ESBD_488348_1773259594159_304-26-1692 FIDM Svcs, Q&A Final 3.11.2026.pdf

RFP #304-26-1692SH FIDM Services Page 1 of 7 CPA’s Official Response to Questions

Request For Proposals

Financial Institution Data Match (FIDM) Services

RFP No. 304-26-1692SH

Comptroller’s Official Responses to Questions from Potential Respondents

March 6, 2026

1. Regarding technology platform and deployment preferences (Note: Please refer to the bottom after Question 13 for extra details):

(a) Can the Comptroller describe the current FIDM technology environment, including hosting platform, data matching technology, FI portal (if any), and integration points with Comptroller systems

(b) Is the Comptroller open to either: (i) a contractor-provided product/platform installed within CPA's data center or state cloud, OR (ii) a custom-developed solution hosted on the contractor's TX-RAMP certified cloud environment?

Is there a preferred deployment model?

(c) As the Comptroller open to the use of Artificial Intelligence (AI) and Machine Learning (ML) technologies to enhance matching accuracy, predictive analytics, compliance monitoring, or FI support services? If so, are there any CPA Infrastructure to support AI and policies or guidelines governing AI usage that respondents should be aware of?

COMPTROLLER RESPONSE:

Reference Section 1.1 (Background); Successful Respondent shall serve as Comptroller’s agent in performance of all FIDM Services. Reference Section 1.3 (Definitions and Acronyms), noting the definition for FIDM: “The exchange of data between a Financial Institution and Successful Respondent...” (emphasis added). Reference Section 4.2.8 (Respondent Narrative, Preliminary Work Plan, and Proposed Transition Plan). It is solely Respondent’s responsibility to thoroughly review the entire RFP and to ensure Respondent’s Proposal demonstrates with sufficient detailed description and explanation how Respondent’s offered services will meet or exceed the requirements of the RFP.

(a) Reference Part II (Scope of Work), including but not limited to Sections 2.1.3 (Data Exchange, Data Quality Control, and Data Matching) and 2.1.5.1.d.ii (Sharing of information) for minimum requirements Successful Respondent must deliver under the Contract. Under the current contract for substantively same FIDM Services, all Services are delivered turnkey using current contractor’s proprietary solutions (hosted by current contractor).

Comptroller uses ANSI standard file formats documented in Appendix A (Multistate Financial Data Match Specifications Handbook). Comptroller’s technology used in batch file transfers includes MVS JES3, Control-M, and GlobalScape. Comptroller is not required to maintain an internal FI portal for file transfers.

(b) See Comptroller Response to Question 1(a).

(c) See Comptroller Response to Question 1(a).

2. Is there a current FIDM services contractor, and if so, can the Comptroller provide information on the current contract value, the incumbent vendor's name, and any lessons learned or challenges experienced with the current program that the Comptroller would like addressed in the new contract?

COMPTROLLER RESPONSE: The current contractor is Informatix, Inc. The total amount paid under the existing contract through December 31, 2025 is $714,595.00.

3. How many Financial Institutions (FIs) are currently authorized to do business in Texas that would be required to participate in the FIDM program? Of these, how many are currently enrolled (if applicable), and what is the approximate breakdown between Method 1 and Method 2 reporting preferences?

RFP #304-26-1692SH FIDM Services Page 2 of 7

COMPTROLLER RESPONSE: The following data is accurate as of December 31, 2025:

Texas FI required to participate

FI

enrolled FI using

Method 1 Reporting FI using

Method 2 Reporting 926 910 255 655

4. The RFP indicates a Services Commencement Date of July 1, 2026. Does the Comptroller expect full production data matching to begin on July 1, 2026, or is this date intended to mark the beginning of the implementation/development phase with a later "go-live" date for production operations? If the latter, what is the expected timeline for full production readiness?

COMPTROLLER RESPONSE: Reference Anticipated Schedule of Events on RFP page 1 and in Section 3.5 (Schedule of Events). Services Commencement Date is July 1, 2026 or as soon thereafter as practical (emphasis added).

Reference Sections 1.1 (Introduction), and 2.1 (Services Description) for description of required Services, including but not limited to development of a project plan for implementation. Also see Comptroller Response to Question 1.

5. Can the Comptroller provide historical data on (a) the average number of matches (full and partial) per quarter, (b) the typical "hit rate" (percentage of delinquent taxpayers matched to FI accounts), and (c) the average dollar value of matched accounts? This information would assist in developing accurate cost projections and performance benchmarks.

COMPTROLLER RESPONSE:

Average Full Matches

Per Quarter Average Partial Matches

Per Quarter Hit Rate

Percentage Average Dollar Value Of Matched Accounts

420,093 106,291 61.8% $18,303

6. Section 2.2.3 references payment based on the Mandatory Price Sheet schedule. Can the Comptroller clarify whether payment is expected to be (a) a flat monthly fee, (b) per-match fee, (c) per-FI enrolled fee, (d) per-Delinquent Taxpayer processed fee, or (e) some combination? Additionally, is there a preferred pricing model that would best align with the Comptroller's budget structure?

COMPTROLLER RESPONSE: Reference Section 4.2.9 (Proposed Fee) and Exhibit A, Attachment C (Mandatory Price Sheet). Also reference Section 2.2.5 (Optional Features, Products or Services).

7. In the event of transition from an existing contractor, will the Comptroller facilitate access to (a) the current FI database including enrollment status and contact information, (b) existing CFI Agreements, (c) historical compliance records, and (d) current file formats and technical specifications? What is the expected transition timeline and level of cooperation from any incumbent?

COMPTROLLER RESPONSE: Reference Section 2.1.5.1.d.iv (Transition Services). In event of transition of Services from the incumbent, orderly transition will be within a reasonable period of time that in no event will exceed 90 days, and:

(a) Comptroller or Comptroller’s specified third party will provide Successful Respondent with a list of FI and information on the then current status, including compliance and reporting, of the FI.

(b) Comptroller or Comptroller’s specified third party will provide Successful Respondent copies of existing CFI Agreements. Also see Comptroller Response to Question 35.

(c) See Comptroller Response to Question 7(a).

(d) See Comptroller Response to Question 1.

8. Section 2.2.5 indicates the Comptroller is "particularly interested in receiving pricing and detailed description for lien/levy services." Can the Comptroller provide additional details on the specific lien/levy services desired, including expected volumes, types of levies, and how these services would integrate with the core FIDM matching services?

COMPTROLLER RESPONSE: Reference Sections 1.2 (Background) 2.1 (Services Description), and 2.2.5 (Optional Features, Products or Services). Lien/levy services, if offered, shall be related to accounts within required FIDM Services. It is solely Respondent’s responsibility to provide a detailed description of any offered lien/levy services and integration with the required FIDM Services and provide applicable pricing for such optional services.

9. Section 2.2.4 establishes liquidated damages of up to $500 per calendar day of default for failure to timely deliver Services. Can the Comptroller clarify (a) which specific deliverables or milestones would trigger liquidated damages,

(b) whether there is a cure period before liquidated damages apply, and (c) whether FI-caused delays (e.g., late submission of data) would be excluded from liquidated damages calculations?

RFP #304-26-1692SH FIDM Services Page 3 of 7

COMPTROLLER RESPONSE: Reference Section 2.2.4 (Liquidated Damages) and Exhibit A, Section XIII (Term and Termination). Reference Section 4.2.1 (Transmittal Letter) last paragraph for instructions applicable to a Respondent taking exception to any RFP provisions or to Exhibit A (Sample Contract) terms and conditions. Also see Exhibit B, paragraph 38.

10. Section 14.9(t) requires TX-RAMP Level 2 Certification. For vendors not currently TX-RAMP certified, (a) is provisional certification acceptable at contract award with full certification required by go-live, (b) what is the expected timeline for Comptroller security assessment activities, and (c) will the Comptroller accept FedRAMP Moderate authorization as an alternative path to TX-RAMP Level 2?

COMPTROLLER RESPONSE:

(a) Reference Exhibit A, Section 14.9.t) (State Authorization and Risk Management Program (TX-RAMP)). Contractor shall obtain TX-RAMP certification in accordance with the Texas DIR TX-RAMP Manual.

(b) Reference Exhibit A, Section 14.9.l) (Independent Information Security Assessment).

(c) See Comptroller Response to Question 10(a).

11. Regarding proposal evaluation: (a) Will the Comptroller provide scoring sheets or a more detailed scoring rubric beyond what is stated in Section 5.2? (b) What criteria will determine which respondents are invited to oral presentations? (c) Will oral presentations be scored separately or used to adjust written proposal scores? (d) Is there a minimum score threshold for a proposal to be considered responsive?

COMPTROLLER RESPONSE:

(a) No. See Part V (Proposal Evaluation and Selection).

(b) See Comptroller Response to Question 11(a).

(c) See Comptroller Response to Question 11(a).

(d) See Comptroller Response to Question 11(a).

12. Subcontracting Restrictions: Are there any restrictions on the percentage of work that can be subcontracted, or any requirements that specific functions (e.g., data matching, FI outreach) must be performed by the prime contractor?

COMPTROLLER RESPONSE: Reference Sections 3.3 (Respondent Obligations), 4.2.5 (Proposed Subcontractor(s) Identifying Information), and 4.2.6 (Respondent and Proposed Subcontractor(s) Qualifications and Experience). There are no minimum or maximum requirements applicable to the percentage or type of subcontracted work. There are no requirements that specific functions must be performed by Successful Respondent. Also see Exhibit A, Section III (Services) and Exhibit B, paragraph 24.

13. Reference Requirements: Section 4.2.6 requires references from "projects similar in size, scope and nature." Will the Comptroller accept references from FIDM programs operated for child support enforcement purposes, or must references be specifically from tax-related FIDM programs?

COMPTROLLER RESPONSE: Reference Part II (Scope of Work) and Section 4.2.6.1 (Experience), noting subparagraphs b., c., and d. For clarity related to Section 4.2.6.3 (References) requirements: Comptroller does not restrict “nature” of similar FIDM services projects to only those that are tax-related FIDM services. It is solely Respondent’s responsibility to ensure Respondent’s Proposal includes a complete description of work performed and deliverables provided that demonstrates how the Respondent’s experience and referenced projects meet the requirements stated in the RFP.

14. Extra Details:

To ensure a seamless transition and develop the most effective technical approach, can the Comptroller please provide information on the current FIDM program's technology infrastructure and preferences for the new solution:

(a) Data Exchange Platform: What technology platform is currently used for secure file transfer with Financial

Institutions (e.g., proprietary SFTP server, third-party managed file transfer solution, cloud-based platform)? What is the current hosting environment (on-premises data center, state-managed cloud, commercial cloud provider such as AWS, Azure, or GCP)?

(b) Encryption & Security: What PGP/GPG key management system is currently in use? Are there existing encryption keys that would need to be transitioned, or will new keys be generated for the new contract?

(c) Data Matching Technology: What database or data matching engine is currently used for matching delinquent taxpayer records against FI account data? Does the Comptroller currently use any fuzzy matching or probabilistic matching tools, or is matching strictly deterministic based on TIN/SSN?

RFP #304-26-1692SH FIDM Services Page 4 of 7

(d) FI Portal/Interface: Is there an existing web portal or application that Financial Institutions use for enrollment, file submission, compliance tracking, or communication? If so, what technology stack powers this portal?

(e) Integration Points: What systems does the FIDM solution currently integrate with at the Comptroller's office (e.g., tax system of record, collections system)? What integration methods are used (APIs, batch file transfers, direct database connections)?

Deployment Model Preferences:

(f) Product vs. Custom Development: Is the Comptroller open to either of the following deployment approaches, or is there a preferred model?

Option 1 - Contractor Product Installation: Contractor provides a proven Commercial Off-The-Shelf (COTS) or proprietary FIDM platform to be installed and operated within the Comptroller's data center or state-managed cloud environment

OR

Option 2 - Contractor-Hosted Custom Solution: Contractor develops and hosts a custom-built solution on the contractor's TX-RAMP certified cloud environment, with the Comptroller accessing the system via secure web interface and APIs.

(g) Data Residency: If a contractor-hosted cloud solution is acceptable, are there specific data residency requirements (e.g., data must reside within Texas or the United States)?

Emerging Technologies:

(h) Artificial Intelligence & Machine Learning: Is the Comptroller open to the incorporation of Artificial Intelligence

(AI) and Machine Learning (ML) technologies to enhance FIDM program outcomes, such as:

• Intelligent matching algorithms to improve match accuracy and reduce false positives

• Predictive analytics to prioritize high-value accounts for levy action

• Automated anomaly detection for FI compliance monitoring

• AI-powered chatbots or virtual assistants for FI support and inquiry handling

• AI for automated document review and data extraction As AI/ML is of interest, are there any specific Comptroller policies, ethical guidelines, or approval processes that would govern the use of AI in this program?

COMPTROLLER RESPONSE:

(a) Reference Sections 2.1.5.d.ii (Sharing of Information) and 2.2.1 (Information Technology Requirements). The current hosting environment for Comptroller’s files is Comptroller’s on-premises data center. See Comptroller Response to Question 1.

(b) See Comptroller Response to Question 14(a).

(c) See Comptroller Response to Question 1.

(d) See Comptroller Response to Question 1.

(e) See Comptroller Response to Question 1.

(f) See Comptroller Response to Question 1.

(g) See Comptroller Response to Question 14(a).

(h) See Comptroller Response to Question 1.

15. Will the Comptroller please provide the historical volume of “non-compliant” Financial Institutions (Types 1-4) over the last fiscal year? Specifically, what is the average monthly volume of enforcement calls or letters currently required?

COMPTROLLER RESPONSE: The volume of non-compliant FI for each of FI Types 1 through 4 for Comptroller’s Fiscal Year 2025 (FY25) are: Type 1 (13); Type 2 (2); Type 3 (63); and Type 4 (0). The average volume of monthly enforcement calls for FY25 is 13, and the average volume of monthly enforcement letters issued by vendor for FY25 is 13, representing at least one call and one letter per month per each non-compliant FI. There are no minimum volume requirements for enforcement calls or letters under the existing contract.

16. Does the Comptroller permit vendors to leverage a Master Data Management (MDM) solution to derive and maintain the contact list for all Financial Institutions authorized to do business in Texas using regulatory listings or will we be required to leverage a pre-existing, verified, up-to-date list provided by the Comptroller?

COMPTROLLER RESPONSE: Reference Part II (Scope of Work), including but not limited to Section 2.1.2 (Outreach and Support to Financial Institutions); reference Section 4.2.8 (Respondent Narrative, Preliminary Work

RFP #304-26-1692SH FIDM Services Page 5 of 7

Plan, and Proposed Transition Plan). It is solely Respondent’s responsibility to ensure Respondent’s Proposal demonstrates how the offered services will meet or exceed the requirements of the RFP.

17. Our Data Governance Program service establishes governed frameworks to improve data quality. Regarding Section

2.1.3.3 (Data Quality Control), will the Comptroller provide an existing Data Dictionary and set of business rules for data correction, or is the vendor expected to develop the Data Governance Framework and standardized definitions as part of the Data Strategy phase?

COMPTROLLER RESPONSE: Reference Section 2.1.3.3 (Data Quality Control) and Appendix A (MSFIDM Handbook).

18. Our practice specializes in Advanced Analytics & AI. Regarding Section 2.1.5.2 (Partial Matches), is the Comptroller open to the use of probabilistic matching models or AI-driven predictive analytics to score 'Partial Matches' by likelihood of accuracy, rather than relying solely on static character-matching logic (which we are more than capable of doing)?

COMPTROLLER RESPONSE: See Comptroller Response to Question 14(c).

19. Section 2.2.1 specifies the use of a single static IP address for SFTP, however, given modern high-availability cloud architectures, would the Client accept small, defined range of IP addresses (whitelisted subnet) to ensure redundancy and uptime, eliminating a single point of failure?

COMPTROLLER RESPONSE: Reference Section 2.2.1 (Information Technology Requirements). Also see Section

4.2.1 (Transmittal Letter), last paragraph and Exhibit B, paragraph 38.

20. The RFP mentions the Comptroller utilizes an IBM Mainframe. Will the Comptroller confirm if the vendor will be required to interface directly with the mainframe protocols (e.g., EBCDIC encoding, specific job control headers, etc.), or is the interface strictly limited to dropping standard ASCII text files via the SFTP server? Is this IBM Mainframe an

AS/400?

COMPTROLLER RESPONSE: See Comptroller Response to Question 1. Reference Section 2.2.1 (Information Technology Requirements). Comptroller’s computer hardware used in connection with the Services includes an IBM z17 mainframe.

21. Our Source Data Integration capabilities allow for secure ingestion from disparate systems. While the RFP specifies SFTP, would the Comptroller consider a modernized data exchange architecture (e.g., API-based ingestion or a secure Data Lakehouse landing zone) to improve data consistency and timeliness?

COMPTROLLER RESPONSE: See Comptroller Response to Question 19.

22. The MSFIDM Handbook specifies standard fixed-width file formats. If a Financial Institution is unable to produce this legacy format, is the vendor permitted to accept modern formats (CSV, JSON, XML) from the bank and transform them into the required MSFIDM format before sending to the Comptroller? Or must the banks strictly adhere to the Handbook?"

COMPTROLLER RESPONSE: See Comptroller Responses to Questions 1 and 17.

23. The RFP requests static weekly/quarterly reports (e.g., Full Match Analysis). Our practice delivers Role-Based Dashboards for near-real-time performance monitoring. Would the Comptroller accept secure, interactive dashboards (e.g., PowerBI/Tableau) as a superior substitute for the static PDF/Excel reporting requirements?

COMPTROLLER RESPONSE: See Comptroller Response to Question 1.

24. The RFP requires data to be purged/overwritten with nulls within 60 days. Does this 'purge' requirement extend to automated backup tapes/snapshots stored in immutable cloud storage (AWS S3/Azure Blob), provided those backups age out naturally, or must active destruction processes be run against backup archives as well?

COMPTROLLER RESPONSE: Reference Section 2.2.2.3 “At a minimum, FI and Successful Respondent shall overwrite and save with nulls all DM Files prior to erasing…” (emphasis added). Also see Exhibit A, Section 14.9.m) (Media Sanitization). For avoidance of doubt, if backup archives’ natural aging extends beyond the contractually required retention period or age out prior to end of the contractually required retention period, sanitization must comply with requirements of NIST Special Publication 800-88 (Guidelines for Media Sanitization).

RFP #304-26-1692SH FIDM Services Page 6 of 7

25. In alignment with our System Consolidation and Program Transition capabilities, we utilize automated workflows to manage compliance. Can the Comptroller confirm if 'automated digital notifications' (triggered emails/portal alerts) satisfy the 'minimum contact' requirements for non-compliant FIs, or is manual telephonic outreach strictly mandatory?

COMPTROLLER RESPONSE: Reference Sections 2.1.2 (Outreach and Support to Financial Institutions) and 2.1.4 (Compliance Assurance). Section 2.1.4.3 (Minimum contact…) sets forth minimum contact requirements. Section

2.1.4.5 requires Respondent’s Proposal include a detailed description and explanation of how Respondent’s proposed compliance program meets or exceeds the RFP requirements.

26. Does the Comptroller require the vendor to hold the TX-RAMP Level 2 certification at the organizational level, or is it sufficient if the underlying hosting provider (e.g., AWS GovCloud, Azure Government) holds the certification?

COMPTROLLER RESPONSE: Reference Exhibit A, Section 14.9 (CPA Data Safeguard Standards), paragraph t) (State Authorization and Risk Management Program (TX-RAMP)). It is solely Respondent’s responsibility to thoroughly review the entire RFP and all applicable referenced materials, including Texas DIR TX-RAMP Manual.

For avoidance of doubt, paragraph t) provides that “Contractor shall obtain TX-RAMP certification” (emphasis added) in accordance with Texas DIR TX-RAMP Manual. Contractor will not meet TX-RAMP Level 2 certification via an underlying hosting provider’s certificate.

27. Will the selected respondent be required to store all data on mainframe or is a windows-applicable technology permitted?

COMPTROLLER RESPONSE: Reference Exhibit A, Section 14.9 (CPA Data Safeguards Standards) and Appendix A (MSFIDM Handbook). See Comptroller Response to Question 1.

28. Are there any information technology restrictions on leveraging scripting languages (e.g. Python), third party master data management applications, or database technologies (PostGres, MS SQL Server, etc.) to support this application?

COMPTROLLER RESPONSE: See Comptroller Response to Question 27.

29. Is there a target “go live” date in mind following the July 1, 2026 commencement?

COMPTROLLER RESPONSE: See Comptroller Response to Question 4.

30. Our 'Data Strategy & Governance' service includes Maturity Analysis and Roadmap Development. Is the Comptroller interested in a proposal that includes a 'Phase 2' roadmap to modernize the FIDM program’s data infrastructure (e.g., moving from flat files to a Data Lakehouse model) as part of our strategic value add?

COMPTROLLER RESPONSE: Reference Section 2.2.5 (Optional Features, Products or Services).

31. Does the Comptroller have a starting point of contact information for FI and FI trade associations, or will the selected contractor be required to put together this information?

COMPTROLLER RESPONSE: See Comptroller Response to Questions 7 & 16.

32. Does the Comptroller have draft CFI agreements and/or enrollment forms that may be leveraged as a starting point?

COMPTROLLER RESPONSE: See Comptroller Responses to Questions 1, 7, and Question 35.

33. Please confirm the vetHub target percentage for this RFP.

COMPTROLLER RESPONSE: Reference Section 4.2.13 (Veteran Heroes United in Business Subcontracting Plan).

Reference VetHUB Subcontracting Plan Form (Bid Package #2) posted to the Electronic State Business Daily. See Comptroller Response to Question 12.

34. Does the Comptroller have a CRM system (e.g., Microsoft Power Platform or Dynamics 365 or Salesforce, etc.) that may be used to track and manage FIs and FI trade associations? If so, please provide an overview of what is currently available, including licenses and module(s).

COMPTROLLER RESPONSE: See Comptroller Response to Question 1. Comptroller does not have a CRM system available for Successful Respondent’s use to track and manage FIs and FI trade associations.

35. Pg. 6, Section 2.1.2 Outreach and Support to Financial Institutions - Will new agreements need to be executed for all FIs under the new contract, or will the State accept the FI agreements already in place for the new contract term?

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0

RFP #304-26-1692SH FIDM Services Page 7 of 7

COMPTROLLER RESPONSE: Reference Section 2.1.2 (Outreach and Support to Financial Institutions), paragraph number 3. For clarity, each FI currently participating in FIDM Services has executed a CFI Agreement with Comptroller. Existing CFI Agreements allow amendment of the CFI Agreement only upon written agreement executed by Comptroller and the FI. If Successful Respondent is not the incumbent contractor (see Comptroller Response to Question 2), each existing CFI Agreement will require written amendment for purposes of updating, at a minimum, Comptroller’s designated Agent and Agent’s contact and notice information.

36. Page 18, Section 3.9 Confidential Information; Nondisclosure; Open records & Page 20, Section 4.2, Item #11: As a privately-held company, we consider our Financial Statements as confidential and proprietary including to staff within our organization. May we provide our Financial Statements in a separate password-protected PDF marked Confidential in accordance with Section 3.9 and submit it via a separate email? The password would be provided to the appropriate recipient.

COMPTROLLER RESPONSE: Reference Sections 3.8 (Deadline for Submission of Proposals; Delivery Instructions; Number of Copies Required) and 3.9 (Confidential Information; Nondisclosure; Open Records), and Exhibit F (Certification Regarding Public Nature of the Proposal).

37. Page 23, Section 4.2.11 Financial Statements: Our 2025 audited financial statements will not be available as of the date of submission of this proposal as we are currently undergoing our financial audit. Will our 2024 and 2023 audited financial statements and internally prepared 2025 financial statements suffice for this requirement?

COMPTROLLER RESPONSE: Reference Section 4.2.11 (Financial Statements).

38. Page 35, Section 14.9.t State Authorization and Risk Management Program (TX-RAMP) – Can you confirm that a TX- RAMP certification is not required for this contract if vendor’s solution uses a cloud-based service provider? If one is required, would the state accept a FedRAMP certification from our cloud provider in lieu of the TX-RAMP certification?

COMPTROLLER RESPONSE: See Comptroller Response to Question 10.

39. Exhibit A, Sample Contract, Art. X Insurance, Pg 30, Subsection (iii): Respondent’s Professional Liability Insurance coverage is per claim, rather than per occurrence. Will the Comptroller accept claims-made rather than occurrence-based policy in the amounts stated?

COMPTROLLER RESPONSE: Reference Section 4.2.1 (Transmittal Letter) last paragraph for instructions applicable to a Respondent taking exception to any RFP provisions or to Exhibit A (Sample Contract) terms and conditions. Also see Exhibit B, paragraph 38.

40. Exhibit A, Sample Contract, Art. X Insurance, Pg 30, last paragraph: Because our insurance carrier no longer includes a cancellation notice requirement on the policy document in conformance with industry-wide practices, will the Comptroller accept direct notification from the Contractor in regard to 30 days’ prior written notice of cancellation?

COMPTROLLER RESPONSE: See Comptroller Response to Question 39.

41. Exhibit A, Sample Contract, Art. XIV, Pg 33, Section 14.9 l) – Independent Information Security Assessment – Will the state accept an initial SOC 2 Type 1 within 3 months of contract execution then a SOC 2 Type 2 annually thereafter from the vendor? If not, will the State accept the vendor’s data center SOC 2 Type 2 report to meet this requirement?

COMPTROLLER RESPONSE: Reference Exhibit A, Section 14.9.l) (Independent Information Security Assessment). Comptroller shall not accept a vendor’s data center SOC 2 Type 2 report to meet the requirement. Also see Comptroller Response to Question 39.

42. Attachment C - Price Schedule 1 – Line items, #1 & #2: For line items #1 & #2 may we provide a price per Financial Institution per Quarter which is the industry standard?

COMPTROLLER RESPONSE: Reference Sections 2.2.5 (Optional Features, Products, or Services) and 4.2.9 (Proposed Fee). Reference Exhibit A, Attachment C (Mandatory Price Sheet). For clarity, Respondent must complete Price Schedule 1 which specifies Description, Quantity and Unit of Measure for all line items. Price Schedule 2 allows Respondent to submit Optional Features, Products, or Services, including any alternative pricing strategy that may be applicable to any Price Schedule 1 line item.