers to electronically pay estimated and balance due taxes.

Since January 1999, individual taxpayers have been able to electronically pay the balance due on individual tax returns by way of an electronic funds withdrawal or credit card payment.

Currently, individual and business taxpayers can pay electronically by authorizing an electronic funds withdrawal (direct debit) from a checking or savings account or through an authorized e-file provider; by credit or debit card using a touch-tone phone or Internet; or by credit or debit card through an integrated e-file and e-pay solution. These payment options are made possible by the Taxpayer Relief Act (TRA) of 1997, which authorized the acceptance of tax payments via any commercially acceptable means.

As described in the TRA of 1997, the Secretary of Treasury is authorized to receive internal revenue taxes through any commercially acceptable means; however, the Secretary may not pay any fee or provide any other consideration under any related contracts. Please note this may change pending approval of Legislation H.R.5445 21st Century IRS Act or any other legislation of similar nature that may impact the IRS Pay by Card Program. If the legislation is approved, it is anticipated this may have an impact to the contract.

In the 2021 filing season, credit or debit card payment options for taxpayers could include (1) pay by phone or Internet through service providers; (2) electronically file and pay through service providers who partner with software developers; and (3) electronically file and pay through authorized IRS e-file providers and commercial tax preparation software.

C.1.2 OBJECTIVE

The IRS is looking for the best solutions for making electronic payment options the preferred method for paying taxes. The IRS is seeking contractor(s) who can identify and provide approaches to move balance due return payments, estimated tax payments, installment payments and other tax forms with related payments to electronic transactions.

The government is looking to minimize cost to the taxpayer and ensure privacy and security.

Electronic payment options should simplify payment transactions in such a way as to encourage taxpayers to explore other opportunities for electronic exchanges with the IRS. A goal is to communicate that electronic payment options are (1) convenient, safe and secure and (2) a normal outgrowth of the trend in electronic filing and overall e-commerce.

The IRS vision is to improve the taxpayer experience through continuous innovations in taxpayer service and compliance programs. The IRS intends for the taxpayer to make a debit or credit card Web payment by accessing the contractor’s website through IRS.gov. This process would include clear sequential steps to minimize abandonment, and be a maximum of five steps, clearly showing progress through the steps on each page.

C.1.3 SCOPE

The primary objective of this Performance Work Statement (PWS) will focus on expanding the use of electronic payment methods to collect federal tax payments and encouraging taxpayers to use electronic media to interact with the IRS. The contractor shall provide all personnel, material equipment, and supervision necessary to provide e-Payment Services as outlined in this performance work statement (PWS), including all deliverables, at no cost to the Government.

Integrated e-file and e-pay credit card service provider option is available non-competitively and is outside of the scope of this contract. Refer to the Credit Card Bulk Provider (CCBP) requirements for information on how to become an integrated e-file and e-pay credit card service provider.

Additionally, Automated Clearing House (ACH) is an electronic network for financial transactions in the United States. An ACH product solution is outside the scope of this contract

C.1.4 BACKGROUND

During Fiscal Year 2017, the IRS processed more than 245 million returns, including individual income, corporate income, and employment income tax returns. IRS provided nearly $436 billion in refunds to taxpayers and collected $3.4 trillion in federal revenue. IRS provided taxpayer assistance through $495.6 million visits to IRS.gov and assisted nearly 63.2 million taxpayers through our toll-free telephone helpline or at walk-in sites. Of the more than 173 million individual tax returns processed, 70% were filed electronically. The data was derived from the IRS 2017 Data Book. The following chart is based on actual combined data (amount & volume) received per year.

Table 1.4

HISTORICAL CREDIT/DEBIT PAYMENT DATA

Credit Cards Only

(Approx. Dollars

Collected by IRS)

Debit Cards Only

(Approx. Number of Transactions)

May 2015 – Dec 2015 $ 965,072,284 2,055,442

Jan 2016 – Dec 2016 $ 4,209,497,983 3,966,690

Jan 2017 – Dec 2017 $ 4,804,498,366 4,188,944

Jan 2018 – Dec 2018 $ 5,722,531,559 4,634,086

Jan 2019 – Dec 2019* $ 5,836,982,190 4,726,767

Totals $ 21,538,582,382 19,571,929

*Projected totals for tax season 2019 based on the following: 2019 Credit Cards Dollars =

$5,722,531,559 (2018 total) X 2% = $114,450,631 (2% increase expectation in 2019 due to tax reforms

IRC 965 Transition Tax and Bi-partisan Budget Act) and 2019 Debit Cards Volume = $4,634,086 (2018 total) X 2% = $92,681 (2% increase expectation in 2019 due to tax reforms IRC 965 Transition Tax and

Bi-partisan Budget Act).

Note: The totals for credit cards are calculated differently than debit cards because the convenience fee for credit cards is based on a percentage of the tax liability whereas the convenience fee for debt cards is based on a fixed flat fee.

C.1.5 CREDIT CARD PROGRAM REQUIREMENTS

The contractor’s URL will be displayed on IRS.gov in section Pay Taxes by Credit or Debit

Card. The contractor shall be limited to one Uniform Resource Locator (URL) to collect and process payments which will be promoted in the e-pay service providers and fees list and integrated in the IRS e-file and e-pay list.

The IRS reserves the right to promote the contractor(s) based on price, user experience, or other factors, or to pick a preferred provider each year and to utilize the preferred provider on

IRS.gov and through the call centers.

The phase-in period is from May 1, 2020 through December 31, 2020. During this period, the contractor shall adhere to C.2, Business Requirements for implementation. Only after the

Annual Requirements Review Meeting (Kickoff) through June 30th of each year, may the contractor submit proposed changes (refer to chart in section C.7).

C.2 BUSINESS REQUIREMENTS

C.2.1 The contractor shall provide an electronic payment processing service in American

English (see section508/Web Content Accessibility Guidelines (WCAG)), which allows taxpayers to make federal tax payments through a convenient, safe and secure means.

C.2.1.1. The contractor is subject to Section 508 of the Rehabilitation Act of 1973

(as amended by the Workforce Investment Act of 1998) and the Architectural and

Transportation Barriers Compliance Board Electronic and Information Technology

(EIT) Accessibility Standards (36 CFR Part 1194). The electronic payment processing service shall include applicable accessibility provisions of part 1194

Subparts B, C and D; such as, 1194.22 Web-bases Intranet/Internet Information and

Applications and 1194.23 Telecommunications Products in accordance with FAR

39.2.

C.2.1.2 The contractor shall exercise best practices and industry standards for preparing and maintaining systems and application documentation. The documentation shall be Section 508 compliant. The contractor shall provide a detailed narrative on the IT configuration as it applies to the IRS contract. This shall include the type of IT environment being used at the contractor site, virtual machines, how many and the operating system (if applicable) and all IT assets being used at the site or at remote sites identified in “Alternate Work Locations.” The locations shall include servers, workstations, laptops, routers, switches, and virtual environments.

C.2.1.3 The contractor’s electronic payment system shall allow connection with the IRS securely using Application Programming Interface (API) technology.

C.2.1.4. The contractor shall include CAPTCHA (Completely Automated Public

Turing Test to Tell Computers and Humans Apart) on their website as a layer of security when a taxpayer enters their federal payment.

C.2.1.5 The contractor shall allow the taxpayer to make a debit or credit card web payment by accessing the contractor’s website through IRS.gov. This process shall include clear sequential steps to minimize abandonment, and be a maximum of five steps, clearly showing progress through the steps on each page.

C.2.1.6 The contractor shall provide a mobile-friendly version of their website for tablets and Smartphone (e.g., Android, Apple, or other similar devices), with the capability to allow the taxpayer a “View Full Site” option.

C.2.1.7 The contractor shall include mobile payments in their strategy and Marketing

Plan. The payments shall be broken out separately in weekly and monthly reporting.

The report shall be provided to the Contracting Officer’s Representative (COR)/

Contracting Officer (CO) or as specified by COR/CO. Refer C.6.3.

C.2.1.8 The contractor shall distinguish mobile payments by smartphone and tablet within the daily reports. The contractor shall do the classification by using an indicator called user agent which will identify the device, browser, and operating system.

C.2.2 The contractor shall provide a system that allows a wide array of taxpayers’ (i.e.

domestic, international) access for making federal income and business tax payments. All

Interactive Voice Response (IVR) and Internet applications are required to provide taxpayers with a unique toll-free number and web address (URL) for the completion of federal payments only.

C.2.2.1 The contractor shall provide a system that allow international taxpayers access for making federal individual and business tax payments. All IVR and internet applications are required to provide international taxpayers with a unique non-toll-free number for the completion of federal payments only.

C.2.2.2. The contractor shall provide an IVR system with capabilities to capture required fields determined by the government to validate the taxpayer’s entity (refer to C.2.17).

C.2.3 The contractor shall settle funds through the Treasury Financial Agent (TFA). All funds must settle within 24 – 48 hours (refer to section 5 in the CCBP requirements).

C.2.4 The contractor shall provide only guaranteed payments to the government for federal taxes owed. Funds shall be available in the contractor’s designated bank account one business day after the settlement file is submitted.

C.2.5. The contractor shall comply with electronic payment regulations of the Internal

Revenue Code, including Treasury Regulations 301.6311-2, Payment by credit card and debit card and any subsequent updates and revisions

C.2.6 The contractor shall provide a system that accepts federal income for individuals (i.e.

1040, 1040ES, 4868) and business (i.e. 94X) tax payments including balance due, extension, installment and estimated payments. The IRS reserves the right to increase tax payment types annually. Payments shall be accepted in accordance with written filing season credit card processing periods as defined by the IRS (refer to CCBP requirements).

C.2.6.1 The contractor shall provide a secure a payment method that converts cash payment to electronic transactions for the unbanked or underbanked.

C.2.6.2 The contractor shall enable the cash payments method system to have the capability to accept a range of taxpayer payments and not limit the payment transaction amount to $1,000.

C.2.7 The contractor shall minimize duplicate and erroneous payment opportunities by establishing processes to prevent users from submitting multiple, identical payments and comply with the limits on the number of payments that can be made per taxpayer per tax type in accordance with IRS guidelines. An integrated database that centrally regulates such limitations, independent of the payment channel, shall be used.

C.2.8 The contractor shall provide an accuracy rate of 99% or higher for all transmitted transaction data as provided by the taxpayer. This includes accuracy of electronic payment data forwarded to the service by the contractor that may be impacted by intermediate actions taken by the contractor necessary for coding, applying, and transmitting payment data. Any adjustments to transaction files resulting from failure to correctly verify and validate payment information shall be the responsibility of the contractor.

C.2.9 The contractor shall implement systems controls to prevent duplicate payments that could result from multiple transmissions of a settlement file or other errors resulting from the completion and transmission of identical payment transactions. Duplicate payments caused by insufficient system controls will adversely impact the contractor’s accuracy rate.

C.2.10 The contractor shall participate in the Annual Requirements Review Kickoff Meeting in accordance with section C.7.

C.2.11 The contractor shall provide monthly development status report by the 5th day of each month through the life of the contract (the initial report will be discussed in the Kickoff). The report shall be provided to the COR or as specified by the COR.

C.2.12 The contractor shall adhere to government banking regulations regarding debit and credit card rate fees.

C.2.13 The contractor shall inform taxpayers of the dollar amounts of all fees, if any, related to the payment transaction and obtain taxpayers’ acknowledgement or acceptance of fees prior to completing any payment transactions. The contractor shall inform the taxpayer that fees charged are by the contractor, not by the IRS.

C.2.14 The contractor’s proposed method for obtaining taxpayer’s acknowledgement or acceptance of fees must be approved in advance by the government.

C.2.15 The contractor shall provide a privacy policy notice on their system to protect the taxpayer’s personally identifiable information.

C.2.16 The contractor shall submit payment data files in accordance with the CCBP requirements for transmitting payment data to the government’s TFA. The contractor shall forward settlement files to the TFA one business day prior to settlement.

C.2.17 The contractor shall secure entity validation, in accordance with the CCBP requirements, prior to forwarding settlement files to the TFA.

C.2.17.1 The contractor shall exercise due diligence in notifying taxpayers of entity rejections. The contractor shall provide assistance to the taxpayers with their entity rejection corrections without providing the given reason from IRS (IRS reject code reason) following IRS security guidelines for Taxpayer Protection Act.

C.2.17.2 The contractor shall ensure that certain edits and actions are performed to confirm the validity of taxpayer information and ensure that the federal tax payment will be applied accurately and as intended by taxpayers.

C.2.18 The contractor shall convert payment transactions to Automated Clearing House

(ACH) debit authorizations and settle funds through the TFA.

C.2.19 The contractor shall submit daily, payment detail records or settlement files using the

American National Standards Institute (ANSI) X12 Electronic Data Interchange (EDI) 813 transaction set. The TFA will initiate one bulk debit each business day from the contractor’s account, which must be established for this purpose (refer to CCBP requirements).

C.2.20 The contractor shall provide settled funds where the payment transaction date is less than 11 days prior to the settlement date (cards only). In the event that funds settlement is delayed beyond this period due to a reject condition, such as invalid entity, the payment must be re-initiated, and the new payment date submitted for posting.

C.2.21 The contractor shall retain transaction logs (i.e. card authorization logs) for 72 months from the date of each transaction. The information in such logs shall include transaction type, date and time, credit card number (if applicable), amount of transaction, and approval/ confirmation number. This requirement shall survive the life of this contract, and the government will have the right to inspect such logs at its discretion. Upon contract expiration or termination, the contractor shall submit to the government the transaction logs within three business days in an accessible, readable and usable Microsoft Excel format.

C.2.22 The contractor shall, in accordance with section C.7, complete any necessary modifications to software, systems, and services in accordance with its commercial business practices to conform to the provisions of Treasury Regulations 301-6311-2 (d)(1). The government will inform the contractor regarding any significant changes which shall have an impact on the current contract.

C.2.23 The contractor shall provide a merchant descriptor on the taxpayer’s card statement describing the tax payment amount as a unique line item entitled “U S Treasury Tax

Payment.”

C.2.24 The contractor shall provide a merchant descriptor on the taxpayer’s card statement describing the transaction fee amount as a unique line item and include the card authorization number.

C.2.25 The contractor shall conduct post implementation review of live application including production monitoring, reporting, user/non-user surveys and user free-form comments.

C.2.26 The contractor shall provide federal taxpayers 24-hour x 7 days a week access to electronic payment options and networks employed by the contractor at a rate equal to or exceeding 95% availability on any given calendar day. This includes the total number of customers successfully accessing the contractor’s electronic transaction network on the first attempt compared to the total number of attempts as well as overall availability.

C.2.27 The contractor shall ensure that certain edits and actions are performed to confirm the validity of taxpayer information and ensure that the federal tax payment will be applied accurately and as intended by taxpayers.

C.2.28 The contractor shall provide an acknowledgement or confirmation of payment acceptance to the taxpayer. In the event that other companies are subcontracted to participate in the program, the contractor shall minimize all fees or surcharges assessed (refer to section

C.7).

C.2.29 The contractor shall provide taxpayers with confirmation of payment transactions through the payment means used to complete the payment (refer to section

C.6.3). An integrated database shall be used whereby taxpayers may verify all payments through either payment application regardless of input channel.

C.2.30 The contractor shall provide taxpayers live and automated customer service including frequently asked questions and problem resolution assistance. The contractor shall provide clear, concise messaging and consistent treatment. Live customer service assistance shall be available, at a minimum, Monday through Friday, 7:00 am to 7:00 pm, local time.

C.2.31 The contractor shall exercise due diligence in notifying taxpayers of entity and payment rejections. Processes and procedures shall be documented and subject to IRS’s review and approval.

C.2.32 The contractor’s system shall have the capability to process, at any given day, the federal tax payment volume, at a minimum, 203K per day.

C.2.33 The contractor shall provide documentation to the government before the program commences of application test plans, test cases and test results, and certification(s). Refer to section C.7.

C.2.34 The contractor shall provide the Transaction Processing Networks Documentation employed in the program and the network’s interfaces according to National Institute of

Standards & Technology (NIST), to the government before the program commences.

Documentation requirements include the System Security Plan (SSP), Risk Assessment, Configuration Management Plan, Contingency Plan or Disaster Recovery Plan, Incident

Response Plan, Security Awareness Training & Education Plan, Information Security Policy

(ISP), and Acceptable Use Policy (AUP). Configuration control and management shall be exercised and documented as system and functionality changes occur (refer to section C.6.13).

C.2.34.1 The contractor shall ensure NIST approved tools are available to routinely monitor and manage network devices, servers, and workstations. In addition, the contractor shall have FIPS 140-2 compliant encryption tools to enable the contractor to securely transmit security-related or performance-related information to the IRS. A list of NIST approved tools may be obtained from the following web site:

http://nvd.nist.gov/scapproducts.cfm#scapproducts

C.2.34.2 The contractor shall provide a Capacity Plan, to, i.e., an assessment of the level of storage and transaction processing capabilities of the computer system/network. The contractor shall utilize documentation management and defect reporting tools to organize and control systems, applications and documentation changes and track problems from the point of awareness to resolution. The government or government representative will conduct on-site security reviews.

(refer to section C.6.9).

C.2.34.3 The contractor shall adhere to IRS policy and prepare their worksite host location(s) for the annual IRS onsite security reviews. The contractor is subject to a contractor security review to validate that security controls are in place. Security controls shall be implemented using guidance from the Special Publication (SP)

NIST 800-53, Recommended Security Controls for Federal Information Systems &

Organizations, rev 4 and any applicable IRMs. Refer to IRM 10.8 in section C.8.

C.2.35 The contractor shall provide initial and final functional requirements (refer to sections C.6 and C.7) and user interface documentation to the government, including but not limited to interactive voice response scripts and call flows, web pages, desktop software input, Funds Settlement Timeline detailing payment data flow from transaction authorization to settlement, and information screens, application design and architecture schematics describing (a) work processes, business rules, error conditions and data flow from payment initiation through completion and (b) customer service functions and outputs (reports, etc.) for review and approval before the program commences. Once the program commences, subsequent functionality and user interface changes (scripts, web screens, etc.) and the complete user experience including page flow, content, and design is subject to IRS review, revisions and approval.

C.2.36 The contractor shall provide incident reports of any material network outages, work stoppages, or other payment processing problems. This includes, but is not limited to, systemic problems related to authorizing credit on-line and human errors that result in duplicate payments or non-payment. Outages and stoppages in excess of one hour are considered to be material in nature during non-peak processing periods. The contractor shall also provide, if applicable, a monthly report of transaction requiring exception handling such as payments requiring annual correction due to the entry of an erroneous taxpayer identification number

(TIN/EIN) or tax year/tax period. The report shall be provided by the 5th day of each month to the COR.

C.2.37 All outages during peak processing are considered material. Peak processing periods http://nvd.nist.gov/scapproducts.cfm#scapproducts include the seven-day period ending on the 15th day of January, April, June, September and

October (or the next business day if the 15th falls on a weekend or holiday), including any outages outside of the peak periods. The contractor shall inform the COR of all incidents within 24 hours of occurrence or awareness and shall provide an incident report within 5 business days. Incident reports shall include a description of the incident, the cause, number of taxpayers impacted, and dollars involved, duration of the incident, and actions taken by the contractor to remedy the incident.

C.2.38 The contractor shall provide to the government a signed IRS CCBP agreement form.

The contractor shall provide an IRS Annual CCBP registration form, if applicable. Refer to section 5 in the CCBP requirements.

C.2.39 The contractor shall provide a Project Plan Work Breakdown Schedule (WBS) using

MS Project, MS Word or MS Excel (i.e., using current IRS version), covering the system development life cycle and update the Project Plan WBS after the Annual Review Kickoff meeting. (refer to C.6.8, C.6.22).

C.2.40 The contractor shall utilize and provide a separate test environment from production for system security and functional testing.

C.2.41 The contractor shall provide a primary and backup transaction processing system and complete necessary contingency planning to ensure that disaster recovery processes include actions to continue transaction processing in the event of unplanned events. Backup systems should be deployed within one hour after the primary system experiences an outage. At the contractor site, the contractor shall maintain a full inventory of the IT assets, including serial number so that any lost, stolen, or misplaced equipment may be easily detected referred to in section C.6.13).

C.2.41.1. The contractor is subject to a contractor security review to validate that security controls are in place. Security controls shall be implemented using guidance from the SP NIST 800-53, Recommended Security Controls for Federal Information

Systems & Organizations, rev 4 and any applicable IRMs. Refer to IRM 10.8 in section C.8.

C.2.42 The contractor shall comply with technical, procedural and security requirements and controls as defined by the IRS. The contractor shall meet the IRS requirements for system and data security requirements in the areas of: computer, communications, personnel, physical, procedural, and training. Refer to IRM 10.8 in section C.8.

C.2.43 The contractor shall provide necessary systems and data accesses to the government’s representative performing independent verification and validation (IV&V) reviews of system’s readiness, including, but not limited to, application functionality testing, and stress testing.

C.2.43.1 In addition the contractor is subject to a contractor security review to validate that security controls are in place. Security controls shall be implemented using guidance from the SP NIST 800-53, Recommended Security Controls for Federal

Information Systems & Organizations, rev 4 and any applicable IRMs. Refer to IRM

10.8 in section C.8.

C.2.44 The contractor shall implement systems controls that provide fraud detection and limit fraudulent payment transactions. The system shall have the capability to prevent transactions from certain cards or to certain accounts. The contractor shall incorporate best practices and industry standards. The contractor shall inform the COR of all incidents within

24 hours of occurrence or awareness and shall provide an incident report within 5 business days.

C.2.45 The contractor shall complete annual integrated readiness testing with IRS and TFA

(includes use of simulated payment data on test systems and production systems). The tests shall cover the contractor’s primary and back-up host sites and ensure readiness to accept transactions as well as forward settlement files from both sites. The contractor shall complete this testing by following the guidelines in the CCBP requirements. Refer also to C.7 for the due dates.

C.2.46 The contractor shall perform full cycle, live transaction processing (all applications) through the back-up site for a 24-hour period. This will be scheduled annually, coordinated with the TFA and completed prior to January 1st.

C.2.47 The contractor shall support the need for confidentiality, integrity, and availability of information relating to electronic payment transactions with absolutely no disclosure or use except to the extent authorized by written procedures in the Treasury Regulation 301-

6311-2.

C.2.48 The contractor and their employees who have or could potentially have access to taxpayer information are subject to the Taxpayer Browsing Protection Act of 1997 provisions, section 6103 provisions of the Act and IRS Unauthorized Access (UNAX) briefing requirements. In accordance with the Security Annual Training (SAT) program, all electronic contractor SAT completion certificates and UNAX forms for the initial on-boarding training

(10-day requirement) and annual training, and all questions pertaining to the SAT requirements, shall be emailed to the COR/CO or as specified by the COR/CO.

C.2.49 The contractor shall maintain the confidentiality of any information relating to federal electronic payment transactions completed in a single transaction. This includes absolutely no disclosure or use of information collected during this transaction for any purpose other than processing the transaction to the U.S. Treasury. Information collected during the transaction shall not be disclosed or used for any purpose prohibited by law and the Internal Revenue

Code. All federal tax information shall be segregated, logically and physically from any other work being handled or processed by the contractor.

C.2.50 The contractor shall be limited to up to 100 contractors to work on the contract throughout the life of the contract.

C.2.51 The contractor shall actively encourage and promote the use of electronic payment product(s). The contractor shall provide a Marketing Plan and deliverables that support and facilitate public awareness of IRS e-file and electronic payments during performance periods.

The contractor shall adhere to the Marketing Plan once it’s approved by the government. Refer to

C.6.26 and Chart C.7.0. Additionally, the contractor shall collaborative with the IRS to agree on the Marketing Plan and on measures for success.

C.2.52 Prior to the expiration (or termination), December 31st at 11:59 PM, the contractor all user interface methods (payment IVR, customer service IVR and Web) shall be updated to inform taxpayers that the payment services are no longer available and refer taxpayers to the IRS customer service number and web site for assistance. Refer to C.6.25 Shutdown.

C.2.53 The contractor shall provide weekly and monthly transaction reports. The reports shall include volumes and dollars for individuals and businesses according to card issuer, as well as, whether these payments were credit or debit transactions. The contractor shall provide this report in MS Excel (i.e., using current IRS version). Refer to section C.6.3.

C.2.54 The contractor shall adhere to a Quality Control Plan (QCP) for measuring and attaining quality of performance under this contract. A sustaining focus throughout the QCP shall be the attainment of continuous quality improvement and shall emphasize deficiency prevention over deficiency detection.

C.2.55 The contractor shall release the chargeback refund to the taxpayer once received from the IRS within 48 hours.

C.2.56 The contractor shall remediate all high security findings and all functionality findings annually by December 1st.

C.2.56.1 The contractor shall provide a Plan of Actions and Milestones (POA&M) to the COR/CO or as specified by the COR/CO to monitor remediations of security findings (low, medium, high) during the contract period of performance. Refer to

C.6.19 and C.7.0)

C.2.57 The contractor shall provide a payment card application to be available on IRS mobile devices only to be used by IRS authorized personal (e.g. Revenue Officer) during their field visit to individuals/business taxpayer.

C.2.58 The contractor shall provide at the end of each calendar year quarter a transaction report showing the debit and credit card convenience fees collected for tax payments. The contractor shall provide four transactions reports annually. The report shall include the number of debit card payments received and the quarterly debit card convenience fee amount collected.

The report will shall also include the number of credit card payments, the quarterly credit card convenience fee amount collected, and the average credit card convenience fee charged. The report shall be cumulative for each quarter and showing annual amounts. The transaction reports shall be delivered to the IRS on the 15th day of the month following the end of the calendar year quarter.

C.2.59 The contractor shall submit Findings and Marketing reports during the contract period of performance. The reports shall be provided to the COR/CO or as specified by the COR/CO.

Refer to C.6.7 and C.7.0.

C.3 QUALITY ASSURANCE SURVEILLANCE PLAN

C.3.1 In accordance with the FAR 37.604 and 46.401, the contract performance requirements will be evaluated to insure the services conform to the contract requirements;

the government will perform the inspection based on the Quality Assurance Surveillance

Plan (QASP) (see Section J.1, Attachment A). The government QASP should be used as one measurement factor in the contractor’s Quality Control Plan as defined in section C.2.54

C.3.2 It is anticipated that there will be 100% inspection for all Business Requirements.

The frequencies of inspections and Acceptable Quality Limits (AQL) are listed in the QASP;

however, the government may change the inspection frequency and AQL as required to maintain the level of quality assurance requirements. The contractor will receive a written notice from the CO and COR regarding any changes to the QASP requirements.

C.3.3 The COR will insure the contractor is informed regarding the results of all QASP inspections. Depending on the QASP inspection results, the COR may require a meeting with the contractor’s Program Manager to review the contractor’s Quality Control measures.

C.3.4 The contractor shall be responsible for the quality of products and services provided under the terms of this contract, to include those products and services provided by sub-contractors. The contractor shall re-perform work that does not meet contract requirements, unless it is of a nature that re-performance is not possible or otherwise directed by the COR/CO or as specified by the COR/CO. Re-performance of work shall not constitute an excusable cause to miss any timeliness standards (e.g., if a report is due the first business day of the month, then the report shall be submitted in final form no later than the first business day of the month). To ensure that the requirements of this Contract are met, the contractor shall implement an effective

QCP in accordance with FAR 52.212-4(a).

C.4 DUTIES AND RESPONSIBILITIES OF THE GOVERNMENT

The government’s duties and responsibilities during the term of this contract will be to:

C.4.1 Provide electronic record specifications necessary for funds settlement and posting of tax data related to the electronic payment transactions.

C.4.2 Provide functional requirements documentation annually, outlining validity checks and processing periods.

C.4.3 Designate Treasury Financial Agent(s) to act on the government’s behalf for settlement of funds in payment of taxes owed.

C.4.4 Provide outline of required reports and plan documents – Refer to outline in section C.6.

C.4.5 Provide no monetary consideration (zero-dollar contract) to the contractor for electronic payment transactions. The contractor will be paid through convenience fees charged to the taxpayer when they use the payment service.

C.4.6 Process credit card chargeback actions in accordance with the provided IRS

Chargeback Procedures. This shall include reimbursing the contractor for unauthorized or erroneous charges that are substantiated by the cardholder and approved by the contractor’s duly authorized management representative. The contractor shall have completed and delivered the appropriate IRS chargeback form and supporting documentation to the IRS as described in the procedures. Such chargeback requests shall be processed based on the contractor’s determination of the appropriateness of this action as signified by its authorized claimant’s signature. In the event, the IRS notifies the contractor of duplicate payments that may be subject to chargeback action, it is incumbent upon the contractor to research the nature of the duplicate payment and timely initiate the appropriate action.

Chargebacks have no effect on the zero-dollar contract as the chargeback reimbursement process has to do when the cardholder has established an erroneous or unauthorized charge, and not merely because the taxpayer has made an overpayment and is entitled to a refund.

Chargeback requests received within 150 days of the contract end date will be processed in accordance with the previously established procedures. Refer to IRM 21.4.4 referenced in C.6.4 and C.8 and IRM 21.4.4.7.2 for “Credit Card Chargebacks” and IRM 21.4.4.7.2.1 for “How is a

Chargeback Initiated?”

C.4.7 In accordance with FAR 42.1502 and 42.1503, the contractor’s performance will be evaluated and input into the Past Performance Information Retrieval System (PPIRS) using the Contractor Performance Assessment Reporting System (CPARS).

C.4.8 Provide a hyperlink from the IRS Web Site to the contractor’s Web Site. IRS may identify participating partners in its information materials or products. All decisions involving these or other marketing decisions will be solely at the discretion of the IRS.

C.4.9 The IRS may identify participating partners in its information materials or products.

C.4.10 The IRS Credit Card Program marketing approach will be addressed annually solely at the discretion of the IRS throughout the life of this contract.

C.5 KEY PERSONNEL

Key personnel are considered to be essential to the performance of the contract. The contractor’s Project Manager is designated as key and may only be replaced with the approval of the CO, in accordance with the terms and conditions of section C.5.2.

C.5.1 CONTRACTOR’S KEY PERSONNEL

The contractor shall provide a Project Manager, or designated representative, for this contract who shall have the authority to make any no-cost contract technical decisions, or special arrangement regarding this contract. The Project Manager shall be responsible for the overall management and coordination of this contract and shall act as the central point of contact with the government. The Project Manager, or designated representative, shall have full authority to act for the contractor in the performance of the required services.

The Project Manager, or a designated representative, shall meet with the COR to discuss problem areas as they occur. The Project Manager, or designated representative, shall respond within four hours after notification of the existence of a problem.

C.5.2 ALL PROPOSED SUBSTITUTES

The contractor shall notify the CO and COR, prior to making any changes to key personnel. No changes in key personnel will be made unless the contractor can demonstrate that the qualifications of prospective replacement personnel are equal to or better than qualifications of the key personnel being replaced. The contractor shall provide a detailed resume. All proposed substitutes shall have qualifications equal to or exceed the person being replaced. The CO shall be notified in writing of any proposed substitution at least 15 days or 30 days if a security clearance is obtained in advance of the proposed substitution.

C.6 DELIVERABLES

The contractor shall submit the following deliverables in accordance with sections C.2 and C.7. After contract award, the sections C.6 and C.7 requirement will be discussed during a contractor and government kickoff meeting.

Additional meetings may be held based on the government’s requirements; these meetings will be announced to the contractor prior to the meetings dates. The kickoff meeting formalizes the final content, format, delivery dates, inspection and process flow for C.6 and C.7 requirements prior to the Implementation of Electronic Payment Services for the filing season.

All deliverables shall be submitted electronically. Documentation formatting and contents are subject to inspection, verification and approval by the COR.

Table 6.1

Deliverables Summary

Deliverables Summary:

C.6.1 Electronic Payments (C.2.1, 2.22)

C.6.2 Monthly Development Status Reports (C.2.11)

C.6.3 Weekly and Monthly Transaction Reports (C.2.53)

C.6.4 Weekly Chargeback Reports (If Applicable C.6.4)

C.6.5 Exception Handling Reports (C.2.36)

C.6.6 Ad Hoc and Incident Reports (C.2.36)

C.6.7 Findings and Marketing Reports (C.2.59)

C.6.8 Project Plan WBS (C. 2.39)

C.6.9 Capacity Analysis (C.2.34.2)

C.6.10 System Security Plan (C.2.34)

C.6.11 Configuration Management Plan (C.2.34)

C.6.12 Risk Assessment Plan (C.2.34)

C.6.13 Contingency Plan or Disaster Recovery Plan (C.2.34)

C.6.14 Incident Response Plan (C.2.34)

C.6.15 Security Awareness Training & Education Plan (C.2.34, C.2.48)

C.6.16 Information Security Policy (C.2.34)

C.6.17 Acceptable Use Policy (C.2.34)

C.6.18 Network Design and Architecture Schematic (C.2.35)

C.6.19 Plan of Action and Milestones (POA&M) (C.2.56)

C.6.20 Process and Data Flow Schematic (C.2.35)

C.6.21 Funds Settlement Timeline (C.2.35)

C.6.22 System Development Life Cycle (C.2.39)

C.6.23 Test Plans, Test Cases and Test Results (including test data output reports)

(C.2.8, C. 2.33)

C.6.23.1 Section 508 Test Plan (see C.2.1)

C.6.24 Functional Requirements/User Interface Documentation (C.2.2, C.2.6, C.2.31, C.2.46, C.2.49)

C.6.25 Shut down Plan (C.2.52)

C.6.26 Marketing Plan (C.2.51)

C.6.1 ELECTRONIC PAYMENTS

The required data fields for each tax payment include (refer to the CCBP requirements document):

1 A nine-character Taxpayer Identification Number [first social security number (SSN) as shown on the tax return for the year for which the payment applies or the employer identification number (EIN)], 2 Four-character name control (provided to contractor in the entity validation response file, 824 transaction set), 3 Payment type, 4 Tax period ending date (six-character date field), 5 Payment amount, 6 Payment authorization date, 7 Daytime telephone number, and

8 Confirmation number.

C.6.2 MONTHLY DEVELOPMENT STATUS REPORTS

Upon the commencement of initial requirements meeting through the implementation date, the contractor shall provide monthly development reports by the 5th day of each month. The report shall be provided to the COR. The report shall contain the following information:

1 Date of report, 2 Project manager name, 3 Project manager telephone number, fax number and e-mail address, 4 A brief description of the work accomplished, emphasizing the progress made since the last reporting period, 5 A description of any unresolved and/or anticipated problems, if any (include schedule impacts), 6 An estimate of the percent of work accomplished to date, and

7 A statement on the status of the program as it relates to the WBS, either confirming that milestones are on schedule or explaining the nature and extent of the pending delay.

C.6.3 WEEKLY AND MONTHLY TRANSACTION REPORTS

The contractor shall provide weekly and cumulative monthly transaction reports. The reports shall cover the post-implementation progress of the program. Weekly reports shall include all required transactions and cumulative data from Sunday through Saturday. The reports shall be provided no later than 6:00 pm Eastern Time on the following Monday. Monthly reports shall be provided by the 5th day of each month and include all prior month transactions cumulative data and reconcile any adjustments made during that month. The contractor(s) shall submit all reports in Microsoft Excel format. After contract award the government will provide the contractor(s) with a template of the report format. The reports shall contain aggregate payment volumes by payment type and dollar amount broken down by the categories listed below.

Historical data shall also be provided (if applicable) to compare changes in volumes from the prior year. All reports shall be provided to the COR.

The report shall contain the following information:

1. Date of report,

2. Period covered,

3. Total volume and total dollar amount of transactions by:

- Web-PC, Web-Mobile/Tablet and IVR

- Point-of-Sale and Integrated File & Pay, if applicable

- IRS Form tax type

- Card Issuer for debit and credit card

- Mobile payments

4. Total number and total dollar amount of successful (authenticated) attempts,

5. Average payment amount,

6. Largest dollar payment amount,

7. Total number of failed (unauthenticated) attempts,

8. Reasons for failed (unauthenticated) attempts,

9. Total number of abandoned or incomplete transactions,

10. Customer service activity, and

11. Report of entity rejects, where the user has provided invalid entity information.

C.6.4 WEEKLY CREDIT CARD CHARGEBACK REPORTS (IF APPLICABLE)

The contractor shall provide weekly reports of all credit card chargeback actions identifying the transaction date, dollar amount, action request date, and reason for action. These actions shall be in conformance with chargeback procedures issued by the IRS and meet the definition of chargeback provided by the contractor and agreed to by the IRS. These reports shall be sent to the designated IRS point of contact (POC) and the COR by close of business each Friday.

Additionally, the contractor shall be responsible for monitoring for trends or patterns of suspicious activity and reporting this information to the COR. Refer to IRM 21.4.4.7.2 and

21.4.4.7.2.1 at IRS.gov and in C.10 in the contract.

C.6.5 EXCEPTION HANDLING REPORTS

The contractor shall provide a monthly report of transactions requiring exception handling such as payments requiring manual correction due to the entry of an erroneous taxpayer identification number (SSN/EIN) or tax year/tax period. The report shall be provided by the 5th day of each month to the COR.

C.6.6 AD HOC AND INCIDENT REPORTS

The contractor shall provide ad hoc reports as necessary. Ad hoc reports may include but are not limited to reporting information that supports or further defines incident reports where payment transactions are delayed or otherwise impacted. The contractor shall provide an incident report of any material network outages, work stoppages, or other payment processing problems as described in section C.2. The reports shall be provided to the COR.

C.6.7 FINDINGS AND MARKETING REPORTS

C.6.7.1 Findings Reports

The contractor shall provide an initial and supplemental findings report. A copy of this report shall be provided to the COR and the IRS Senior Manager or his/her designee. The Findings

Report shall describe:

a. The Credit Card Program features

b. Conduct and findings of the program as they relate to the contractor’s and any subcontractor’s performance (including a summary of all payment transactions, special features such as Spanish language, recurring payments and payment reminders, any problems, changes made during the filing season and lessons learned)

c. Recommendations for improvement including changes to the contractor’s and/or IRS processes

d. Practitioner and/or client feedback including customer satisfaction survey results

e. Customer service activity based on automated and live assistance provided

f. Summary of trends or patterns of suspicious activity

The initial report shall include activity occurring between January 1 and April 30 (each year).

The…