USVI Public Records

Document text

Page | 1 3. Statement of Work for EBT Services This statement of work describes the requirements an EBT Contractor (Bidder) must meet for providing SNAP EBT services to the Territory. Each requirement is consistent with the FNS regulations for SNAP EBT systems and the Quest® Operating Rules. The EBT Contractor must comply with all rules and regulations applicable to its activities and obligations under the contract, including but not limited to: 1. Quest Operating Rules, Version 2.2 (September 2014 (as revised), https://www.nacha.org/s/quest/-operatingrules.html 2. USDA Food and Nutrition Services, SNAP Regulations, CFR Title 7 and the following additional SNAP and EBT websites and reference materials: a. http:/www.ecfr.gov b. http://www.fns.usda.gov/snap/ebt 3. Corresponding Federal regulations, 7 CFR Parts 274, 277, and 278.5. 4. Statement on Standards for Attestation Engagements (SSAE) No. 16, Service Organization Control (SOC 1 and 2), requiring that States with EBT systems ensure an examination of their EBT transaction processing is conducted at least annually, 7 CFR § 274.1(i)(2). 5. Adjustment Rule revising SNAP regulations pertaining to a State agency's ability to make adjustments to a household's account in an EBT system. 7 CFR § 274.7(c). 6. Interoperability Rule implementing legislation requiring interoperability of SNAP EBT systems and portability of electronically-issued benefits nationwide, 7 CFR § 274.8(b) (10). 7. EBT Welfare Reform Rule implementing EBT provisions of the 1996 Personal Responsibility and Work Opportunity Reconciliation Act (PRWORA), 7 CFR Part 274. 8. EBT issuance system approval standards,7 CFR § 274.8. 9. SNAP Reauthorization regulations pertaining to the standards for approval of EBT systems, the participation of retail food stores and wholesale concerns, and State agency liabilities and Federal sanctions, www.fns.usda.gov/snap/ebt/. 10. Information Reporting for Payments Made in Settlement of Payment Card and Third Party Network Transactions I.R.S. 26 CFR Parts 1, 3, and 301. 11. Middle Class Tax Relief and Job Creation Act of 2012,Spending Policies for Assistance under State TANF Programs, Public Law 112-96, 126 Stat. 156(2012), Title IV § 4004. Page | 2 12. FNS Handbook 901, Advanced Planning Document Handbook, March 5, 2014, http://www.fns.usda.gov/apd/Handbook_901/HB901_2007.htm, SNAP provisions of the Agricultural Act of 2014 (Farm Bill), section 4002, Retailers.. NOTE: The Virgin Islands DHS has made every effort to ensure all referenced material Cited is accurate and complete; however, at the time of this release, information provided may be out-of-date. Contractor shall keep current and is responsible for independently verifying the accuracy of the latest revisions. For the most recent information on implementation of the Farm Bill, see: http://www.fns.usda.gov/snap/2014-farm-bill- implementation. If there is a conflict within the governing regulations and guidelines regarding a specific standard, Virgin Islands DHS, in consultation with the Contractor, will determine the appropriate standard. The final decision will remain with Virgin Islands DHS. 3.1. General Requirements The following section delineates the general requirements for the VI EBT system the EBT Contractor must meet. Bidders must note their acceptance of each requirement in this Statement of Work (SOW). This can be made in a single statement of acceptance. Detailed descriptions of the acceptance of each requirement are not required as part of the RFQ response. Any and all exceptions to the requirements listed in Section 3 must be provided in the bidder’s response to this RFQ. 3.1.1. Regulatory Provisions and Operating Rules Federal EBT regulations and commercial Electronic Funds Transfer rules affect government EBT system design and performance requirements. The EBT requirements contained in this RFQ are intended to conform to the following current federal regulations and national guidelines: 3.1.1.1 Section 1729, Mickey Leland Memorial Domestic Hunger Relief Act of 1990 Section 1729 of the Mickey Leland Memorial Domestic Hunger Relief Act of 1990 amended Section 7 of the SNAP Act of 1977 to require the U.S. Department of Agriculture to issue regulations for EBT system delivery for SNAP benefits to eligible households. 3.1.1.2 7 CFR §274, SNAP: Issuance and Use of Program Benefits FNS rules and regulations implement standards that EBT systems are required to meet in order to be approved for operation under the SNAP. The EBT system must comply with all FNS regulations in effect at the time of contract signing. 3.1.1.3 Quest® Operating Rules The EBT Contractor system and EBT system services must meet the requirements of the Quest® Operating Rules which are maintained by NACHA. These rules define the duties, tasks, requirements, and responsibilities for EBT Contractors, acquirers, retailers, and networks and the performance standards (measures) they are required to maintain during the life of the contract. 3.1.1.4 Personal Responsibility and Work Opportunity Reconciliation Act of 1996 (PRWORA) This Act is intended “to restore the American family, enhance support and work opportunities for families with children, reduce out-of-wedlock pregnancies, reduce welfare dependence by requiring Page | 3 work, meet the health care needs of America’s most vulnerable citizens, control welfare and Medicaid spending, and increase state flexibility.” 3.1.1.5 EBT Interoperability and Portability Act of 2000 This Act established uniform standards to achieve interoperability and requires that any state agency entering into a new contract include provisions to implement interoperability and portability by October 1, 2002. 3.1.2. EBT Benefit Types Although clients may be certified to receive assistance from one or more benefit programs, DHS to date has deployed EBT only for the SNAP Program. The Territory reserves the right to add additional benefit programs to the EBT system. Such program additions may be negotiated with the selected EBT Contractor and would require a change order for the contract that results from this RFQ. Bidders are, cautioned, therefore, to adhere to the EBT account structure, defined in Section 3.2 EBT Host Requirements, which accommodates a broader range of programs. 3.1.2.1. SNAP Benefits SNAP is a federal program funded by USDA/FNS, and administered by DHS at the local level. It is operated under the authority of the Food and Nutrition Act of 2008 and provides government benefit funds for the purchase of eligible food items and seeds at authorized retail locations. SNAP benefits are generally pre-funded EBT accounts; SNAP benefits become available when a client initiates an EBT transaction.at an EBT retailer. Benefits are posted to a ledger-type account by way of a benefit authorization file or a benefit authorization record transmitted by an eligibility system to the designated EBT Contractor. SNAP benefits posted to an EBT Account represent credit balances only—no funds are transferred when benefits are authorized. Following the approval of SNAP transactions during an EBT processing day, the EBT Contractor initiates a draw of federal funds sufficient to settle the net of SNAP purchase and return transactions. SNAP transactions are settled on the next banking day after the day of transaction approval and purchase. SNAP benefits are accessed and settled on a first-in, first-out basis. Unused benefits carry over to the following month. 3.1.2.2. Group Home Support In addition to traditional retailers, SNAP retailers may include group home and congregate living facilities such as drug/alcohol treatment centers, blind/disabled group living facilities, and battered women’s shelters. A bidder must support the DHS-proposed group homes and the VI proposed model is provided in the following paragraph. Bidders may propose an alternative approach after contract award. In the VI-proposed group home model, the group home will function as a traditional SNAP retailer. Each group home will be issued a unique retailer identification number by FNS. The group home will utilize a commercial or government-issued POS terminal to initiate on-line, real-time food purchase transactions or paper food vouchers to initiate off-line food purchase transactions. Reimbursement to group homes for food provided residents will occur in the same manner as for traditional retailers. SNAP clients will initiate POS transactions to access SNAP benefits in their VI EBT account that will cause a corresponding payment to be credited to the group home’s designated financial institution account. Transactions may occur twice monthly, on the 1st and on the 16th, or as frequently as daily, with a transaction corresponding to each meal. Page | 4 3.2. EBT Host Requirements The EBT host is the core of the EBT Contractor’s system and supports the following:  SNAP EBT Account Structure;  Account Set-Up/Maintenance and Benefit Authorization;  Client EBT Account Maintenance;  Card Issuance and Activation;  PIN Selection, Replacement, and PIN Tries;  Administrative Terminal Functionality;  Transaction Processing;  Management of a SNAP Program Retailer Validation Database;  EBT Settlement and Reconciliation;  EBT Reporting and Data Storage;  EBT System Interface with CARIBS; and,  EBT Host System Security. 3.2.1. SNAP EBT Account Structure The solution the bidder will implement must include an EBT Account Structure to ensure that 1) benefit balances are accurately maintained; 2) benefits accessed by clients are drawn from the appropriate EBT account; and 3) benefit accounts are not overdrawn. The EBT Contractor must accept liability for any funds drawn from an incorrect account; for overdraws of benefit accounts; for incorrect debits and credits, including adjustments and reversals; and for incorrect postings of benefits to a recipient’s EBT account. In the future, the VI may have a multi-program EBT environment where clients may receive benefits from one or more programs. The VI may consider the addition of restricted and non-restricted cash accounts, non-restricted direct deposit and restricted Medicaid accounts. Funding methods vary across programs and these, as well as other considerations, impact the EBT Account Structure. Given the restrictive nature of the SNAP Program, SNAP and cash benefits may not be commingled with each other. Balances for each benefit type must be accounted for separately. 3.2.2. Account Set-Up/Maintenance and Benefit Authorization The solution the EBT Contractor will implement must have the capability to accept Demographic files and Benefit Authorization files from DHS in frequent batch during regular office hours. Also, the EBT contractor must give DHS the capability to link the card number to the client’s case number online during the regular office hours even prior to receiving the demographic or benefit files. However, the EBT Contractor must support batch file processing on a 24 hours per day, 7 days per week basis. Page | 5 Under the current system, there are 3 components in setting up client’s account. These are the demographic data, benefit information and card linkage. When the demographic data or benefit information is missing, the other 2 components are put in a pending area. When the card linkage is missing, the account is created but the card status is inactive. When the 3 components are complete, an active account is created. Demographic File consists of data that control client set-up and demographic maintenance. Client set-up controls the specific access to the account. Demographic maintenance includes the demographic data of EBT accounts, such as client’s name, address, social security number and more. Benefit Authorization data is used to post benefits to the client’s account. Benefit Authorization data is transmitted through frequent batch file transmissions for credit/posting to the client accounts. Card Linkage allows DHS to link the card number to the client’s case number online during regular office hours with or without the demographic data or the benefit information on the EBT contractor host system. The EBT Contractor must be able to accept Demographic files and Benefit Authorization files in batch, at a minimum, at 3 and 6 PM daily, seven days a week. Also, DHS links the card number to client’s case number online during regular office hours. Such frequency maintains a high level of client service, allowing the client to receive an EBT card linked to client’s case number, select his or her PIN, and leave the office with benefits available on the same day, assuming that no account set-up data is missing. The EBT Contractor must confirm receipt of initial and subsequent transmission(s) within thirty (30) minutes of receipt until successful transmission/receipt has been completed. The EBT Contractor must provide system reports to DHS of all file transmissions that identify any record(s) not successfully received and processed with the corresponding reason for record rejection. See Section 3.2.10.1.2 Batch Processing Confirmation and Exception Reporting for additional requirements. In the event of a natural or other disaster when the CARIBS system is unavailable for processing, the EBT Contractor must maintain on-line communications between DHS offices and the EBT host via the EBT administrative terminal and DHS telecommunications network. Only in extreme situations will the on-line transmission of Account Set-up and Benefit Authorizations records data through the administrative terminal be allowed by DHS. The EBT Contractor system must confirm the receipt, processing, and result of Account Set-up and Benefit Authorization transactions transmitted on-line through the EBT administrative terminal. The EBT Contractor must have the capability of restricting access and use of Account Set-up and Benefit Authorization functions of the administrative terminal, except when specifically requested by DHS. Demographic File The Demographic File consists of data that control client set-up and demographic maintenance. Client set-up controls the specific access to the account. Demographic maintenance includes the demographic data of EBT accounts, such as client’s name, address, social security number and more. This file may be used to change the control of the account and/or update client demographic information. At a minimum, the demographic data elements for all programs must include:  Account Access  Last Name Page | 6  First Name  Middle Initial  Date of Birth  Social Security Number  Eligibility Case Identification Number  Street Address  Secondary Address  City  Territory  Zip Code  Transaction Type Identifier (set-up, change account data, or modify account status)  Local Office Identifier The EBT Contractor may designate other demographic data elements it determines necessary to support its EBT operations. The EBT Contractor must notify DHS of demographic record exception, including but not limited to rejected set-up requests and reason for rejection (e.g., duplicate case). 3.2.3. Benefit Authorization The EBT Contractor must receive and process Benefit Authorization data transmitted by CARIBS daily in frequent batches transmitted during normal office hours and no less than once per month as an end-of-day batch file for regular monthly benefit issuances. For Benefit Authorization files sent during normal office hours, the EBT Contractor must process the files and post the authorized benefit amounts to the EBT account within thirty (30) minutes of receipt. DHS issues SNAP benefits monthly to eligible households with EBT accounts established in a previous month. For regular monthly benefit issuance, DHS sends a Benefit Authorization File at the end of each month containing the next (future) month’s benefits. Files received at or prior to 11:59 pm local St. Thomas time must be processed and report transmitted prior to 7:00 am the following day. At a minimum, the Benefit Authorization transaction must include the following data elements:  Client Case Identification Number  Eligibility Office Identification Number  Benefit Type  Benefit Amount  Benefit Availability Date  Benefit Month and Year  Transaction Type Identifier (Benefit add, cancel) Page | 7 3.2.3.1. Card Linkage The EBT contractor must support both Over-The-Counter Card Issuance and Over-The Counter Card Replacement. These online functions must link the card number to the client’s case number. 3.2.3.2. Client EBT Account Maintenance Upon notification by DHS through the set-up processes, the EBT Contractor must establish and maintain an account for each cardholder or client. The primary purpose of client account maintenance is to ensure that accurate and timely information is maintained regarding client account balances, account status, and client demographic information. 3.2.3.3. Maintain Account Balance and Transaction History Current account balances and a rolling 180-day transaction history for each account must be maintained for on-line access through administrative terminals or ARU's. After 180 days, transaction history data must be maintained off-line for a minimum of three (3) years, or longer if required by Territory, Federal Reserve Board, NACHA, or federal legislation. At a minimum, transaction histories must include:  Client name  PAN (card number)  EBT account number  Client case identification numbers  All benefit program identifiers  All retailer identification numbers  Terminal identification number  Transaction type  Transaction amount  Transaction date  Transaction results (approval or denial code) At a minimum, the last ten (10) transactions, specified by program type, must be available to the client through the ARU. More extensive transaction histories must be available through customer service. When a client makes a purchase or performs a balance inquiry, a SNAP balance must be reported on the client’s receipt. If cash programs are added in the future, a single cash balance must be reported separately from the SNAP balance. 3.2.3.4. Post Benefits (Credits) A SNAP benefit authorization file specifying the amount of benefits authorized for a specific month will be transmitted to the EBT Contractor. Benefits are credits posted to an existing EBT account; no funds are realized until benefits are accessed, funds are drawn down from the federal government, and reimbursement (settlement) occurs the following banking day. In addition to benefit authorizations, SNAP refunds at the point-of-sale at retailer locations must also result in credits to client accounts. The EBT Contractor must ensure that SNAP EBT refunds are posted to the correct SNAP account. Page | 8 3.2.3.5. Post Debits Because of a food purchase, or because of administrative actions initiated by DHS, debits must be posted to a client’s account. The EBT Contractor must be capable of capturing and posting account debits on an on-line, real-time basis to ensure that client accounts are not overdrawn and that there are sufficient balances to cover any authorized transactions. 3.2.3.6. Hold Funds For retailers without POS equipment and in instances when the retailer system, network or EBT host is down or otherwise unavailable, a manual SNAP transaction may be performed to allow the uninterrupted purchase of food. When manual SNAP transactions are performed, the retailer is required to obtain voice authorization. The EBT Contractor must place a “hold funds” on the manual voucher amount approved by voice authorization for up to 30 days or until the retailer clears the transaction. If the manual voucher is presented for settlement within 30 calendar days from the date of authorization, the EBT Contractor must debit the client account and settle the transaction. If the manual voucher is not presented within 30 calendar days from the authorization date, the EBT Contractor must release the hold on funds and make them available again for client access. A retailer not presenting a manual transaction within 30 days must not receive payment, regardless of voice authorization and approval. 3.2.3.7. Benefit Expungement SNAP clients who have been issued a benefit must be able to use that benefit for 365 days from the availability date. If a benefit (or a portion of that benefit) still remains in the account after 365 days, it must be expunged. Clients must not be able to access benefits that are older than 365 days; therefore the EBT Contractor must track the benefit as it ages from the availability date to 365 days after the availability date. The EBT Contractor must expunge the benefit (not the entire account) from the system and provide DHS with a report of expunged benefits (See Section 3.2.10.1.1 Account Activity Reporting for more information about reporting). The EBT Contractor must provide monthly reports to DHS by eligibility office of all expungements to DHS including client case identification number, client/payee name, benefit type, benefit authorization number, and benefit balance. Expunged benefits must not be reinstated. 3.2.3.8. Administrative Actions The following administrative actions must be supported by the EBT host:  Account Update: The EBT Contractor must support the updating of client information as initiated by DHS. Through the batch process DHS will send Account Set-up files identified as updates and client information that has been updated in CARIBS including account status, client demographics, and authorized representative information. The account update function will not affect financial data in a client’s record on the EBT Contractor’s system. To support issuance during disaster situations only, the account update function must also be available through the administrative terminal.  Account Adjustment: SNAP account adjustments (i.e., credits or debits) must be supported by the EBT Contractor in accordance with FNS regulations and Quest® Operating Rules.  Expungement: When expungement occurs according to the specified program expungement rules, the EBT Contractor must provide a report of all expungement activity. Expungements are non-settling transactions. Page | 9  Repayment: The EBT Contractor must support voluntary benefit repayments through the EBT administrative terminal application. 3.2.3.9. Account Status Maintenance An account status must be maintained for each client account. The valid account status must be as follows:  Active: Accounts having client initiated debits or credits posted during the month must be designated as active accounts.  Dormant: If for a period of 30 days there are no client initiated debits posted to an account, the EBT Contractor must flag and transmit a notification message to DHS. If for a period of 60 days there are still no client-initiated debits posted to an account, the EBT Contractor must transmit an additional notification message regarding the flagged account to DHS. If for a period of 90 days there are no client-initiated debits posted to an account, the EBT Contractor must block client access to the card by changing the card status to inactive. Client access to the benefits must remain blocked until action is taken by DHS to re-activate the account. 3.2.3.10. Card Status Maintenance A card status must be maintained for each client account. The valid card status must be as follows:  Active: When card is linked successfully to the client’s account. The demographic and benefit files are processed successfully.  Inactive: The card cannot be used by the client. This status can be initiated by DHS when the card is not working properly or by the client when the card is reported lost.  Prohibited: The card cannot be used by the client. This status is initiated by sending an update on the account access in the demographic file. A client may request to deny the access of the Authorized Representative to her account. 3.2.3.11. Account Balance and Transaction History Inquiries Information regarding account balances must be available to the client 24 hours per day, 7 days/week through the ARU or through POS terminals with balance inquiry capability. A history of transactions must also be made available to the client 24 hours per day, 7 days/week through the ARU. Also, during the hours when live Customer Service Representatives (CSRs) are available for general inquiry, CSRs must be able to provide account balance and transaction history if requested to do so by the client. DHS must have access to client balance and transaction history data through administrative terminals in DHS offices. EBT system internal controls and security features must provide for various levels of administrative access and data entry and processing: view only, view and limited entry, unrestricted view and entry. DHS intends that its personnel have access only to the client EBT account information that is needed for the direct performance of their jobs. 3.2.4. Card Issuance and Activation Once a new EBT Contractor is selected, the new Contractor must continue to support administrative functions that enable card issuance, card activation, by clients over-the-counter (OTC). Such support Page | 10 must continue until such time as a new issuance process is developed and implemented. The current OTC issuance process, which must be maintained, is described in the sections which follow. The new EBT contractor can discuss alternative methods of card delivery with the VI during contract negotiations. 3.2.4.1. Activate the EBT Card All EBT cards will be issued over-the-counter. PIN selection will occur at the time of card issuance. The EBT Contractor system must support card activation during PIN selection. The bidder’s solution to be implemented must include a methodology to support card activation during PIN selection. The date and time of card activation must be maintained on the system and displayed on the administrative terminal. 3.2.4.2. De-activate the EBT Card The EBT Contractor, through its CSRs, must cause a lost or stolen EBT card (PAN) to be immediately “statused” or otherwise deactivated under the following conditions: when a card is reported lost, stolen or non-functioning; when the corresponding EBT account is closed; and when the card is deactivated through an administrative terminal transaction. 3.2.4.3. Card Replacement The EBT Contractor must provide the functionality to support the over-the–counter replacement by DHS personnel of a lost, stolen, or non-functioning EBT card. When an EBT card is replaced, the replacement card must have a different embossed PAN; a PAN must not be reissued. However, a cardholder must be able to use the same PIN with his or her replacement card. If a client reports a lost, stolen or non-functioning VI EBT card to the toll-free customer service help line for deactivation, the Customer Service Representative must verify the client’s identity prior to deactivating the card. Currently there is no fee for card replacement. At some point, DHS may impose a fee for card replacement contingent upon approval of the fee by FNS and provided the fee does not exceed the cost to replace the card. If a card replacement fee is imposed, the EBT Contractor must debit the fee automatically from the client’s SNAP account. In accordance with federal regulations, if a fee structure is implemented, fees are required to be returned to the Territory. The EBT Contractor system must maintain the card issuance and replacement history for each cardholder for display upon inquiry. 3.2.5. PIN Selection, Replacement, and Pin Tries Each EBT card must require a PIN to access benefits through a secure and encrypted POS device. Clients will select their own PIN. The EBT Contractor must support the following functions related to the PIN. 3.2.5.1. PIN Selection For over-the-counter card issuance, clients must select their PIN by entering a four (4) digit number into a PIN selection device. The device must require that the PIN be entered two (2) times by the client for verification purposes. The PIN must be encrypted and transmitted from the local office directly to the EBT host. To maintain security, the device must require the entry of a valid user ID and password by the local DHS office personnel. This must be completed prior to activating the PIN selection process. The PIN offset must reside at the EBT host, not on the EBT card. Page | 11 3.2.5.2. PIN Replacement For ongoing operations, the EBT Contractor solution to be implemented must have the functionality to select a new or replacement PIN at the local DHS eligibility offices. The process must be identical to that of initial PIN selection during OTC card issuance. A client may elect to change his or her PIN at any time. Under no circumstances may a PIN be transmitted to the EBT host in the clear. 3.2.5.3. Card Suspension for Invalid PIN Attempts After four (4) consecutive invalid PIN attempts, the EBT Contractor must automatically block card access to the EBT account until the beginning of the next day (i.e., 12:01am) or another time as designated by DHS. At that time, the counter must be reset to zero and card access must be unblocked. If a client enters a valid PIN before reaching the maximum number of PIN attempts, the counter must be reset to zero. 3.2.6. Administrative Terminal Functionality The EBT Contractor must support full administrative terminal transaction processing and functionality. Administrative transactions that originate at administrative terminals located in DHS offices must be sent to the EBT Contractor on-line real-time. All administrative terminal transactions are “exception” transactions and must be reported by the EBT Contractor separately. Transactions that originate at administrative terminals for on-line transmission to the EBT host are subject to a requirement for two (2) second EBT host machine throughput for transaction processing. At a minimum, the administrative transactions that must be supported by administrative terminals include:  Account Adjustments  Card Issuance/Activation  Card Replacement  Client PIN Selection  Client Account Information Inquiry  SNAP Repayments  Retailer Information Inquiry  Online Reporting  Account Set-up (restricted for disaster situations only)  Benefit Authorization (restricted for disaster situations only) The EBT Contractor solution to be implemented must provide administrative terminal access and administrative terminal application software and communication protocols to all DHS eligibility offices. In addition, the vendor must provide administrative terminal software, the communication protocol, and the establishment of user IDs for the FNS Regional Office and Caribbean Area Office. FNS administrative terminal capability must be for account inquiry and reporting purposes only. The EBT Contractor will be responsible for providing the communication network for any administrative terminals that it deploys. Administrative terminal functionality must include multi-level access controls to ensure that only authorized individuals process administrative transactions or access client account information Page | 12 through administrative terminals. The bidder’s solution to be implemented must clearly address “how” the solution will provide and support the required administrative terminal functionality, including multi-level access controls. The bidder’s solution to be implemented must include a Graphical User Interface for administrative terminal functionality. The bidder’s solution to be implemented must include the hardware (administrative terminals or other terminal configuration) and software necessary to support these functions. Reports to DHS of administrative terminal transactions must identify the eligibility office at which the transaction originated and the administrative terminal operator originating the transaction. 3.2.7. Transaction Processing The EBT Contractor must have the capability to receive and process client EBT transactions originating from POS terminals. These transactions can be routed from the point of origination through a commercial switch or through a direct connection to the EBT Contractor. The EBT Contractor must ensure that clients access their benefits only at POS terminals in authorized locations. 3.2.7.1. Transaction Processing Requirements When a transaction authorization request is received, the EBT Contractor must provide the following transaction processing capability:  The EBT Contractor must determine and record the transaction type to the client’s account;  The EBT Contractor must respond to transactions with either an approval or denial message back to the acquiring terminal (POS); and,  The EBT Contractor must maintain the integrity of the system by accounting for all transactions received and processed. 3.2.7.2. Transaction Accounting The EBT processor must maintain a general ledger account balance for each benefit program processed as well as separate account activity and available balance for each EBT account. Changes in the clients’ account balances must be balanced to changes in program benefit obligations outstanding at the end of each 24-hour processing cycle. The changes in program and client account balances must balance to the value of the day's transactions. 3.2.7.3. Authorize or Deny Transaction The EBT Contractor must authorize the transaction if:  The retailer has a valid FNS authorization number;  The card is active;  The card authentication value (CAV) is verified;  The number of PIN tries has not been exceeded;  The client PIN is verified as being valid;  The account is active; and,  There are sufficient active funds in the account. Page | 13 If any one of these conditions is not met, the EBT Contractor must deny the transaction. The EBT Contractor must ensure that client benefit accounts are not overdrawn and must assume all liability if an account overdraft does occur. 3.2.7.4. Transaction Sets At a minimum, the EBT Contractor must support the following POS and Exception transaction sets: 3.2.7.4.1. POS SNAP Transactions A balance must be printed on the receipt after each SNAP transaction. SNAP transactions include:  SNAP Purchases  SNAP Merchandise Return  Manual Authorization  Voucher Clear  Balance Inquiry  Voids or Cancellations  Reversals 3.2.7.4.2. Exception Transactions The EBT Contractor must support the following exception transactions within the context of the Quest® Operating Rules and USDA/FNS regulations including any waivers. The VI has one waiver that is pending approval by FNS: POS RE/DE-INSTALLATION FEES [7 CFR 274.3(a)(2)] - ALLOWS SA TO CHARGE REASONABLE FEES TO REINSTALL EBT POS DEVICES IF THE RETAILER BREACHES THE RETAILER AGREEMENT AND RETURNS TO THE EBT SYSTEM USING STATE SUPPLIED TERMINALS, OR IF THE RETAILER RETURNS AFTER BEING DISQUALIFIED. THIS ALSO ALLOWS A SA TO CHARGE REASONABLE FEES TO DE-INSTALL STATE- SUPPLIED POS TERMINALS IF A RETAILER CHANGES TO A THIRD PARTY PROCESSOR. THE POSSIBILITY OF THESE CHARGES SHOULD BE MENTIONED IN THE RETAILER AGREEMENT AND TRAINING MATERIAL. 3.2.7.4.2.1. Manual Voucher Authorization and Clearing Transactions The EBT Contractor must process manual vouchers for SNAP transactions only when electronic transactions are not available due to disasters or EBT system failure. Please see Appendix E – Retailer Data for additional information. The exempt retailers listed below can continue to use manual vouchers for purposes other than disasters or EBT system failures: STARS Business Type Codes and Descriptions Business Type Code Description Store or Meal Service AD Drug and/or Alcohol Treatment Program Meal Service Page | 14 BC Non-profit Food Buying Co-op Store BW Shelter for Battered Women and Children Meal Service CD Communal Dining Facility Meal Service DF Direct Marketing Farmer Store FM Farmers' Market Store GL Group Living Arrangement Meal Service HP Homeless Meal Provider Meal Service MC Military Commissary Store MD Meal Delivery Service Meal Service SC Senior Citizens' Center/Residential Building Meal Service Exempt retailers authorized before March 21, 2014 and currently using manual vouchers for ongoing business can continue to use manual vouchers until further notice from USDA/FNS. A new retailer who purchases a store that already has one of the above exemptions can continue until further notice from the USDA/FNS. The EBT Contractor must have specific approaches to the following:  A retailer must properly complete a manual voucher, including the customer’s signature on the voucher. The customer’s signature is substituted for the customer’s PIN. A retailer shall always obtain an approval number from the EBT Retailer Helpdesk prior to dispensing the purchased goods. In the event approval is not obtained and goods are dispensed, the retailer is liable for the full transaction amount.  Retailers must clear the manual voucher within 30-calendar days of the voucher approval, electronically on the POS terminal or by mail, if the retailer uses manual vouchers to conduct ongoing business. If the retailer does not clear the manual voucher within thirty (30) calendar days after receiving telephone approval, the approval number expires and the funds return to the customer’s EBT account. The liability for the transaction will rest with the retailer. As described in the Quest® Operating Rules, a standard sales draft will be used for manual SNAP transactions. Subsequently, the authorized retailer or acquirer will convert the manual transaction to an electronic transaction for transmission to the EBT Contractor. The EBT Contractor must support a voucher clear transaction within the POS transaction set. For those without a POS device on which to clear the manual authorization, the voucher must be mailed for clearing and settlement. When the sales draft data is received, the EBT Contractor must process the transaction. The following process must be used for manual voucher transactions. A retailer will call the retailer ARU supported by the EBT Contractor to receive an approval for the transaction and authorization number (if the transaction is approved). The transaction must be approved if all the following criteria are met:  The retailer provides a valid FNS authorization number;  The card is active;  The number of PIN tries has not been exceeded; Page | 15  The account is active; and,  There are sufficient funds in the active account. If approval is received, the retailer will include the authorization number on the sales draft. For verification, the client will be required to sign the sales draft. Upon providing an authorization for a manual SNAP transaction, the EBT Contractor must put a hold on funds in the client's SNAP account sufficient to cover the value of the authorization. If the manual transaction is properly presented (either electronically or by mail) within 30 calendar days, the EBT Contractor must settle the transaction. If the manual transaction is not presented within 30 calendar days, the EBT Contractor must release the hold and make the funds available for client access. 3.2.7.4.2.2. Reversals A SNAP purchase or return transaction may be reversed. A reversal is a system-generated transaction in which a previously approved transaction is reversed, usually because the response cannot be successfully sent back to the acquiring POS device. The EBT Contractor must have the capability to accurately process the reversal transaction and have the results accurately reflected in the client's EBT account. 3.2.7.4.2.3. Transaction Adjustments A transaction adjustment is initiated by an acquirer to correct an out-of-balance condition identified during the terminal, retailer, or acquirer reconciliation process. The adjustment will reference a settled original transaction that is partially or completely erroneous. The EBT Contractor must have the capability to process the adjustment and have this reflected in the client's account. The EBT Contractor must comply with all FNS regulations and Quest® Operating Rules regarding adjustments to client EBT accounts. 3.2.7.4.2.4. Void/Cancellation A void/cancellation is a transaction that is manually voided following the receipt of an approval from the EBT host. A transaction may be voided/cancelled at the POS by a retailer or by a client. The void/cancellation message must include the trace number, the exact dollar amount, and other identifying information from the original transaction. The EBT Contractor must have the capability to accurately process the void or cancellation transaction and have the transaction appropriately reflected in the client's account. At the retailer site, the retailer is expected to transmit the trace number and the exact dollar amount of the original transaction. 3.2.7.5. Transaction Routing The EBT Contractor must recognize and receive transactions from all FNS authorized retailers using EBT-only POS terminals provided by the EBT Contractor, or using Third Party Processors (TPPs) that have been certified for acquiring and routing EBT transactions by the EBT Contractor. The selected EBT Contractor must support interoperability for clients of the Virgin Islands who utilize their EBT cards in other states and territories, as well as route transactions from other states and territories’ clients who wish to use their EBT cards in the Virgin Islands. 3.2.7.6. Retailer Validation SNAP benefits can only be used to purchase eligible items at FNS authorized retail locations. Prior to approval of SNAP transactions, the EBT Contractor must validate that the transaction originated at an FNS-authorized retail retailer location. This validation is accomplished by matching the retailer identifier number against the FNS retailer identifier in the database of authorized FNS retailers maintained by the EBT Contractor (see Section 3.2.8 Management of a SNAP Retailer Validation Database for database Page | 16 requirements). The FNS retailer authorization number must be included in the SNAP transaction message. 3.2.7.7. Stand-In Authorization Processing for SNAP Transactions In the event of EBT host system failure, stand-in authorization processing rules will apply. During stand- in authorization, processing retailers will use manual vouchers for SNAP purchases up to $40 without prior authorization from the EBT host. Once the EBT host becomes available the retailer will use the normal manual voucher authorization process (see Section 3.2.7.4.2.1 Manual Voucher Authorization and Clearing Transactions) to receive an authorization number for each SNAP transaction that occurred during the system failure. The retailer will then use a POS device to clear the vouchers. The EBT Contractor must make every effort to notify retailers of the unavailability of the EBT host. The maximum purchase amount permitted for stand-in authorization processing will be $40. If the purchase amount is $40 or less and the client has insufficient funds to cover the purchase, the EBT Contractor must accept liability for the amount for which the client is insufficient. If an authorized retailer allows a purchase in excess of that amount and the client has insufficient funds to cover the purchase, the authorized retailer is liable for any amount exceeding $40. 3.2.7.8. Transaction Processing Technology The EBT Contractor must provide on-line processing, in a real-time environment. The EBT Contractor's host mainframe must process transaction requests, maintain EBT account balances and transaction history data, and initiate and perform daily financial settlement, account reconciliation, and EBT system activity and performance reporting. The EBT Contractor must maintain records of all such services for a period of three (3) years. The EBT host must operate 99.9 percent of the time, calculated on a monthly basis, 24 hours daily, 7 days per week, except for scheduled downtime for system maintenance. The EBT Contractor must notify DHS in advance of scheduled downtime and must also provide for prompt notification to DHS in the event of unscheduled downtime. The EBT host must process a transaction request and respond within two (2) seconds of the time the request is received. The two-second response time must be maintained 98 percent of the time, calculated on a monthly basis, 24 hours a day, 7 days per week. An accuracy standard of no more than 2 errors per every 10,000 transactions processed must be maintained. The EBT host must process EBT transactions and must respond to balance inquiries initiated by cardholders at POS devices. The EBT Contractor must respond to cardholders' requests for historical data received via the ARU and Customer Service Center. The EBT Contractor must respond to inquiries and processing requests initiated by authorized personnel via EBT administrative terminals located in DHS offices and to inquiries initiated at the FNS Caribbean and Regional offices. The EBT Contractor must provide DHS staff with on-line access to account data for the previous three (3) months. Additionally, the EBT Contractor must maintain account activity and transaction data for at least three (3) years and must provide such data to DHS upon request. Data stored off-line must be made available to DHS within one week of the request and at no additional cost. The bidder’s solution to be implemented must support a process and timeframes for responding to DHS requests for data stored offline. Page | 17 3.2.8. Management of a SNAP Retailer Validation Database The EBT Contractor must develop and maintain a SNAP retailer database management system that encompasses the functional requirements listed below. The system must be structured to ensure that accurate EBT transaction detail data are captured for each retailer. The retailer databases must include records of retailers authorized to participate in SNAP. 3.2.8.1. Maintaining the FNS Retailer Database The EBT Contractor must use the FNS Retailer EBT Data Exchange (REDE) system to obtain and maintain its retailer database. The EBT Contractor must electronically acquire SNAP retailer authorization numbers from FNS and maintain a mechanism for acquiring data updates on a business day basis. This function is vital to maintaining the integrity of the EBT system in assuring that only authorized retailers are redeeming SNAP benefits. The EBT Contractor must receive and process updates to the FNS retailer database from the Benefit Redemption Systems Branch (BRSB). The EBT Contractor must ensure that all newly authorized retailers are enabled to conduct SNAP transactions within 2 weeks of receipt of a signed contract from the retailer. Conversely, the EBT Contractor must suspend or de-authorize the SNAP transaction processing privileges of a retailer within 48 hours of notification by the RPMD that the retailer is de- authorized/suspended. 3.2.8.2. Transmitting SNAP Redemption Data to FNS The EBT Contractor must transmit information on retailer SNAP redemptions to the FNS State Tracking of Authorized Retailers System (STARS). Transaction data must also be sent to FNS’ Anti-Fraud Locator using EBT Retailer Transactions (ALERT) system. 3.2.8.3. Retailer Confidentiality The EBT Contractor must provide physical and access security to the retailer management data and must ensure the privacy of confidential data. 3.2.9. EBT Settlement and Reconciliation The EBT Contractor's host must operate on a 24 hour processing cycle. At a designated cutoff time each day, the EBT Contractor must close out the current processing day and commence the next processing day. 3.2.9.1. Daily Cutoff and Balance Processing The EBT Contractor must designate a standard daily cutoff time for EBT transaction processing. The 24- hour period between the cutoff time on Day1 and Day2 constitutes the EBT transaction day. The specified cutoff time must allow the EBT Contractor sufficient time to originate ACH payments for next day settlement. It is also preferred that the EBT cutoff coincide as closely as possible with the cutoff time of the prevailing regional network to minimize the need for carry over or suspense accounting. 3.2.9.2. Reconciliation The EBT Contractor must meet Food and Nutrition Service reconciliation requirements of 7CFR § 274.4 and support DHS reconciliation in accordance with the guidelines identified in the FNS Reconciliation Guidance. At a minimum, the bidder’s solution to be implemented must include procedures for reconciling the following:  Client account daily beginning balance and net draws versus the ending balance;  Client net redemptions versus acquirer settlement values; Page | 18  Total net change in system wide obligations outstanding to the sum of the net change in obligations outstanding for all benefit programs;  Total net change in system wide obligations outstanding to the sum of the net change in obligations outstanding for all Government agencies;  The net settlement value of all transactions to the sum of the net settlement values for all benefit programs;  The net settlement value of all transactions to the sum of the net settlement values for all eligibility offices;  Benefits posted to household accounts against DHS issuance authorization file;  Territory issuance authorization file against the amount obligated in the AMA system; and,  Each individual retailer’s transactions and credits against deposits. The information generated during system cutoff and balance processing must be used by the EBT Contractor to prepare the daily settlement files. The EBT Contractor must specify procedures for maintaining audit trails throughout the settlement processes. The EBT Contractor must provide adequate reporting, including suspense information if necessary, to accommodate DHS in reconciling daily EBT activity to the draw down in the Automated Standard Application for Payments (ASAP). 3.2.9.3. Commercial Settlement To effect commercial settlement through the Automated Clearing House, the EBT Contractor must have an originating and receiving relationship with the ACH or a bank that can originate and receive ACH transactions on behalf of the EBT Contractor. On a business day basis, the EBT Contractor must originate an ACH credit for the total balance due for EBT benefits provided during the just closed EBT processing day for EBT-only retailers, TPPs, or other benefit providers that are directly connected to the EBT host. The benefit provider credits must be entered into the ACH for settlement on the next banking day. The EBT Contractor must provide a toll-free telephone number to retailers and TPPs for inquiry or reporting of settlement problems. This may be the same telephone number used for retailer customer service described in Section 3.3.5. Retailer Customer Service. 3.2.9.4. Federal Settlement To cover settlement for SNAP transactions, the EBT Contractor must originate a payment request through the Treasury's ASAP at the Federal Reserve Bank of Richmond prior to 11:59 p.m. Eastern Time. The funds will be transferred to the EBT Contractor through a fed wire or an ACH settlement, based upon the preference of the EBT Contractor. Federal funds may not be drawn to cover unauthorized issuance or transactions in excess of client account balances. 3.2.9.5. Settlement Reporting As part of DHS settlement requirements, the EBT Contractor must transmit reports and data files validating the daily total amount of funds requested from the federal ASAP payment system to the appropriate Territory agency. These reports and data files will be provided electronically and the formats for this data will be as agreed between DHS and the EBT Contractor. 3.2.10. EBT Reporting and Data Storage The bidder’s solution to be implemented must include the capability for DHS to segment or sort and read information at the Territory level and at the two District office levels, the St. Thomas District and the St. Page | 19 Croix District. For transactions that originate at administrative terminals, a code identifying the individual who originated the transaction must be provided. The bidder’s solution to be implemented must include the data transfer requirements to be placed on DHS to support reporting at these levels. The bidder’s solution must also include a means for reporting to DHS the most efficient and cost effective combination of raw data extract and/or standard report formats (i.e., paper and terminal access). DHS has identified seven categories of required reports: Financial Audit, Program Management, Security and Fraud, System Performance, FNS AMA Reporting Requirements, Compliance Investigation and Reporting, and Retailer Redemption Data for SNAP. The bidder’s solution to be implemented must have system reports to satisfy the stated requirements. The final content, format, layout, and data elements of the reports, the frequency of reports, and the method by which the reports will be made available to DHS by the EBT Contractor must be agreed upon during the process of defining the system requirements. As a deliverable, the EBT Contractor must develop a Reports Manual describing all standard reports to be generated by the EBT Contractor. 3.2.10.1. Financial Audit Reports Financial audit reports include those reports the EBT Contractor must provide in order to account, reconcile, and audit the EBT system processing and operations. 3.2.10.1.1. Account Activity Reporting The EBT Contractor must provide daily account activity reports reflecting all account actions received from DHS via batch and/or on-line administrative terminal processing. The following account activity reports have been defined. Account Activity Reports Report Name Description Format Frequency Benefit Authorization Report The EBT Contractor must provide to DHS a daily electronic report of EBT Benefit Authorizations processed and made available to clients. At a minimum, the report must provide the total of SNAP benefits authorized and or impacted through administrative actions such as coupon conversions, expungements and benefit repayments. Electronic File Daily Account Maintenance Report The account maintenance report must provide a comprehensive listing of all account maintenance actions processed by the EBT system over the preceding business day. This report must include both on-line and batch account maintenance actions. Electronic File Daily Account Status Report(s) The EBT Contractor must report to DHS all accounts that have reached the inactive (30, 60, and 90 days inactivity) status. The report(s) must be sorted by local office. Electronic File Monthly (at a minimum) Page | 20 Account Activity Reports Report Name Description Format Frequency Administrative Terminal Action Report This report must provide a listing of all administrative terminal actions received and processed by the EBT system over the preceding business day. Administrative terminal actions must include changes to client, case, or account data (e.g., client name or address), benefit authorizations, and card maintenance (issue and status cards). Electronic File Daily Account Audit Report This report must provide a detailed audit trail of all system functions and transactions that affect the account balance or status of an account. Admin Terminal Online history 3.2.10.1.2. Batch Processing Confirmation and Exception Reporting The EBT Contractor must provide a standard set of batch processing reports to be used by the EBT Contractor and DHS to ensure the complete and accurate transfer of data during nightly batch processing. The reports must support the following criteria: Batch Processing Confirmation and Exception Reporting Report Name Description Format Frequency Batch Confirmation Message The EBT Contractor must provide a confirmation message for all overnight batch files received from DHS. The confirmation message must contain summary verification data including the total number of records received in the batch and the number of records by record type (e.g., number of add, change and delete records). Electronic File or Admin Terminal Every batch file processed Batch Exception Report The EBT Contractor must provide a batch exception report for all batch files received by DHS. Batch exception reports must contain a listing of all records received within a batch that were not processed by the EBT Contractor. Each record included in an exception report must have a corresponding reason code indicating the cause of the rejection. In particular, duplicate case exceptions must be clearly identified. Electronic file Every batch file processed 3.2.10.1.3. Settlement Reporting Daily settlement reports and report data must be transmitted to DHS via batch processing. At a minimum, these reports must include the following: Page | 21 Settlement Reports Report Name Description Format Frequency Daily Activity Report This report must provide summary information on client transaction activity for both settled transactions and transaction held in suspense Electronic file Daily Automated Clearing House (ACH) Activity Report This report must provide detail and summary information on money movement initiated to settle client transaction activity Electronic file Daily Clearing Reports These reports must provide detail and summary information on financial activity and money movement necessary between Territory and federal agencies to settle client transaction activity. The clearing reports must include data on retailer funds held in suspense and provide a level of detail sufficient to enable DHS to accurately meet its federal reporting requirements. Electronic file and/or admin terminal Daily 3.2.10.2. Program Management Reporting The EBT Contractor must support the following management reporting: Program Management Reports Report Name Description Format Frequency Conversion Report Some unique data requirements will be necessary during the EBT system implementation. The EBT Contractor must produce reports to be used by DHS to identify those clients who are on the EBT system and/or scheduled for conversion to the new EBT system. Data elements to be included in the conversion reports include, but are not limited to:  Client name  EBT account number  Client case identification number  Social Security Number  PAN (EBT card number)  Status (e.g. active, awaiting card issuance or confirmation of receipt of card, etc.) Electronic file On request Page | 22 Program Management Reports Report Name Description Format Frequency Program Participation Data The EBT Contractor must provide – by program – detailed and summary information on card and case activity. Currently, only the SNAP Program is on EBT. This data must include, but is not limited to, the program participation data, including total number of cases/cards, total amount of benefits expended or redeemed by day and month, coupon conversion activity, and number and amount of inactive cases by period of inactivity (i.e., 30, 60 and 90 days) Electronic file Monthly Card Activation Report At the request of DHS, the EBT Contractor must provide a report of cards that have been activated and the date of activation. The EBT Contractor must also provide a separate report of cards that have not been activated and associated case information Electronic fie On- request 3.2.10.3. Security and Fraud Reports The EBT Contractor must support the data requirements of both the federal government and DHS for ensuring the integrity and proper use of benefits to be distributed by the EBT system. Security and Fraud Reports Report Name Description Format Frequency ALERT Transaction Activity The SNAP Contractor must transmit ALERT data to FNS. Extract File Monthly Client Fraud and Compliance Report The EBT Contractor must work with DHS to define a periodic extract file for the investigation of client fraud. DHS will use ALERT data, provided by FNS, to help identify clients potentially involved in SNAP fraud. FNS can identify potentially fraudulent retailers and then DHS can follow up by analyzing transaction patterns of those clients that performed transactions at a particular retailer. Data requirements for this extract file include, but are not limited to transaction data, a daily activity file of all client- initiated transactions, including at a minimum the EBT Account Number, transaction amount, retailer FNS authorization number, date, time, benefit type, transaction type, and transaction status (approval or denial code). Extract File On-request Page | 23 Security and Fraud Reports Report Name Description Format Frequency Administrative Terminal Security Report The EBT system must provide for a variety of user security profiles to enable DHS to manage user access to the EBT system. Reports on users, including worker name or identification number, status, and security profile, must be available on-line. In addition, the EBT system must provide information on user activity to assist DHS in the detection and investigation of internal fraud. This data must be available daily and include, at a minimum, user identification information (e.g., name, security identification number or code, and office location), the number of failed terminal log-on attempts for a given user identification number or code, and an audit trail of terminal functions (e.g., cards issuance/replacement, and account set- up/update) processed during a terminal session (e.g., business day). Electronic file Monthly 3.2.10.4. System Performance Reports System performance reports will be used by DHS to monitor the operations and performance of the EBT system, Customer Service operations, and the Automated Response Unit. These reports must provide statistical information on system utilization and response time. Unless specified elsewhere, system performance reports must be supplied on a monthly basis. Data to be provided include, but are not limited to, the following: Security and Fraud Reports Report Name Description Format Frequency Response Time Analysis Report This report must include response time analysis information including a statistical summary of response time of the customer service operation, ARU operation, and EBT host. Paper Report Monthly System Availability Report To ensure compliance with the system availability requirements specified in this document, the FNS regulations, and the Quest® Operating Rules, the EBT Contractor must provide a monthly report of the system availability, including detailed documentation and explanation of both scheduled and unscheduled downtime or processing interruptions. Paper Report Monthly Page | 24 Security and Fraud Reports Report Name Description Format Frequency Transaction Activity Reports The EBT Contractor must provide daily and monthly statistical reports on transaction activity including the number and type of transactions requested and processed per hour, day, and month through the EBT host system and various subsystems, including but not limited to customer service operation and the ARU. Electronic file Monthly 3.2.10.5. FNS AMA Reporting Requirements On a business day basis, the SNAP EBT Contractor must provide data necessary to support increases/decreases to the Project’s ASAP account balance at the Federal Reserve Bank. The data must be provided via the AMA batch process. The Federal Reserve Bank will serve as the Account Management Agent (AMA) for the FNS SNAP EBT benefit account. The AMA interfaces with the Treasury Department's Automated Standard Application for Payments (ASAP); establishes ASAP account funding limits for the Territory for SNAP EBT activity; and performs the reconciliation required by FNS. Consequently, the EBT Contractor must interface with the AMA and provide the necessary data. 3.2.10.6. FNS SNAP Redemption Data Reporting Requirements The EBT Contractor must provide detailed daily SNAP redemption data to STARS, the FNS SNAP redemption database. The data format and requirements of this file is specified by FNS. 3.2.10.7. FNS Compliance Investigations and Reporting The EBT Contractor must advise, assist, and appropriately act to aid Territory and federal agencies in detection and investigation of abuses by retailers, clients, or workers. This may entail cooperation with various authorities of both Territory and federal agencies that are responsible for compliance with laws and regulations surrounding the programs. Retailers authorized by FNS to accept SNAP Program benefits may become subject to monitoring and investigations by DHS, SNAP Retailer Operations Division, USDA Office of the Inspector General, the Internal Revenue Service, Secret Service, or local police departments. Clients are subject to investigation by DHS program authorities and occasionally others. The EBT Contractor must cooperate with local and federal agencies in these investigations by creating client cases, providing benefit access cards, and providing information. Access to information concerning these matters must be restricted at the EBT Contractor so that investigations are not compromised. These needs must be addressed prior to the functional demonstration; tested as necessary in acceptance testing; and available at implementation. At a minimum, the EBT Contractor must support the following:  Creation of cases and cards to be used by investigators;  Posting benefit amounts to the investigators' cases, possibly on an irregular basis as needed by the investigators;  Training, card issuance, and PIN selection for investigators using the cases;  Providing information from the system as needed for evidentiary purposes;  Providing transaction data, starting at implementation, of store transaction history (via the ALERT file) on a daily basis to FNS; and, Page | 25  Retention of all records for a period of three years or longer if notified. 3.2.10.8. Fraud Analysis and Prevention Fraud and theft are major cost components in banking environments where large numbers of employees and customers have easy access to products and even the cash receipts of the business. By understanding what is normal and what is anomalous in daily operations, regional, store and risk managers can identify and proactively address fraudulent behavior to minimize loss. Fraud preparation and planning is crucial in providing a comprehensive framework for building effective anti-fraud measures. The EBT Contractor shall provide an Anti-Fraud Plan that includes locating and stopping fraud by actively and aggressively monitoring the activities of customers, employees, retailers and others for the purpose of identifying, at the earliest possible opportunity, evidence of fraudulent conduct. The Contractor shall include in the Anti-Fraud Plan a description of fraud analysis techniques intended for fraud prevention of customers served through remote banking service systems. The Contractor shall ensure all data through business rules and analytical models are in near-real time or in batch so that suspicious activity may be spotted with greater accuracy. A. The Contractor shall state specific fraud analysis techniques and tools used to show a full comprehensive approach for the following:  Detection and Alert Generation  Fraud Data management  Predictive and Prevention Analysis  Alert Management  Social Network Analysis  Drill Down Dashboard  Analysis Reports  Risk Behavior  Data Mining Techniques B. Standardize and/or ad-hoc reports that shall be used by either DHS or the Contractor for the purpose of detecting and preventing fraud. These reports may be requested by DHS at any time during the length of the Contract. C. A description of responsibility and procedure to refer any potentially fraudulent cases to the State Project Manager and cooperate with the Attorney General, the Office of the Inspector General, or any other law enforcement agency when requested, in investigating cases of alleged fraud. D. An annual review of the Anti-Fraud Plan with DHS to include trends in the industry, current fraud detected, if any, counter measures taken to eliminate fraud and types of preventive measures implemented. The Contractor shall work with DHS to proactively identify additional or revised anti-fraud measures. Measures will be monitored and reported on monthly and all measures are subject to DHS approval. E. A description of the internal control framework (control environment, risk assessment, control activities, information and communications, and ongoing monitoring) to show the establishment and enforcement of a strong anti-fraud program and controls. Page | 26 3.2.10.9. Federal Audit Guidelines The EBT Contractor’s system must comply with the Federal EBT Audit Guidelines. Please refer to the Review Guidelines for Service Organizations Providing EBT Services for Government Programs in Accordance with SAS-70. 3.2.11. EBT System Interface with CARIBS The EBT Contractor must support both batch and on-line, real-time transmissions between the DHS eligibility system and the EBT host via a dedicated leased communications line. The provision of communications facilities for batch and on-line, real-time transmissions (with the exception of dial-up modem transmissions) between the EBT Contractor and the Virgin Islands will be the responsibility of the EBT Contractor. The EBT Contractor must use communication software, hardware, and protocols compatible with DHS’s hardware/software configuration, but this configuration will change during the contract period as CARIBS will be replaced during the next 18 months. The EBT Contractor must determine, in conjunction with DHS, the appropriate capacity for each facility installed to ensure that all transmissions are completed within the time frames specified in this document. The bidder’s solution to be implemented must have a communications infrastructure for completing all batch and on-line telecommunications described in this document and must include a process to ensure that the data transferred are the data received. The bidder’s solution must also have procedures and processes to ensure data integrity and prevent the processing of duplicate data, after contract award. The EBT Contractor must provide DHS with any proposed and/or required commercial software. Each transmitted batch file must have a header and a trailer record for identification. The header record must include time, date, and control number for the file. The trailer record must include control totals of data on the file. All benefit authorizations must be identified by a combination of the client’s case number, benefit type, authorization number and amount, and date and time of the availability of benefits. The EBT system must receive benefit authorizations from DHS and post them to the respective clients’ EBT account(s). The EBT Contractor must ensure that there is no duplicate posting of benefits, or duplicate processing of files. If an error impacts the timely and accurate delivery of benefits, the EBT Contractor must notify DHS immediately so that DHS may take corrective action and retransmit the file. At present CARIBS, the DHS eligibility system, supports a dedicated T-1 line connected to the EBT host. The Territory is responsible for the ongoing costs of the dedicated T-1 line. This arrangement may change as DHS develops and implements a replacement system for CARIBS over the next 30 months. 3.2.12. EBT Host System Security The EBT Contractor must insure the security of EBT data and the privacy of client information. In additional, the EBT Contractor must develop an EBT System Security Plan that addresses the requirements that follow. 3.2.12.1. Security Controls This section addresses security and control requirements pertaining to the development and overall operational characteristics of the Electronic Benefit Transfer information and processing systems. The bidder’s solution to be implemented must have systematic and procedural controls for the following areas and other pertinent controls for the EBT system operations. Page | 27 3.2.12.1.1. Control of PINs The bidder’s solution to be implemented must have system and procedural controls to ensure that access to all PINs are strictly controlled. The EBT Contractor must ensure the confidentiality of the PIN during selection and verification. The Data Encryption Standard (DES) algorithm must be used to control all PINs so that the number never travels or is stored in the clear. The EBT Contractor must ensure that clear-text representation of the PIN is never displayed on PIN entry devices. 3.2.12.1.2. Access Controls The EBT Contractor must provide for security software to control access to the EBT system. Such security software must ensure that all access to the VI EBT system is strictly controlled. The EBT Contractor must provide access control software that has, at a minimum, the following capabilities: User Identification and Authentication: All personnel requiring access to the system must be established within the system. The system must require unique identification from each user to access the system (i.e., use ID and password). In addition, the system must support blind password display. The system must protect authentication data so that it cannot be accessed by any unauthorized user. The system must also provide the capability of associating this identity with all actions taken by that individual subject to audit. The system must be able to maintain information for determining the authorizations of individual users. The system must support a lock-out threshold for excessive invalid access attempts. The log-on IDs and passwords of users no longer authorized to access the system must be immediately deleted. Discretionary Access Controls: The system must use identification and authorization data to determine user access to information and level or type of information accessed. The system users must be provided the capability to specify who (by individual user or users, or type of users) may have access to system data. The system or network must assure that users without that authorization are not allowed access to the data. System Access Audit Controls: The system must be able to create an audit trail of access to the system and maintain and protect such records from modification, unauthorized access, or destruction. The system must define and control access between named users and named objects (including but not limited to, files and programs). The system must be able to record the following types of events: log on, log off, change of password, creation, deletion, opening, and closing of files, program initiation, and all actions by system operators, administrators, and security officers. For each recorded event, the audit record must identify: date and time of the event, user, type of event, and the success or failure of the event. For log- on, log-off, and password change, the origin of the request (including but not limited to terminal ID) must be included in the audit record. For file-related events the audit record must include the file's name. The system administrator (or system security administrator) must be able to selectively audit the actions of one or more users based on individual identity. EBT Transaction Controls: The EBT Contractor must provide controls to ensure that EBT transaction communications are safeguarded, and EBT transactions are processed only for properly executed transactions from authorized terminals. Message validation must provide for control edits for message completeness, file and field formats, and control and authentication measures. The bidder’s solution to be implemented must have controls to secure communication lines and links. The EBT Contractor must have the ability to perform error checking of transmitted data to ensure integrity of transmitted data, including range checks for acceptable data fields and message format checks. In addition, the EBT Contractor must provide a configuration layout showing complete end-to-end details of the telecommunications and automated information systems(s) as part of the detailed system design required as a system development deliverable. Page | 28 3.2.12.2. System Data Security System data must be protected to ensure that system and confidential information are not disclosed for unauthorized purposes. Such data security controls must at a minimum, include the following: Virgin Islands Access: The EBT Contractor must ensure that designated users from DHS may access only the system in relation to system data and operations regarding the Virgin Islands. Disclosure of Information and Data: Vendors must provide written assurance that sensitive information made available in any format will be used only for carrying out the provisions of this Contract, and that information contained in such material will not be divulged or made known in any manner to any person except as may be necessary in the performance of this RFQ. Disclosure to anyone other than an authorized officer or employee of DHS is prohibited without prior written approval. Sensitive information must be accounted for upon receipt and properly stored before, during, and after processing. In addition, all related output must be given the same level of protection as required for the source material. Separation of Duties: The EBT Contractor must provide for adequate internal controls through separation of duties and/or dual control for the functions of card and PIN issuance, system administration and security administration, account set-up and benefit authorization, and benefit authorization and settlement authorization. This required separation of duties includes the separation of operations from control functions, such as reconciliation controls. Backup and Contingency Operations: The EBT Contractor must provide for backup procedures to ensure the continuation of operations in the event of a temporary disruption (i.e., 4 hours or less) in operations. Backup procedures will allow benefit access when the EBT Contractor's computer, system terminals, or communications are not operational. Backup procedures must include manual transaction processing for the SNAP Program. The EBT Contractor must also provide for contingency plans for benefit issuance in the event of catastrophic disruption of benefit delivery services. The EBT Contractor must also provide for backup procedures to ensure the continuation of operations in the event of a halt in operations of the DHS eligibility system due to a disaster. The EBT Contractor must establish policies and assign responsibilities to ensure that appropriate contingency and disaster recovery plans are developed and maintained. Contingency planning consists of the advance plans and arrangements, which are necessary to ensure continuity of the critical functions. The contingency plan must include the actions to be taken, the resources to be used and the procedures to be followed before, during, and after any unlikely event occurs that would render inoperative a function supportive to the EBT system. The contingency plan must cover all events of total or partial cessation of operations or destruction of the database or physical facility. Such planning must include procedures and availability of equipment for both automated and manual procedures. All back-up and contingency plans must be incorporated into the Business Continuation and Recovery Plan deliverable required of the EBT Contractor. The bidder’s solution to be implemented must include the intended approach to meet both backup system operations and contingency plans for benefit delivery. The bidder’s solution to be implemented for contingency planning must include the actions to be taken before, during and after a disaster (or contingency), along with documented and tested procedures which, if followed, must ensure the availability of critical resources and facilities maintaining the continuity of operations in a contingency situation. The bidder’s solution to be implemented must have an architecture, technical capabilities, and organization to protect the system during emergencies. Page | 29 3.3. Retailer Management, POS Terminal Installation, Maintenance, and Deployment Requirements The EBT Contractor must have specific approaches to the following: A. Providing all approved FNS retailers the opportunity to participate in the EBT system. The Contractor must supply, on DHS’ behalf, POS terminals to all FNS approved exempt retailers who do not choose to purchase their own equipment. The Vendor must take the necessary steps to provide access to the EBT system for those retailers who choose to acquire their own terminals. FNS regulations require that exempt retailers authorized to participate in the SNAP be provided the opportunity to participate in the EBT system. Alternatively, the Vendor must supply POS devices to exempt SNAP retailers who do not choose to purchase their own equipment. The Agricultural Act of 2104, P.L. 113-79 states that after March 21, 2014 some store type will continue to be exempt from retailer cost provisions. Those store types that are exempt are:  Drug and/or Alcohol Treatment Program;  Non-profit Food buying Co-Op;  Shelter for Battered and Children;  Communal Dining Facility;  Direct Marketing Farmer or Farmers’ Markets (Vendors are strongly encouraged to offer a cost efficient Farmers’ Markets solutions);  Group Living Arrangement;  Homeless Meal Provider;  Military Commissary;  Meal Delivery Service;  Senior Citizen’s Center/Residential Building. The Vendor shall provide wireless point-of-sale (POS) equipment for SNAP EBT transactions at no cost to SNAP Authorized Direct Marketing Farmers of Farmers’ Markets who do not have access to a telephone line or electricity at their selling location. B. Procuring and maintaining retailer POS equipment at all exempt retailer locations requesting contractor supplied terminals. The contractor must complete deployment, installation and training before converting to the new EBT system. C. Replacing any defective or malfunctioning POS equipment that Contractor provides to retailers. At a minimum, a defective or malfunctioning POS terminal shall be repaired or replaced by the close of the retailer’s business day following the day it was reported. The Contractor shall provide same day service between 8AM to 5 PM if the retailer has only one terminal to process EBT transactions. POS terminals shall, at a minimum, have:  A display screen for messages;  A key pad for data entry, including PIN entry; Page | 30  A card reader (Magnetic Stripe and/or Bar Code); and  A two-part paper printer for receipts and messages The terminal shall not display PIN input in the clear on any screen nor shall the customer's full account number be printed on any receipt/validation. The balance may not be displayed on the screen of the POS unless it is a “Balance Only POS”. Refer to the Quest Operating Rules, Chapter 9, and 7 CFR § 274.8(b)(6)(7) for additional information. The new EBT Contractor must prepare technical, recruitment and training materials to assist in the deployment of POS terminals to retailers. For EBT terminals deployed by the EBT Contractor on behalf of DHS, agreements regarding the use and operation of such terminals will be between the EBT Contractor on behalf of DHS and the retailer. The EBT Contractor may charge reasonable costs to de-install government deployed terminals in retailer locations that are disqualified or otherwise leave the program and likewise may charge reasonable costs to re-install terminals at retailer locations that are reinstated or otherwise rejoin the program. According to federal regulations retailers must provide adequate EBT service, defined as having EBT equipment at a sufficient number of registers to provide comparable check-out service to both SNAP and non-SNAP customers. Retailers must ensure that SNAP customers are treated in the same manner as non- SNAP customers at the store level. Newly authorized retailers must have access to the EBT system within two weeks after the retailer receives its FNS authorization notice. However, whenever a retailer chooses to employ a third party processor to drive its terminals or elects to drive its own terminals, access to the system must be accomplished within a 30 day period or a mutually agreed upon time, to enable the third party interface specifications and required functional certification to be performed by the EBT Contractor. 3.3.1. EBT Only-Terminal Deployment The EBT Contractor shall provide all approved retailers the opportunity to participate in the EBT system. The Contractor shall supply, on Virgin Islands DHS’s behalf, POS terminals to all FNS approved exempt retailers who do not choose to purchase their own equipment. This equipment shall be restricted to EBT use only. The EBT Contractor must procure and maintain retailer POS equipment at all exempt retailer locations requesting contractor supplied terminals. All terminals deployed by the EBT Contractor for processing EBT transactions must meet the operational requirements of the EBT system and support the full EBT transaction set. The terminal must provide for visual verification of the transaction message before positive action is taken by the cardholder to release the message for authorization and settlement. For all terminals deployed by the EBT Contractor, the EBT Contractor must comply with the Quest® Operating Rules. 3.3.2. POS Terminal Support Services The EBT Contractor must provide the following services for all POS terminals deployed by the EBT Contractor  Routine maintenance on all equipment; Page | 31  Repair or replacement services on faulty POS terminal equipment within 24 hours of service calls;  Supplies; and,  Retailer training for all EBT Contractor deployed terminals. The EBT Contractor must make available a telephone number (see Section 3.3.5. Retailer Customer Service) for reporting terminal malfunctions. The EBT Contractor must use reasonable efforts to replace problem terminals by delivery or through the mail. If a replacement terminal is shipped to the retailer, the EBT Contractor must contact the retailer to assist with the replacement process. The retailer may call the Retailer Customer Service to obtain assistance. 3.3.3. Retailer Training and Materials The EBT Contractor must provide retailer training on the use and operation of all government-deployed POS terminals. In addition, the EBT Contractor must provide training or training materials on EBT system operations to retailers who request this service. Financial institutions and TPPs will be responsible for training retailers using POS equipment and software deployed by them. (See Section 3.5.3 Retailer Training and Materials for additional requirements.) 3.3.4. POS Terminal Processing Standards Federal regulations at 7 CFR § 274.8(b)(1), require that for leased line communications, 98 percent of EBT transactions must be processed within 10 seconds or less, and 100 percent of EBT transactions must be processed within 15 seconds. For dial-up systems, 95 percent of EBT transactions must be processed within 15 seconds or less, and 100 percent of EBT transactions must be processed within 20 seconds. 3.3.5. Retailer Customer Service The EBT Contractor must provide EBT-only retailers with a toll-free help line that includes an ARU available 24 x 7 to provide manual voucher authorizations and live customer service agents available between the hours of 7:00am and 9:00pm Monday through Friday to respond to equipment problems. The toll-free number must be used exclusively for retailer support and must be operated and adequately staffed by competent, knowledgeable personnel in an industry standard manner. The services provided must include:  Manual voucher transaction processing and voice authorization;  General problem resolution; and,  Retailer Terminal Service. 3.3.6. Interface Specifications for TPPs and Retailers Driving Their Own Terminals To support EBT retailers that deploy their own terminals, within 30 days of the start of the contract, the EBT Contractor must provide DHS with interface specifications that would enable these retailers and third party terminal drivers to interface directly with the EBT Contractor to perform SNAP EBT transactions. The EBT Contractor must provide these specifications to retailers and third party terminal drivers as well. The EBT Contractor must not unduly withhold certification for retailers and third parties who enter into direct connect arrangements with the EBT Contractor. Page | 32 3.3.7. Retailer and Third Party Acquirer Agreements For all retailers who accept the EBT Contractor-deployed terminals, the EBT Contractor must enter into agreements on behalf of DHS to deploy and drive EBT-only POS terminals pursuant to this RFQ, and to act as the transaction acquirer to retailers. For those retailers who choose to modify their existing equipment and either acquire the services of a third party processor or serve as their own third party processor, the agreement must be to provide access to the EBT system by third party processors and those retailers that self-process, or any other acquirer. The agreements will describe the terms and conditions regarding the arrangements for use of the POS equipment and the operating procedures and rules. At a minimum, the agreements must include language that requires: 1) Compliance with SNAP regulations; 2) Compliance with the Quest® Operating Rules; 3) No charging for authorization and settlement processing for EBT transactions; and, 4) that only FNS authorized retailers may perform SNAP transactions. The text of retailer and third party processor agreements require federal and DHS approval. Retailer and third party processor agreements must be submitted as part of the EBT Retailer Management and POS Deployment Plan. 3.3.8. Acquirer and POS Certification The EBT Contractor must provide retailers and POS transaction acquirers with the standards for certifying retailers’ existing POS equipment for EBT. The standards must be those contained in the Vendor’s approved EBT POS Certification Plan. Certification standards must comply with the Quest® Operating Rules and the most current ANSI specifications, which is an implementation of the ISO 8583 Message Interface for Financial Transactions. 3.3.9. Retailer Settlement Processing/Support The EBT Contractor must establish a daily, electronic financial settlement schedule(s); develop settlement policies and procedures; and provide settlement information over the Retailer Help Line. 3.3.10. QUEST® Logo The EBT Contractor must provide the QUEST® logo to all retailers upon execution of the retailer agreement along with all other retailer information. Page | 33 3.4. EBT Card Design, Production and Distribution Requirements The award of the new EBT contract for EBT services will require the continued use of the Territory’s current EBT card design as well as card issuance and distribution processes. 3.4.1. The Current SNAP EBT Card Given that the new EBT Contractor must continue to use the current SNAP EBT card, detailed information and requirements are provided in this section so as to facilitate the new Contractor’s continued support of the current card. EBT cards must have the PAN pre-embossed on the card front and the PAN encoded on track two of the magnetic stripe on the card reverse. The card must have a signature panel for personalization, but the client’s name must not be embossed on the card. The bidder’s solution to be implemented must include methods for requesting, delivering (including delivery time frames from request date), tracking, and accounting for card stock inventoried in eligibility offices The EBT Contractor must accept liability for account losses due to the unauthorized use of cards reported lost or stolen and for loss of card stock until the card stock is received at the designated DHS location. 3.4.1.1. EBT Card Issuance The Territory does not wish to convert its existing client cards to a new card stock. The new Contractor must continue to use the Territory’s current card design. The new Contractor must have the capability to operate without replacing the existing cards that have already been produced and/or issued and without disruption to the cardholder’s benefit access and services. If the client needs a replacement card, the PIN for the client shall be transferred from the old card to the new (replacement) card. Once a new card is issued, the old card must be deactivated. 3.4.1.2. Technical Specifications The bidder’s solution to be implemented must have card design, production, and distribution services for the Virgin Islands EBT card. It is anticipated that technologies will change and the vendor will adopt and adapt card specifications as necessary to accommodate developments in the commercial infrastructure and/or benefit program requirements. The bidder’s solution to be implemented must have an approach for meeting any new card design, encoding and security requirements and must agree to comply with the prevailing card standards. 3.4.1.3. Card Standards Compliance The EBT Contractor must ensure that the cards designed and produced for the VI EBT system comply with the specifications prescribed in the Quest® Operating Rules, including the Quest® "service mark", as well as International Standards Organization (ISO) and American National Standards Institution (ANSI) standards for magnetic stripe cards. The Virgin Islands EBT card must be non-expiring using the “4912" convention which must be encoded on Track 2. No expiration date will be embossed on the face of the card. The Track 2 Service Code field must be encoded with the designated number value of "120." The EBT Contractor must encode the Card Authentication Value (CAV) field of Track 2 with a cryptographic value to validate the Track 2 data contents. 3.4.1.4. Card Number/Bin Number The Virgin Island’s Bank Identification Number (BIN)/Issuer Identification Number (IIN) for EBT cards will be provided by the VI. The new Contractor must issue EBT cards containing a 16 digit PAN that Page | 34 uses the Territory’s current BIN/IIN. The process by which the New Contractor determines the PAN for issued cards must not interfere with the existing card base being used by DHS clients. The bidder’s solution to be implemented must have a process by which it will generate the PANs for the EBT cards being issued. 3.4.1.5. Primary Account Number (PAN) The PAN is a 16 digit numeric field present on the card front that identifies the designated EBT Contractor as the government’s designated issuer and the client and case to whom the card is issued. The Bank Identification Number (BIN)/Industry Identification Number (IIN) is the first six (6) digits of the PAN encoded and embossed on the card. A Territory-specific EBT BIN/IIN will be used by the selected EBT Contractor only to provide access to the specified Government benefits. At the end of the contract period, use of the BIN/IIN will revert to the Territory of the Virgin Islands. Ownership of the BIN/IIN remains with the Territory at all times. The last digit of the PAN must be a check digit calculated using Modulus 10 check digit routine. The PAN must be embossed on all cards. 3.4.1.6. Personal Identification Number (PIN) The PIN must be made up of four (4) numeric digits that are either selected by the client. PIN verification must be conducted at the EBT host. For this reason, the PIN offset must reside on the EBT host, not in the stripe on the card reverse. 3.4.1.7. Non-Discrimination Statement The following USDA non-discrimination statement must appear on the card in accordance with 7 CFR § 274.2(e)(5)): “USDA is an equal opportunity provider and employer.” 3.4.1.8. Toll-Free Customer Service Number The customer service and ARU toll-free numbers must be included on the reverse of the card. Instructions for returning lost/discarded cards to the EBT Contractor must also be included on the card reverse. The ownership of the toll-free customer service number must revert to DHS at the end of the contract. 3.4.1.9. Card Specifications  Four Color Printing: Up to a four color printing process will be used for the card.  Embossing (OTC Vault Cards): The PAN must be embossed on the front of the card and tipped with a contrasting color for readability for ion cases. All cards must contain the following security features on the reverse side:  Signature Panel: The card must contain a tamper evident signature panel.  Liability Language and Instructions: The card must clearly state, “Do Not Write Secret PIN on Card.” A toll-free number for reporting lost or stolen cards and for customer service must be printed on the card as well as a TTY number for hearing/speech impaired. Page | 35 3.4.1.10 Benefit Access via the Card A Virgin Islands SNAP EBT cardholder will access benefits by inserting or swiping their card, specifying a transaction type and amount, and key entering a PIN which is selected by the client. At a minimum, the EBT Contractor must verify each cardholder PAN, PIN, account status, account balance, and retailer location during transaction processing prior to approving the transaction. 3.4.1.11 Security: Control of Card Stock The EBT Contractor must be responsible and bear liability for all un-issued card stock until DHS offices receive the stock. The bidder’s solution to be implemented must have system and procedural controls to ensure that un-issued card stock is properly safeguarded against loss, theft, and/or abuse. 3.4.1.12Client Customer Service Requirements The EBT Contractor must provide client/cardholder Customer Service, the primary purpose of which is to provide current account and benefit access information via a toll-free number. This number must allow for toll-free calls from all telephones, including payphones. All information must be available to clients in both English and Spanish. The EBT Contractor must support the following customer service requirements:  ARU available 24 x 7;  Live CSRs available 24 x 7 to “status” cards reported lost, damaged, or stolen; and,  Live CSRs available during restricted hours (i.e., 9am – 5pm, Monday –Friday), in addition to the above requirement, to respond to general client inquiry. The ARU must respond initially to all incoming calls and must prompt the client to choose information to be provided in English or Spanish. The ARU must also provide a prompt to the client to report a lost, damaged, or stolen card, and, if chosen, the client must be connected to a CSR (24 x 7). Client must be able to be connected from the ARU to a live CSR for general inquiry during specified hours. The EBT Contractor must ensure that there are a sufficient number of CSRs who can support call volume. Anticipated client customer services via either the ARU or CSR must include:  Report a Lost/Stolen Card: Callers selecting "Report a Lost/Stolen Card" from the ARU menu must be transferred immediately to the customer service center. Clients must be able to report cards lost or stolen 24 hours a day 365 days a year.  Current Balance Inquiry: Callers selecting "Current Balance" must be asked to enter the PAN/card number; the ARU must provide "real-time" account balance information.  Transaction History: Callers selecting "Transaction History" must be asked to enter the PAN/card number; the ARU must provide information about the last 10 transactions (i.e., transaction number, amount, date).  Report Unauthorized Card Use: Callers selecting "Report Unauthorized Card Use" must be asked to enter the PAN/card number; the caller must be transferred to the Customer Service Operator for information about reporting unauthorized card use.  Customer Service Representative: Callers selecting "Customer Service Representative" must be immediately transferred to a customer service operator for assistance. This option may be selected for assistance/instruction on transaction processing and balance inquiries and for reporting system/retailer problems or other EBT-related issues. Page | 36 The EBT Contractor must comply with the following performance standards.  Eighty-five percent (85%) of all recipient hotline calls must be answered within four (4) rings, measured on a rolling three month average – four (4) rings is defined as twenty-five (25) seconds.  Ninety-seven percent (97%) of all calls being transferred to a Customer Support Representative must be answered by a live agent within two (2) minutes, measured on a rolling three-month average. The bidder’s solution to be implemented must have escalation procedures for Customer Service to ensure that clients are assisted in a timely and efficient manner. For reporting purposes, the EBT Contractor must provide Automated Response Unit (ARU) and Customer Service Center activity data (refer to section 3.2.10.4 System Performance Reports). Page | 37 3.5. Training Requirements The EBT Contractor must develop training materials and a training plan for client, administrative staff, and retailer training for the conversion and ongoing operations. 3.5.1. Client Training and Materials The EBT Contractor must develop and produce written training materials including a pamphlet and a wallet card. The actual training of clients will be performed by DHS. Approximately 15% of the caseloads speak only Spanish and would be in need of information in Spanish. The EBT Contractor must develop the client pamphlet and the wallet card. The pamphlet and the wallet card will be provided to clients upon receipt of their EBT card. All printed training materials must be written in easy to understand vocabulary — at a fifth grade reading level. At a minimum, the training pamphlet must include the following topics:  Explanation of the Virgin Islands’ EBT program;  Use of the EBT card to conduct SNAP transactions at POS devices;  Safeguarding and care of the EBT card;  Use and safeguarding of the PIN;  Reporting of lost, damaged, and stolen cards;  PIN selection and PIN changes;  Guidance on reporting problems with the card;  Benefit availability dates;  Use of transaction receipts to track balances;  Use of the Customer Service Call Center;  Customer service functions, including a prominent display of the toll-free Customer Service Call Center number;  Non-discrimination statement, “USDA is an Equal Opportunity Provider and Employer;”  Information on requesting and processing of adjustments against a customer’s EBT account;  SNAP benefits shall not be used to pay for any eligible food purchased prior to the time at which an EBT card is presented to authorized retailers or meal services;  SNAP benefits cannot be sold for cash or exchanged for non-food items;  SNAP trafficking definition, fraud, and abuse, including what constitutes fraudulent activity along with examples. Specifically, clients need to know that if they allow others to use their card, they are responsible for the transactions that are processed with that card; and may be held accountable. 3.5.1.1. Wallet Card The EBT Contractor must provide a Wallet Card that may be kept with the EBT card as a quick reference guide. These Wallet Cards must provide illustrative and text-based instructions on EBT transaction processing, customer service and ARU access, and reporting of lost/stolen cards. Page | 38 3.5.2. Staff Training and Materials The EBT Contractor must train DHS staff/personnel before conversion. DHS staff training must be in classroom format. Additionally, Learning System training would be favorably regarded. Staff training must include a general overview of EBT operations, as well as specialized training in administrative terminal functions such as card issuance and PIN selection, financial settlement/reconciliation, and reports and should target local office eligibility worker staff, local office card issuance staff, financial management staff, and program management staff, respectively. Ongoing staff training will be the responsibility of the Virgin Islands. The following is an estimate of individuals needing to be trained and training types The EBT Contractor must provide written training materials for DHS. Written training materials must be provided in hard copy for distribution to DHS offices, as well as in electronic media as specified by DHS. The EBT Contractor must include the following topics in administrative training materials:  Training clients in the use of EBT;  Interface management and operations;  Disaster recovery and contingency plans;  Administrative terminal functionality  System security and access control;  Operation and use of any proposed PIN selection equipment; and,  EBT system customer service functionality. 3.5.3 Retailer Training and Materials The EBT Contractor must provide the training and training material to retailers participating in the VI EBT Program. The EBT Contractor must develop training materials and the training of retailers receiving EBT-only POS equipment. On St. Croix, there are three Exempt EBT retailers who receive EBT-Only POS devices and four on St. Thomas/St. John. The EBT Contractor must also provide training information, materials and requirements to TPPs and financial institutions for use in training their POS customer retailers. Training materials must be provided in hard copy for distribution to retailers, as well as in electronic media as specified by DHS. The EBT Contractor must include the following topics in their curriculum for retailer training:  EBT objectives and retailer participation;  Operation and use of the EBT card at the POS;  Reconciliation and settlement procedures; EBT Overview Administrative Function Training Financial Management Training Program Managers 25 10 10 Fiscal 25 10 25 Eligibility & EBT Workers 85 25 25 Page | 39  Interacting with participants and addressing concerns; and,  Manual processing, if the EBT system is down. At a minimum, the retailer training materials must include the following:  An EBT Retailer POS Procedures Manual describing the equipment, maintenance, and troubleshooting procedures; and,  Quick Reference Cards summarizing and explaining the steps in the EBT transaction. 3.6. Vendor Security Requirements The EBT Contractor and all subcontractors must ensure that an appropriate level of security is established and maintained in connection with the EBT services provided pursuant to this RFQ. The EBT Contractor will process information that has been designated sensitive but unclassified. Sensitive but unclassified information is any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest of the conduct of federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. The EBT Contractor must comply with regulations issued by the USDA Food and Nutrition Service for EBT system security requirements at 7 CFR § 274.(b)(3) 8 with the Virgin Islands automated data processing and information retrieval systems at 7 CFR § 277.18(p). In addition, the EBT Contractor must comply with the Security requirements contained in the Quest® Operating Rules and any future modifications thereto. The EBT Contractor will be required to meet the EBT security requirements contained in this section and must also comply with the standards, policies, and regulations described above. 3.6.1. Control and Security Requirements The bidder’s solution to be implemented must have security controls, used by the EBT Contractor and/or any subcontractor(s), in the performance of services required under this RFQ. It is the expectation of DHS that the EBT Contractor will rely on EFT industry standards and conventions to ensure a sound and secure EBT operating environment. 3.6.2. Facilities Physical Security The EBT Contractor must utilize physical security and access control systems to limit access to any facilities used to produce cards, process data, or house any sensitive data to those authorized personnel and authorized visitors. The control systems must have the capability to detect and report attempted unauthorized entries into the facility. The EBT Contractor must regulate access to primary and backup data centers in such a way that the flow of all persons can be monitored and controlled by a security staff or other control process. This can be accomplished through the utilization of closed circuit television camera systems, card reader access systems, intrusion detection alarms, or similar systems. Minimum physical security protection measures must be implemented to deny unauthorized access to, manipulation, and/or sabotage of the EBT data processing and telecommunications facilities. The bidder’s solution to be implemented must have physical controls for operational facilities in these areas. Page | 40 3.6.3. Administrative and Personnel Security The EBT Contractor must ensure the integrity of EBT system operations including that of personnel involved in system administration and security administration. The EBT Contractor must ensure that appropriate screening is conducted of all personnel who are assigned to work on the Electronic Benefits Transfer system, and that such screening complies with Title 12, U.S.C., Section 1829. 3.6.3.1. General Organizational Controls The EBT Contractor must designate an organizational entity responsible for EBT security administration. Security and control responsibilities for personnel involved in security administration must be clearly delineated in the position descriptions for such personnel. A Security Program Official will be designated. This official must be responsible for the approval of security specifications during the development of the EBT system. This official must also be responsible for ensuring that security activities during system development are accomplished and management officials are kept aware of the system security design specifications. 3.6.3.2. Supervisory and Management Controls The EBT Contractor must provide for supervisory and management controls in controlling risks to the EBT system and operation. In addition, the EBT Contractor must provide for separation of duties, dual control, and/or other measures to control against operational risks. 3.6.3.3. Internal Theft Controls The EBT Contractor must ensure that adequate safeguards are in place to control against internal theft and/or embezzlement. Such controls must include pre-employment inquiries and background checks on new and temporary personnel. 3.6.3.4. Security Awareness Training The EBT Contractor must provide security awareness training, in accordance with Federal Information Security Management Act of 2002 (FISMA), for all personnel involved in the management, operation, programming, maintenance, or use of the EBT system. EBT Contractors and subcontractor employees must be aware of their security responsibilities, know how to fulfill them, and know the penalties involved if they are not fulfilled. Such training should be directed to the specific EBT system and operational procedures that the personnel will be using. 3.6.4. Inspections, Audits, and Investigations DHS and USDA must have the right to inspect, review, investigate, or audit all parts of the EBT Contractor's or any subcontractor's facilities engaged in performing EBT services. In such capacity, DHS or its representatives must have access to facilities, records, reports, personnel, and other appropriate aspects of the EBT system. 3.6.5. Comprehensive Security Program The EBT Contractor must be responsible for the implementation and maintenance of a comprehensive security program for the EBT system and operations. This program must include the administrative, physical, technical and systems controls that will be implemented to meet the security requirements of the EBT system and this section. It is the expectation of DHS that the system of internal controls used to manage risks to the EBT system and operations will be based on EFT industry standards used by EBT Contractors to manage their business exposure. Page | 41 3.6.5.1. EBT System Security Plan The EBT Contractor must submit documentation of its comprehensive security program in the form of the EBT System Security Plan, which is one of the system development deliverables described in this RFQ. The EBT System Security Plan must describe the administrative, physical, technical and systems controls to be implemented for the EBT system. The EBT System Security Plan should reflect the guidance of FNS Handbook 901 and the FNS EBT System Security Guidelines. In addition to describing the planned controls to meet the security requirements of this section, the EBT Security Program and EBT System Security Plan must provide for the ongoing certification and examination of the EBT Contractor's operations and control system. The EBT Contractor may use OMB Circulars A-130 and 90-08 as references and templates in preparing the EBT System Security Plan 3.6.5.2. Annual Attestation Engagement Requirements The EBT Contractor and any sub-contractor(s) must arrange for the performance of an annual attestation engagement on the VI EBT system by a nationally recognized independent auditor selected by the EBT Contractor in conformance with AICPA SAS No. 70, Processing of Transactions by Service Organizations. The work of the auditor must culminate in a report on the policies and procedures placed in operation and tests of the operating effectiveness of the VI EBT system. The report must be addressed to DHS and submitted within 30 days of the completion of the annual audit. The EBT Contractor must cooperate with DHS or its representatives to perform audits and/or inspections of its records at any reasonable time during the term of the contract and for a period of three (3) years following the date of final payment under the contract, to assure compliance with its terms and/or to evaluate the EBT Contractor's performance. Any amounts that have been paid by DHS and are found to be improper in accordance with the terms of the contract must be returned to DHS or may, at the discretion of DHS, be returned in accordance with other remedies. The EBT Contractor must permit DHS and any other governmental agency authorized by law, or their authorized designee to monitor all activities conducted by the vendor pursuant to the terms of this contract. As the monitoring agency may, in its sole discretion deem necessary or appropriate, such monitoring may consist of internal evaluation procedures, reexamination of program data, special analysis, on-site verification, formal audit examinations, or any other reasonable procedures. All monitoring must be performed in a manner that will not unduly interfere with contract work. 3.6.6. Incident Reporting The EBT Contractor must notify DHS of any instances of non-compliance promptly upon their discovery but no later than five business days after the instance was discovered. Notification must include a description of the non-compliance and corrective action planned and/or taken Page | 42 3.7. Disaster Preparation and Contingency Planning It is the goal of the Territory to continue transaction processing and disbursement of benefits in the event of adverse situations related to systems and telecommunications failures and in natural and other disasters. This section of the RFQ addresses major risk points and solutions derived to enable continuation of business with minimal interruption in these adverse situations. 3.7.1. Contractor EBT System The EBT Contractor must continue transaction processing and disbursement of SNAP benefits in the event of any EBT host systems and communication failures. The EBT Contractor must notify the Territory immediately of any outages. If the outage is expected to exceed one hour in duration, and/or a determination of necessity is made based on an evaluation of the problem and the time required to resolve, transaction processing must be switched to the EBT host hot back up site. In the event of a primary system failure, the processor’s backup site must take over the operations. The EBT Contractor must notify the Territory immediately when they make the decision to move to an alternate disaster back-up site to provide EBT services. If the EBT Contractor is providing EBT services to multiple states, the Business Continuation and Recovery Plan must address the timing and order of recovery of the Territory as compared to the other agencies being processed. The disaster back-up site and alternate communications routing must be tested annually (Continuation of Business Test) to demonstrate the EBT Contractor’s capability to transition their host processing operations from their primary facilities to their backup facilities. The EBT Contractor must provide the Territory with copies of these test results within 30 calendar days of completion of the testing. The new EBT Contractor must provide an alternate means of authorization of EBT transactions during short-term outages, when switching over to the back-up site is not considered appropriate. The bidder’s solution to be implemented must also include how the EBT Contractor will notify both the Territory and the retailer community that an outage is occurring and alternate means of authorizations are currently in place. In the event of a disaster impacting the availability of the EBT Contractor’s primary data processing site, the new EBT Contractor must have available a back-up site for host processing and telecommunications network services. The backup contingency must be maintained concurrently and must be able to take over on-line and batch processing within two (2) hours of notification by the Territory. In the event of a natural or other disaster when the CARIBS system is down and unavailable for processing, the EBT Contractor must maintain on-line communications between each DHS district office and the EBT host via the EBT administrative terminal and DHS telecommunications network. Only in extreme situations will the on-line transmission of Account Set-up and Benefit Authorization records processed through the administrative terminal be allowed by DHS. The EBT Contractor system must confirm the receipt, processing, and result of Account Set-up and Benefit Authorization transactions transmitted on-line through the EBT administrative terminal. The EBT Contractor must have the capability of restricting access and use of Account Set-up and Benefit Authorization functions of the administrative terminal, except when specifically requested by DHS. 3.7.2. EBT Business Continuation and Recovery Plan The EBT Contractor must provide an EBT Business Continuation and Recovery Plan that details how the EBT Contractor will insure continuous operability of the EBT Contractor’s host system processing and communications facilities to the Territory. The disaster recovery plan in the bidder’s solution to be Page | 43 implemented must include a notification process as well as disaster declaration criteria and timeframes that are acceptable to the Territory. 3.7.3. EBT Disaster Services Plan The EBT Contractor must provide a EBT Disaster Services Plan to the Territory. The EBT Disaster Services Plan must detail steps to be taken by the EBT Contractor to provide alternate methods to deliver SNAP benefits to cardholders in the event of telecommunications failures and natural and other disasters and system outages that may take place within the Territory. The Plan must describe the actions to be taken before, during and after a disaster or outage, along with documented, tested procedures which, if followed, will ensure the availability of critical resources and facilities maintaining the continuity of operations in a contingency situation. The EBT Disaster Services Plan must include provisions to ensure that cardholder and retailer/merchant services incur minimal interruption. 3.7.4. Disaster Services The EBT Contractor must support providing benefits to the Territory’s clients subsequent to the occurrence of a natural disaster in the Territory. The basic assumption in the disaster scenario is that there is sufficient infrastructure available within the retailer community to support EBT as a means of benefit payments. This section explains the requirements to the EBT Contractor for providing these benefits. In the event of a disaster, the EBT Contractor must provide the following disaster support services to the Territory: 3.7.4.1. Cardholder Support Services In the event of a disaster, the EBT Contractor must be able to post all benefits throughout the Territory or in designated district offices immediately, regardless of actual availability date. 3.7.4.2. Benefit Reissuance In the event of a disaster, the EBT Contractor must be able to reissue benefits to active SNAP recipient accounts based on a previous month’s benefit issuance amount or a percentage of benefits issued in a previous month. 3.7.4.3. Customer Service Support In the event of a disaster, and at the request of the Territory, the EBT Contractor must have the capability to immediately implement a specific disaster ARU script that has been approved by the Territory. This script must be changeable to meet differing situations throughout a disaster; e.g., manual voucher approval rules may be implemented and later revoked as conditions improve. 3.7.4.4. Drop Ship Delivery of Disaster Cards In the event of a disaster, the EBT Contractor must be able drop ship active cards via overnight express mail or courier service to a specific DHS district office(s). 3.7.5. Retailer Support Services 3.7.5.1. Retailer Customer Service In the event of a disaster, the EBT Contractor must provide the same scope of services to retailers for the ARU and Customer Service operations. The ARU must have a specific disaster script that has been Page | 44 approved by the Territory. Because call volumes will likely increase, the EBT Contractor must increase the number of CSRs to support retailers. 3.7.5.2. SNAP Manual Voucher Forms and Hold Period The EBT Contractor must provide a sufficient supply of extra SNAP manual voucher forms for processing in the event of a disaster and provide the ability to extend the hold period for FS manual vouchers. 3.7.6. Technical Support 3.7.6.1. Batch File Processing In the event of a system outage or other disaster, the Territory may need to transmit account set up and maintenance records (including demographic updates) via an online host to host or client to host link, using a protocol of its choosing. The EBT Contractor must receive and process such records 24 hours per day, 7 days per week. The EBT Contractor must process the records, perform all edits, set up and maintenance processes, and reflect changes by times agreed upon with the Territory. 3.7.6.2. Disaster User Profiles for FNS Approved Disaster Issuances The EBT Contractor must maintain user profiles that include workers authorized to perform disaster related functions. These workers must have access to administrative terminal screens required for disaster services, as well as inquiry access. 3.7.6.3. Continuation of Business Test The EBT Contractor must report to the Territory on the results of the Continuation of Business test within 30 calendar days after the test is conducted. 3.7.6.4. FNS Disaster SNAP Program Reports The EBT Contractor must provide data to the Territory to support FNS disaster reporting requirements and regulations on the following:  Number of new and ongoing households approved  Value of benefits approved (new and ongoing)  Value of benefits issued 3.7.6.5. Accelerated Expungement of Benefits The EBT Contractor must be able to support specific benefit types for use during disaster situations only. These benefits must be expunged 90 days issuance or as specified by the Territory. 3.7.6.6. Transmission Alternatives The EBT Contractor must support alternate methods of batch file postings in the case of telecommunication failures. At a minimum this alternate method must include the acceptance and processing of data cartridges and other media. 3.7.6.7. Administrative Terminal Access In the event the Territory’s eligibility system or the traditional interface is not accessible, the Territory must have access to the EBT Contractor’s administrative terminal functionality using a direct dial process. The EBT Contractor must support the alternative communication means to be used in the Page | 45 absence of the traditional interface. The EBT Contractor must provide the appropriate password, access and software components, and training prior to the disaster situation. 3.7.6.8. Disaster System Testing The Territory’s Disaster SNAP Assistance System as well as its general disaster response systems must be periodically tested to ensure they are ready to be used to respond to an actual disaster. The EBT Contractor must support periodic testing of disaster response systems for preparedness, and in conjunction with other testing warranted by software or equipment changes that may have an impact. 3.7.6.9. Post Disaster Support and Catch up Reconciliation Processing The bidder’s solution to be implemented must include procedures and methods that they will use to provide post disaster support and catch up reconciliation processing during and following a disaster. The bidder must provide disaster support services for the following reconciliation topics:  Disaster issuance reconciliation: benefits issued, transacted, and expunged  Inventories of non-issued disaster cards and return to secure storage  Inclusion of disaster benefit issuances in billing reports  Disaster Benefit Types The EBT Contractor must be able to support the Territory in the case where there are multiple disasters occurring in a nearly simultaneous timeframe. Such support must include the establishment of unique disaster benefit types to support the accurate reporting of disaster-specific benefit issuance activity and billing. 3.7.6.10. Support for FNS Requirements and Regulations The Contractor must supply reporting to support FNS requirements and regulations. 3.7.7. Cardholder Support Services 3.7.7.1. Disaster Card and PIN Inventory The EBT Contractor must maintain a stock of disaster vault cards with pre-assigned PINs to be dropped shipped to the Territory during an outage or disaster. The number of vault cards and pre-assigned PINs required by the Territory will be determined during the Design Phase. However this option can be selected any time during the Contract with advance notice. The cards must be embossed or printed with flat graphics with a designated Disaster PAN only. Vault stock cards must be readily distinguishable from regular non-disaster EBT cards. Card/PIN matching pairs must be readily identifiable, and batches of cards and PINs must be produced in a fashion that facilitates the matching logistics. If compromised in any way, vault cards must be able to be statused by customer service. The EBT contractor must have a capability to designate generic demographic information including a card number and case number matrix (matrix process) for each local district based on the office profile. The Disaster card are considered pre-authorized after they are PINed and linked to a case number using the matrix process. When the disaster card number is entered in the disaster system, the case number linked to the card is assigned to the disaster application. Page | 46 The bidder’s solution to be implemented must include procedures and methods they will use to support card and PIN issuance during and following a disaster. The bidder’s solution must inlcude disaster support services for the following topics:  Card handling and security  Card production  Card Types  Card storage and inventory controls  Card delivery and security  Card Number and Case Number matrix process  PIN issuance, selection, and security, including provision of additional PIN selection devices for use in an outage or disaster The Territory’s plan in supporting EBT clients in the event of a natural disaster is to maintain an inventory of pre-embossed and pre-encoded EBT cards within the Territory that would be used in the event of a disaster. Following the declaration of a disaster requiring that SNAP benefits be issued expeditiously by FNS, the Territory would issue the disaster EBT cards to eligible clients within the disaster areas. Following the issuance of the card, the Territory would update the respective EBT account on the Contractor’s EBT System through the batch interface with the associated demographic information, including the assigned case number and client name. Benefits would also be added to the EBT account through the batch interface. To support the Territory’s plan for EBT Disaster Services, the Contractor must maintain on the EBT database predefined disaster accounts and the related EBT card. The Contractor must maintain an agreed upon number of EBT accounts to be used for disaster services and the associated EBT cards and system assigned PINs. These EBT accounts shall remain on the Contractor’s EBT system until utilized for a disaster. 3.7.7.2. On-Line Cardholder Account Set-up and Benefit Issuance In the event of a disaster, eligibility requirements for specific types of emergency assistance may be more liberal than those used for determining “normal” eligibility for benefits. The Territory requires the ability to set up accounts for this new population quickly, and provide them with emergency benefits. These benefits are specifically targeted for disaster assistance, and must be used within 90 days or for a time period specified by the Territory. Once an individual has been determined eligible, received a card and PIN, and been assigned a unique ID, the Territory must have the ability to add the cardholder to the EBT host and issue benefits thru a batch process. Support for backup remote direct dial access to the EBT administrative terminal via desktop PC or laptop must be provided. 3.7.7.3. On Site Card Issuance Emergency vault cards with pre-assigned PINs must be shipped via overnight express on the same day of the Territory’s request to each DHS district office if a disaster has been declared. The Territory will Page | 47 determine the number of cards required for same day shipment. The remaining cards must be available to the Territory within five days of the request. 3.7.7.4. PINs Embedded in Card Numbers The EBT Contractor must be able to support over-the-counter issuance of pre-loaded disaster vault cards with pre-assigned PINs embedded in the card numbers. Pre-authorized Disaster Services Cards will have the initial PIN set to the last four digits of the card. Clients will be able to select or change a PIN in each local Human Services office using a Card Activation and PIN Select (CAPS) device. Local Human Services office staff will operate the CAPS devices, and they will be required to log in to the device using special user-ID and password. Page | 48 3.8. Vendor Activities and Deliverables The VI EBT Project will be conducted over a period of nine (9) years (assuming all contract extensions are exercised. The project will include three pre-operations phases and an Operations Phase. The pre- operations phases, Design, Development and Transition, must include all tasks required to modify the EBT Contractor system to meet the specific needs and requirements of the Territory. The Operations Phase must include all tasks required to maintain ongoing operations of the EBT system. In this section of the RFQ, the activities to be performed by the EBT Contractor in the various phases and the resulting deliverables, which are considered to be project requirements, are specified. 3.8.1. Project Phases The Territory envisions the EBT project consisting of four generally sequential phases. These phases are:  Design Phase  Development Phase  Transition Phase  Operations Phase The EBT Contractor must provide the anticipated timelines for each of the phases and the estimated completion dates for the project deliverables within each phase in the preliminary EBT Project Work Plan to be submitted upon contract award. For planning purposes, bidders should assume the project initiation date of January 5, 2017 3.8.1.1. Design Phase. The length of time and deliverables from the Design phase shall be based on tasks and deliverables identified within the EBT Project Work Plan. The Design Phase shall commence with the signing of a contract and shall continue for the timeframe mutually agreed upon by the Territory and the EBT Contractor. All deliverables identified within the EBT Project Work Plan are subject to Territory review and approval. 3.8.1.2 Development Phase The Development Phase shall commence following the completion of the Design Phase. The duration of the Development Phase and the due date for the deliverables in this Phase must be specified in the preliminary Project Work Plan. During this Phase of the project, the EBT Contractor shall configure and test the VI EBT system according to the system specifications defined and agreed upon during the Design Phase. All deliverables for the Development Phase identified within the EBT Project Work Plan are subject to Territory review and approval. The EBT Contractor shall allow a minimum of 10 work days for the Territory to review and comment upon the deliverable. The EBT Contractor shall complete system testing, as well as provide the final training materials during the Development Phase. 3.8.1.2.1. System Testing The majority of system testing will take place during the Development Phase. The system testing that must be conducted by the EBT Contractor includes the following:  Functional Demonstration: The functional demonstration provides Territory and federal representatives the opportunity to review planned EBT system functionality. The EBT Page | 49 Contractor must prepare a report of the demonstration results including any system modifications that were identified. The Functional Demonstration should occur as early as possible but no later than six (6) weeks prior to the System Acceptance Test to insure the design is proceeding according to the expectations of both DHS and the EBT Contractor.  System Interface Test: This test must be conducted between DHS’s eligibility systems and the EBT host to ensure that all files transferred electronically from DHS’s eligibility systems to the EBT host and from the EBT host to DHS’s eligibility systems are properly received, accepted, and processed. A description of the SNAP eligibility system, CARIBS, is provided in Appendix C of this RFQ. The Interface Test should occur as early as possible, but no later than eight (8) weeks prior to the System Acceptance Test.  System Acceptance Test: The system acceptance test provides Territory and federal representatives the opportunity to test EBT system functionality and ensure compliance with the system design requirements. This test must consist minimally of functional requirements, security, recovery, controls, regression, reports generation, reports accuracy, and "what if" testing. During the test script portion of the acceptance test, representatives will follow detailed test scripts developed by the EBT Contractor. The test scripts must cover all facets of the system's operations and test all of the system processing options and environmental conditions (e.g., hardware and communications failure and entry of erroneous data). It should be noted that planning is underway for CARIBS to be replaced during the next 18 months; Additional acceptance testing will be needed during implementation of the successor system. The ad hoc or "what if" portion of the acceptance test provides DHS and federal representatives the opportunity to include various transaction sets and sequences that may not have been included in the test scripts and to challenge the system's operations and design. The system acceptance test must receive both Territory and federal approval. Test scripts must be submitted to DHS at least two (2) weeks prior to the actual test.  System Stress Test: This test must examine the software and hardware capacity of the system. Capacity testing is required to ensure that the EBT Contractor’s system can support the Virgin Islands’ territory-wide workloads. Network Performance Test: This test must be conducted on the EBT system's communications network to ensure that the network and the EBT Contractor’s network terminal equipment are capable of handling the anticipated transaction volume within the required response time and error threshold specified in this RFQ, the FNS EBT regulations, and the Quest® Operating Rules. The network test must also include testing of the Customer Service Center toll-free number to ensure compliance with financial industry performance standards.  Automated Response Unit (ARU) Test: The ARU system must be tested to ensure that the system properly accepts, processes, and transfers calls within the standards established for the financial industry. The ARU system must be tested to ensure that the system properly accepts, processes, and transfers both retailer and customer calls per the system requirements and within the specifications defined in this RFQ.  Transition Test: Once a new EBT Contractor is selected, the EBT Contractor must demonstrate the conversion process of the EBT system from the current EBT Contractor to the new EBT Contractor’s system. Testing must validate the conversion results, and Page | 50 demonstrate the new EBT Contractor’s ability to perform test transactions against the converted database. Test transactions performed against the converted database must include both customer transactions (e.g., SNAP purchase transactions) and administrative transactions (e.g., card replacement transactions). 3.8.1.3. Transition Phase The Transition Phase consists of the activities required to convert the EBT processing for the Territory when a new EBT Contractor is selected. It is anticipated that some of the Transition Phase activities, specifically the EBT-only retailer conversion, will begin prior to the end of the Development Phase. However, the EBT Contractor must begin any of the database conversion activities only after the development activities have been completed, and a sign-off from the Territory has been received for the Transition Testing. The new EBT Contractor must ensure that the value of SNAP benefits transferred from the present EBT system is equal to the amount of funds that will be in the VI ASAP account. If not equal, the new EBT Contractor must work with the outgoing EBT Contractor to resolve any variance. If the ASAP account is short, the new EBT Contractor must notify the Territory so that it can make the ASAP account whole. The EBT Contractor must also advise the Territory of any overages found in its ASAP account during this reconciliation period so that the Territory can advise FNS to authorize the necessary adjustment and reduce the ASAP account accordingly. The activities within the Transition Phase must consist of the following:  EBT-Only Retailer Conversion  Cardholder Database Conversion, which includes:  Transaction history  Customer card and demographic data account set-ups  Benefit data  Transfer of the toll-free Customer Service telephone number used by recipients  Coordinating with FNS, the Treasury Department and the Federal Reserve Bank on transferring the NC ASAP account balance to the new EBT Contractor  Administrative Terminal application connectivity The activities taking place during the Transition Phase shall follow the process defined within the approved EBT Transition Plan required during the Design Phase 3.8.1.3.1. EBT-Only Retailer Conversion During the conversion of EBT-only equipment, it is critical that clients not be negatively impacted in their ability to redeem their benefits due to conversion and that business operations of stores using EBT-only terminals not be negatively impacted due to the conversion to new terminals and terminal drivers. Therefore, the new Contractor must convert 95% of all EBT-only terminals prior to database conversion. 3.8.1.3.2. EBT Cardholder Database Conversion Database conversion, conversion from the existing database to the new database must take place overnight on a weekend. The system conversion should be completed as soon as possible. The current SNAP EBT contract ends on July 31, 2017. An extension of the current SNAP EBT contract may be negotiated, as needed. The new Contractor must analyze monthly transaction volumes and select a weekend when there would be the least impact on retailers and clients. The time for the entire conversion must be agreed upon by DHS and the Contractor as part of the Project Planning effort. Page | 51 As part of the transition, the new Contractor must:  Perform significant testing of the conversion process, including performing test transactions against the converted database in the test system. Testing must validate that PINs have been converted successfully. Three trial runs must take place.  Accept three years of transaction history to be transferred from the current EBT Contractor;  Provide for conversion of 180 days of on-line transaction history onto the new system  Have checkpoints and reconciliation procedures built into the conversion process to ensure that no benefits or records are dropped; and,  Have a contingency fallback plan in case the conversion cannot be completed in a timely manner due to unforeseen problems. 3.8.1.4. Operations Phase The Operations Phase begins after the EBT System has been transitioned from the previous EBT Contractor to the new EBT Contractor. During the Operations Phase the new EBT Contractor must maintain ongoing communication with the Territory on EBT operations and must immediately notify the Territory of any issues or system problems. The new EBT Contractor must maintain an on-site project manager for ongoing communications for the first three months of the Operations Phase. The ongoing communications required from the EBT Contractor include status reports containing all open issues and issues closed since the last report, monthly status meeting with the EBT Contractor, and other reports/meetings at the Territory’s request. Of particular importance is the advance notification to the Territory of scheduled downtime of the EBT system by the Contractor. During the Operations Phase, the EBT Contractor must maintain and update as required the key design and operational manuals delivered during the pre-operations phases. The deliverables that the EBT Contractor must maintain and update include the following:  EBT Project Work Plan  EBT Functional Design Document  EBT Detailed Design Document  EBT Business Continuation and Recovery Plan  EBT Disaster Services Plan  EBT System Security Plan  EBT System Operations/Interface Procedures Manual  EBT Reports Manual  EBT Settlement/Reconciliation Manual  EBT Administrative Terminal User’s Manual Page | 52 3.8.1.5 Transition Out Activities Cooperation in Transition to Subsequent Contractor The new contractor becomes the Incumbent at database conversion and eventually may be replaced by another vendor. This would be the last, or transition, phase of the contract. Expectations and requirements for transition include: a commitment to cooperate with the next contractor for transition planning, cleaning up the database before conversion, participating in conference calls, providing data for trial runs, participating in a minimum of two trial runs, having sufficient staff and managers on call during database conversion, reconciliation of database values before and after database conversion, key exchange, final reporting, assessment of liability for errors/discrepancies found in database values after database conversion, payment of any errors or discrepancies for which the contractor is determined liable. 3.8.2. Project Deliverables The majority of formal project deliverables must be developed during the three pre-operations phases of the Project. During these phases, the EBT Contractor must prepare and submit the project deliverables that are listed below under their respective phases. The dates upon which the EBT Contractor will submit the draft and final versions of the required deliverable(s) to DHS for review and approval must be specified in the preliminary EBT Project Work Plan. Upon contact award the bidder must propose due dates for each deliverable. The EBT Contractor must provide electronic versions of all deliverables to DHS. All deliverables will be subjected to DHS review and approval (some also require FNS review and approval and DHS may have other entities review the deliverables as well). Consolidated DHS comments will be provided to the EBT Contractor within three (3) weeks of the receipt of each draft document unless an alternative review schedule is mutually agreed upon. The EBT Contractor must address all DHS comments prior to submission of the final versions of the deliverables to DHS for acceptance. DHS and federal agencies will participate in the specified system testing and will participate with the EBT Contractor in assessing test results. System testing must be completed to the satisfaction of DHS and federal agencies prior to commencement of the Transition and Operation Phases of the project. The bidder agrees to develop a service level agreement after contract award. The Service Level Agreement shall identify the performance standards and performance measures that shall govern the Vendor's performance throughout the contract period and shall include a mutually agreed upon penalty for failure to meet the standards 3.8.2.1. EBT Project Status Reports The EBT Contractor must prepare weekly EBT Project Status Reports during the three pre-operations phases, Design, Development and Transition. The EBT Contractor must provide these EBT Project Status Reports by the fifth working day following the weekly reporting period and must provide progress information on all completed, ongoing, and planned project activities. These reports must summarize any outstanding project issues or obstacles and detail any proposed deviations from planned activities, schedules, or staffing. The specific format and content of the EBT Project Status Reports will be agreed upon within three weeks of contract execution. Weekly verbal status reports may also be required at the request of DHS or federal agencies. Status reporting requirements during the Operations Phase will be determined prior to the beginning of the phase. Page | 53 3.8.2.2. EBT Project Work Plan The EBT Contractor’s EBT Project Work Plan must include, at a minimum, a schedule of all phases, tasks and deliverables required throughout the project. The Plan must identify the individual tasks and deliverables by project phase, as defined below. The Plan must identify all critical path and dependency tasks and delineate the responsibilities of the EBT Contractor, the Territory and Federal agencies. The EBT Contractor must submit the draft EBT Project Work Plan no later than four weeks after signing of the contract. The Territory shall review and comment on the Plan within ten (10) working days. The final EBT Project Work Plan must be provided ten (10) working days following the receipt of the comments from the Territory. Acceptance of the deliverable is contingent upon DHS review and approval. Once the EBT Project Work Plan is submitted and approved by DHS, the EBT Contractor must submit updates to the EBT Project Work Plan with each biweekly status report. This ongoing submission must include a written summary of all changes to the plan, including detailed discussions, reasons for, and impact of any scheduled delays. The EBT Contractor must maintain the master EBT Project Work Plan for the duration of the pre-operation phases. 3.8.2.3 EBT Transition Plan Once a new EBT Contractor is selected, the new EBT Contractor shall be responsible for the transition of the customer and retailer database from the current Contractor’s EBT system to the new EBT system. The EBT Contractor must prepare an EBT Transition Plan that covers each of the following activities in detail:  Transition of transaction acquirers;  Transition of the customer database including the current 100,000 disaster account set-ups;  Transfer of the toll-free Customer Service telephone number used by recipients;  Coordinating with FNS, the Treasury Department and the Federal Reserve Bank on transferring the VI ASAP account balance to the new EBT Contractor; and,  Administrative Terminal application connectivity. The EBT Transition Plan must address the processes to be used for the transition, how the processes shall be tested and contingency plans for problems and issues that may occur during the transition. The EBT Transition Plan must also address the verification and validation of the transition process, in particular the validation of the customers’ account balances and cardholder PINs that are converted to the new system. Acceptance of the deliverable is contingent upon DHS review and approval. 3.8.2.4. EBT Functional Design Document The EBT Contractor must prepare an EBT Functional Design Document, as part of the Design Phase. This deliverable must, at a minimum, provide a functional overview and a description of the operating environment, procedures and workflows of the EBT system. Page | 54 3.8.2.5. EBT Detailed Design Document The EBT Contractor must prepare a Detailed System Design Document as part of the Design Phase. The EBT Detailed System Design Document must describe the total system configuration including system hardware, functionality, file layouts, message and file flows, data elements, system interfaces as well as details of the settlement and reconciliation functions. All functionality specified in this RFQ must be addressed at the detail design level in the Detailed System Design Document. Acceptance of the deliverable is contingent upon DHS review and approval. 3.8.2.6. EBT Systems Test Plans Document In the EBT System Test Plans Document the EBT Contractor must identify all the activities and procedures that must be performed to thoroughly test the EBT system. The document must outline the test purpose, methodology, environment, and approval rating system. Test plans must be developed for the following:  Functional Demonstration  System Interface Test  System Acceptance Test  System Stress Test  Network Performance Test  ARU Test  Transition Test The EBT Contractor must identify and incorporate into the testing process those automated tools and testing techniques that can provide the most thorough testing and most efficient use of resources. Acceptance of the EBT System Test Plans Document is contingent upon DHS and federal review and approval. The EBT Contractor shall develop system test plans during the Design Phase. 3.8.2.7. EBT Business Continuation and Recovery Plan The EBT Contractor must provide a EBT Business Continuation and Recovery Plan to insure continuous operability of the EBT Contractor’s host system processing and communications facilities to the Territory. The EBT Contractor must produce an EBT Business Continuation and Recovery Plan that provides a description of the types of service interruptions that may impact the EBT system’s operations and therefore require the use of backup and recovery processes. For each potential interruption type, the EBT Contractor must, at a minimum, detail the steps to be taken to survive and recover from the interruption. The EBT Business Continuation and Recovery Plan must detail steps to be taken to recover from systems failures, telecommunications failures and natural and other disasters. This Plan must include provisions to ensure that cardholder and retailer/merchant services incur minimal interruption. The EBT Business Continuation and Recovery Plan must detail guidelines, considerations, and specific steps for making the decision to switch over from the primary site to the backup site in the event of a primary system failure. The EBT Business Continuation and Recovery Plan must include a notification process as well as disaster declaration criteria and time frames that are acceptable to the Territory. Procedures must include a timeframe for making the cutover decision, and a timeframe for the processor’s backup site to take over operations from the primary host; that is, the specified period within Page | 55 which the telecommunication links, the databases, and the CPU processing must be operational and able to accurately and completely process EBT transactions via the back-up site. 3.8.2.8. EBT Disaster Services Plan The EBT Contractor must provide a EBT Disaster Services Plan to the Territory. The EBT Disaster Services Plan must detail steps to be taken to provide alternate methods to deliver SNAP benefits to cardholders in the event of telecommunications failures and natural and other disasters and system outages. Included in this plan must be the specific technical and procedural measures to be available for use as warranted in emergency situations. The Plan must describe the actions to be taken before, during and after a disaster or outage, along with documented, tested procedures which, if followed, will ensure the availability of critical resources and facilities maintaining the continuity of operations in a contingency situation. The EBT Disaster Services Plan must include provisions to ensure that cardholder and retailer/merchant services incur minimal interruption. The Plan must state the resources committed to each contingency operations plan for each system component as well as provide detailed problem and escalation procedures and indicate whether the contingency plan has been tested under real or simulated conditions. Acceptance of the deliverable is contingent upon DHS review and approval 3.8.2.9. EBT System Security Plan The EBT Contractor must prepare an EBT System Security Plan that details the system provisions and proposed user profiles established within the EBT system. The EBT System Security Plan must describe the administrative, physical, technical and systems controls to be implemented for the EBT system. The EBT System Security Plan should reflect the guidance of FNS Handbook 901 and the FNS EBT System Security Guidelines. In addition to describing the planned controls to meet the security requirements of this section, the EBT Security Program and EBT System Security Plan must provide for the ongoing certification and examination of the EBT Contractor's operations and control system. The EBT Contractor may use OMB Circulars A-130 and 90-08 as references and templates in preparing the EBT System Security Plan. Acceptance of the deliverable is contingent upon DHS review and approval. The Territory requests that the EBT Contractor recommend the appropriate timeframe for producing and delivering the EBT System Security Plan deliverable within the project schedule where the due date shall be agreed upon between the Territory and the EBT Contractor. 3.8.2.10. EBT Training Plan The EBT Contractor must prepare and submit a comprehensive EBT Training Plan that identifies the proposed deadlines and supportive tasks for the planning, design, development, production and distribution of all training and training materials. The EBT Training Plan must address the timeline for creation of the deliverables and the timeframe for training DHS staff and retailers. Acceptance of the deliverable is contingent upon DHS review and approval. 3.8.2.11. EBT Training Materials The EBT Contractor must develop EBT Training materials and a comprehensive plan for administrative staff and retailer training throughout the project including conversion and ongoing operations. Training materials must include:  Client Training and Materials: The EBT Contractor must provide client training materials as described in Section 3.5.1. Client Training and Materials. The EBT Contractor must Page | 56 provide client pamphlets and wallet cards in a sufficient quantity to accommodate the caseload for conversion and ongoing operations. Written client training materials must also be provided in electronic media as designated by DHS.  Staff Training and Materials: The EBT Contractor must provide written training materials for DHS office staff as described in Section 3.5.2. Staff Training and Materials. The EBT Contractor must provide ten (10) of hard copies and one (1) master copy to DHS. The staff training materials must also be provided in electronic media as designated by DHS.  Retailer Training and Materials: The EBT Contractor must also develop a curriculum and training materials for EBT retailers as described in Section 3.5.3 Retailer Training and Materials. 3.8.2.12. EBT Administrative Terminal User The EBT Contractor must provide an Administrative Terminal User Manual that includes guidance and procedures for DHS staff on the functionality of the administrative terminal. 3.8.2.13. EBT Retailer Management and POS Deployment Plan In the EBT Retailer Management and POS Deployment Plan, the EBT Contractor must describe its approach to retailer management and the deployment of EBT-only POS terminals. The plan must describe how the EBT Contractor will:  Maintain the database of FNS authorized retailers;  Conduct outreach and marketing to FNS authorized retailers during conversion, including a schedule of activities;  Deploy EBT-only POS terminals during conversion, including:  A schedule of activities  The number of SNAP retail stores that will need benefit access devices/POS terminals; and  The number of POS terminals that will need to be deployed at SNAP retail stores.  Deploy or remove EBT-only POS terminals during ongoing operations when retailers are added or removed from the SNAP program by FNS;  Provide retailer customer service;  Provide supplies and maintenance for EBT-only terminals; and  Train retailers. Copies of Retailer and Third Party Acquirer Agreements must be included as part of the EBT Retailer Management and POS Deployment Plan for review and approval by the Territory and FNS. Acceptance of the deliverable is contingent upon DHS and FNS review and approval. 3.8.2.14. EBT Updated Systems Test Plans Upon completion and approval of the design documents, the EBT Contractor must update the EBT System Test Plans Document, as appropriate, and must develop system test criteria and produce system test scripts. Test criteria must describe the desired system outcomes and performance measures. Test scripts must provide detailed, step-by-step instructions on the actual test and system functions to be demonstrated. Test scripts must describe the desired system outcomes and test results. The EBT Page | 57 Contractor must develop and control test data. Acceptance of the deliverable is contingent upon DHS review and approval. 3.8.2.15. EBT System Test Reports The EBT Contractor must produce individual EBT System Test Reports describing the results of each test, giving a detailed listing of all system deficiencies ranked by level of importance and presenting a schedule that addresses the resolution of all system deficiencies. The EBT Contractor must also describe any additional testing required to satisfy the test objectives. The test reports must also specify necessary system modifications identified during system testing. The EBT Contractor must provide reports describing the results of each test that is performed, as well as any additional re-testing that is required to satisfy the test objectives. The test reports must also describe the intended scope and results from the tests, and any system modifications that are identified as necessary to resolve system errors and deficiencies found during the testing. The EBT Contractor must submit interim test reports no later than two weeks following the completion of the respective test being performed. The EBT Contractor must submit the final versions of EBT System Test Reports as defined in the EBT Project Work Plan, subject to approval by DHS. The EBT Contractor must complete the following EBT System Test Reports:  Functional Demonstration  System Interface Test  System Acceptance Test  System Stress Test  Network Performance Test  ARU Test  Transition Test 3.8.2.16. Updates to Functional Design Document and the Detailed System Design Document The EBT Contractor must revise both the Functional Design Document and the Detailed Design Document to reflect any system modifications identified and made as a result of the system testing. If revisions are required, the Contractor must submit the updated Detailed Design Document no later than one month following the completion of the EBT system testing process. 3.8.2.17. System Operations/Interface Procedures Manual The EBT Contractor must prepare an EBT Systems Operations/Interface Procedures Manual that includes an introduction giving the purpose, audience, organization, related documents and feedback. This manual must be delivered to the Territory during the Development Phase. At a minimum, the EBT Systems Operations/Interface Procedures Manual must include:  Batch files and the times of transmission;  Administrative terminal configuration;  File transmission problem resolution and escalation procedures; and,  Batch maintenance record formats. The EBT Contractor must submit the draft and final EBT Systems Operation and Interface Procedures Manual on the dates agreed upon and specified in the approved EBT Project Work Plan. Page | 58 3.8.2.18. EBT Reports Manual The EBT Contractor must provide an EBT Reports Manual describing all standard reports to be generated by the EBT Contractor along with instructions on accessing reports via on-line terminals. The EBT Reports Manual must include a brief description of the periodic data files to be provided to DHS for internal report generation. A review of all reports will be conducted by DHS as part of the submission of comments on the draft EBT Reports Manual. 3.8.2.19. EBT Settlement/Reconciliation Manual The EBT Contractor must provide an EBT Settlement/Reconciliation Manual that provides guidance and procedures to the Territory on performing a daily reconciliation of the Contractor’s EBT System as defined within 7 CFR 274.1k and the FNS EBT Reconciliation Guidelines. The EBT Settlement/Reconciliation Manual must identify the specific EBT reports from the EBT Contractor’s system that are required for settlement and reconciliation of the EBT system. 3.8.2.20. Third Party Acquirer and POS Certification Plan The EBT Contractor must prepare an EBT Third Party Acquirer and POS Certification Plan for certifying pre-existing commercial equipment and third party acquirers. The designated EBT Contractor must provide its certification standards to DHS for review and approval. Certification standards must reflect the Quest® Operating Rules and standard transaction message format as reflected in the most current ANSI specifications. Certification standards must be available to acquirers no later than thirty (30) days after contract execution.