annexure d - welcome to etenderpublication | national … · · 2018-01-19provider will perform...

RFP27/ ATM & SSD Acquiring project

of 12

ANNEXURE D

1. Background and introduction Postbank, a division of the South African Post Office, and Financial Institution, intends to

certify as an ATM and POS Acquiring bank which will unlock new revenue streams for the

bank and will expand its current product offering in the market. As part of its value proposition

to existing and new customers, Postbank has secured Acquiring licenses from both Visa

and MasterCard that will allow it to launch its very own ATM network using a dual approach

to position ATMs at various locations within SAPO locations, but also elsewhere where traffic

and volumes (from existing and other bank customers) prove commercially viable. Data

from the SARB and other banks, suggest that cash is still on the rise, strengthening the

business case for ATMs.

An ATM network comprises of various components, namely device hardware management,

software management, switching and Cash-in-Transit (CIT) - each of which requires

immense capital expenditure, set-up lead time, expertise, integration and human resources

in order to successfully launch, and operate. The provision and management of an ATM

network requires intense specialisation, and for this reason, many of the other banks with

ATMs have decided to operate this infrastructure on an outsourced basis through

specialised Service Providers.

In line with the trend by government departments and state-owned companies to off-load

non-core and specialised assets from its balance sheet in an attempt to reduce capital

requirements from state coffers, the business case for a fully outsourced and managed ATM

business model was demonstrated to the Postbank PPC, and adopted for implementation.

Based upon target customer needs, Postbank has identified two types of ATMs for

deployment, namely cash dispensing ATMs and those that integrate with Merchant stores


of 12

allowing customers to take expensive and risky cash out of merchant environments. Service

Providers also perform a vital function in that they work closely on an ongoing basis with

banks in order to maximise and optimise ATM placement in order to reduce the risk of

duplicated infrastructure that do not meet transactional traffic thresholds. Service Provider

who work closely with switch operators in the industry is best placed to know and advise

banks in terms of spread and distribution of existing ATMs location of other banks, well as

areas where demand growing is, but not met with sufficient infrastructure.

Service Providers who have already invested millions into operating ATMs on behalf of

banks, are willing to achieve economies of scale while relying upon the strong brands and

trust factor that comes with existing banks. The banking industry is among the most

regulated of all industries, and for this reason, ATM Service Provider know that in order to

make money, customers are likely to transact on their own bank ATMs or least on those

belonging to established banking brands. Some Service Providers are willing to incur all

costs relating to the capital expenditure and ongoing operational costs of operating an ATM

network, in exchange for leveraging off the strong brands, customer base and banking

licenses held by banks. In this way Service Providers are able to acquire transactional

volumes through their ATM networks, while banks are able to make revenue off Acquiring

infrastructure which it does not have to own or maintain. This option was shown as the most

commercially viable option for Postbank, as it results in the lowest Total Cost of Ownership

(TCO) for the Group.

The purpose of this document is to define the specifications required for the tendering and

procurement of a fully managed outsourced solution of ATMs. Under the proposed

procurement scheme, the successful Service Provider/s will work closely with Postbank in

order to establish an ATM footprint bearing the Postbank brand, mainly in locations where

transactional banking volumes are in supply. The locations identified could be within

strategic locations in SAPO premises (with the support and permission of Retail and S&I),

or they could be retail locations where space will be rented from reputable Landlords.

Service Provider/s will be required to manage all interactions and fit all costs arising from

sourcing of rental space on an ongoing basis. It is not possible to quantify upfront an


of 12

exhaustive view of every single ATM deployment upfront, as there are many factors which

will drive this over time, for instance, evolving customer demand, other bank’s ATM

deployment strategy, and opportunities arising from new property development and mixed

economic development nodes across the country. All CIT function pertaining to

replenishment of ATMs will be managed by the Service Provider who in turn will use its own

partners to stock ATMs. The Service Provider will carry all risk arising from fraud, theft of

robberies. While Postbank will be given real-time access to any of its ATMs, The Service

Provider will perform all monitoring functions across the envisaged Postbank ATM footprint,

with no problem management intervention required from Postbank. This is a highly

desirable business model as it lowers the TCO for the banks, and allows the bank to acquire

a new revenue stream.

2. Objectives of the bid Postbank’s objectives with this bid are to: • Appoint a Service Provider who is able to provide a “Fully Managed Service” for the

deployment and management of an ATM and SSD network including transaction

switching to all three Payment System Operators i.e. VISA, MasterCard &

BankservAfrica.

• Appoint a service provider with skills and capabilities to facilitate with the certification of

Postbank as acquiring bank with all industry stakeholders as mandated by PASA and

SARB

• Contract with the successful bidder for a period of three (3) years with the possibility of

further extension as Postbank is seeking to achieve its organisational and strategic

objectives through alliance partnerships.


of 12

3. SCOPE OF WORK

Postbank requires the following products and services that encompass the “Fully Managed”

service from a single service provider:

3.1 Systems Integration and VISA Certification Process

Postbank is a primary member of VISA and MasterCard and already in possession of Issuing

and Acquiring BINs for both associations. Postbank however hasn’t activated the acquiring

BINs as it is yet to acquire and implement the switch (Postilion) acquiring modules. As an

interim solution, the winning bidder will be expected to facilitate with the integrate into

Postbank’s systems as well as facilitating with the ATM Acquiring certification utilising the

bidder’s transaction switch to route all transactions to all the card associations (VISA,

MasterCard & BankservAfrica) on behalf of Postbank. Postbank will take over the

routing/switching of transaction to VISA, MasterCard and BankservAfrica as soon as the

Postbank switch is upgraded and internal certification process successfully completed. The

diagram below depicts the proposed systems integrations and flow of all ATM transactions.


of 12

Figure 1: High Level ATM Acquiring Architectural Overview

Item Description

1 Integration Link between the Service Provider and the Postbank Switch.

Customer transaction data from the Service Provider switch should be replicated

onto the Postbank switch for record keeping purposes.

2 Certification of Postbank as an ATM Acquirer with BankservAfrica

3 & 4 Certification of Postbank as an ATM Acquirer with VISA and MasterCard

5 Postbank branded SSD connected directly to the Service Provider switch

6 Postbank branded ATM connected directly to the Service Provider switch

3.1.1 Impact on Postbank internal Systems and Processes

We do not anticipate signification impact or changes on Postbank internal systems as the

current processes utilised for settlement of the current SAPO branch outlet OTCD and

Saswitch ATM transactions will be sufficient. The following minimum changes will be

expected:

All new terminals (ATMs and SSDs) will be recorded in Postilion/UBS

All merchants that will be allocated an SSD will be expected to open a business

account with Postbank that will be used for settlement purposes.

A new product code for SSD transactions will be created in UBS


of 12

3.2 Managed Services

Upon successful systems integration and completion of ATM EMV Acquiring certifications,

the winning bidder will be expected to deliver the following services to Postbank:

Requirement Description

Site Identification and

Selection

The ability to utilise various data sources to create heat maps

identifying best possible locations to deploy Postbank branded

ATMs. Ability to apply other criteria including safety and

security, competitor ATMs and ease of servicing to assist with

the selection of the most suitable site location. The Service

Provider will work closely with SAPO’s Security and

Investigation team to determine the site security prior to

approval for installation. The identification and selection of

ATM sites is an ongoing process involving both the Service

Provider and Postbank/SAPO. SAPO has the final say in the

approval of all identified sites.

The Service Provider will be required to provide a 12 month

deployment plan to rollout 100 cash ATMs and 100 SSDs within a

month of being appointed. The plan will include rollout into agreed

SAPO branches as well as offsite ATMs.

Site Rental (except for

SAPO Outlets)

Negotiating with the landlord and ensuring that the proper

lease agreement is signed. This will apply to all offsite ATM

sites. For Postbank branch sites, the SAPO Properties in

conjunction with the retail business unit, will be responsible for

negotiating with the landlord (in cases where the branch is not

owned by SAPO). Postbank will pay SAPO an agreed monthly

rental.

Device Types &

Functionality

The ability to supply and deploy both cash dispensing ATMs

and Self-Service Devices (SSD). For SSDs, Postbank will only

consider devices with large screens and the look and feel of a

proper cash dispensing ATM. The following transactions are

expected from both of the devices; Cash withdrawals, Balance

enquiries, mini statements, prepaid airtime, prepaid electricity

ATM Purchase &

Upgrades

The ability to purchase and upgrade ATMs at short notice.

Postbank will expect the Service Provider to supply and install

the ATM within 4 weeks of obtaining a signed lease.

Site Preparation

(including wet works)

The Service Provider will be expected to generate

installation/construction designs for each site and seek


of 12

approval from and SAPO Properties and the Retail business

unit prior to site construction

ATM Transportation The transportation of ATMs and related construction material

will be the sole responsibility of the bidder

ATM Installation & de-

Installations

The installation and de-installation of ATMs will be the sole

responsibility of the bidder. De-installation of ATMs will be

based on joint decision between the bidder and Postbank.

Branding & Signage The design of ATM branding and signage including application

guidelines will be managed by Postbank. The bidder will utilise

the designs and guidelines to ensure that the applications are

in compliancy with Postbank requirements. The ATM/SSD

screens will be branded to comply with Postbank’s brand

specifications.

ATM Maintenance – 1st

and 2nd Line

Maintenance

Ability to remotely identify problematic ATMs and despatch the

relevant personnel to go and fix within a reasonable and

agreed response time (MTTR)

Transaction Switching –

to VISA, MasterCard

and Bankserv

Ability to route all ATM transactions to the relevant channel for

authorisation. Transaction from other bank customers are

either routed to Bankserv, VISA or MasterCard and Postbank

customer transaction will be routed directly to Postbank for

authorisation.

Consumable Supplies –

Receipts

The bidder will be responsible to the supply of ATM receipts

and any other related consumables

Cash Supply – Based

on received orders

The supply of cash will be the responsibility of Postbank. The

Service Provider will order the cash via the agreed Postbank

Channels

Cash Logistics

(Transportation and

ATM Replenishment)

The transportation of cash and replenishment of ATMs will be

the sole responsibility of the Service Provider. A PSIRA

registered service provider to be utilised

Cash Insurance The insurance of cash as soon as it leaves the cash centre, in-

transit and in ATMs is the responsibility of the Service Provider

Cash Forecasting &

Reconciliations

The bidder will use automated cash forecasting tools to

estimate the cash required for ATM replenishment. Postbank

expects the Service Provider to order the most optimal levels

to avoid unnecessary costs of cash funding.


of 12

Contact Centre –

Customer Support

The bidder will provide a contact centre that customers can

contact for queries and dispute resolutions. Postbank requires

remote/online access to the query and dispute logging system

to assist with the management of Postbank customer issues.

Dispute Resolution Postbank expects the bidder to address all customer disputes

within the industry agreed SLAs.

Custodian Training In the event that Postbank might decide to replenish some of

the outlet located ATMs, Postbank will expect the bidder to

provide the outlet custodian with all the relevant training

ATM Monitoring The bidder should provide access to the monitoring system to

enable Postbank to be able to determine the status and

performance of the network at any point.

Reporting and Analysis

- web access provided

to Postbank

The bidder should provide Postbank access to operational and

transactional performance data for reporting and Analysis

purposes.

3.3 Device Types and Functionality

To ensure that Postbank is able to meet all its Financial Inclusion obligations including

provision of banking services to remote rural areas, we propose the deployment of two type

of devices, a non-cash dispensing Self-Service Device and a Low Cost Cash dispensing

ATM. The placement of these devices will be decided on a site by site basis based on

defined criteria including potential transactions, accessibility, security etc.

Device Type Functionality and Placement

Low Cost ATM (EMV

Compliant)

Should have the option to offer up to 4 canisters to be able to cater

for smaller denominations: R10, R20, R50, R100.

Minimum Transactions Required:

- cash withdrawal,

- Balance enquiry,

- Mini Statement

- Prepaid airtime,

- Prepaid electricity

- Card less Transactions (P2P) money transfer


of 12

Self-Service Device (EMV

Compliant)

The SSD has the same look and feel as a cash dispensing ATM and

can perform most of transactions that can be performed on ATMs.

The difference is that it does not have a cash dispenser. When a

customer makes a cash withdrawal transaction, he/she will be

presented with a slip indicating the amount withdrawn. The customer

will take this slip to the merchant to exchange for cash. The merchant

will present these slips to the bank for settlement. The SSD can be

wall or desktop mounted within a merchant environment.

The SSDs are placed in remote rural locations where placement of a

cash dispensing ATM is not logistically possible and no POS facilities

exist. Should mimic the look and feel of a real ATM

Minimum Transactions Required:

- cash withdrawal,

- Balance enquiry,

- Mini Statement

- Prepaid airtime,

- Prepaid electricity

- P2P money transfers

3.4 Deployment Targets

We will adopt a dual ATM Distribution strategy covering both suitable SAPO outlets as well

as offsite site locations at places such as retail outlets, taxi ranks, spaza shops, and petrol

stations. Sites will be assessed on a case by case basis to ensure the most optimal

distribution complementing the SAPO outlet network as well as retail outlets offering cash-

back facilities through the SAPO POS devices. The table below indicates the estimated

deployment targets for the next 5 years.


of 12

2018 2019 2020 Total

Cash ATMs 100 350 350 800

SSDs 50 150 150 350

Total 150 500 500 1150

3.5 Business Non-Functional Requirements

3.5.1 Performance Requirements

Requirement Descriptions

Increase Customer Satisfaction

The ATM network must allow customers to access banking services 24 hours a day, 365 days a year with minimum downtime period for backup and maintenance. A minimum of 96.5% ATM network availability is expected

Transaction Speeds

The Service provider will ensure that the network is configured to ensure that transaction, especially cash withdrawals are completed within industry average speeds.

Expand Product Offerings

The ATM platform should provide facilities for the bank to offer new services and products

User Interfaces The user interface shall comply to the bank’s brand and customer interface requirements

User Friendly The system to be easy to use without a customer going through tutorials.

3.5.2 Security Requirements

Requirement Description

Backup, recovery & business continuity

Both data and software should be backed up periodically, the

frequency of back up depending on the recovery needs of the

application. The back-up may be incremental or complete.

Automating the backup procedures is preferred to obviate

operator errors and missed back-ups.

Recovery and business continuity measures should be in place and

a documented plan with the organization and assignment of

responsibilities of the key decision making personnel should be

produced.


of 12

An off-site back up is necessary for recovery from major failures /

disasters to ensure business continuity. Hot sites or warm sites or

should be available for business continuity.

The business continuity plan should be frequently tested.

Retained Cards All retained cards should be taken to a central point where they are captured and destroyed in accordance to the ATM PCH rules

Card Skimming The Service Provider will constantly monitor and check all ATMs to ensure that no external skimming devices are placed in the card reader to compromise customer card data.

3.6 Risk Management

The deployment of ATMs introduces new risks to the business especially as it relates to deployment at or within SAPO outlets. The following risks have been identified and will be managed between the Service Provider and the respective SAPO departments.

Risk Mitigation

Site Location ATMs will be placed at security assessed and approved sites located at SAPO outlets, retail outlets, Taxi ranks, petrol stations, spaza shops. A risk assessment criteria will be jointly developed by SAPO Risk and the Service Provider. SAPO will have the final say on the approval of sites based on the risk assessment.

Lease Agreements All offsite ATM site leases will be negotiated and agreed directly between the service Provider and the landlord. Copies of the site will be shared with the bank for record purposes. For branch sites (not owned by SAPO) that have been identified as suitable ATM sites, lease agreements/amendments will be negotiated between the landlord and SAPO Properties. In such cases, the Service provider will remove the site rental cost from the monthly fee to be invoiced to the bank. This will also apply to SAPO owned outlets.

Outlet Site Design Each site will be assessed to decide whether placement should be Lobby, Kiosk or Through the wall

Cash Replenishment The outlet ATMs will be constructed in such a way not to have any impact on customers and branch staff.

Outlet Staff Security Risk The placement of branch ATMs will designed to ensure that cash replenishment has minimum impact on outlet staff and


of 12

Outlet Insurance Risk Outlet insurance risk will be re-assessed for all branches where placement of an ATM is earmarked to ensure that the branch is always fully covered.

Forced Access to cash in ATMs through ATM Bombings, Grinding or Tempering

All cash dispensing ATMs will be fitted with SARB approved dye staining technology. The dye stain should destroy the cash in the event of a breach, explosion of excessive vibration.

annexure d - welcome to etenderpublication | national … · · 2018-01-19provider will perform...

Documents