ESBD_458413_1759519818233_1_Part A 946M1 Merchant Card.pdf

9-2024 Solicitation No. 304T-26-946M1 Page A1

TEXAS COMPTROLLER OF PUBLIC ACCOUNTS

STATEWIDE PROCUREMENT DIVISION

REQUEST FOR PROPOSALS

Merchant Card Services

RFP No. 304T-26-946M1

NIGP CLASS-ITEMS

946-35 946-49

SCHEDULE OF EVENTS

ESBD Posting Date October 3, 2025 Pre-Proposal Conference Date and Time October 20, 2025 10:00am CST Questions Submission Deadline Date October 22, 2025 Response to Questions through Addendum Date, or as soon thereafter as practical October 29, 2025

RESPONSE DUE DATE December 2, 2025 RESPONSE DUE TIME 1:30 pm Central Time in Austin TX

**NOTE** This Solicitation is composed of two parts: (1) Part A: Special Instructions, (including attachments and appendices, if any) and (2) Part B: General Instructions and Contract Terms and Conditions (including attachments and appendices, if any). In the event an instruction or term in Part A conflicts with an instruction or term in Part B, the instruction or term in Part A prevails, and any addenda or amendments to either Part A or Part B control over the original versions.

Page A2

SUBMISSION CHECKLIST

COMMUNICATIONS WITH ANYONE OTHER THAN THE POINT OF CONTACT LISTED

IN SECTION A.12.4 MAY RESULT IN DISQUALIFICATION OF A RESPONSE.

CPA will disqualify any response received without the required documentation identified below.

ATTACHMENT A - EXECUTION OF RESPONSE

MANDATORY PRICE SHEET

CPA may disqualify any response received without the required documentation identified below.

IDENTIFICATION OF CLAIMED CONFIDENTIAL/PROPRIETARY INFORMATION, if any

ATTACHMENT B - RESPONDENT INFORMATION

ATTACHMENT C - PREFERENCES

ATTACHMENT D - INSURANCE STATEMENT OF INTENT

ATTACHMENT E – SELF INSURED RENTENTION CERTIFICATION AND REQUEST FOR

APPROVAL

IDENTIFICATION OF ALL EXCEPTIONS AND ASSUMPTIONS to terms of this Solicitation or Contract, if any

CONFLICT OF INTEREST DISCLOSURE, if applicable – Reference Part B.1.1.

MANUFACTURER’S PRICE LIST

DESCRIPTIVE LITERATURE FOR PRODUCTS OFFERED

SIGNED COPIES OF ALL ADDENDA to this Solicitation, if any

REFERENCE SECTION A.17 AND SECTION A.18 FOR SUBMISSION REQUIREMENTS

Page A3

PART A: SPECIAL INSTRUCTIONS

Table of Contents

A.1 DEFINITIONS

A.2 DESCRIPTION

A.3 TERM OF THE CONTRACT

A.4 PRICING

A.4.1 PRICING STRUCTURE – FIRM PRICE WITH ESCALATION

A.5 PRICE ADJUSTMENTS

A.5.1 PRICE DECREASES OR DISCOUNT INCREASES

A.5.2 PRICE ADJUSTMENT CALCULATION – EQUIPMENT ONLY

A.5.3 PRICE ADJUSTMENT CALCULATION – FEES AND SERVICES

A.5.4 PRICE ADJUSTMENT REQUESTS

A.5.5 TARIFFS

A.6 INSURANCE

A.7 REQUIREMENTS AND SPECIFICATIONS

A.7.1 RESPONDENT QUALIFICATIONS

A.7.2 OPERATIONS

A.7.3 TYPES OF CARDS AND PAYMENTS ACCEPTED

A.7.4 PAYMENT GATEWAY

A.7.5 SETTLEMENT

A.7.6 CHARGEBACKS

A.7.7 EQUIPMENT/COMPUTER SOFTWARE

A.7.8 DATA ACTIVITY AND SETTLEMENT REPORTING

A.7.9 MONTHLY BILLING AND PAYMENTS

A.7.10 SURCHARGES AND CONVENIENCE FEES

A.7.11 SECURITY

A.7.12 SUBCONTRACTORS

A.7.13 IMPLEMENTATION SCHEDULE

A.7.14 CUSTOMER SUPPORT

A.7.15 TRAINING

A.7.16 SERVICE INTERRUPTION OR FAILURE

A.7.17 PAYMENT CREDIT

A.8 EQUIPMENT

A.8.1 CURRENT EQUIPMENT

A.8.2 NEW IMPLEMENTATIONS, EXPANSIONS AND REPLACEMENT EQUIPMENT

A.8.3 CONDITION OF PRODUCTS

A.8.4 QUANTITIES

A.8.5 WARRANTY

A.9 SHIPPING, DELIVERY, AND PACKAGING

A.9.1 IDENTIFICATION OF SHIPMENTS AND DOCUMENTATION

A.9.2 PACKAGING AND LABELING

A.9.3 SPECIAL DELIVERY REQUIREMENTS

A.9.4 HOURS OF DELIVERY

A.9.5 DELIVERY SCHEDULE

A.9.6 DELIVERY DELAYS

A.9.7 COMPLIANT PRODUCTS

A.10 RETURN, CANCELLATION, AND RESTOCKING FEE

A.11 PURCHASE ORDERS, INVOICES AND REPORTING

A.11.1 CUSTOMER PURCHASE ORDERS

A.11.2 INVOICES AND EXPEDITED PAYMENT DISCOUNTS

A.11.3 REPORTING REQUIREMENTS (MANAGED)

Page A4

A.11.4 STATEWIDE CONTRACT DEVELOPMENT REPORTING

A.12 RESPONSE INFORMATION

A.12.1 SCHEDULE OF EVENTS

A.12.2 SOLICITATION ADDENDA

A.12.3 QUESTIONS AND ANSWERS

A.12.4 POINTS OF CONTACT

A.12.5 PRE-PROPOSAL CONFERENCE

A.12.6 DOCUMENTS AND ATTACHMENTS INCLUDED WITH THIS SOLICITATION

A.13 HUB SUBCONTRACTING PLAN

A.14 DISCLOSURE OF INTERESTED PARTIES

A.15 EVALUATION OF PROPOSALS

A.15.1 PHASE I: EVALUATION OF MINIMUM REQUIREMENTS AND RISK OF NON-PERFORMANCE

A.15.2 PHASE II: EVALUATION OF COST PROPOSAL - EVALUATION PROCESS

A.15.3 PHASE III: EVALUATION OF QUALIFICATIONS

A.15.4 EVALUATION FACTORS

A.16 AWARDS

A.16.1 AWARD APPROACH

A.16.2 NON-AWARD

A.16.3 AWARD NOTICE

A.16.4 SUBSTITUTIONS

A.16.5 ADDING NEW COMMODITIES AND/OR SERVICES

A.17 ORGANIZATION OF THE RESPONSE FOR SUBMISSION

A.17.1 CONFIDENTIAL/PROPRIETARY INFORMATION

A.17.2 ATTACHMENT A - EXECUTION OF RESPONSE

A.17.3 ATTACHMENT B - RESPONDENT INFORMATION

A.17.4 ATTACHMENT C - PREFERENCES

A.17.5 ATTACHMENT D – INSURANCE STATEMENT OF INTENT

A.17.6 ATTACHMENT E – SELF INSURED RETENTION CERTIFICATION AND REQUEST FOR APPROVAL

A.17.7 HUB SUBCONTRACTING PLAN

A.17.8 FINANCIAL RESPONSIBILITY/STABILITY

A.17.9 PROPOSED SOLUTIONS

A.17.10 MANDATORY PRICE SHEET

A.17.11 NEGOTIATIONS, ASSUMPTIONS, AND EXCEPTIONS

A.17.12 MANUFACTURER’S PRICE LIST

A.17.13 DESCRIPTIVE LITERATURE FOR PRODUCTS OFFERED

A.17.14 SIGNED ADDENDA TO SOLICITATION

A.18 SUBMITTING THE RESPONSE TO CPA

A.18.1 ELECTRONIC SUBMISSION (PREFERRED)

A.18.2 HARD COPY SUBMISSION

Page A5

A.1 DEFINITIONS

In this Contract, the following terms and acronyms have the meaning set forth below.

TERM DEFINITION

Assessment Fee Fees imposed by the credit/charge card Associations that are passed through to the Customer.

Association The credit card association known as Visa U.S.A., Inc., Visa International, Inc., MasterCard International Incorporated, American Express, Discover and any successor organizations or associations of such successor organizations.

Authorization Process by which a Customer electronically accesses the Contractor’s system to obtain verification by an issuing entity of a credit/charge card, on-line or off-line debit card transaction.

Authorization Fee Fees charged by the Contractor or Customer to obtain an authorization.

Automated Clearing House (ACH) Network

A nationwide electronic funds transfer system governed by the ACH Operating Rules and Guidelines, which processes electronically originated credit and debit transfers for participating financial institutions.

Chargeback A credit provided by a Credit/Charge Card issuer to the Consumer in the amount (or portion of the amount) of a disputed Credit/Charge Card, or disputed Debit Card transaction.

Commercially Reasonable Efforts

The efforts that a prudent party that desires to complete a transaction or other action would use in similar circumstances to ensure that a transaction, action or other result occurs as expeditiously as possible without the necessity of assuming any material obligations or incurring any material fees, expenses, or costs other than those fees, expenses and costs which the party has contractually agreed to expend.

Consumer The end customer of a State of Texas Agency, education entity or other program participant.

Contactless Payments

Payments made using cards or other objects containing chips that can be read by Point of Sale (POS) devices by proximity of the card/object to the POS device without actual physical contact.

Contract Any Contract resulting from this Solicitation, consisting of the Contract documentation as provided in Section B.3.2.

Contractor Any Respondent awarded a Contract based on this Solicitation.

Convenience Fee

Participants will be permitted to assess a fee for transactions. The fee will apply, whether conducted in person, internet, phone, mail or kiosk, versus other forms of payment, such as cash, check, Automated Clearing House (ACH), and Personal Identification Number (PIN) based debit.

CPA The Texas Comptroller of Public Accounts, the state agency issuing this Solicitation.

Credit/Charge Cards

Mastercard, Visa, Discover and American Express branded cards or such other cards as may become available and included under the Contract during the Contract term.

Customer State of Texas agencies, institutions of higher education, and Texas SmartBuy members, including CPA, that are required or permitted by law to purchase goods and services under contracts established by CPA.

Debit Cards An electronic payment card tied to a bank account of a Consumer which is processed either by entry of a PIN (On-Line Debit Card) or processed like a credit/charge card (Off-Line Debit Card).

eCheck An electronic payment funded by a bank account.

Page A6

ESBD The Electronic State Business Daily, which is available online at http://www.txsmartbuy.com/esbd

Financial Services Processing (FSP)

Processing of the four nationally recognized Credit/Charge Cards (Mastercard, Visa, Discover and American Express branded cards), On-Line and Off-Line Debit Cards, eChecks, Apple Pay, other mobile payments and digital wallet services and other future forms of electronic payments.

FOB Destination The seller retains the risk of loss until the goods reach the buyer, and the seller bears all shipping costs.

Interchange Fee A fee imposed by a credit/charge card Association that is passed through to the Customer.

Level I Data Transaction amount, authorization reference number, transaction/posting date, merchant name/location and merchant category code.

Level II Data Sales tax amount, Purchase ID (UPC code)/Customer-defined accounting code, merchant’s tax ID number, Historically Underutilized Business (HUB) information, 1099 status, plus all Level I Data

Level III Data

Purchase item descriptions, extended item amount, debit or credit indicator, discount amount, delivery zip code, order/ticket number, discount per line-item, line-item total, shipping/duty amount, item product codes, unit cost, quantity and unit of measure, plus all Level I and Level II Data.

MID Merchant Identification number or code.

Party or Parties Either CPA or Respondent, separately or collectively.

Payment Gateway Services

On-Line services that automate payment transaction (e.g. process, verify, encrypt transactions through secure internet connections) for the Customer.

Payment Optimization

A strategic approach to improving the efficiency, security and cost-effectiveness of a business’s payment processing.

PCI DSS

(Payment Card Industry Data Security Standards)

The payment Card Industry Data Security Standard as set forth by the https://www.pcisecuritystandards.org/security_standards/ped/index.shtml.

PCI PED

(Payment Card Industry PIN Entry Device Standard)

The Payment Card Industry PIN Entry Device standard as set forth by the https://www.pcisecuritystandards.org/security_standards/ped/index.shtml.

POS Point of Sale, system used to process transactions and accept payments in person.

Preauthorized Payments

A transaction where a Consumer authorizes a Customer to make one or more future charges to such Consumer’s Credit/Charge Card account or to initiate Off-Line Debit Card transactions at a future date.

Process/Processing When referring to Mastercard, Visa and Discover, transactions shall include authorization, capture, settlement and reporting; when referring to American Express, shall mean only authorization, capture and in certain cases reporting.

Processing Fee A fee charged by the Contractor to a Customer for Financial Services Processing (including interchange pass through fees and fees identified in the Mandatory Price Sheet).

Respondent Any person or company that submits a Response to this Solicitation.

Response A bid or proposal submitted to CPA in response to this Solicitation.

Solicitation This document, along with all other documents incorporated in this document and posted to the ESBD, soliciting responses for the proposed commodities and services.

http://www.txsmartbuy.com/esbd https://www.pcisecuritystandards.org/security_standards/ped/index.shtml.

https://www.pcisecuritystandards.org/security_standards/ped/index.shtml.

Page A7

State Agency

A department, commission, board, office, or other agency in the executive branch of state government created by the state constitution or a state statute;

the supreme court, the court of criminal appeals, a court of appeals, or the Texas Judicial Council; or a university system or an institution of higher education as defined by Section 61.003, Texas Education Code, except a public junior college.

Surcharge Fee The amount added to a transaction when a customer chooses to pay with a credit card, intended to help offset the associated processing costs.

Texas SmartBuy Members

Political subdivisions and other entities authorized by law to make purchases from Texas State Comptroller of Public Accounts centralized contracts.

A.2 DESCRIPTION

The Statewide Procurement Division (SPD), a division of CPA, requests sealed responses for proposals to establish a contract for merchant card, automated clearing house (ACH) and eCheck services, which will enable State Agencies and Texas SmartBuy Members to accept payments using credit and debit cards, ACH and eCheck payments.

The Comptroller’s Office is responsible for designating depositories and financial agents of the state and for monitoring daily deposit flows and coordinating credit and debit card programs for State Agencies.

The Comptroller’s Office intends to select a single Contractor to provide the services but reserves the right to select more than one Contractor in its sole discretion. The contract(s) shall be in addition to and separate from any other contracts for any type of credit and debit card services that the Comptroller’s Office may have or may subsequently procure, including other contracts for credit and debit card services.

The Contractor, as an independent contractor, shall provide the services under the Contract, at its facilities and with its own personnel.

Goals of Contract Comptroller’s Office wishes to contract with a Respondent whose proposal provides the best value to the State while best meeting these goals:

• Competitive pricing.

• State of the art transaction processing.

• Industry leading information security.

• Best in class customer support.

• Robust reporting.

Contract Value

The projected dollars processed during the life of the contract, is estimated to be in excess of $930 million. This figure assumes that the contract is in place throughout its term, and all four of the one-year renewals are exercised.

Page A8

Quantities indicated for each item in the Mandatory Price Sheet - are estimates only. These shall not be construed as a minimum or a maximum quantity of service that Customers may need.

Each Customer is treated as a separate entity and will have unique merchant agreements to provide credit and debit card services, but all are governed by the State’s master contract. The fees collected, the transaction volume, and the average ticket size of each Customer vary widely. Specific Customers and estimated volumes are provided for historical purposes; no specific Customers or volumes are guaranteed under this RFP or any Contract resulting from it.

Excluding Texas.gov, State Agencies are required to use the Contract for Merchant Card Services unless an exemption has been granted by the Statewide Procurement Division of the Texas Comptroller of Public Accounts. In addition, there are over 2,000 Texas SmartBuy Members who are eligible to purchase services off this Contract. Texas SmartBuy Members may use the Contract or enter into their own credit and debit card agreements separate and apart from such Contract. Information about the Texas SmartBuy Membership Program and the member list can be accessed at:

https://www.txsmartbuy.gov/smartbuy-membership.

NOTE: This Contract specifically excludes services provided through Texas.gov.

A.3 TERM OF THE CONTRACT

The initial term of this Contract commences on the effective date set out in a Notice of Award issued by CPA and automatically expires on March 31, 2028.

1st Renewal Option: April 1, 2028, through March 31, 2029 2nd Renewal Option: April 1, 2029, through March 31, 2030 3rd Renewal Option: April 1, 2030, through March 31, 2031 4th Renewal Option: April 1, 2031, up to one (1) additional year

CPA may unilaterally renew the Contract.

A.4 PRICING

A.4.1 Pricing Structure – Firm Price with Escalation

Response prices for Merchant Card Processing Services must be firm, all-inclusive, fixed prices for the life of the contract. Contract pricing for may only change in accordance with the Price Adjustments provision of the Contract, provided however, that if a Contractor offers or provides a lower price to any customer for the same goods or services, under the same terms and conditions provided for CPA and its Customers, the Contractor must provide the same lower price under the Contract.

All fees and costs must be listed in the Mandatory Price Sheet. The Description column in the 1.1 Processing Fees tab provides information on the various fee types. There is space is available at the bottom of the forms for entering additional fee types not listed, if needed. If a service is provided at no cost, enter $0.00 (zero) in the cost column. Any fee not listed will be considered as provided at no cost. Note:

• Respondent shall pass through all interchange fees, dues, and assessments (association fees) for all providers WITHOUT MARKUP.

• 100% tokenization and payment optimization is required.

• Early termination fees are not acceptable. See Section B.3.5 regarding termination of contract.

https://www.txsmartbuy.gov/smartbuy-membership

Page A9

Unit prices must include all Contract requirements. Shipping shall be FOB Destination; therefore, unit prices must include statewide delivery (all shipping, handling, and delivery fees and fuel surcharges).

A.5 PRICE ADJUSTMENTS

A.5.1 Price Decreases or Discount Increases

Contractor shall immediately implement any price decrease or discount increase that becomes available. Contractor shall notify CPA of price decreases or discount increases by email to:

spd.cmo@cpa.texas.gov

A.5.2 Price Adjustment Calculation – Equipment Only

This Contract provides for price increases only in connection with increases in manufacturer list pricing. To be eligible for a contractual price increase on any item, Respondent must submit an acceptable manufacturer’s price list that includes the item. The list must be current as of the submission date of the Proposal and price increase request. The list must be in a form recognized in the applicable industry; a price list prepared for purposes of this Solicitation is not acceptable. The list must include an effective date or other verification that it is current. CPA must be able to verify the list using an external or third-party source, such as reviewing the manufacturer’s website or corresponding with the manufacturer’s representative. CPA may reject a price list in its sole discretion. CPA may disqualify any Response that does not include a manufacturer’s price list.

If the Respondent is unable to provide an acceptable manufacturer’s price list, Respondent may request CPA to consider an appliable PPI or other documentation of its cost to perform the Contract, such as quotes or invoices. CPA may consider cost documentation that in its sole discretion is acceptable.

Acceptable cost documentation must at a minimum be (1) clearly related to Contract performance, (2) verifiable by an external or third-party source, (3) certified as complete and accurate by the Respondent, under penalty of perjury, and (4) include the proportion or amount of the respective cost (i.e., fuel is 15% of the total cost or fuel cost is $30.00 of the total cost). CPA may reject cost documentation in its sole discretion.

For a price adjustment request, after the initial contract term, the Contractor will calculate the maximum allowable Contract price using the following formula:

Maximum Allowable Contract Price = (Original Price ÷ Original Mfg. Price) x New Mfg. Price, where:

(1) “Original Price” is the price at which the item was initially awarded to the Contractor;

(2) “Original Mfg. Price” is the price reflected on the manufacturer’s price list submitted with the response or alternate cost documentation accepted by CPA in accordance with this Section;

(3) “New Mfg. Price” is the price reflected in the manufacturer’s price documentation or alternate cost documentation submitted by Contractor in support of its price adjustment request that CPA in its sole discretion determines is acceptable.

Ineligibility for Price Increases. If Respondent fails to provide an acceptable manufacturer’s price list, applicable PPI, or acceptable alternate cost documentation related to a particular item, CPA may award a Contract at a firm, fixed price for those items. Respondent will not be eligible for any price increases for the duration of the Contract, including all renewal and extension periods.

mailto:spd.cmo@cpa.texas.gov

Page A10

A.5.3 Price Adjustment Calculation – Fees and Services

Contractor fees may be adjusted at time of renewal or at the sole discretion of CPA throughout the term of the Contract upwardly or downwardly when correlated with the index specified below and published by the Bureau of Labor Statistics (BLS).

BLS website: http://data.bls.gov/cgi-bin/srgate

Producer Price Index: PCU5221105221104 / PPI Industry data for Commercial Banking-Other Banking Services, Not Seasonally Adjusted

Note: Enter the index number in the Series ID box and click Next and “Retrieve Data.”

For a price adjustment request, after the initial contract term, the Contractor will calculate the maximum allowable Contract price using the following formula:

Maximum Allowable Contract Price = (Original Awarded Price ÷ Original Index) x New Index, where:

(1) “Original Awarded Price” is the price at which the item was initially awarded to the Contractor;

(2) “Original Index” is the index value for the month and year that Responses to this Solicitation were submitted; and

(3) “New Index” is the index value for the month and year that the price increase request is submitted.

If the Respondent can demonstrate that the price index lags behind costs of performance or does not account for significant costs of performance, Respondent may request CPA to consider other documentation of its cost to perform the Contract, such as quotes or invoices. CPA may consider cost documentation that in its sole discretion is acceptable. Acceptable cost documentation must at a minimum be (1) clearly related to Contract performance, (2) verifiable by an external or third-party source, (3) certified as complete and accurate by the Respondent, under penalty of perjury, and (4) include the proportion or amount of the respective cost (i.e., fuel is 15% of the total cost or fuel cost is $30.00 of the total cost). CPA may reject cost documentation in its sole discretion.

A.5.4 Price Adjustment Requests

Proposed pricing must remain firm for the initial term of the Contract. After the initial term of the Contract, price adjustments may be requested based upon the formula in Section A.5.2 and Section A.5.3, respectively.

CPA may accept, reject, or negotiate price adjustments. The Contractor will receive written notification from Statewide Contract Management (SCM) documenting action taken, including effective dates, when appropriate.

If a complete, properly submitted price increase request is rejected, the Contractor may request to cancel the Contract for those items covered by the request. CPA may approve or reject item cancellation requests. CPA will specify the effective date of item cancellation in its written notice of approval. Purchase orders dated prior and up to the effective date of approval or cancellation, as applicable, must be honored at the Contract price in effect when issued.

Price adjustment requests and cancellation requests under this section should be sent by email to:

spd.cmo@cpa.texas.gov http://data.bls.gov/cgi-bin/srgate

Page A11

A.5.5 Tariffs

The parties may agree to adjust prices periodically to reflect changes in tariffs implemented after the Response Due Date that affect the cost of supplying goods under this Contract. Any existing tariffs at the time of the response should be considered as part of the response price. To request a price increase related to tariffs, Contractor must provide documentation that includes the effective date, amount, and scope of the tariffs. Contractor must demonstrate with specificity the effect of tariffs on its necessary and reasonable cost of supplying goods under this Contract, including its commercial reasons for using a source subject to tariffs. Any adjustment is at CPA’s sole discretion. If CPA grants an adjustment related to tariffs, Contractor shall monitor tariff levels and notify CPA within five business days of any reduction or repeal. CPA may reduce or retract a tariff adjustment it has granted at any time by notifying the Contractor of the new prices.

A.6 INSURANCE

The Response must include a statement that Respondent intends to obtain and maintain for the term of the Contract (and any renewal periods) the minimum insurance coverage specified in the table below.

The Response should also describe other insurance coverage maintained by Respondent in the ordinary course of business and provide proof of same in its Response. If Respondent’s normal and customary insurance coverage exceeds the minimum required amounts in this Solicitation, the Contract will require those normal and customary types and amounts of coverage. Proof of insurance may be provided in the form of current certificates of insurance.

Respondent may propose alternate insurance amounts or coverages in the form of an exception. See Section A.17.11 If CPA rejects the exception, the Respondent shall obtain the minimum coverage listed.

Any subcontractor performing work under this Contract must meet the same minimum insurance requirements. Contractor shall ensure its subcontractors’ compliance with all requirements.

Page A12

Minimum Required Amounts of Insurance Coverage Type of Insurance Each Occurrence/Aggregate Commercial General Liability (Occurrence based) Required types of coverage: Blanket, Broad Form Property Damage, Premises and Operations Hazards, Products and Completed Operations Hazards, Independent Contractor’s, and Contractual Liability

Bodily Injury and Property Damage $1,000,000 Each Occurrence Limit $2,000,000 Aggregate Limit $2,000,000 Products/Completed Operations Aggregate Limit $1,000,000 Personal Injury and Advertising Liability

Automobile Liability All Owned, Hired and Non-Owned Vehicles (Required if the Contractor owns vehicles or uses vehicles to perform the Contract)

$500,000 Combined Single Limit (for each accident)

Workers’ Compensation (Required if the Contractor has one or more employees)

Statutory Limits

Employer’s Liability Bodily Injury by Accident Bodily Injury by Disease Bodily Injury by Disease

$1,000,000 Each Accident $1,000,000 Each Employee $1,000,000 Policy Limit

Umbrella or Excess Liability

$10,000,000 per Occurrence of additional coverage (either Umbrella or Excess Liability) for all liability policies required for this Contract (excluding Workers’ Compensation insurance)

Additional Insurance

Additional insurance and related provisions may be required by Customer depending on Customer’s particular circumstances. Customer will identify any additional insurance requirements when placing a purchase order

Bankers Professional Liability/Errors and Omissions $10,000,000 per Occurrence

Cyber Liability Coverage $15,000,000 per Occurrence

Crime Insurance $15,000,000 per Occurrence

All required insurance policies must be issued from a company or companies with a Financial Strength Rating of “A-” or better and a Financial Size Category of VIII or larger from AM Best. CPA may consider other sources of information and reserves the right to determine whether an insurer is acceptable in its sole discretion.

Page A13

All insurance policies must be issued by companies authorized to do business under the laws of the State of Texas and in a form satisfactory to CPA. Except as specified below, all of the Contractor’s insurance policies must:

(1) be written on a primary and non-contributory basis;

(2) name the state of Texas as a certificate holder on all certificates of insurance;

(3) name the state of Texas, its officers and employees as additional insureds on all policies other than workers’ compensation and professional liability; and

(4) include a waiver of subrogation in favor of the state of Texas, its officers and employees for bodily injury (including death), property damage or any other loss arising from this Contract or any purchase order.

Contractor shall submit current certificates of insurance to CPA within five business days of receiving a request from CPA. In its sole discretion, CPA may allow Contractor to satisfy insurance requirements with coverage of a third-party providing goods or services under the Contract, such as products liability coverage provided by a manufacturer, that will provide comparable protection to CPA and Customers. However, the Contractor shall maintain at least $1,000,000 of commercial general liability coverage for itself.

The Contractor must provide proof of coverage. Notices shall be sent to the contact listed in Section A.12.4, Points of Contact. Failure to submit acceptable proof of insurance may result in termination.

Contractor shall maintain the required insurance throughout the Contract.

Contractor must disclose on its insurance certificate whether any of the coverage required under the Contract is being satisfied with a Self-Insured Retention (SIR) and list the amount of the SIR. CPA may, in its sole discretion, accept or reject any SIR in excess of $100,000, or “greater than $X” if accompanied by certification that the company maintains the capital to cover the SIR and Contractor shall provide any documentation requested by SPD. Respondent must complete and return Attachment E - Self Insured Retention Certification and Request for Approval before SIR can be evaluated.

Contractor shall:

(1) provide written documentation to Statewide Contract Management (SCM) by email at spd.cmo@cpa.texas.gov at least 30 calendar days prior to any cancellation, non-renewal, or material change of a required policy;

(2) ensure all insurance policies and certificates of insurance for required coverage are written to include all products, services, and locations related to Contractor’s performance under the Contract; and

(3) deliver proof of all renewal policies prior to any expiration of a required policy to SCM by email at spd.cmo@cpa.texas.gov. All renewal policies and corresponding certificates of insurance must meet all terms set forth in the Contract.

Contractor must ensure that all provisions of the Contract concerning liability, duty, and standard of care, together with the indemnification provision, are underwritten by contractual liability coverage sufficient to include such Contractor’s obligations under the Contract.

Page A14

A.7 REQUIREMENTS AND SPECIFICATIONS

A.7.1 Respondent Qualifications

The Respondents shall:

(1) Be a company or an individual or whose partners or principals or both are engaged in the business of providing merchant card services to large Federal or State government agencies for a minimum of 7 years within the last 10 years. Recent start-up businesses do not meet the requirements of this solicitation. A start-up business can participate as a subcontractor or HUB protégé. See https://comptroller.texas.gov/purchasing/vendor/hub/ for information about the HUB program.

(2) Be a company or an individual whose partners and participants have not filed for bankruptcy within the last 10 years.

NOTE: A start-up business is defined as a new company that has no previous operational history or expertise in the relevant business and is not affiliated with a company that has that history or expertise. Two companies are affiliated if the two companies have a common parent company or if one is the parent or subsidiary of the other.

A.7.2 Operations

Section A.17.9 requires that responses must describe the services that will be available through this contract for domestic US operations only.

NOTE: Most State Agencies use Texas.gov for internet or web related payments. Texas.gov is covered by a separate payment services contract and will not be part of this contract. Texas SmartBuy Members do not use Texas.gov and will have varying web application requirements.

Credit and Debit Card Acceptance/Authorization

• Electronic authorization services, including Internet, if other than Texas.gov and phone authorization, 24 hours per day, seven days per week.

• An initial response time of not more than 30 seconds for any transaction with a monthly average of no more than 12 seconds per transaction.

• Electronic authorization through a Point of Sale (POS) terminal.

• Electronic authorization through a computer.

• Back-up procedures for alternative authorization in the event that the individual Customer is unable to access the system via computer or POS terminal.

• Procedures to securely issue a credit to a customer account.

• A means of alternative authorization provided during network downtime.

• Acceptance of payments from Internet sales, if other than Texas.gov.

ACH and eCheck Payments

• Support for all NACHA formatted Standard Entry Class (SEC) Codes.

• The ability to connect and support ACH and eCheck payment transactions, including same-day transactions.

https://comptroller.texas.gov/purchasing/vendor/hub/

Page A15

• Deposit all funds for all ACH and eCheck payments into the appropriate CPA-Treasury account for state agencies and into designated accounts for Texas SmartBuy Members.

• Propose a funds flow process for debit-based ACH and eCheck payments by a Consumer, subject to CPA approval.

• Funds flow process shall minimize risk to CPA, Customers, Consumers, and Contractor.

• Funds flow process shall be mutually agreed to by the Parties prior to award.

• Respondent’s bank account(s) shall be Federal Deposit Insurance Corporation (FDIC) insured.

• Support for variable recurring payments.

A.7.3 Types of Cards and Payments Accepted

Responses should include a description of the Respondent’s ability to process all credit and debit cards identified in the Mandatory Price Sheet. At a minimum, Respondents must be able to process payments made with MasterCard, Discover, American Express, Visa, Apple Pay, and other mobile payment and digital wallet services. Per Section A.17.9, Responses must outline the basic differences among the various credit and debit card acceptance conditions and processing procedures. Individual Customers must be able to enter credit and debit card transactions using the same verification method and procedures.

A.7.4 Payment Gateway

Per Section A.17.9, Responses should include a listing and description of the different gateways available under their proposed response and Customer’s ability to choose the gateway that best meets their needs. Description should include detailed information on encryption, verification, security, fees, and technology/software platform for each gateway offered.

A.7.5 Settlement

All funds received from credit card, debit card, ACH and eCheck transactions from State Agencies must be deposited to an account at a financial institution designated by CPA, unless stated otherwise in statute. All funds received from credit card, debit card, ACH and eCheck transactions from Texas SmartBuy Members must be deposited to the accounts designated by the Texas SmartBuy Member.

• The awarded Contractor must provide the settlement of funds as soon as possible, but no later than two banking days following the transaction day.

• There must be a separate electronic deposit for each merchant number.

• The awarded Contractor is not authorized to subtract from amounts deposited any discounted fees, chargebacks or any miscellaneous debits. These items must appear individually, and service charges must be handled separately.

• All transactions must be processed at the end of the monthly cycle, regardless of size.

• Customers must have access to an online system to research settlement information.

• CPA must also be able to distinguish the type of transaction by identification in each individual

ACH transfer record for accounting purposes.

Section A.17.9 requires a description of how quickly funds will be deposited, the ability of the Respondent to have one deposit per merchant number, and your company’s ability to deposit the full value of transactions with chargebacks, miscellaneous debits and service charges handled separately.

Responses must list, as required in Section A.17.9.3, the name(s) and telephone number(s) of the

Page A16 person(s) specifically assigned to handle error resolution, research, and administrative assistance with regard to settlement of funds.

A.7.6 Chargebacks

All chargebacks must be processed by the applicable card Associations’ regulations governing chargebacks. Awarded Contractor must provide an option for Customers to research and view chargeback information on the internet and have electronic notification of chargeback sent to Customer.

In Section A.17.9.1, responses must specifically describe the procedures to be followed by all parties in the event of a chargeback. Responses must describe all chargeback procedures and conditions in detail.

A.7.7 Equipment/Computer Software

Most locations will process transactions through a personal computer with card information input through a card reader device. For other locations, transaction input may be divided among personal computer and Point of Sale (POS). In addition, Customers may need connections to accept payments for online sales, if other than Texas.gov.

The Mandatory Price Sheet includes a listing of the current equipment in use. Please note that this equipment may change before the start of the new contract. Customers will make all decisions concerning when and if they need new equipment.

Individual Customers may need to have computer and/or POS software that is somewhat specialized.

Certain Customers may need the ability to enter transactions accompanied by some type of code, to allow for subtotals by revenue type. For example, if one purchase included a gift item, a restaurant meal, and a lodging fee, a Customer would enter the revenue code for each item, but charge the Consumer’s card a grand total amount. At the end of the transaction day, the Customer will need the ability to obtain subtotals by revenue type. Describe your ability to accommodate this code requirement in your response to Section A.17.9.1. Additionally, describe your company’s ability to provide specialized software to meet each entity’s internal needs. In this Section, describe any value added software features that are provided at no cost, such as inventory control or auditing.

A.7.8 Data Activity and Settlement Reporting

Per Section A.17.9.1, responses must describe the ability of the Respondent to meet reporting needs and the number of months this information is available online. Responses must describe (see Section A.17.9.5) any additional reports that are available. Any fees associated with these reports must be listed on the Mandatory Price Sheet.

Individual Customers’ staff, at each location, must be able to print a report from both a computer and POS terminal printer, daily and monthly which would include the following information about each transaction:

• Operator identification number.

• Last four digits of cardholder number.

• “Last four” type identifier for ACH and eCheck accounts.

• Date and time of transaction.

• Unique trace or reference number.

Page A17

• Card type, for example, MasterCard or VISA.

• Accepted/declined status.

• Sale/return code.

• Authorization/approval code.

• Dollar amount of transaction.

• Discretionary field.

• Surcharge or convenience fee for transaction.

Further, it is required that the Customer’s staff at each location, have the ability to print a report listing subtotals by revenue type.

The staff at the Customer’s headquarters must have the ability to obtain previous business day’s transaction totals from the awarded contractor by data file transfer electronically. Further, Customer’s headquarter staff must have the ability to obtain previous business day’s unsuccessful transactions.

Monthly reports must be available via Internet online access for Customers. Hard copy monthly reports must be provided upon Customer request.

Contractor must provide the Treasury Division of the Comptroller’s Office the ability to obtain transaction totals listed by participating State Agencies electronically and must have this information on the day that the funds are deposited.

A.7.9 Monthly Billing and Payments

Part B, General Instructions and Contract Terms and Conditions, Section B.5.3 Invoicing and Payment Requirements do not apply to the fee for service portion of this contract.

For State Agencies, the awarded contractor may directly Automated Clearing House (ACH) debit the Comptroller’s Office account once per month. The monthly debit should be for any and all charges including discount fees, chargeback fees, adjustment fees, and miscellaneous fees. The ACH debit must also be identified as a fee in the ACH record.

The awarded contractor must provide a monthly service charge report (statement) detailing the total dollar volume, the number of transactions processed, ACH, eCheck, or card type and any and all service charges to each participating Customer. Separate monthly billing must be provided for Customer’s different Merchant Numbers. This report shall be made available on-line for research and reconciliation.

The individual participating Texas SmartBuy Members are solely responsible for payment from funds or accounts of those entities. CPA is not responsible for any payments to awarded contractor or any other entity under this RFP or any contract resulting from this RFP.

Per Section A.17.9.1, describe your billing procedures to meet the above requirements and provide a sample monthly statement.

A.7.10 Surcharges and Convenience Fees

Per Section A.17.9.1, all responses must describe the Respondent’s ability to assist Customers as requested to add fees to their transactions that meet the requirements of the Associations and Business

Page A18 and Commerce Code, Title 12, Chapter 604A.0021. Each agency makes its own decision on whether to charge a convenience fee and if so, what the amount will be.

A.7.11 Security

Contractor must comply with all state and federal laws and regulations regarding confidentiality, privacy and security pertaining to Customer’s confidential information. Contractor represents and warrants that it will employ safeguards to ensure the confidentiality, integrity and availability of Customer information and shall limit the sharing of information based on need to know. Contractor must adhere to the following security requirements:

1. Customers may require a higher level of security including, but not limited to, personnel and physical security requirements (e.g. a higher level of security clearance may be required for Contractor’s employees with access to sensitive Customer systems, such as additional background checks). If additional security is required, Customer will specify further requirements during implementation.

2. Contractor shall provide a program system for Customers that complies with the applicable statutorily required accessibility standards for the State of Texas, to comply with the State of Texas reporting requirements outlined in 1 Texas Administrative Code Chapter 206 and 1 Texas Administrative Code Chapter 213. Contractor shall respond to all written inquiries from CPA regarding the program system’s compliance with requisite accessibility standards within five (5) business days of receiving such request.

Access to Customer Data: Contractor represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of Customer Data. Contractor will not collect, access, use, disclose, or retain Customer Data other than as necessary to perform the services specified in a contract resulting from this solicitation. Contractor will restrict access to Customer Data to only those personnel who must have the information on a “need to know” basis. Contractor will not use Customer Data, or any information derived from Customer Data, for its own benefit or the benefit of any other person or entity. Contractor will not share Customer Data with its parent company or other affiliate.

Location of Customer Data: Contractor shall ensure that Customer Data (i.e., primary and backup) remains, at all times, within the continental United States. Contractor shall receive, process, transmit, and store all Customer Data within the continental United States. Contractor’s point of access to Customer Data shall be within the continental United States.

Encryption Standards:

1. Contractor shall encrypt Customer Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2. Contractor shall utilize encryption standards that are FIPS 140-2 compliant.

3. Minimum cryptographic algorithm used by Contractor must be Advanced Encryption Standard

(AES) 128 or higher (256 AES is preferred).

Page A19

4. Contractor shall encrypt Customer Data transmitted over a public or private network. Approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over SSL), (3) HTTPS (HTTP over SSL), and (4) virtual private network.

Independent Information Security Assessment: If Contractor has access to a Customer Information System or receives, processes, transmits, or stores Customer Data, then Contractor shall provide CPA with a summary report of the most recent information security assessment conducted by an independent third-party (e.g., SSAE-18 SOC 2 Type II, ISO 27002) upon contract award and annually thereafter. CPA, in its sole discretion, may conduct a security assessment of any information system holding Customer Data or connected to a Customer Information System. CPA’s security assessment may consist of a review of the following: (i) independent third-party assessment(s) contracted by Contractor (e.g., SSAE-18 SOC 2 Type II, ISO 27002), and, and (ii) Contractor’s System Security Plan.

Media Sanitization: Contractor shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when Customer Data in the custody of Contractor is no longer required to be retained by contract with CPA.

Contractor must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information: (i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the contract with CPA, Contractor must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of Customer Data by Contractor is technically impossible or impractical. Contractor’s obligations set forth in this clause survive the termination or expiration of the contract as long as Contractor retains Customer Data.

Third-Party Service Providers: It is Contractor’s sole responsibility to ensure that its access and the access Contractor grants to its service providers to Customer Data or Customer Information Systems does not result in unauthorized access to Customer Data or Customer Information Systems.

Payment Card Industry Standards: Contractor shall implement and maintain certification of Payment Card Industry (PCI) compliance standards. In addition, Contractor represents and warrants that the software used for the processing of credit card payments is in compliance with all applicable PCI standards including, but not limited to, PCI SSC’s Software Security Framework (SSF) and Point to Point Encryption Solution Requirements (P2PE).

Security Incident Notification: Contractor shall have policies and procedures for the effective management of Security Incidents that shall be made available to CPA upon written request.

Within 24 hours of Contractor’s discovery or reasonable belief and Contractor’s relationship manager knowledge that there has been an event that results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential Customer information (“Security Incident”), Contractor shall provide notice to CPA by calling (800) 531-5441 EXT 34357.

Until the investigation is complete, Contractor shall submit daily, or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes all event details Contractor is permitted by law or Contractor’s internal policies to be shared with CPA. Contractor shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Contractor shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Contractor. If Contractor does not reimburse such costs

Page A20 within 30 days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, and should CPA choose to do so, Contractor shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).All responses must describe in Section A.17.7.1, the Respondent’s security controls, tokenization, and safeguards to protect credit…