RFQ 83310120Q0057 QA document.pdf

RFQ 83310120Q0057 - - AMENDMENT 0001

Services for Comprehensive Review of Illicit Finance Risks

Question and Answer

26 August 2020

1. Question: Is there an incumbent contractor currently performing these services, or have similar services have been performed in the past, or is this a new requirement?

Answer: This is a new requirement.

2. Question: If this is a follow-on requirement, could you please provide the previous contract or task order number?

Answer: Similar services are not currently being provided

3. Question: Does this work require a Public Trust or a Secret Clearance?

Answer: Yes. The work requires a Public Trust clearance or the ability to obtain a Public Trust clearance.

4. Question: Is system access required to support this effort?

Answer: Yes

5. Question: Are offerors required to provide two pricing options to the option period?

Answer: No. Pricing is to be for all work needed to complete this review.

6. Question: The Past Performance Questionnaire was not included as an Attachment.

Answer: This document is attached with Amendment 1

7. Question: Under 2.0 “Background,” in the first paragraph, it references the bank’s “Customer Due Diligence (CDD) processes.” Does the bank already have existing CDD processes? If so, how voluminous and/or extensive are they?

Answer: Yes, EXIM has existing CDD processes including a screening process, for which EXIM currently uses World Check, and media searches in larger transactions. The current processes also include enhanced due diligence reviews for parties that meet the criteria for such reviews.

The written procedures for the screening processes comprise approximately 15 pages, covering the different review standards for the various EXIM programs. EXIM also has an Anti-Fraud Strategy which includes certain aspects of CDD. EXIM will provide the vendor has access to all documents describing EXIM’s current CDD process. The documents are not voluminous or extensive.

8. Question: Under 2.0 “Background,” in the first paragraph, it references the bank’s “compliance systems.” Does the bank already have existing compliance systems? If so, how voluminous and/or extensive are they?

Answer: EXIM has certain components of what might fit into a “compliance system”. This includes a screening process, as discussed above, procedures for enhanced due diligence, and suspension and debarment procedures. The written processes for these three components total approximately 35 pages. EXIM will provide the awardee access to all documents describing EXIM’s current CDD process. The documents are not voluminous or extensive.

9. Question: Under 2.0 “Background,” in the third paragraph, it references the bank’s “illicit finance compliance program.” Does the bank already have an existing compliance program? If so, how voluminous and/or extensive it is?

Answer: Please see answer to question No. 8 above.

10. Question: Under 2.0 “Background,” in the fourth full paragraph, it references a “comprehensive written report to the Board of Directors and Senior Management.” Does this refer to EXIM Bank’s Board and Senior Management? If so, who prepares the report; is it an annual report;

and how voluminous and/or extensive is it?

Answer: This refers to a one-time report to be written by the vendor, with the oversight and assistance of EXIM staff, as a key deliverable of the contract. “Board of Directors and Senior Management” does refer to the EXIM’s Board of Directors and Senior Management. Section 7.0 Specific Requirement/Tasks of the Performance Work Statement describes the information to be included in the report.

11. Question: Under 2.0 “Background,” in the last paragraph, it references the bank’s “illicit finance compliance program.” Does the bank already have an illicit finance program? If so, how voluminous and/or extensive is it? Also, is it different from the “illicit finance compliance program” referenced in Bullet 3 above?

Answer: Please see answer to questions No. 8 and 9 above.

12. Question: Under 3.0 “Scope,” it references the bank’s “risks relating to illicit finance.” Does the bank already have a list and analysis of its “risks relating to illicit finance”? If so, how voluminous and/or extensive are they?

Answer: No, the Bank does not currently have such a list and analysis.

13. Question: Under 3.0 “Scope,” it references the bank’s “risk assessment” and its “polic[ies] and procedures.” Does the bank already have a risk assessment and policies and procedures relating to illicit finance? If so, how voluminous and/or extensive are they? Also, are they different from the “risks relating to illicit finance” referenced in Bullet above?

Answer: Please see answers to questions 7, 8 and 12 above.

14. Question: Under 4.0 “Objectives (Nature of Work),” it references the bank’s “understanding of the illicit finance risks.” Does the bank already have a document setting forth its understanding of “illicit finance risks”? If so, how voluminous and/or extensive is it? Also, is it different from the “risks relating to illicit finance” referenced in Bullets above?

Answer: The only such document is as referenced in the answers to questions 7, 8 and 12 above.

15. Question: Under 5.0 “Applicable Directives,” it references the bank’s “policies and directives.”

Does the bank already have such “policies and directives”? If so, how voluminous and/or extensive are they? Also, are they different from the “policies and procedures” referenced in Bullet above?

Answer: EXIM’s policies and directives relevant to this matter are as set forth in the answers to questions 7, 8 and 12.

16. Question: Under 7.0 “Specific Requirements/Tasks,” in the introductory paragraph, it references the bank’s “illicit finance risks.” Does the bank already have a list and analysis of its “illicit finance risks”? If so, how voluminous and/or extensive are they? Also, are they different from the risks referenced in Bullets above?

Answer: Please see the answer to question 12, above.

17. Question: Under 7.0 “Specific Requirements/Tasks,” in numbered ¶ 2, the 2nd sub-bullet, it references the bank’s “risks associated with third-party partnerships.” Does the bank already have a list and analysis of its “risks associated with third-party partnerships”? If so, how voluminous and/or extensive are they? Also, are they different from the risks and the “policies and procedures” or “directives” referenced in Bullets above?

Answer: No, EXIM does not have such a list and analysis.

18. Question: Under 7.0 “Specific Requirements/Tasks,” in numbered ¶ 2, the 2nd sub-bullet, it references temporary measures under COVID-19. Does the bank already have any such temporary measures? If so, how voluminous and/or extensive is it?

Answer: Yes, EXIM has temporary measures under COVID-19. Please note that many of the COVID-19 measures are modifications to existing products rather than new financial products.

Please see: https://grow.exim.gov/blog/covid19_exim_is_open

19. Question: In Attachment IV, “Special Requirements,” under “Quality Control,” on p. 5, it says that the Contractor has to submit a “Quality Control Plan” and a “Management Approach.” How essential are these submissions at this point in time?

Answer: These are required elements for Quote to be considered Responsive.

20. Question: Is this Request For Quotation (“RFQ”) set aside for small business. The RFQ states that this is set-aside 100% for small business; however, the Contracting Officer has not incorporated ___ (14) (i) 52.219-6 Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644) or ___ (15)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003 (15 U.S.C. 644) in RFQ Attachment III at PDF p. 3.

Answer: FAR Clause 52.219-6 is now incorporated within RFQ Attachment III

21. Question: As an international law firm with ethical obligations, Contractor typically requests an advanced forward-looking waiver from prospective clients. Is the following waiver term acceptable for including in a contract, if awarded?

Contractor represents companies and individuals throughout the United States and internationally, who may have matters in conflict with the Client or one or more of its affiliates. Contractor is undertaking to represent the Client in this Matter on the basis of the Client’s agreement to the following consent and waiver:

https://grow.exim.gov/blog/covid19_exim_is_open

During this representation, or any future representations that are initiated without a new or amended engagement letter, Contractor will not be precluded from representing other clients (including, but not limited to, any current or future Contractor clients) who have legal, financial, business, or other interests directly or indirectly adverse to the Client or any related entities, in matters that are not substantially related to this representation (including representations in negotiations, regulatory matters, litigation, the providing of advice or opinions, alternative dispute resolution proceedings of various kinds, or other matters). By retaining Contractor for this representation, the Client agrees that it waives any claim of conflict of interest or breach of duty on the part of Contractor, and it will not seek to have Contractor disqualified as counsel to another client in the event of such adverse matters.

Answer: There may be a broad range of types of entities that provide quotes for this RFQ, and therefore EXIM cannot agree to specific conflicts of interest waiver language that is focused on a specific law firm, or even law firms generally. However, EXIM refers to the language below contained in the RFQ and in particular the language set forth in FAR Subpart 9.5. That Subpart, while retaining waiver discretion for the Government, expressly guides the Government waiver decision as follows: “The exercise of common sense, good judgment, and sound discretion is required in both the decision on whether a significant potential conflict exists and, if it does, the development of an appropriate means for resolving it.”

Organizational Conflict of Interest:

Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may effect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

22. Question: Could the paragraph set forth under The Hold Harmless and Indemnification Agreement provision on page 6 of the RFQ Attachment IV – Special Requirements be changed with alternative language set forth below:

Contractor will indemnify EXIM Bank from all losses, liabilities, damages, costs and expenses arising from third party claims, demands or actions (whether in law, equity or an alternative proceeding) that are finally determined, or agreed by EXIM Bank and Contractor, to be caused by: (i) any breach or violation of any professional obligations by Contractor in the course of providing services to EXIM Bank; (ii) any lien or security interest on or against property or realty of EXIM Bank that arises from any negligent action or inaction by Contractor in connection with providing services to EXIM Bank; (iii) any negligent, willful or reckless acts or omissions by Contractor, or failure to comply with Applicable Law by Contractor, in connection with performance of services on behalf of EXIM Bank; (iv) death, personal injury, bodily injury or property damage caused by Contractor in connection with performance of services on behalf of EXIM Bank; or (v) any infringement, violation or misappropriation of the Intellectual Property Rights of any third party by (a) Contractor, (b) any work product, materials or other deliverables provided by Contractor, or (c) EXIM Bank use of any such work product, materials or deliverables (“Indemnified Claims”). Contractor will cooperate with EXIM Bank in EXIM Bank’s defense of such a claim as reasonably requested.

This term does not expand Contractor’s liability for acts or omissions beyond that provided by applicable law, extend the statute of limitations otherwise applicable to professional liability claims, nor impair Contractor’s ability to assert defenses otherwise available in professional liability claims, such as contributory or comparative negligence.

Answer: No, the substitute language is not acceptable. However, please bear in mind that all disputes – including claims - related to or arising from the contract are subject to the Contracts Disputes Act and the disputes provisions contained or incorporated in the contract.

23. Questions: Must all work and efforts by the Contractor’s personnel be performed inside the United States? Could a team include a U.S. person with strong qualifications who is Association of Certified Anti-Money Laundering Specialists certified, but is resident in our Hong Kong office?

Answer: EXIM would prefer the work be preformed within the United States. EXIM would not be willing to accept the risk associated with a vendor working out of Hong Kong at this point in time.

24. Question: Should the assessment be based solely on U.S. federal law and regulations, as well as specified international standards set forth in section 7.0 of Attachment, including the Financial Action Task Force 40 Recommendations and Organization for Economic Cooperation and Development Export Working Group 2019 Anti-bribery Recommendation. Can EXIM also confirm that the assessment need not evaluate legal requirements of any specific U.S. state, any foreign, non-U.S. jurisdiction such as the European Union or the United Kingdom, or other international institutions, such as United Nations Security Council?

Answer: Yes, as to legal requirements, the assessment should be based solely on U.S. federal law and regulations as well as the international standards set forth in section 7.0. However, beyond legal requirements, we seek to have the customer due diligence practices meet a standard of “best practices” as well. To the extent that “best practices” may be based in or inspired by other foreign legal requirements or even U.S. state legal requirements, EXIM would welcome the information, but EXIM does not require an evaluation of foreign legal requirements or U.S. state requirements as part of the work.

25. Question: EXIM appears to be asking the Contractor for a policy/systems level assessment of the illicit finance compliance program. Please advise whether EXIM also is instructing the Contractor to conduct a transactional testing/verification assessment of such program, such as by selecting a random sample of transactions undertaken by different business, product, and/or service lines and determining whether EXIM’s personnel have followed the policies, procedures, and instructions of EXIM.

Answer: No, the Contractor will not be responsible for assessing whether EXIM’s personnel have, in fact, complied with EXIM’s policies, procedures and instructions. However, consistent with the Performance Work Statement, EXIM would expect that a proposal for a “best practices” compliance system would include proposed recommendations for remediation as well as recommendations, such as specific internal controls, that should be part of a holistic compliance program.

In the Background section of the Performance Work Statement, EXIM mentions the “Four Pillars” of compliance:

• A system of internal policies, procedures and controls;

• A designated compliance function with a compliance officer;

• An ongoing employee training program;

• An independent audit function to test the overall effectiveness of the AML program.

This Performance Work Statement is focused on helping EXIM design a program consistent with the first pillar (first bullet above). The PWS is not contemplating the work associated with the fourth pillar (forth bullet above). EXIM anticipates that phase of work taking place in the future.

26. Question: Although Attachment II, Page 2, and Attachment IV, Pages 5-6, state that the Contractor is expected to perform work on its own premises due to the COVID-19 pandemic, does EXIM anticipate that the Contractor will need to travel to any worksites in Washington DC or other locations in order to complete the project in observance of any health and safety protocols?

Answer: No, EXIM does not anticipate that the Contractor will need to travel to any specific locations in order to complete the project. However, the Contractor, as part of the security clearance, will need to be fingerprinted by acceptable official offices, which may entail travelling to those offices in the Contractor’s state or to Washington, D.C., if local facilities are closed.

EXIM will not pay for travel expenses associated with traveling to the acceptable official office for fingerprinting.

27. Question: Does EXIM anticipate that the Contractor will need security clearances (other than the background check described in Attachment IV, Pages 10-12 and/or require access to any U.S.

government national security-classified information above the level of Sensitive-but-Unclassified (SBU) information?

Answer: No, EXIM does not anticipate that the Contractor will require security clearances other than as specified.

28. Question: Does EXIM anticipate that the Contractor will conduct fact gathering or other outreach on behalf of EXIM with relevant U.S. regulatory agencies or other agencies in the U.S.

national security community?

Answer: No, EXIM does not anticipate that the Contractor will conduct fact gathering or other outreach on behalf of EXIM with relevant U.S. regulatory or other agencies in the U.S. national security community.

29. Question: Can the contractor assume that EXIM desires to voluntarily follow the Customer Due Diligence Rule promulgated by the Financial Crimes Enforcement Network, U.S. Department of the Treasury, to verify the beneficial owners of legal entity customers for new account holders, even if the Client may not be legally considered a “covered” U.S. financial institution under that Rule?

Answer: No, the Contractor cannot make such an assumption. However, the Contractor will be expected to assess the risks to EXIM given its products and location of business and then make recommendations to EXIM considering EXIM’s risks. It is at the discretion of the Contractor whether it recommends EXIM’s voluntary compliance with FinCEN’s Customer Due Diligence rule.

30. Question: It is noted that the review is “focused on re-designing and upgrading EXIM’s customer due diligence and compliance systems.” (RFQ Att. 3) RFQ Att. 3 also refers to a goal to ensure “EXIM…has an adequate illicit finance compliance program.” To what extent is the review limited to the Customer Due Diligence processes, or is it contemplated to examine Customer’s overall compliance programs addressing illicit finance risks (that is, beyond Customer Due Diligence)?

Answer: The review is not limited to the Customer Due Diligence processes themselves and it is expected that the Contractor will review EXIM’s overall compliance programs addressing illicit finance risks.

31. Question: Is the scope of “fraud” included in the RFQ already defined by EXIM, or whether a particular standard is intended. For example, international financial institutions (“IFIs”) generally define “fraud” as any act or omission including any misrepresentation that knowingly or recklessly misleads or attempts to mislead a party to obtain a financial or other benefit or to avoid an obligation.

Answer: EXIM’s Anti-Fraud Strategy sets forth definitions of “fraud” and “fraud risk”:.

• Fraud: is a deliberate act (or failure to act) with the intention of obtaining an unauthorized benefit, either for oneself or for somebody else, by using deception or false suggestions or suppression of truth or other unethical means, which are believed and relied upon by others. Depriving another person or the Bank of a benefit to which they are entitled, by using any of the means described above, also constitutes fraud. Examples of fraudulent acts include, but are not limited to, the following:

i. Embezzlement;

ii. Forgery or alteration of documents;

iii. Unauthorized alteration or manipulation of computer files; and

iv. Falsification of financial documents.

• Fraud Risk: is the vulnerability that an organization faces from individuals capable of combining all three elements of the fraud triangle (pressure, opportunity and rationalization). The measure of a specific fraud risk is the product of the likelihood that a specific fraud event will occur, and the impact such an event will have on the Bank.

After contract award, the awardee will be provided with a copy of EXIM’s Anti-Fraud Strategy.

32. Question: Does EXIM intend for the Contractor to examine concepts related to fraud, such as “collusion” or “coercion,” which frequently are included within the scope of sanctionable practices by IFI compliance standards?

Answer: To the extent that examining such fraud-related concepts as “collusion” or “coercion” is necessary to assess EXIM’s current Customer Due Diligence practices and design “best-practices” CDD and Compliance system, then EXIM would expect the Contractor to do so.

33. Question: Will the scope of the project include assessing the extent to which EXIM’s existing compliance program and functions (including its Office of Inspector General) include a reporting, investigations, and sanctions function to address the full scope of illicit finance activities. This is not specifically listed within the four pillars, but potentially could be included as part of a comprehensive review and analysis of EXIM’s current policies, procedures, and processes with regard to illicit finance risks under Article II, Section 7.3.

Answer: The Contractor will not be expected to assess any practices within the Office of the Inspector General. However, the Contractor will be provided with descriptions of process of reporting suspicious activity to the Office of the Inspector General, and the general investigative function of that Office.

34. Question: Attachment V of the RFQ refers to a “past performance questionnaire” that was attached. Can you provide a copy of that attachment or where it can be found as we didn’t see it attached?

Answer: See #6

35. Question: For descriptions of past performance experience, when information is included about the “value” of the example, is EXIM looking for information about the “value” of the contractor for that work such as how much Contractor was paid?

Answer: EXIM is looking to understand whether Performance would meet contractual requirements to the Government’s benefit. The amount of monetary compensation earned by the vendor in past performance may be indicative of the complexity of the former assignment.

EXIM reviews all aspects of the past performance submission to determine whether, in the opinion of the Contracting Officer, the past performance reference is relevant to the work to be undertaken in the PWS.