RFO PART 6 JOFOC -Cryptocurrency Managed Services 20260914_Redacted.pdf

FAR Overhaul Part 6 JOFOC for Cryptocurrency Managed Services - MIQ M-26-A44-R-000122

United States Department of Justice United States Marshals Service

Asset Forfeiture Division

Revolutionary FAR Overhaul (RFO) 12 Justification for Other Than Full and Open Competition

(Negotiated Procurements) This acquisition follows the procedures presented in Revolutionary FAR Overhaul (RFO) Parts 6.103 and 6.104 as authorized by 41 U.S.C 3304(a) (1). This justification authorizes the use of other-than-full-and-open competition for this requirement in accordance with RFO Parts 6.103 and 6.104 as authorized by 10 U.S.C.

3204(a)(1) or 41 U.S.C. 3304(a)(1).

MIQ Request Number M-26-A44-R-000122

Contract Specialist’s Name

Contracting Officer’s Representative

Nature or Description of Action

The United States Marshals Service (USMS) Asset Forfeiture Division (AFD) is seeking to award a sole source contract for cryptocurrency management services of its Class 2-4 inventory. As a result, the contract will provide the full range of cryptocurrency asset custody, management, disposal, and consulting services that are in line with industry standards.

The resulting vehicle will be a commercial Firm Fixed Price (FFP) Indefinite Delivery Indefinite Quantity (IDIQ) contract.

Description of Supply or Service

The Cryptocurrency Managed Services Class 2-4 contract supports the USMS in providing custody, management, and disposal services of cryptocurrency assets seized and forfeited under the Department of Justice (DOJ) Asset Forfeiture Program (AFP), the Treasury Executive Office for Asset Forfeiture (TEOAF) components, which administers the Treasury Forfeiture Fund (TFF), and other U.S Federal Government agencies with related law enforcement missions.

The requirement will include the following:

The full range of cryptocurrency custody services by an experienced cryptocurrency custodian, as well as management and disposal services, that are in line with industry standards.

This includes but is not limited to such activities as accounting, customer management, audit compliance, wallet creation and management, private encryption key generation and management, backup, and recovery of private encryption key material.

Estimated Total Value

This action will encompass a period of performance (PoP) of 18 months.

The estimated value of this action is $8,128,125.00

Vendor’s Name

Coinbase Inc.

Unique Entity ID CCKXXH3LHEE9 CAGE Code 8K8U7 Physical Address: ONE MADISON AVENUE SUITE 2400 & 2500, NEW YORK, NY 10010 USA

Indicate Statutory Authority for Contracting without Full and Open

Competition

6.103-2 Unusual and Compelling Urgency

Authority 41 U.S.C. 3304(a)(1).

Contractor’s unique qualifications

AFD Cryptocurrency seizures began in Fiscal Year (FY) 2013 with Bitcoin. These seizures have since grown exponentially in volume, cryptocurrency type and value. The USMS began managing the seized cryptocurrency inventory in-house without the services of private sector vendors; however, maintaining and supporting in-house management is very complex. Due to the sheer size and scope of the growing and evolving accrued inventory, AFD deemed that acquiring the services of insured and qualified companies to manage inventory was the most efficient and optimal course of action to protect the DOJ AFP from potential financial loss. Attempts to procure these services began in 2019, however no viable contracts resulted from these attempts. In 2023, the USMS pursued a new path forward based on lessons learned from its prior experience and available market research. This approach divided the cryptocurrency portfolio in two requirements - Cryptocurrency Managed Services Class 1 and Class 2-4. It was believed that this approach would attract more qualified bidders and promote greater competition and pricing. The Class 1 requirement was solicited as a full and open competition and was aimed at getting a reputable vendor known in the industry for most used and popular assets traded on the primary exchanges and with the highest volume and inventory value.

The Class 1 contract award was issued to Coinbase Inc.

(“Coinbase”). The Class 2-4 requirement was for the management of cryptocurrency that must be manipulated to be liquidated, as well as less common cryptocurrency. Based on market research, this contract was solicited as a small business set-aside and aimed at securing market makers or brokers who operate on secondary exchanges and perform swaps and auctions. The Class 2-4 contract award was issued to Command Services and Support (CMDSS) Inc. and was unsuccessfully protested by an unsuccessful offeror at the Agency level and the GAO. It was subsequently protested at the Court of Federal Claims (COFC). In May 2026, the COFC denied the protest. The protestor filed an additional motion asking the COFC to reconsider but that was denied in August 2026.

The Class 2-4 Base Year performance began December 1st, 2024, and Option Year 1 was exercised this past December;

however, due to a recent event, a Stop Work notice was issued on January 23, 2026, after it was discovered that an employee of CMDSS allegedly stole the USMS seized the U.S. For further details, please see evaluation documents attached.

Coinbase provides advanced solutions for the intake of new cryptocurrency assets with its self-service platform and can handle in excess of 450 assets, including ETFs. Being a public company, fiduciary and qualified custodian, headquartered and regulated in the United States is of significant value for the type of portfolio to be managed on behalf of the USMS. The control, segregation of assets, and wallet monitoring options provide confidence that USMS will be able to effectively manage a large portfolio. The allowance for customization provides confidence that Coinbase will be able to meet the current and urgent needs of USMS. The asset management solution used by Coinbase exceeds the needs of the current PWS. The asset management solution also provides a mechanism for the USMS to always see its portfolio in totality and individually by transaction.

Coinbase’s sophisticated security measures are industry leading represent the industry’s best practices, which will assist the USMS in properly addressing the custody and management of all current and future inventory. Coinbase exceeds standards by storing all hardware in a controlled access safe but also maintaining 24/7 surveillance.

Coinbase is the only company with a current Authorization to Use (ATU) designation, required by the USMS who could perform work without substantial interruption and/or delays and mitigate adverse impact on the agency’s mission. To ensure the security and privacy of federal information, an ATU is mandatory for external information system services that either process, store, or transmit federal data or operate information systems on behalf of the federal government. This designation must be obtained before the USMS is permitted to utilize the services of an outside vendor.

To receive this designation, the USMS Information Technology Division (ITD) is required to collect and review a substantial number of artifacts identifying their security controls and proof of their effective operation. This process typically takes six months or longer to obtain but can be delayed depending on the quality of the artifacts provided.

Coinbase is also one of few entities in the cryptocurrency operating market that is compliant with the Service Organizations Controls (SOC) audit, which was a requirement for both Class 1 and Class 2-4 acquisition process. Under this requirement, vendors are required to contract with a Certified Public Accountant (CPA) firm that specializes in auditing IT and business process controls and can produce a SOC audit report annually to supplement the USMS’s financial statement reporting and internal control testing. This is extremely costly.

The requirement encompassed a SOC 1 Type 2 report, which is necessary to ensure that financial information is being handled securely and that internal controls are in place for financial statements and reporting. In accordance with Civil Asset Forfeiture Reform Act of 2000, the Department of Justice Office of the Inspector General (OIG) contracts with an independent auditor to perform an audit of the Assets Forfeiture Fund and Seized Asset Deposit Fund’s (AFF/SADF) annual financial statements.

The requirement also encompassed the annual receipt of System and Organization Controls I (SOC 1) Type 2 and System and Organization Controls II (SOC 2) Type 2 reports provided by a third party, which provides independent assessment on controls related to security, availability, processing integrity, confidentiality, and privacy. In situations where cryptocurrency assets are not covered by their SOC 1 Type 2 and SOC 2 Type 2, the Contractor is required to provide third party compliance audit options, to include inclusion in other audits or testing.

The alignment between commercial SOC audit requirements and the federally mandated National Institute Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Information Systems and Organizations supports the efforts of the USMS Cybersecurity Information System Security Officer (ISSO). This helped in conducting a risk assessment as part of the USMS ATU process. It also aided in identifying any deficiencies or issues with the security posture of the contractor system before awarding the Class 1 contract.

The ISSO’s assessment and report played a key role in the decision of the USMS Chief Information Officer (CIO) to issue an ATU for the Cryptocurrency Managed Services Class 1.

Based upon the urgent need for continuity of services, Coinbase is uniquely suited to provide the highly specialized support described herein. The Performance Works Statement (PWS) calls for an orderly transition of inventory from the USMS to the performing entity for custody and management.

This transfer is in the interest of efficiency because it will allow Coinbase to provide support for these mission critical services while simultaneously allowing AFD the ability to follow through with the pending criminal investigation and gauge how this case will further affect the evolution of the cryptocurrency requirement. The process is expected to be lengthy and complicated due to the significant loss involved;

further, it will undoubtedly affect the cryptocurrency insurance landscape for small businesses and their ability to apply for coverage. It is already highly challenging for emerging cryptocurrency small businesses to secure adequate insurance due to extreme price volatility, high-risk security threats, limited historical loss data, and the niche, rapidly evolving nature of the sector. From market research data, coverage is often expensive (premiums can reach 5% of coverage limits) and while it may primarily cover hacks, it will not cover market fluctuations or regulatory losses. As a result, policies can be very expensive, and often provide insufficient coverage for large-scale theft, which as in the case of CMDSS, will have significant repercussions not only at the individual performer level but potentially at the larger operating environment level.

Finally, with Cryptocurrency Class 2-4 levels at inventory levels encompassing assets which exceed in value, the impending risk for additional theft or losses, AFD’s inability to carry out pending court-ordered liquidations, and the absence of alternate solutions make it critically urgent to award an operable sustainment contract to Coinbase. To initiate and complete a full acquisition process to an entity other than Coinbase would require in excess of 12 months, therefore contract requirements could not reasonably take place until the new award release and its related ATU process completed.

The ability to ensure continuity of services while meeting all contractual, regulatory and performance requirements would be greatly affected, and AFD operations, Federal Court proceedings and overall mission support could be seriously compromised. The harm to the Government, both at a financial and general perception level, would be significant and long-lasting.

Efforts made to Promote Competition

During the term of the Coinbase contract, the USMS intends to re-compete this requirement The solicitation process is anticipated to take approximately 12 months. If an offeror other than Coinbase be awarded the contract, then the sole source contract to Coinbase will no longer be utilized and the qualified custodian status. Additionally, Coinbase can support all the cryptocurrency types in the questionnaire and most importantly, Coinbase has a current ATU with USMS that would allow USMS to use its services immediately.

The market research did not identify any alternative vendor that could provide the same integrated mission-specific operational capability and operational implementation - to include the ATU - required by the Government.

Based on the above, this action to award a sole source award to Coinbase is the most advantageous method to meet the AFD’s urgent mission requirements. This course of action is the only technically viable, the safest and most cost-effective acquisition strategy, and it will prevent unacceptable delays and service interruption to the critical support and services for the remaining Class 2-4 assets currently in custody and for the inventory that is also expected to be returned to the USMS upon completion of the investigation process.

Any Other Facts Supporting the use of Other Than Full and Open

Competition

Without approval for this Justification, the AFD will be unable to continue custody and manage the sizable Cryptocurrency 2- 4 current in house inventory. Said activities will further be hindered when the unaccounted asset types and/or amounts are returned via insurance claim or upon completion of the investigation process. Failure to procure the required services will also reduce operational effectiveness during future seizure and forfeiture operations, limit collection and liquidation capabilities, delay operational deployment timelines, and increase overall mission risk.

This action will reflect a Period of Performance (PoP) of 18 months. This time frame is essential to provide the stability needed to execute mission critical functions while concurrently, the USMS can prepare and set a re-competition effort underway. The Class 2-4 requirement will be further refined and completely vetted against the existing regulatory framework in addition to all applicable emerging guidelines as cited in this document.

Interested Sources

The notice to solicit under the Statutory Authority for contracting without Full and Open Competition for Unusual and Compelling Urgency will be posted to the GPE/System for Award Management (SAM) https://www.sam.gov/ as per RFO Subpart 5.2. The USMS plans to review the lessons learned from the ongoing investigation in addition to the existing applicable regulatory framework and revise its competitive procurement strategy for these services upon re-competition time.

Certifications and Approvals

Technical Certification: I certify that the facts and representation under my cognizance which are included in this justification are complete and accurate to the best of my knowledge and belief.

Technical Representative

Supervisory Contract Specialist Concurrence: In accordance with USMS Policy Directive 6.1, Section 7(c), I hereby concur with proceeding with this Justification for Other Than Full and Open Competition.

Supervisory Contracting Officer

Office of General Counsel Review: In accordance with USMS Policy Directive 6.1, Section 2(a), I have reviewed this Justification for Other Than Full and Open Competition.

Office of General Counsel

Contracting Officer’s (CO) Certification and Approval: In accordance with RFO Part 6.104-1(a)(12), I hereby certify that the information provided in this Justification for Other Than Full and Open Competition is accurate and complete to the best of my knowledge and belief.

Additionally, in accordance with RFO Part 6.104-1(a)(12), I hereby determine that the circumstances described above apply to this requirement.

Pursuant to RFO Part 6.104(a)(12), my certification above serves as the approval of this Justification for Other Than Full and Open Competition.

Eliana York Contracting Officer

ELIANA

YORK

Digitally signed by

ELIANA YORK

Date: 2026.09.10 07:38:38 -04'00'