Questions and Answers-2026 DFOP0019468 NOFO.pdf

Questions and Answers for

Global Cybercrime and Cryptocurrency

Assessment and Intelligence Gathering

NOFO#: DFOP0019468

August 19, 2026

SENSITIVE BUT UNCLASSIFIED

Question 1:

Section D.2 of the NOFO on page 19 requires applicants submit a “History of US Government

Federal Assistance Awards” document outlining our experience with implementing US government-funded federal assistance awards. We note that there is no indication of a timeline provided for this history. May INL clarify and/or confirm that applicants can submit their history?

INL Response:

The NOFO – does not provide specific guidance on the timeline of how far back an applicant should list their US government-funded federal assistance.

History of U.S. Government Federal Assistance Awards

“This document outlines the applicant organization’s experience with implementing U.S.

government-funded federal assistance awards, including current and completed projects within the past 3 years.

• The list must include the awarding agency, point of contact, name of the project, start and end dates, and amount of the award.

• If the applicant has never received a U.S. federal assistance award, please list other projects the organization has implemented, including the information requested in the bullet above.”

Cost, budget & payment

Question 2:

For a U.S.-based for-profit applicant without a Negotiated Indirect Cost Rate Agreement

(NICRA), may we elect the de minimis indirect cost rate (up to 15% of MTDC) for this award?

INL Response: No. (see Question 15)

Question 3:

Will the award be administered via advance payments or cost-reimbursement, what is the anticipated drawdown and financial-reporting cadence, and does the two-year budget allow for annual inflation or escalation adjustments?

INL Response: Yes. The award will be administered in the context of reimbursement and/or an advanced payment request, and this will be included in the terms and conditions of the award. This will be explained further at the time to the awarded recipient. Also based upon §

200.440 Exchange rates.

• Cost increases for fluctuations in exchange rates are allowable costs subject to the availability of funding. Prior approval of exchange rate fluctuations is required only when the change results in the need for additional Federal funding, or the increased costs result in the need to significantly reduce the scope of the project. Before providing https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=f299e07ce012e8365dfca828e95a9d55&term_occur=999&term_src=Title:2:Subtitle:A:Chapter:II:Part:200:Subpart:E:Subjgrp:40:200.440 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=1a63702dd48b9f334e01353e2c7e180a&term_occur=999&term_src=Title:2:Subtitle:A:Chapter:II:Part:200:Subpart:E:Subjgrp:40:200.440

Assessment and Intelligence Gathering approval, the Federal agency must ensure that adequate funds are available to cover currency fluctuations to avoid a violation of the Antideficiency Act.

• The recipient or subrecipient is required to make reviews of local currency gains to determine the need for additional Federal funding before the expiration date of the

Federal award. Subsequent adjustments for currency increases may be allowable only when the recipient or subrecipient provides the Federal agency with adequate source documentation from a commonly used source in effect at the time the expense was made, and to the extent that sufficient Federal funds are available.

Question 4:

Cost share is recommended but not required; does proposing cost share improve the evaluation?

INL Response: Whatever the applicant wishes to include. The solicitation states desired but “Not required.”

Eligibility, partners & goals

Question 5:

What is the process and any required approval for adding a sub-recipient or contractor, including after award? Is a sub-recipient's UEI required at application, or only prior to award?

INL Response: According to p. 17 of the NOFO Partner Information (if subrecipient) is being proposed)

• Introduce and provide relevant information about key partner organizations and sub-recipients

• Briefly describe the division of labor and/or distinct roles and responsibilities among the applicant organization and its partners

• If proposing a sub-recipient, please briefly describe the applicant organization’s experience related to managing sub-recipients

The 2 CFR 200 requires subrecipients to obtain a UEI. Please note the UEI for subrecipients is not required at the time of application but will be required before an award is processed and/or directed to a subrecipient.

All proposed subrecipients are required to have a Unique Entity Number (UEI) print to receive funding. Please note: the UEI for subrecipients is not required at the time of application but will be required before an award is processed and/or directed to a subrecipient. An active

SAM.gov registration is not required for subrecipients.

Question 6:

May a single organization submit separate applications for both Goal 1 and Goal 2, and would an award under one affect the other?

https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=276f22420cbc684a6b76ce3d9b641dca&term_occur=999&term_src=Title:2:Subtitle:A:Chapter:II:Part:200:Subpart:E:Subjgrp:40:200.440 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=aaceb564b8c7c84aae11701eb5ba9548&term_occur=999&term_src=Title:2:Subtitle:A:Chapter:II:Part:200:Subpart:E:Subjgrp:40:200.440 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=4c66cc5424e706a4170a60725a5c98b6&term_occur=999&term_src=Title:2:Subtitle:A:Chapter:II:Part:200:Subpart:E:Subjgrp:40:200.440

Assessment and Intelligence Gathering

INL Response: Organizations can submit separate applications for Goals 1 and 2. Submissions to the goals will be evaluated independently. An award for one will not influence an award for the other. [Potential addition: Organizations applying to both Goals would need to demonstrate the ability to effectively pursue both activities simultaneously.

Scope & methodology

Question 7

Is there a required or preferred harm-measurement and source-country-ranking methodology, or is the methodology offer-or-defined?

INL Response: Applicants can present preliminary methodologies. Methodologies should identify metrics that are feasible to collect.

Question 8:

What are INL's expectations and any restrictions regarding lead generation, and how may the resulting leads and intelligence be used or shared (including with foreign partner agencies)?

INL Response: Leads and intelligence can be used for the purpose of the project, but no information can be disseminated outside of the project without express written authorization from the Contract Officer or Contract Officer’s Representative. This includes U.S. and foreign parties.

Question 9:

Is there a minimum expected cadence or volume for the situational updates and intelligence/leads packages, and does INL prefer a scheduled or on-demand delivery model?

INL Response: On demand delivery model is preferred.

Data, tools & security

Question 10:

Is the use of proprietary commercial platforms (e.g., blockchain analytics and OSINT) as the delivery engine acceptable, and what are the data-rights expectations for tool-generated outputs?

INL Response: INL retains rights to all information produced because of the funded activity. If proprietary tools are used, the implementer must ensure all data and information is turned over to

INL in a readable, searchable, and otherwise accessible format unencumbered with licensing obligations.

Question 11:

Are any personnel security clearances required (and if so, at what level), and what is the expected data classification and handling for deliverables (e.g., SBU/CUI, or any classified components)?

Assessment and Intelligence Gathering

INL Response: Personnel security clearances are neither required nor discouraged. Data classification should be handled consistently with standards for SBU-Law Enforcement Sensitive.

Intellectual property and data

Question 12:

For a for-profit recipient, how does the Department distinguish between a recipient's pre-existing proprietary data and methodologies (background intellectual property) and data first produced under the award? Where a recipient's proprietary dataset is queried while producing a deliverable but is not reproduced within it, does the Government's license under the Standard Terms and

Conditions extend to the underlying dataset?

INL Response: Respondent can provide a proposal for separating pre-existing proprietary data from data produced under the program. However, all data and information turned over to the government at the end of the contract must be complete for the purposes of research, citation, or program decisions and provided in a medium that maintains the data in an easily searched and organized manner. Partial data will not be accepted by the government based on its origin in proprietary intellectual property.

Question 13:

What is INL's process for handling proprietary or confidential commercial information contained in applications and in deliverables produced under an award? Specifically, does the Department provide pre-disclosure notification to the recipient before releasing marked material in response to a FOIA request, and how should applicants mark such material?

INL Response: Government abides by FAR Subpart 9.505-4 Obtaining access to proprietary information based on the facts and nature of the proposed contract.

Question 14:

Where a for-profit recipient's ordinary commercial business involves licensing data products, would revenue from unrelated commercial sales of a product that also draws on award-funded work constitute program income under the award? How does the Department distinguish program income from a recipient's ordinary course of business revenue?

INL Response: Respondent is responsible for presenting a proposal for disaggregating work under the award from commercial business. The respondent needs to justify why work that is facilitated or enabled by funds obtained through the award is not subject to the terms of the award.

Assessment and Intelligence Gathering

Cost principles and award structure

Question 15:

Appendix C states that for-profit applicants are governed by FAR Part 31 and that 2 CFR 200

Subpart E does not apply. Can the Department confirm whether a for-profit applicant without a

NICRA may elect the 15% de minimis indirect rate, given that 2 CFR 200.414 refers to non-

Federal entities? If not, what indirect cost methodology should a for-profit applicant without NICRA use?

INL Response: For-profit companies cannot elect to use the de minimis indirect cost rate under current federal regulations. The de minimis rate is a provision in 2 CFR 200.414(f) of the Uniform

Guidance, which applies to non-federal entities such as state/local governments, Indian tribes, institutions of higher education, and nonprofit organizations that do not have an active federally negotiated indirect cost rate agreement (NICRA) It allows these entities to recover up to 15% of

Modified Total Direct Costs (MTDC) without submitting a NICRA, reducing administrative burden.

However, for-profit entities are governed by different cost principles. Under the Federal

Acquisition Regulations (FAR), for-profit recipients must follow FAR Subpart 31.2 cost principles, not the 2 CFR 200 Subpart E principles that govern the de minimis rate. Since the de minimis rate is defined in Subpart E, it is not applicable to for-profits.

Question 16:

Would a fixed-price license for access to a commercially available proprietary dataset, provided by an entity that sells the same product to unrelated customers, be treated as a contractor procurement under 2 CFR 200.331 rather than a sub-award? If the supplier is an affiliate of the applicant under common control, how should the cost be treated given FAR 31.205-26(e)?

INL Response: 2 CFR 200.331 states “the pass-through entity is responsible for making case-by-case determinations to determine whether the entity receiving Federal funds is a subrecipient or a contractor” not the Federal agency. FAR 31.205-26(e) applies to the price of the license in question, so the response is contingent on the price proposed. Barring exemption under the

Commercial Exception provided by the Contracting Officer, respondents should operate at actual cost incurred without attaching additional profit margin.

Eligibility and timing

Question 17:

Given the stated 4-to-8-week processing time for SAM.gov registration and the August 31 application deadline, will the Department consider an application from an organization whose

SAM.gov registration has been submitted but is not yet active at the application deadline, provided it becomes active before award?

Assessment and Intelligence Gathering

INL Response: All organizations, whether based in the United States or in another country, must have a Unique Entity Identifier (UEI) and an active registration in SAM.gov. A UEI is one of the data elements mandated by Public Law 109-282, the Federal Funding Accountability and

Transparency Act (FFATA), for all Federal awards. An applicant must maintain an active registration while it has a proposal under review by the Department and must continue to keep the registration active for the entire duration of the period of performance of any Federal award that results from this NOFO.

Exemptions Section (NOFO)

An exemption from the UEI and Sam.gov registration requirements may be permitted on a case by-case basis. See 2 CFR 25.110 for a full list of exemptions. Organizations requesting exemption from UEI or SAM.gov requirements must email the point of contact listed in the NOFO at least two weeks prior to the deadline in the NOFO providing justification of their request. Approval for a SAM.gov exemption must come from the warranted Grants Officer before the application can be deemed eligible for review.

Question 18:

Can the Department confirm that a foreign-based for-profit organization may serve as lead applicant with a US-based organization as sub-recipient, including where the US sub-recipient conducts activities requiring engagement with US law enforcement and access to US victim data?

INL Response: Per the NOFO-Organizations may form a consortium and submit a combined proposal; however, one organization should be designated as the lead applicant and other organization(s) listed as sub-recipient partner(s). Also, as long as the foreign-based for-profit organization’ SAM.gov account remains active from the beginning of the application throughout the award.

Delivery:

Question 19:

Will the recipient be granted access to non-public US Government data, such as case-level IC3 data or law enforcement case files, or is the assessment expected to rely solely on published reports and open sources? Relatedly, will intelligence packages containing wallet addresses and attribution to named individuals be handled at an unclassified level, and are there handling requirements or clearance expectations for recipient staff?

INL Response: Awardees will not be provided access by the government to law enforcement sensitive information relevant to active cases or have access to information classified beyond the security clearance held by the individuals requesting access. Information obtained by the awardee under the program should be handled consistently with SBU-Law Enforcement

Sensitive.

Assessment and Intelligence Gathering

Question 20:

Goal 2 authoritative data sources include FBI IC3 reports, DOJ indictments, FinCEN advisories, and OFAC designations. Some of the most probative data for measuring harm to U.S. victims, including non-public IC3 case-level data and BSA reporting, is not publicly available. Should applicants assume that the assessment will rely on publicly available and commercially licensed sources, or does INL anticipate facilitating post-award access to relevant non-public U.S.

government, partner-government, law-enforcement and/or financial-intelligence data through appropriate arrangements?

INL Response: Respondents should not anticipate receiving assistance from INL in obtaining non-public information.

Question 21:

Under Goal 2, deliverable 3 provides that the recipient will deliver intelligence products "on demand or based on a schedule negotiated with INL." To support comparable staffing and pricing assumptions, can INL provide an indicative number or range of detailed country profiles, scheduled situational updates, briefings and on-demand intelligence packages expected during the

24-month period?

INL Response: Respondent should perform a broad country analysis to be able to identify and rank the top ten countries and provide detailed profiles. Situational updates on these countries should be of sufficient detail to confirm a country’s comparative rank and inclusion on the list, or replacement countries if necessary. A separate list of no more than five countries should identify rapidly emerging threat jurisdictions that are not in the ranked ten.

Question 22:

The budget considerations identify field research travel to priority source countries where applicable and security conditions permit. Given that priority countries will be determined through the baseline assessment and much of the activity in question is borderless and conducted online, what level and purpose of travel does INL anticipate? Would a remote first approach, with targeted travel after priority countries are identified and subject to security review, be responsive?

INL Response: Respondent is responsible for proposing methodology for developing baseline and country assessments.

Question 23 :

Objective 2.1 requires that assessments measure harm exclusively to U.S. persons, U.S. businesses, and U.S. critical infrastructure, and that harm to citizens of other nations must not be incorporated into harm scores or country rankings. Where an incident affects victims of multiple nationalities and available data does not reliably disaggregate U.S. victims, does INL prefer the methodological approach to disaggregation?

Assessment and Intelligence Gathering

INL Response: Respondent is responsible for proposing methodology for disaggregating damage to U.S. targets and explaining a country’s inclusion and ranking on the baseline assessment.

Question 24:

Where intelligence products or analytical deliverables rely on commercially licensed data or proprietary analytics that cannot be transferred to INL in raw form, will INL accept derived analytical datasets, source references, data dictionaries, documented calculations, vendor methodologies, and supporting analytical narratives in lieu of the underlying data and fully reproducible methodologies, or does INL require sufficient transparency to independently reproduce all findings?

INL Response: Materially answered in Question 12. Respondent can provide a proposal for separating pre-existing proprietary data from data produced under the program. However, all data and information turned over to the government at the end of the contract must be complete for the purposes of research, citation, or program decisions and provided in a medium that maintains the data in an easily searched and organized manner. Partial data will not be accepted by the government based on its origin in proprietary intellectual property.

Question 25:

Does INL anticipate that award activities and deliverables will remain unclassified, and are there specific system, clearance, marking, privacy or dissemination-control requirements applicants should budget for in connection with intelligence packages that may be shared with U.S. Embassy personnel or foreign partners?

INL Response: All information should be packaged and handled consistently with SBU-Law

Enforcement Sensitive. Respondent should not anticipate permission to distribute information outside of the U.S. government. Information cannot be distributed outside of the program, including U.S. government recipients, without written consent of the Contract officer or Contract

Officer Representative.

Question 26:

The NOFO requires identification of "top source countries" while also distinguishing between primary operational hubs and facilitating jurisdictions. Where criminal activity spans multiple countries (e.g., operators in one jurisdiction, infrastructure in another, and laundering activity through a third), does INL expect a single country attribution for scoring purposes, weighted attribution across multiple countries, or separate rankings for operational hubs and facilitating jurisdictions?

INL Response: Respondent can assume INL familiarity with cybercrime operational structures.

Ranking of top countries should combine operational hubs and facilitating jurisdictions. Critical facilitating jurisdictions may warrant inclusion on the list and might be at the expense of an

Assessment and Intelligence Gathering operational hub. Respondents are responsible for proposing methodology for attributing scores and developing ranking.

Question 27:

Is there a public product that approximates what INL envisions for the baseline landscape assessments under Goals 1 and 2 USTR's Notorious Markets List, UNODC regional threat assessments, or similar?

INL Response: The expectation of the baseline assessments is not modeled off a public product.

Respondents are free to use an existing product as a framework or design their own.

If not, what makes an assessment finding directly actionable for programming decisions?

Information on methodology in the NOFO takes precedence in the case of any real or perceived contradiction in guidance in this response. Assessments should provide a comparative ranking of the worst offending countries, and the quantitative metrics that produced the comparison.

Assessments are intended to assist INL in triaging target countries for mobilizing foreign assistance to law enforcement in detecting, disrupting, and investigating cybercrime operations and criminals targeting U.S. citizens.

Question 28:

Under Activity 3 of both goals, what content and level of detail does INL expect in a single situational update?

INL Response: Situational updates should be of sufficient detail to confirm a country’s comparative rank in the baseline assessment or inform whether it has increased or decreased priority during the assigned timeframe.

Question 29:

For Goal 2, is a leads package intended for investigative lead generation or for evidentiary use by receiving authorities?

INL Response: Investigative lead generation.

Question 30:

Deconfliction between Goals 1 and 2. Objectives 1.3 and 2.1 both cover blockchain analysis of drug-related flows. If separate awards are made, will recipients be expected to coordinate methodologies or share underlying data?

INL Response: No.

Assessment and Intelligence Gathering

Question 31:

Under Goal 2's framework for financially motivated state-linked activity, would a large exchange compromise attributed to a state-linked group fall within scope where proceeds appear directed to revenue generation?

INL Response: State-linked activity should be noted and flagged but should not be used as a metric for comparative ranking or lead generation. The program is focused solely on non-state actor criminal activity targeting U.S. citizens.

Question 32:

May outputs derived from commercially licensed blockchain analytics or dark web monitoring platforms be shared with Embassy personnel and foreign partner officials? If so, should applicants’ budget for redistribution rights, and under which OMB category?

INL Response: Information cannot be distributed outside of the program, including U.S.

government recipients, without written consent of the Contract Officer or Contract Officer

Representative. Respondents should not anticipate permission to distribute information outside of the U.S. government.