ESBD_451805_1757341253589_RFI 311-26-090825AK Texas Strategic Bitcoin Reserve.pdf

RFI 311-26-090825AK

RFI 311-26-090825AK – Texas Strategic Bitcoin Reserve

KELLY HANCOCK

ACTING TEXAS COMPTROLLER OF PUBLIC ACCOUNTS

Request for Information (RFI) for

Texas Strategic Bitcoin Reserve

RFI No. 311-26-090825AK

September 8, 2025

Schedule of Events

September 08, 2025 Issuance of RFI

September 19, 2025 Deadline for Submission of Questions (2:00 p.m., CT)

October 15, 2025 Release of Answers to Questions

(or as soon thereafter as practical)

October 30, 2025 Deadline for Submission of Responses (2:00 p.m., CT)

Late Responses will not be considered

A. Summary

1. Type of Document: Request for Information (RFI)

2. Deadline for Responding to RFI: October 30, 2025 @ 2:00 p.m., Central Time (CT)

Respondents are solely responsible for ensuring receipt of their

Responses at the email addresses specified in Section A.4 on or before the specified deadline; late Responses will not be considered.

3. Point of Contact for this RFI: Texas Comptroller of Public Accounts, Contracts & Purchasing

Attention: Alexander Kost, Sourcing Analyst

111 E 17th Street, Austin, TX 78774

4. Method of Submitting Responses: Responses and questions must be submitted by email to

Email: Researchcpa@cpa.texas.gov

5. RFI Addenda: TTSTC will post any amendments to this RFI as addenda on the

Electronic State Business Daily (ESBD) located at http://www.txsmartbuy.com/esbd. It is the responsibility of an interested party to periodically check the ESBD for updates to the

RFI prior to submitting a RFI Response.

6. Questions and Answers: Questions regarding this RFI must be submitted in writing to the

Point of Contact, Researchcpa@cpa.texas.gov, no later than

September 19, 2025; 2:00 p.m. CT. Telephone inquiries will not be accepted. The Trust Company intends to post answers to questions received on the ESBD on or about October 15, 2025.

7. Respondent Presentations: In TTSTC’s sole discretion and to assist in additional information gathering, CPA may invite Respondents to give a presentation to explain in further detail the recommendations made or information provided in the RFI Response. Any presentation(s) will be performed at Trust Company offices located in the Thomas

Jefferson Rusk Building, 208 East 10th Street, Fourth Floor, Austin, Texas 78701; presentation date(s) and time(s) to be arranged.

B. Introduction

In response to the enactment of Senate Bill 21 (the Texas Strategic Bitcoin Reserve and Investment Act, the

“Act”) and Senate Bill 1 (the General Appropriations Act, the “GAA”) by the 89th Texas Legislature, the

Texas Treasury Safekeeping Trust Company (the “Trust Company” or “TTSTC”), on behalf of the

Comptroller of Public Accounts (“CPA”),1 issues this Request for Information No. 311-26-090825AK

(“RFI”) to gather information and industry best practices regarding the creation and management of the

Texas Strategic Bitcoin Reserve. The Strategic Bitcoin Reserve will provide the State with the capability to

1 Per Chapter 404 of the Texas Government Code, the Comptroller of Public Accounts serves as TTSTC’s sole shareholder and director.

http://www.txsmartbuy.com/esbd safely acquire, custody, and exchange bitcoin and other qualifying cryptocurrency and provide any related services that are needed to properly and efficiently meet the Act’s requirements.

Responses to the RFI will aid TTSTC’s general understanding of the types of offerings which are commercially available in this industry. All references in this RFI to a “Reserve” means the Texas Strategic

Bitcoin Reserve as stated in the Act. On behalf of the CPA, TTSTC will be responsible for establishing and managing the Reserve. As such, TTSTC is seeking information pertaining to services contemplated in the

Act and as further described in Section E of this RFI. These services may include, but are not limited to, providing a secure bitcoin/cryptocurrency custody solution to securely hold the state’s bitcoin and cryptocurrency assets that will be acquired by TTSTC or its designated contractor. The Reserve and any related service providers must have a secure mechanism for accepting, maintaining custody, exchanging, withdrawing, and transferring bitcoin and other qualifying cryptocurrency assets held by TTSTC for CPA and the State of Texas.

The Act establishes the Texas Strategic Bitcoin Reserve as the first of its kind in the United States. Article

IX, Section 18.38 of the GAA appropriates $10,000,000 to be deposited to the Reserve for the acquisition of bitcoin in conjunction with the Act. The GAA becomes effective as of September 1, 2025. The Reserve is a special fund outside the state treasury; however, cash deposits intended for use by the Reserve may be invested with the state’s Treasury Pool until such time as cash is needed for the acquisition of bitcoin or other qualifying cryptocurrency. On behalf of CPA, TTSTC may contract with one or more third parties for the administration and/or management of the Reserve, and related services, including contracts with or for the following: a qualified custodian that employs secure custodial technologies, including cold storage or other secure technologies; a qualified liquidity provider to facilitate the purchase and management of assets in the reserve; investment-related guidance and strategies, and independent audit services.

No appropriations were included to cover the cost of establishing and maintaining the Reserve; however, the Act allows TTSTC to sell bitcoin or other cryptocurrencies in the Reserve to cover the reasonable costs associated with administering and managing the Reserve. This RFI seeks input from interested Respondents on the feasibility and requirements of establishing the Reserve in a secure, yet cost-efficient manner for the

State of Texas.

To aid TTSTC in gathering information regarding applicable industry standards and best practices for cryptocurrency custody solutions and related services, TTSTC is seeking information from qualified

Respondents, which are defined to include companies that provide commercially available cryptocurrency custody or exchange service offerings to large institutions with operations in the State of Texas and the

United States. The definition of Respondents includes, but is not limited to, qualified custodians and entities that meet the requirements for qualified liquidity providers in the Act (Texas Government Code Section

403.705(b), more specifically).

C. Background

As regulatory clarity around digital assets has improved in the U.S. and Europe over the last few years, institutional investors are increasing their exposure to digital assets to help enhance their financial resilience and the financial security of their clients and hedge against inflation and economic volatility. According to a recent Ernst & Young report, institutional investors increased their allocations to digital assets in 2024 and intend to continue this trend in 2025. More than 75% of the 352 institutional investors surveyed (mostly large U.S.-based firms with at least $1 Billion AUM) are expected to increase their allocations to digital assets in 2025, with nearly 60% planning to allocate at least 5% of AUM to digital assets and related products.2 These trends are significant, and states and national governments around globe are paying attention.

As a state committed to innovation and economic growth, Texas became the first state in the U.S. to commit public funds to cryptocurrency by creating the Texas Strategic Bitcoin Reserve. The Act, coupled with the

GAA appropriating $10 Million for the Reserve, demonstrates the state’s support for the responsible and prudent adoption of cryptocurrency. This RFI is intended to help TTSTC capture the industry’s best practices so it can utilize these practices in the implementation and management of the Reserve.

The data collected will be used for the purpose of contracting with a third party to implement a state-of-the-art cryptocurrency Reserve. To identify best practices for establishing the country’s first cryptocurrency reserve, the RFI seeks feedback and information from cryptocurrency community members, industry organizations, cryptocurrency custody and trading platforms, and other digital asset-related investment firms or service providers to inform the development of this program. Additionally, the RFI presents an opportunity for potential service providers to provide input on factors TTSTC should consider when establishing and managing the Reserve for the State of Texas.

The main goals of the RFI are to:

• Assist TTSTC in understanding the requirements needed for the successful implementation of the nation’s first ever strategic bitcoin and cryptocurrency reserve.

• Help the Trust Company identify key subject matter experts and providers of custody and investment services in the cryptocurrency context.

Who should respond to the RFI?

• Entities with multiple years of experience and expertise providing cryptocurrency-related services to large U.S. financial institutions, including expertise in the investment, custody, and/or exchange of bitcoin and cryptocurrency.

D. Definitions

4. Act – SB 21 (89th Regular Session of the Texas Legislature), the Texas Strategic Bitcoin Reserve and Investment Act.

5. Cryptocurrency – a type of virtual currency that utilizes cryptography to secure transactions that are digitally recorded on a distributed ledger, such as a blockchain.

6. GAA – SB 1 (89th Regular Session of the Texas Legislature), the General Appropriations Act.

7. Qualified Custodian – a state or federally chartered financial institution or other entity regulated by the State of Texas or other entity regulated by this state that has custody of virtual currency.

8. Qualified Liquidity Provider – an entity that:

i. Is licensed or regulated under applicable federal or state law;

ii. Maintains audited financial statements prepared by a regulated auditor;

iii. Has at least five years of experience trading in the digital assets industry;

iv. Maintains an office and has a registered principal in this state; and

2 Increasing Allocations in a Maturing Market, 2025 Institutional Investor Digital Assets Survey, available at https://www.ey.com/content/dam/ey-unified-site/ey-com/en-us/insights/financial-services/documents/ey-growing-enthusiasm-propels-digital-assets-into-the-mainstream.pdf

v. Can certify that the provider meets the above requirements.

9. Reserve – Texas Strategic Bitcoin Reserve.

10. Virtual Currency –

i. A digital representation of value that:

a. Is used as a medium of exchange, unit of account, or store of value; and

b. Is not legal tender, whether or not denominated in legal tender; and

ii. Does not include:

a. A transaction in which a merchant grants, as part of an affinity or rewards program, value that cannot be taken from or exchanged with the merchant for legal tender, bank credit, or virtual currency; or

b. A digital representation of value issued by or on behalf of a publisher and used solely within an online game, game platform, or family of games sold by the same publisher offered on the same game platform.

E. Scope

TTSTC seeks information to help determine the best industry practices and solutions for a government-sponsored institutional bitcoin and cryptocurrency reserve by requesting responses to the following questions:

1. Company Background

a. Please provide a summary of your company’s background, including the year and state or location of incorporation, and the locations of headquarters, offices, and employees.

b. Does your company have offices or employees in the State of Texas? If not, is your company considering expanding its operations to the State of Texas in the future? If your firm subcontracts for cryptocurrency custody services, is that firm located in Texas? Please provide the location of the servers that could be utilized in connection with the Reserve.

c. Does your company have offices or employees located in countries of concern as defined in

Section 2270.001(2-b) of the Texas Government Code (North Korea, China (including Hong

Kong), Russia, or Iran)? Is your company owned (majority) or controlled by a citizen of a country of concern?

d. Please describe the number of years and types of experience your company has in connection with the investment, custody, and/or exchange of bitcoin and cryptocurrency, including whether your company uses subcontractors in the custody and/or exchange of bitcoin and cryptocurrency.

2. Plan for Reserve

a. Please recommend a general plan of operation for the country’s first Strategic Bitcoin Reserve, including a summary of how the State of Texas should securely acquire, hold, and manage digital assets. Please include a discussion on how your firm will ensure Bitcoin and cryptocurrency assets are securely held in the name of the State of Texas and will not be commingled with other client assets. Please include a discussion of economic and technical risks (and benefits) related to the establishment of the Reserve.

b. Please include a discussion on ways in which TTSTC could utilize the assistance of an investment advisory firm to recommend and/or deploy various investment strategies within the

Reserve, including the use of derivatives, to help mitigate risk and maximize potential investment returns for the Reserve. As a reminder, the Texas Legislature did not provide appropriations for operating costs and any custodian or investment advisory firm will need to incorporate a transparent plan for netting expenses from the Reserve.

c. Please include an overview of how you envision the Reserve fitting into Texas broader economic growth and development.

3. Secure Custody of Digital Assets

a. Is your company a Qualified Custodian and/or a Qualified Liquidity Provider as described above? Please explain your answer. If not, does your firm contract with a cryptocurrency custodian? Is such subcontractor a Qualified Custodian or Qualified Liquidity Provider?

b. Please describe how your company would provide secure custody services, and any general recommendations regarding such services. Please include a brief discussion on the following as they apply to your company or your firm’s cryptocurrency custodian subcontractor:

i. The processes used to generate private keys;

ii. Where private keys and related cryptographic information, which enables access to and control over a user's digital assets, are stored;

iii. Are private keys held in cold storage or hot wallets? If hot wallets are used, what are the key controls to prevent loss of funds?

iv. Who can obtain access to private keys?

c. How does your company or your cryptocurrency custodian subcontractor manage and protect cryptographic encryption keys to meet the highest security standards?

d. Please describe the type of insurance coverage your company maintains or requires of its subcontractors pertaining to the custody or transfer of bitcoin and cryptocurrency.

e. Please describe any other features, processes, or procedures your company would use to mitigate the risk of fraud.

f. Please describe all third-party security testing performed on your custody products, including any cryptographic audits and penetration tests, focused on custody infrastructure.

g. Please describe methods your firm or the firm you contract with for the custody of cryptocurrency implements to demonstrate that they hold sufficient assets to cover their users' deposits on a 1:1 basis. Please provide the ways in which this metric is audited on a regular basis. How frequently is the coverage ratio updated and disclosed to stakeholders?

4. Data Controls and Protection

a. Please provide an overview of the controls around your company’s data protection policies.

b. Does your firm or the firm used for the custody of cryptocurrency utilize third-party security audits (e.g. SOC 2, Type II).

c. Does your firm or the firm used for the custody of cryptocurrency utilize cloud computing services for purposes of maintaining custody or exchange of cryptocurrency?

5. Information Systems, Access, and Vulnerability Management

a. Please outline the mechanism by which your company prevents and detects internal and external cybersecurity threats.

b. Please describe your incident response plan, including how you handle breaches or attempted theft.

c. Please summarize your company’s security monitoring and logging capability, including the types of events monitored, the tools used, and the retention period for logs. Explain how your company ensures that these logs are protected from unauthorized access or modification. How does your company ensure that logs with indicators of compromise are triaged and addressed promptly? Summarize your firm’s capability to provide forensic audit trails and timely notifications to relevant authorities.

6. Regulatory Matters

a. What state and/or federal charters, registrations, licenses, and related approvals does your company or your company’s subcontractors hold in connection with the custody and/or exchange of bitcoin and cryptocurrency (e.g., federal bank charter, state charter, special purpose depository institution charter, alternative trading system, swap execution facility, BitLicense, money transmitter, money services, broker-dealer, etc.)?

b. Has your company or your cryptocurrency custodian been examined by a federal or state regulator? Does your primary regulator examine your cybersecurity protocols and operational resilience? Does your primarily regulator conduct on-site examinations? If so, how often do these occur?

c. Please explain how your company’s custody solution complies with pertinent federal and state laws, including AML/KYC requirements.

d. Detail your approach to ensuring ongoing regulatory compliance within the rapidly evolving digital asset landscape.

e. Please describe your firm’s methodology for valuing digital assets, including Bitcoin and other cryptocurrencies.

7. Risk Management and Insurance

a. List all vendors that would provide material services for a Reserve.

b. Describe your company’s process for evaluating the vendors’ compliance with relevant regulations and industry standards.

c. Describe your process for monitoring subcontractor performance and compliance.

d. How will your organization inform government personnel or the contracting officer regarding any disruptions to service or data breaches involving a third-party vendor? What is your standard SLA for notifications to appropriate authorities and contractors?

8. Reporting

a. Please provide a summary of the types of reporting available to clients (e.g., asset holdings, audit logs, etc.)

b. How frequently are these reports generated, and are there customization options for regulatory or internal reporting.

9. Personnel

a. Provide information regarding the expertise and availability of your support team, including escalation procedures and contact protocols.

b. Please describe your approach to security awareness training and how you ensure employees understand and comply with security policies. Provide examples of training materials and demonstrate how you track and enforce employee compliance.

F. Required RFI Response Materials

Respondents must email an RFI response titled “Response to TEXAS BITCOIN RESERVE RFI” to the designated Point of Contact on or before the deadline for Responses (see Section A.2) and as otherwise required by Section A (Summary) of this RFI. The RFI Response should include the items listed below and be organized in the following manner:

1. Entity’s full name and address.

2. If applicable, the organization the Respondent is a member of included in the email subject line.

3. Point of contact information for Respondent regarding its RFI Response (i.e., name, title, telephone number, and email address of Respondent’s designated personnel).

4. A brief summary describing each item requested in Section E of this RFI, in the order listed.

5. Any other information that the Respondent deems pertinent or relevant to this RFI (e.g., brochures or other company literature).

6. RFI responses must be submitted via email to BitcoinReserve@ttstc.texas.gov

G. No Award Results from this RFI

This RFI is issued solely for the purpose of obtaining information that may assist TTSTC in determining

Reserve-related activities that may be requested in a future solicitation, and no contract will be awarded in connection with this RFI. Neither CPA nor TTSTC is under an obligation to issue a solicitation.

Respondent’s submission of a Response is voluntary and failure to respond will have no impact on the evaluation of responses to any subsequent solicitation.

mailto:BitcoinReserve@ttstc.texas.gov

H. No Compensation or Cost Recovery

Neither CPA nor TTSTC shall pay any costs, expenses, or any other amounts to any entity that are incurred under or related to this RFI.

I. Ownership of Responses, Copyright, Public Nature of Responses

Responses to this RFI will be the property of TTSTC. TTSTC, in its sole discretion, may consider or disregard any information submitted in a Response to this RFI. Responses to this RFI will not be returned to Respondents. Responses will be public information and available for public inspection without redaction.

Consequently, a Respondent should not submit any information in its Response that is asserted by

Respondent to be confidential or proprietary.

A response with a copyright notice or marked as “Confidential or Proprietary” is not acceptable and will be rejected by TTSTC as non-responsive to the RFI.