Draft_SOW_PWS_-_RFI.docx

Vault Solution

Vault Solution

Ginnie Mae, Department of Housing and Urban Development

Vault Solution for Electronic Mortgage Promissory Notes for

Ginnie Mae

Performance Work Statement

05/21/2019 introduction

Ginnie Mae is seeking to obtain a robust electronic vault (“eVault”) solution that is fully integrated with the MERS eRegistry to use as secure storage for eNotes and other Trailing eDocs[footnoteRef:2] that serve as collateral for Mortgage Backed Securities (MBS) carrying the Ginnie Mae Guarantee. Ginnie Mae will use the eVault solution as part of a pilot program to test the processes, policies, and controls necessary to enable Mortgagees participating as Issuers in its MBS Program to securitize federally-insured or guaranteed mortgage loans executed on eNotes (“the Pilot”). For each eNote securitized during the Pilot, Ginnie Mae will use the eVault to update its status as a rights holder in the MERS® eRegistry in accordance with various scenarios, including but not limited to, loan payoff, borrower default, or the transfer of mortgage servicing rights, as well as to execute transfers of control and location for eNotes associated with defaulted Issuer portfolios.[footnoteRef:3] Consequently, the provider of the eVault solution being requested will need to demonstrate a substantial record of successful performance in executing transactions with the MERS eRegistry, and the ability to support eNote transactions at varying levels as detailed below. [2: Please see Section 8.0 of this document for a definition of eNote and eDoc respectively.] [3: Please see Mortgage-Backed Securities Guide, HUD Handbook 5500.3 Rev-1 for a description of the various scenarios that can cause Ginnie Mae to default an Issuer. The MBS Guide is available on Ginnie Mae’s website at http://www.ginniemae.gov.]

BACKGROUND

Ginnie Mae is a wholly owned corporate instrumentality of the United States located within the Department of Housing and Urban Development (HUD). Its powers are prescribed by Title III of the National Housing Act, as amended (12 U.S.C. 1716 et seq.). Through its MBS programs, Ginnie Mae guarantees privately issued securities that are backed by pools of mortgages insured or guaranteed by the Federal Housing Administration (FHA), the Department of Veterans Affairs (VA), Rural Development (RD) of the U.S. Department of Agriculture (USDA), and HUD’s Public and Indian Housing program (PIH). The guarantee ensures MBS investors that the timely payment of principal and interest due for each Ginnie Mae-Guaranteed MBS is backed by the full faith and credit of the United States Government.

With the use of its MBS program, Ginnie Mae serves as the principal financing arm for government loans and is responsible for ensuring that funds flow into the mortgage market. The Ginnie Mae MBS Programs are governed by Guaranty Agreements entered into by Ginnie Mae and Issuers according to the terms of the Mortgage-Backed Securities Guide 5500.3, Rev. 1 (“MBS Guide”).

Ginnie Mae has committed to developing and implementing the policies, technology, and operational capabilities necessary to enable Issuers to use eNotes, Trailing eDocs, and other digitized loan files as acceptable collateral for Ginnie Mae MBS[footnoteRef:4]. To accomplish this objective, Ginnie Mae plans to launch the Pilot in 2019 to test its approach, optimize processes, and arrive at a strategy that promotes large-scale adoption of eNotes in the government mortgage segment. The viability of the Pilot depends, in part, in Ginnie Mae’s ability to obtain an eVault and eVault support services outlined in the requirements below. [4: Please see Ginnie Mae’s Digital Collateral Strategy outlined in Ginnie Mae 2020, a White Paper detailing Ginnie Mae’s strategic road map, accessible at https://www.ginniemae.gov/newsroom/publications/Documents/ginniemae_2020.pdf ] statement of work and Requirements

The contractor shall provide an eVault as well as the expertise and resources necessary to meet Ginnie Mae’s Pilot objectives, including:

Production eVault Platform Requirements and Specifications. A production eVault accessible by Ginnie Mae and its agents to use as secure storage for eNotes and other electronic loan files, including Title Insurance Policies, HUD prescribed forms, and security instruments (“Trailing eDocs”) that meets the following specifications.

MERS eRegistry Integration and eDelivery Integration. The contractor’s eVault shall:

· Be fully integrated with the MERS eRegistry.

· Interface with MERS® eRegistry seamlessly and enable Ginnie Mae to update the MERS eRegistry as needed to reflect Ginnie Mae’s status as a rightsholder to the eNote for the life the corresponding loan, or for any other time period prescribed by Ginnie Mae.

· Have the capability to transfer eNotes and any other eDocs in eVault System to another eVault using MERS eDelivery.

· Be capable of establishing a relationship between an eNote and other eDocs related to the same loan such that end users are capable of accessing all documents stored within an eVault that relate to the same loan.

· Support eNote paper out process and deactivation.

Software as a Service (SaaS). The contractor’s eVault shall:

· Be a web-based turnkey solution offered as a web-service

· Provide true electronic vaulting capabilities with a minimum of effort.

Cloud-Based Dynamic Storage. The contractor’s eVault shall:

· Enable document accessibility through a centralized and privileged platform.

· This platform shall be installed behind the institution’s firewall and tightly integrated to existing processes, while allowing authorized, third-party access.

Data and Data Validation Standards. The contractor’s eVault shall:

· Support the Mortgage Industry Standards Maintenance Organization (MISMO) industry standard document version in which the eNote or other eDocs were originally created for the life of loan.

· Allow for the encryption of documents and wrapping them in a Tamper-Evident Seal to instantly identify and reject unauthorized document modifications. This shall, at a minimum, include detailed audit trails that establish both compliance and veracity of electronically signed documents.

· Verify document integrity including, but not limited to, compliance with eNote Document Type Definition (“DTD”) or schema and eNote Tamper Evident Seal before accepting documents.

· Log the validations of eNotes’ and any other SMART Documents’ Tamper Seals in a manner that allows Ginnie Mae to validate the same.

· Support one or more authentication methods to authenticate user access.

· Be capable of identifying whether an eNote being stored is the Authoritative Copy or a copy of the Authoritative Copy.

Data Security and System Availability Standards. The contractor’s eVault shall:

· Be a Federal Information System Controls Audit Manual (FISCAM)/ Federal Information Security Management Act (FISMA)-Certified Platform and shall implement security operations that ensure compliance with these standards.

· Be available 99.99% of the time and only considered unavailable when the servicer goes off line.

· Support operability in accordance with the required service levels. Automated and/or manual component testing shall be in place and performed to prevent threats and ensure recoverability.

· Prevent unauthorized viewing of the most sensitive data and documents through restricted access.

API Integrations. The contractor’s eVault’s Application Programming Interface (API) shall:

· Allow for a seamless integration with Ginnie Mae systems, or have the capability to buildiout integrations to enable potential auto-certification solutions and/or external interfaces.

· The contractor shall ensure that no data/functionality is exposed.

Disaster Recovery Requirements. The contractor shall have:

· A Disaster Recovery Plan and procedures that enable institutions to rapidly recover mission-critical data stored in the eVault.

· The contractor shall at a minimum have an end-to-end document and backup encryption that ensures data remains private and fail-proof and must satisfy regulatory-compliance requirements.

Support Compliance with eCommerce Laws. Support the storage of eNotes and Trailing eDocs in a manner that is consistent with the provisions of UETA and ESIGN as applicable by safeguarding the reliability of the documents, supporting paper-out procedures, as well as de-registration and deactivation of eNotes from MERS eRegistry.

eVault Environment for User Acceptance Testing. In addition to the production eVault identified in Section 3.1, the contractor shall also provide an eVault/eVault environment that replicates the production environment in a manner that is sufficient to conduct user acceptance testing (“UAT”). During UAT, software users will test the software to make sure it can handle required tasks in real-world scenarios, according to specifications, and to identify issues.

eVault Environment for Testing Upcoming Code Releases. A test environment, other than the UAT environment identified in Section 3.2, that supports test execution with hardware, software and network that is configured as per the need of the development and testing users for unit testing, system testing and/or integration testing of programming that has not been incorporated or deployed in the production environment.

eNote Storage and Transaction Volume Requirements. The eVault shall support

1.1.1 eNote Transaction Volumes Requirements. Execute transactions that update the rightsholder fields in the MERS eRegistry for a minimum of 10,000 eNotes per year, including for example, transactions that execute transfers of control and/or location. The various fields in the eRegistry for each eNote may be updated several times each year.

eNote Storage Volume Requirements. Have the capacity to store a minimum of 75,000 copies of the Authoritative Copy of the eNotes for which Ginnie Mae is identified as a rightsholder as well as other related eDocs for each such note, including but not limited to copies of title insurance policies or other digitized loan closing files or pool/loan package files.

Batch/Bulk Processing Requirements. Provide end users with the ability to initiate MERS eRegistry updates in batch for multiple eNotes at a time (Ginnie Mae understand that the eRegistry will accept/perform each such transaction sequentially and not in bulk/batch) even in cases when the Authoritative Copy of the eNote is not changing location. The eVault must also be able to execute bulk/batch transfers of location and control of the Authoritative Copy such that the Ginnie Mae acquired eVault becomes the location of the Authoritative Copy.

Standard Audit/Reporting. The eVault solution shall provide a suite of standard system audit and use reports including event detail and summary reports relating to event logs, document inventories, eNote registration, eNote transfers, eDelivery events, eNote validations, and Ginnie Mae rights holder status by MERS Mortgage Identification Number (MIN).

eVault Implementation and Onboarding Services. The contractor will need to provide:

Licensing and User Credentials Provide Ginnie Mae with any and all necessary user and/or software licenses or credentials necessary for Ginnie Mae employees or third-party agents to access the documents stored in the eVault and execute the transactions described in Section 3.4.

Onboarding and Integration. Perform all necessary activities to establish connectivity between the Ginnie Mae acquired production eVault identified in Section 3.1 and the MERS eRegistry and eDelivery services, including any necessary system testing.

Live User Training. Provide Ginnie Mae employees and designated agents with the requisite training to learn how to access the documents stored in the eVault, how to perform the transactions identified in Section 3.4, as well as how to access and reproduce the reports identified in Section 3.5.

Other Tasks. Perform any other tasks needed to enable Ginnie Mae to obtain the services and/or the functionalities described in Sections 3.1 through 3.5 of this document.

Post-Implementation Help-Desk Technical Support. The contractor shall provide live technical support services for Ginnie Mae eVault users between the hours of 9:00 am EST and 5 pm EST, excluding federal holidays and weekends.

Post-Implementation Custom Reporting and Integrations. The contractor shall have technical staff available to perform ad hoc functions required by Ginnie Mae after the initial implementation, including:

The development of custom reports.

Support API integration with Ginnie Mae’s proprietary systems.

Period of Performance Initial Implementation. The government acknowledges that, upon contract award, the contractor will require a period of time to conduct any necessary system onboarding and integration activities as well as to prepare and deliver user licenses and training. All tasks needed to enable the government to begin using the eVault solution must be provided no later than the date that is 120 days from the contract award date, as detailed immediately below.

Post-Implementation. After all onboarding and implementation, licensing, and user training activities are completed, the contractor shall provide the remaining systems, software and services requested under section 3.0 of this document continuously for the balance of the base year, and for up to an additional 4 option years, except as noted in the table below.

REPORTS AND Deliverables Required Deliverable Due Dates and Reports. The contractor will be required to submit a written report once each of the systems, software, or services (as applicable) required by the tasks identified in the table below have been initially deployed or are otherwise ready for use by the government. The reports detailing completion of each task or readiness of the corresponding system, software or service, as may be applicable, must be delivered no later than the due date detailed in the table below.

Report Delivery Instructions One copy of each Deliverable Report will be submitted to the client representative. The contractor shall deliver each report in a mutually agreed upon format. Deliverables are to be transmitted with a cover letter, on the prime contractor’s letterhead, describing the contents.

Quality Control. The contractor shall ensure the services are performed in accordance with the PWS and commonly accepted commercial practices. The contractor shall develop and implement procedures to identify, prevent and ensure non-recurrence of defective services. The government reserves the right to perform inspections on services provided to the extent deemed necessary to protect the government’s interests. The contractor must control the quality of the software, services and deliverables provided in support of the tasks outlined in this document and maintain substantiating evidence that the same conform to contract quality requirements. The contractor must furnish information to the government if requested. The contractor shall develop and maintain a quality process to ensure services are performed in accordance with commonly accepted commercial practices and existing quality control systems. The contractor shall develop and implement procedures to identify, prevent and ensure non-recurrence of defective services.

INSPECTION AND ACCEPTANCE

General Inspection Responsibilities. The government reserves the right to perform inspections on services provided to the extent deemed necessary to protect the government’s interests. The contractor must control the quality of the services and deliverables provided in support of this task; the contractor must maintain substantiating evidence that services conform to contract quality requirements and furnish such information to the government if requested. ll Deliverable Reports and task deliverables shall be inspected, tested (where applicable), reviewed, and accepted by the Government within a reasonable period of time IAW FAR 52.246-6, Inspection – Time and Material and Labor Hour/ IAW FAR 52.246-4, Inspection of Services – Firm Fixed Price Acceptance criteria. Only the client representative (CR), their designated alternate, the Project Manager (PM) or Contracting Officer (CO) has the authority to inspect, accept, or reject all deliverables. Final acceptance of all deliverables will be provided in writing, or in electronic format, to the PM or CO within 30 days from the end of the task order. Performance by the Contractor to correct defects found by the Government because of quality assurance surveillance and by the Contractor as a result of quality control, shall be IAW FAR 52.246-4, Inspection of Services – Firm Fixed Price The client representative will monitor compliance and report to the PM.

Change Requests. The Government will provide written acceptance, comments, and/or change requests, if any, within 30 calendar days from the receipt of the Deliverable Report. Upon receipt of the Government comments, the contractor shall have 30 workdays to incorporate the Government's change requests and to resubmit the Deliverable Report in its final form.

Instructions, Conditions, and Notices to Offerors or Respondents Past Performance. The contractor will need to demonstrate the capacity to perform the functions and provide the services described in this document by referencing a substantial degree of successful past performance, which requires a minimum showing that the contractor has previously performed at least 10,000 eNote registrations on the MERS eRegistry.

Secured Party Field Support. The eVault will need to have the capability to support the recently announced Secured Party Field field for the MERS eRegistry. Consequently, the contractor will need to demonstrate the capacity to support this field and its functionalities by January 1, 2019 by a minimum showing that the contractor has initiated the requisite testing with MERS to support the Secured Party Field. The government will accept a written certification from the contractor that it has initiated the above referenced testing.

definitions, initialisms and other abbreviations

2 | Page