Addendum 1 Questions and Answers Final.pdf

Ron DeSantis GOVERNOR

J. Alex Kelly SECRETARY

Caldwell Building | 107 E. Madison Street Tallahassee, FL 32399

850.245.7105 | www.FloridaJobs.org | Twitter: @FLACommerce

An equal opportunity employer/program. Auxiliary aids and service are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TTD equipment via the Florida

Relay Service at 711.

FLORIDA DEPARTMENT OF COMMERCE

ADDENDUM NO. 1

SOLICITATION TYPE: Request for Proposal (RFP)

SOLICITATION NUMBER: 25-RFP-004-VW

SOLICITATION TITLE: Identity Management Software

RESPONSE OPENING DATE: 10/7/2025 @ 3:00 PM

ADDENDUM NUMBER: 1

ADDENDUM PURPOSE: Questions and Answers

ADDENDUM DATE: 9/23/2025

The Department hereby amends RFP No. 25-RFP-004-VW as noted within this Addendum. For revisions, underlines represent additions and strikethroughs represent deletions. In the event of a conflict between previously released information and the information contained herein, the information herein shall control. The information in this addendum is hereby made part of this solicitation. All other terms and conditions of the RFP remain in effect.

FAILURE TO FILE A PROTEST WITHIN THE TIME PRESCRIBED IN SECTION 120.57(3), FLORIDA

STATUTES, OR FAILURE TO POST THE BOND OR OTHER SECURITY REQUIRED BY LAW

WITHIN THE TIME ALLOWED FOR FILING A BOND SHALL CONSTITUTE A WAIVER OF

PROCEEDINGS UNDER CHAPTER 120, FLORIDA STATUTES.

Any protest concerning this agency decision or intended decision must be timely filed with the Agency Clerk. Protests may be filed by courier, hand delivery, or U.S. mail at: Agency Clerk, Florida Department of Commerce, Office of the General Counsel, 107 East Madison Street, MSC 110, Caldwell Building, Tallahassee, Florida 32399-4128. Protests may also be filed by fax at (850) 921-3230, or by email at agency.clerk@commerce.fl.gov within the time prescribed in section 120.57(3), Florida Statutes, and Chapter 28-110, Florida Administrative Code (“F.A.C.”). It is the filing party’s responsibility to meet all filing deadlines. The Procurement Officer should be listed and copied in such filings.

The enclosed information has been provided for consideration in the preparation of your response to the above-mentioned solicitation.

This Addendum also includes the following:

Change No. 1: The instructions in Section B.39.1 are hereby amended. Respondents are not required to obtain and submit completed Reference Questionnaires (Attachment H). Instead, respondents must provide accurate contact information for their references in Attachment A. The Department will contact the references directly to conduct interviews and complete the evaluation of past performance.

http://www.floridajobs.org/ http://www.twitter/ mailto:agency.clerk@commerce.fl.gov

9/23/2025

Question Number

RFP Page Number, Section Number, Subsection Reference

Question

Answers

1.

C.3 In C.3, please provide details in regards to "the most current KYC/ AML compliance guidelines" to be met. Are these defined within federal regulations (e.g.

Bank Secrecy Act) or specific Florida statutes (e.g.

Florida Statutes 655, 896)?

The solution must comply with the most current Know Your

Customer (KYC) and Anti-Money

Laundering (AML) guidelines as defined by federal regulations, including the Bank Secrecy Act and the USA PATRIOT Act, as well as relevant Florida Statutes such as Chapters 655 and 896.

C.2 In C.2, is the solution intended to prevent fraud by updating an existing user profile with a risk score, or by limiting user registration and authentication into applications and systems?

Or is it intended to analyze and prevent fraud on a per-transaction basis?

Analyze and prevent fraud on a per transaction basis

C.3 In C.3, Deliverable 1 – Can you please provide more details about the Salesforce

Grants Management System and ID+ API Solution to be integrated with the proposed vendor solution.

The ID+ API Solution will need to be able to perform a review of applicants when they apply for programs through Salesforce

Are services that the RFP requests part of an existing/current project for Commerce, or would they be new for Commerce? If it’s an existing/current project, what vendor provides these services today?

These services will augment and expand our existing fraud prevention capabilities. The Department currently utilizes some services from Socure. This RFP seeks a comprehensive identity management solution that may replace or integrate with existing services to provide the best value to the state.

P. 43, Attachment B, Cost Proposal

For pricing and scoping purposes, what volume of transactions should Respondents anticipate in each year of operations of this project?

Based on historical data from Fiscal Year 2024-2025, the Department received between 14,000 and 15,000 applications.

While future volumes may vary, respondents should use this historical data as a baseline for pricing and scoping their proposals.

P. 28, Section C Scope of Work, Subsections C.2 and C.3

Section C.2 refers to interfacing with the Salesforce platform and mentions a specific Vendor’s fraud detection products.

Deliverable 1 in Section C.3 also refers to solution integration. Please address each of the following:

1. Is this solicitation requesting that the Successful Contractor perform integration services to implement specific products in C.2, or provide access to an identity-verification solution delivering services that those products describe, or both?

2. Has Commerce already procured the scoring and risk-defense products listed in C.2?

1. The successful Contractor will be required to provide a comprehensive identity verification and fraud prevention solution, which includes performing the necessary integration services with our Salesforce platform. 2. The Department has not separately procured all the specific scoring and risk-defense products listed in C.2; we are seeking a solution that incorporates these, or equivalent, functionalities.

Pp. 20-21, Section B Special Instructions …, Subsections B.39 and B.39.1

In Section B.39, the 5th paragraph on page 20 says Commerce will contact the Respondent’s references in order to complete the Attachment H evaluation of past performance. This is consistent with the attachment’s format, which

Please refer to B.39.1, Reference Questionnaire (Attachment H).

includes lines for: “Person Interviewed,” “Interviewed By,” and “Date of Interview.”

However, Section B.39.1 instructs Respondents to obtain three competed, sealed versions of the questionnaires.

Please clarify whether Respondents should follow B.39.1 instructions, or whether Commerce intends to contact clients and conduct the interviews. In the interest of time, we will begin asking clients to complete the questionnaire. To avoid confusion, we will pre-populate the form with “N/A” in the “Interviewed By” line and ask clients to write their names in the “Person Interviewed” line.

But if Commerce wishes to issue a different form for clients to complete pursuant to B.39.1, please provide additional ample time after posting an addendum with a revised version of Attachment H.

P. 20, Section B Special Instructions …, Subsection B.39; and

p. 42, Attachment A Reference Form

Both Attachment A and Section B.39 instruct Respondents not to include confidential clients.

We wish to keep confidential the information about our specific customers because:

clients prefer their names, emails, and phone numbers not be made public; and disclosure could cause competitive harm.

Please reconsider the prohibition on client confidentiality.

We cannot reconsider this prohibition.

P. 10, Section B Special Instructions …, Subsection B.18

The RFP instructs Respondents to provide a separate Redacted Copy of a proposal that includes confidential information. Section B.18 requires further that all confidential content “be set forth on a page or pages separate from the rest of the proposal.” This separation requirement could create a cumbersome review process for Commerce, particularly if portions of sentences/paragraphs are confidential. In this example, a sentence/paragraph would appear incomplete. Commerce would need to refer to segregated information to finish reading the sentence/paragraph. Rather than separating confidential information, would it suffice to redact information where it normally appears in the Redacted Copy? If additional separation remains a requirement, please specify the appropriate Technical Proposal tab in which to include confidential information.

This will suffice and a redacted copy is required.

P. 9, Section B Special Instructions …, Subsection B.15(2)

In the Mandatory Requirements for Evaluation, item 2 on page 9 requires the Redacted Copy of the Technical Proposal on USB drive only. However, Section B.18 on page 11 requires a Redacted Copy “in hard copy and on an USB.” Please clarify whether a hard copy of the Redacted Copy is required.

A hard copy of the Redacted Copy of the Technical Proposal is required, as stated in Section B.18. The instructions in Section B.15, item 2, page 9, are clarified to align with this requirement.

P. 9, Section B Special Instructions …, Subsection B.15(2)

May we provide both redacted and non-redacted versions of the Technical Proposal on the same USB drive? Or should we provide two USB drives: one with the redacted version, and another with the non-redacted version?

Please provide two separate USB drives: one containing the complete, non-redacted Technical Proposal, and a second containing the redacted version.

P. 10, Section B Special Instructions …, Subsection B.15(3);

and p. 16, Section B.36

In the Mandatory Requirements for Evaluation, item 3 on page 10 requires for the Cost Proposal: one original hard copy plus two additional paper copies.

However, Section B.36 on page 16 requires one original hard copy plus one additional paper copy.

Please clarify the correct number of additional paper copies.

Please submit one (1) original and five (5) paper copies of the Cost Proposal, as specified in Attachment L, the Proposal Package Checklist. This clarification supersedes the conflicting requirements in Section B.15(3) and Section B.36.

P. 13, Section B Special Instructions …, Subsection B.23

Section B.23 says about the Vendor Core Contract:

“Commerce may consider any modifications proposed by the Respondent if it is determined to be in the best interest of Commerce.”

Should these proposed modifications be inserted in the Technical Proposal or the Cost Proposal? If the Technical Proposal, in which tab?

Proposed modifications to the Vendor Core Contract should be included in theTechnical Proposal. Please include these in a separate, clearly marked subsection within Tab 3 - Technical Approach.

P. 25, Section B Special Instructions …, Subsection B.45

Section B.45 says Commerce “objects to and shall not consider any additional terms and conditions submitted by a Respondent.” However, we are providing services that include access to sensitive government-regulated data.

There are legal and security matters concerning: our company, our third-party data suppliers to whom we are contractually bound

The Department understands the need to address terms and conditions related to sensitive data. Any proposed additional terms and conditions should be included in the Technical Proposal, within Tab 3 - Technical Approach, as proposed modifications to the Vendor Core Contract. These proposed terms will be reviewed by the Department's legal counsel and may be a subject of negotiations with the successful through licensing agreements, and our data containing sensitive personal identifiable information (PII) about millions of consumers/citizens whom we must protect. These require additional terms and conditions in the final Contract. These circumstances are not unique to us—any vendor providing access to PII will have similar obligations and concerns. Therefore, we would require the opportunity offer additional terms for your review and approval for the final agreement. We could provide these terms in our Technical Proposal or Cost Proposal, or later during a negotiation period after the proposal due date.

Please identify which option Commerce prefers.

vendor.

P. 17, Section B Special Instructions …, Subsection B.38.1

Section B.38.1 restricts Technical Proposals to 75 pages, excluding Attachments, which we assume are the 10 attachments listed on page

9. Is Commerce willing to allow anything else to be excluded from the page count? We suggest the following: Respondent’s standard proposal cover page and cover letter, resumes of key personnel, proposed modifications to the Vendor Core Contract, segregated confidential information (if applicable), and the Respondent’s standard contract terms and conditions (if applicable).

We will not allow anything else to be excluded from the page count.

Page 28/56, Section C Scope of Work, C.2 Background/Overview

Outside of those listed, are there other fraud prevention and fraud investigation tools that the Florida Department of Commerce is interested in, such as Presentation Attack Detection (PAD) or Enhanced Fraud Investigation Dashboards?

We are open to other tools.

Page 28/56, Section C Scope of Work, C.2 Background/Overview

Does the Florida Department of Commerce’s required solution need to meet any of the NIST 800-63-4, Digital Identity Guidelines, assurance levels (IAL, AAL, or FAL)?

While compliance with NIST 800-63-4 is not a mandatory requirement of this RFP, solutions that align with these guidelines are encouraged and may be viewed favorably during the evaluation. Respondents should describe their solution's alignment with these or other relevant industry standards in their Technical Proposal.

Page 16/56, Section B Special Instructions for the Preparation and Submission of Proposals, B.36 Submittal Requirements

Would the Florida Department of Commerce accept a flat-rate quote for unlimited fraud prevention, identity verification, and fraud investigation tools?

Yes

Page 28/56, Section C Scope of Work, C.2 Background/Overview

Email RiskScore, Address RiskScore, Phone RiskScore, Device RiskScore, Alert List, and Global Watchlist Screening and Monitoring are products offered by Socure. Is the Florida Department of Commerce open to RFP submissions from other identity verification and fraud prevention vendors that offer the same services as Socure, or is the Florida Department of Commerce only considering Socure’s products for this RFP?

We are open to all RFP submissions for identity verification and fraud prevention vendors.

Attachment B – Cost Proposal

Do you want separate pricing lines for IDV, KYC screening, ongoing monitoring, KYB/UBO, and manual review?

Yes

Page 23/56, Section B Special Instructions for the Preparation and Submission of Proposals, B.42 Evaluation Criteria

As part of the evaluation process, is the Florida Department of Commerce open to a Vendor Product “Bakeoff” or performance evaluation between all vendors that respond to this

RFP?

Note: It is a best practice in the private sector to conduct a “bakeoff” where the organization sends the same data sets to all responding fraud prevention companies and allows the companies to prove their products effectiveness in a head-to-head competition.

The Department may, at its discretion, invite a shortlist of the highest-ranked respondents to participate in a 'bakeoff' or proof-of-concept demonstration as part of the evaluation process.

Further details would be provided to the shortlisted vendors if the Department chooses to exercise this option.

C.3 Deliverables Which statutes or regulations should we align to beyond “current KYC/AML guidelines” (e.g., OFAC, FinCEN CDD, state rules)?

In addition to general KYC/AML guidelines, the solution should align with the requirements of the Bank Secrecy Act, the USA PATRIOT Act, OFAC regulations, and Florida Statutes Chapters 655 and 896, as applicable.

C.2 Background/Overview

Which lists are in scope (OFAC SDN/SSI, BIS, State Dept., UN, EU, state lists)?

Do you also require PEP and adverse media screening?

At a minimum, the solution must screen against the OFAC SDN/SSI lists. Please describe in your proposal any other relevant watchlists (e.g., BIS, State Dept., UN, EU, state lists) that your solution screens against. While Politically Exposed Person (PEP) and adverse media screening are not mandatory requirements, solutions that offer these capabilities may be viewed favorably.

C.3; C.5.13 Decision Model Standard

Do you want strict, fuzzy, or tiered name-matching thresholds? How should we handle aliases and transliterations?

The Department does not have a preference for a specific matching methodology (e.g., strict, fuzzy, tiered).

Respondents should describe their solution's approach to name matching, including the handling of aliases and transliterations, and explain how their methodology maximizes accuracy while minimizing false positives.

C.1–C.2 Should screening include business entities (KYB) and UBOs? If yes, what ownership thresholds and document proofs are required?

No

C.5.13 Decision Model Standard

Do you want policy controls per program so different grant types can have different risk tolerances?

Yes

C.5.13 Decision Model Standard

Do you want fully automated decisioning, or a mix of automated and manual with review for mixed signals?

Mixed

C.2 Do you want document verification on already-collected IDs (from your current UX)?

No

C.5.12–C.5.14 Are you open to a vendor front-end collection (SDK/embed/hosted link) to improve doc verification and fraud signal capture?

Yes, we would prefer it.

C.2 Products; C.3 Deliverable 1 (Integrate

ID+ API); C.5.14

If all listed outputs (Synthetic Fraud, Identity Fraud, Email/Phone/Device/Address RiskScores, Alert List, Global Watchlist, Doc Verification) are exposed via vendor-agnostic API/SDK with granular fields, is that sufficient? Or should the proposal detail Salesforce-specific integration for each?

It should be a detail Salesforce-specific integration for each of the listed outputs.

C.2; C.3 (Integrate ID+

API)

Where in the existing flow should identity verification/fraud analysis be integrated (e.g., part of signup vs. parallel verification on collected data)?

Front end of an application.

If you want to use information already being collected, what information is currently collected?

Business Owner names/addresses/SSN’s/email addresses and phone numbers.

C.5.14; C.5.12; C.3 For Salesforce Grants Management integration, what specific integration pattern is desired (vendor dashboard vs. results in Salesforce UI)? Any other integration capabilities envisioned?

We prefer a seamless integration where the results of the identity verification and fraud analysis are displayed directly within the Salesforce User Interface (UI), rather than requiring users to access a separate vendor dashboard.

C.5.12; C.5.14 For linking existing systems, will your technical team do most integration? Would full API/SDK/doc/training/SE support suffice?

Yes, our technical team would do the integration. Yes, that would suffice.

Any special flows for minors, unhoused applicants, or applicants without government ID?

No

C.2 Which document types are acceptable (DL/ID, passport, EAD, etc.) and do you require selfie + liveness (active vs. passive)?

Driver's licenses and state-issued ID cards are the primary acceptable documents. Please describe your solution's ability to accept other document types (e.g., passports). While selfie and liveness detection are not mandatory requirements, solutions that offer these capabilities may be viewed favorably.

C.5.12 Annual Subscription; C.3

What SLA do you expect for re-screening after list updates or profile changes?

No requirements at this time.

C.2 Is watchlist screening one-time at onboarding, ongoing (daily/weekly), or event-driven (e.g., before each disbursement)?

Event driven.

P. 18, Section B Special Instructions …, Subsection B.38.1, Tab

Commerce requests the identification of key personnel in Tab 1 of the Technical Proposal. Are there specific types/titles of key personnel that Commerce desires?

No

P. 18, Section B Special Instructions …, Subsection B.38.1, Tab

Commerce requests an “advanced AI-driven identity verification system” in Tab 2.

However, the solicitation does not speak to AI capabilities that Commerce desires. Could Commerce please expand on AI functionality that is both desired and acceptable in the State?

The Department is seeking an AI-driven solution that can provide real-time analysis of applicant data to detect anomalies and patterns indicative of fraud. This could include, but is not limited to, synthetic identity detection, device reputation analysis, and behavioral analytics.

Respondents should describe the AI/machine learning models their solution utilizes and how they contribute to fraud prevention.

P. 51, Attachment I, Evaluation Criteria

Will Commerce allow Respondents to conduct product demonstrations for members of the Evaluation Team?

The Department may, at its discretion, invite a shortlist of the highest-ranked respondents to conduct product demonstrations for the Evaluation Team as part of the evaluation process.

P. 28, Section C Scope of Work, Subsection C.2

Section C.2 refers to fraud detection products. Does Commerce have preferred third-party data sources to include in the solution?

No

Who are the key stakeholders involved in this project, and what are their roles in the decision-making process?

The project stakeholders include representatives from the Department's program offices, information technology division, and procurement office. The decision-making process is led by an evaluation committee composed of five members who will review and score the proposals in accordance with the criteria outlined in the RFP.

Is this RFP for a replacement of any current solutions, if so, what existing systems, tools, or products are currently in place that we are replacing? Any pain points or gaps?

This RFP is intended to procure a comprehensive identity management and fraud prevention solution that will augment and may potentially replace some of our existing tools. As mentioned in our response to Question 4, the

Department currently uses some services from Socure. A key goal of this procurement is to obtain a more integrated and robust solution.

Are there any specific products that FL Dept of Commerce has been looking at or researching to achieve their goals for identity verification, fraud prevention, anti-money laundering compliance, etc? Please list them

No specific products.

Does FL Dept of Commerce have a requirement or preference when it comes to using local US resources, or offshore resources for providing the desired services?

Local US resources are preferred.

What are the preferred integration methods with existing state infrastructure, such as APIs, cloud platforms (e.g., AWS, Azure), or on-premises systems?

This RFP is intended to procure a comprehensive identity management and fraud prevention solution that will augment and may potentially replace some of our existing tools. As mentioned in our response to Question 4, the Department currently uses some services from Socure. A key goal of this procurement is to obtain a more integrated and robust solution.

Can FL Dept of Commerce provide some important use cases and scenarios regarding the solutions requested in this RFP?

A primary use case is as follows:

1. An individual applies for a grant program through our public-facing Salesforce portal.

2. As part of the application process, the applicant's identifying information is sent via API to the vendor's solution for real-time identity verification and fraud risk assessment. 3. The solution returns a risk score and detailed verification results to

Salesforce. 4. Based on pre-defined rules, the application is either automatically approved for further processing, flagged for manual review, or rejected.

Is FL Dept of Commerce also seeking managed services as part of this proposal, or just deployment and integration?

Yes, we are seeking a fully managed Software-as-a-Service (SaaS) solution. The vendor will be responsible for the deployment, maintenance, and ongoing management of the service.

Verification Types: What types of identity verification are required (e.g., document verification, biometric authentication, knowledge-based authentication, or multi-factor authentication)?

At a minimum, the solution should provide knowledge-based and multi-factor authentication.

Respondents should detail any other verification methods their solution supports, such as document verification and biometric authentication, as these may be considered advantageous.

Document Types: Which identity documents need to be verified (e.g., passports, driver’s licenses, national IDs), and are there specific formats or regional variations to consider?

The primary identity documents to be verified are state-issued driver's licenses and identification cards from all US states and territories. Solutions that can also verify other document types, such as US passports, are preferred.

Number and list of applications to be integrated.

Any high priority/high value applications that need additional focus.

The solution will initially be integrated with at least two of our major grant programs. The solution should be scalable to accommodate additional programs in the future.

What is the technical environment for these applications? (e.g., tech stack, single-page application frameworks, mobile OS versions).

Our grant application portals are built on the Salesforce platform.

The front-end is a standard web application accessible through all modern web browsers. The integration will be via a RESTful API as previously noted.

Can you provide more details on the specific types of financial fraud (e.g., grant misuse, business loan scams, or cyber fraud) that the department encounters most frequently?

A primary concern for the programs in scope of this RFP is fraud related to applications for business grants and loans, including the use of synthetic or stolen identities to create fictitious businesses.

What are your primary fraud concerns?

Please elaborate (e.g., account takeover, new account fraud, bot attacks, financial malware, social engineering).

Identity fraud and bot attacks.

What are the key performance indicators (KPIs) or success metrics the department will use to evaluate the effectiveness of the proposed solutions in reducing fraud incidents and improving AML compliance?

A combination of KPI’s not limited to charge back rate and false positive rate.

How does the RFP envision the integration of AI-driven technologies for real-time fraud detection and identity verification, particularly in high-volume scenarios like business registrations or grant applications?

The RFP envisions a seamless, real-time integration where AI-driven technologies are used to analyze application data at the point of submission. The solution should be able to handle high volumes of applications and provide an immediate risk assessment.

What level of automation is desired for AML processes, such as suspicious activity reporting (SARs) or enhanced due diligence for politically exposed persons (PEPs)?

The solution should automate the process of screening applicants against required watchlists and provide a robust alert management system. The solution should provide all the necessary information to support manual SAR filing if necessary.

What percentage of your login or transaction activity is currently flagged as fraudulent?

The Department does not have precise data on the percentage of fraudulent transaction activity at this time. A key goal of implementing this solution is to gain better visibility into this metric.

Current Challenges: What specific fraud challenges or incidents has your organization faced, and how are they currently managed?

Identity fraud, applications will be rejected.

Risk Tolerance: What is your organization’s risk tolerance level, and how do you balance fraud prevention with user convenience?

Conservative

Data Sources: Are there specific data sources (e.g., device fingerprinting, behavioral analytics, third-party data) you prefer for fraud detection?

The Department does not have a preference for specific data sources. Respondents should describe the full range of data sources their solution utilizes for fraud detection and explain how these data sources contribute to the effectiveness of their solution.

Integration Needs: Do you require integration with existing fraud detection tools or systems, and if so, which ones?

The primary integration point will be with our Salesforce platform.

The selected solution should be comprehensive and is not required to integrate with other existing fraud detection tools.

Do you have any specific pain points with the user experience? (too many alerts to manage, too many authentication challenges, slow performance)

No

How will you consume data and risk scores? (e.g., real-time API calls, dashboard analysis, report generation).

The primary method for consuming data and risk scores will be through real-time API calls from our Salesforce platform. We also require a user-friendly dashboard for manual review of flagged applications and the ability to generate reports.

Regulatory Requirements:

Which AML regulations or standards must the solution comply with (e.g., FATF, FinCEN, EU AMLD, KYC/CDD)?

The solution must comply with United States anti-money laundering (AML) regulations, including the Bank Secrecy Act and the USA PATRIOT Act, as well as Know Your Customer (KYC) guidelines from FinCEN.

Screening Needs: What types of AML screening are required (e.g., sanctions lists, politically exposed persons (PEPs), adverse media)?

Sanctions lists, watchlist and transaction monitoring.

Transaction Monitoring: Do you need real-time transaction monitoring, and if so, what are the expected transaction volumes and types (e.g., fiat, crypto)?

Yes, we require real-time monitoring of grant application transactions. As stated previously, we anticipate a volume of approximately 14,000- 15,000 applications per year.

The transactions are all fiat currency (USD); we do not handle cryptocurrency.

Reporting: What are your requirements for generating and submitting regulatory reports, such as Suspicious Activity Reports (SARs)?

Preferably monthly/quarterly.

Audit and Compliance: What are your audit and record-keeping requirements for AML compliance, including retention periods?

Maintaining accessible records of customer due diligence.

Retention periods are determined by the Florida Department of State GS1-SL.

How will fraud alerts be handled? (e.g., via SIEM integration, internal fraud teams, automated actions)

SIEM integration.

Can you describe the scale of operations, including average daily transaction volumes, number of users (e.g., internal staff, external applicants), and data sources (e.g., state databases, federal watchlists) that the solution must handle?

Potentially hundreds of transactions per day. 4-5s of internal users

Number of user accounts/identities that FL Dept of Commerce currently has, both internal and external

4 - 5 internal, no external as of right now. During peak season we could have hundreds of applications daily.

Are there any constraints on data residency (e.g., must remain in Florida or the U.S.)

or preferences for cloud vs.

hybrid deployment models?

All data must be stored and processed within the continental United States. We are seeking a cloud-based Software-as-a- Service (SaaS) solution.

RFP pg 28 Section C.1- Purpose

Florida Commerce lists a number of broad functions including identity verification, know your customer (KYC), and anti money laundering (AML) compliance. Can Florida Commerce estimate the number of new entities/organizations that will be subjected to processing for each broad level function (identity verification, know your customer (KYC), and anti money laundering (AML))?

Potentially hundreds of applications per day during peak season.

RFP pg 34 Section C.5- Contractor’s Responsibilities #14

Florida Commerce requires customer support via email and phone. Could Florida Commerce please specify if this customer support is for Florida Commerce personnel or for end-users?

If it is specifically for Florida

Florida Commerce personnel and yes.

Commerce, would Florida Commerce be open to accepting email, Jira portal, and access to a dedicated customer support representative via phone in lieu of a broad customer support line?

RFP pg 34 Section C.6- Staffing levels

Florida Commerce requests contractor staff to provide resumes for review. Could Florida Commerce please specify the Key Personnel roles required to submit resumes, and should these resumes be submitted along with the proposal as a separate appendix?

As stated in Section B.38.1, Tab 1 of the RFP, respondents are required to identify key personnel and provide their resumes. Key personnel should include, at a minimum, the proposed Project Manager and the lead technical integration specialist. Resumes should be included within Tab 1 of the Technical Proposal.

RFP pg 34 Section C.9- Background Screening

Florida Commerce states that the contractor will be responsible for obtaining and providing Level One, or equivalent, written background checks from FDLE on al employees that work in the building. Is there a requirement for personnel to physically work at the building, or can all work be done remotely?

They can work remotely.

C.1 What is the anticipated volume of transactions (e.g., identity verifications) the system will need to handle daily, monthly, and annually?

Are there peak periods to consider (e.g., specific times of year, during emergencies)?

Potentially 100’s of applications daily during peak periods during a disaster.

C.2 Does the Department currently utilize ID.me or any other identity verification services within its Salesforce grants management system?

How would the proposed solution interact with the

Currently we do not use ID.me.

We do utilize some services from Socure. The proposed solution will be integrated into our Salesforce grants management system and may augment or replace our existing services."

existing identity verification services?

Page 28, Section C.3 – Deliverables, Tasks, Performance Measures and Financial Consequences

The RFP outlines performance expectations and service level agreements for the identity verification platform but does not include any estimated or historical transaction volumes. Could you please provide anticipated or average daily/monthly volumes (e.g., number of identity verification transactions) to help respondents appropriately size and price their proposed solutions?

The Department anticipates approximately 14,000-15,000 applications annually. This can translate to hundreds of applications on peak days.

Respondents should use these figures to size and price their solutions.

Page. 28-29, Section:

C.1-C.2

Please provide anticipated monthly and/or annual transaction volumes, including new applications

vs. renewals.

Can you provide historical volume, seasonality, projected growth?

Potentially 100’s of new applications daily during peak periods. We anticipate approximately 14,000-15,000 new applications annually, with volumes concentrated in peak periods. The solution should be scalable to handle future growth.

Page. 36 - 37. Section:

C.14

Please confirm whether the selected vendor is expected to perform full integration of the identity verification solution into the Salesforce Grants Management System, or if FloridaCommerce (or an existing systems integrator) will handle the development work with vendor-provided API/SDK support.

The Department's existing Salesforce integration vendor will be responsible for the technical work of integrating the selected identity verification solution into our Salesforce Grants Management System.

The successful respondent to this RFP will be expected to provide full API/SDK documentation, training, and technical support to our Salesforce integration vendor to facilitate this work.

Page. 9 & Page 16 Section: B.15; B.36

Please confirm the required number of Cost Proposal copies. Section B.15 states two copies, B.36 states one copy, and Attachment L states five copies.

Please submit one (1) original and five (5) paper copies of the Cost Proposal, as indicated in Attachment L, the Proposal Package Checklist.

Page. 36 - 37 Section:

C.14 #8

Is batch processing intended only for feedback exchange (e.g., confirmed fraud outcomes) or will it also be used to run identity verification and fraud detection? Additionally, what is the anticipated monthly volume of batch files or transactions?

The primary use of batch processing will be for feedback exchange, such as providing the vendor with confirmed fraud outcomes. We do not anticipate using batch processing for real-time identity verification. The volume of batch feedback files is not expected to be large.

Page 28, Section C.3 – Deliverables, Tasks, Performance Measures and Financial Consequences

The RFP outlines performance expectations and service level agreements for the identity verification platform but does not include any estimated or historical transaction volumes. Could you please provide anticipated or average daily/monthly volumes (e.g., number of identity verification transactions) to help respondents appropriately size and price their proposed solutions?

We anticipate approximately 14,000-15,000 applications annually. This can translate to hundreds of applications on peak days. Respondents should use these figures to size and price their solutions. Please see answer to question 81.