5-Year unified payment gateway services for sanparks: card present (cp) and card not present (cnp) transactions

• Advert Date: 05 February 2026.
• Closing Date & Time: 06 March 2026, 11:00 am (bid box at 643 Leyds Street, Muckleneuk, Pretoria).
• No other briefing or site‑visit dates are mentioned in the document.

• Physical address for bid submission: 643 Leyds Street, Muckleneuk, Pretoria (Main Gate: Tender Box).
• No specific SCM or technical contact details are provided in the extracted text.

• Submit the bid to the tender box at 643 Leyds Street, Muckleneuk, Pretoria (Main Gate: Tender Box). The box is open 24/7.
• Use only the official bid forms provided – do not re‑type the content.
• All required returnable documents (SBD 4, SBD 6.1, GCC, etc.) must be completed and attached.
• The bid must be received no later than 06 March 2026, 11:00 am. Late submissions will be rejected.
• Ensure the bid is sealed and clearly labelled with the bid number (GNP‑009‑25).

• Phase 1 – Mandatory evaluation criteria (pages 39‑42). Failure to meet any mandatory requirement results in disqualification.
• Phase 2 – Technical and functionality evaluation (pages 43‑52) with points awarded for compliance with technical specifications and claimed preference points (Annexure C – SBD 6.1).
• Phase 3 – Demonstration phase (pages 53‑54) where shortlisted bidders must demonstrate the solution.
• Phase 4 – Pricing evaluation (pages 55‑60).
• Preference points are allocated under the Preferential Procurement Policy Framework Act and Regulations 2022.
• Reasons for disqualification are listed on page 70.

• Provide a unified payment gateway covering Card‑Present (POS, kiosks, terminals) and Card‑Not‑Present (web, mobile, e‑commerce, QR, NFC, USSD, instant EFT) for a 5‑year contract across all SANParks sites (19 parks, 100+ locations).
• Integrate with SANParks core tourism systems (reservations, property management, access control, ticketing, Wild Card programme).
• Meet security standards: EMV, PCI DSS Level 1, P2PE, tokenisation, end‑to‑end encryption, 3D Secure 2.0, fraud monitoring.
• Support multi‑bank connectivity (FNB, Standard Bank, Absa, Nedbank) with a 90‑day transition window, zero data loss and ≤4 hours downtime.
• Host on high‑availability, load‑balanced servers with fixed IP ranges for firewall whitelisting.
• Provide RESTful APIs, webhooks/callbacks for real‑time transaction data, reporting and reconciliation.
• Reporting must allow fine‑grained filtering (merchant, status, card details, date ranges up to 12 months) and export in Excel/CSV/PDF.
• Performance targets: ≤2 s CP auth (95 %); ≤3 s CNP auth (95 %); ≥50 TPS sustained, 150 TPS burst; 99.9 % uptime; transaction success ≥98.5 %.

• Pricing will be evaluated in Phase 4 (pages 55‑60).
• Bidders must present a cost model that demonstrates a 15‑25 % reduction in processing costs versus the current arrangement.
• Disclose any integration or transition costs for future bank changes; no additional licensing, platform fees or early‑termination penalties will be applied for bank switches.
• Provide a fixed cost schedule for bank transition services or confirm inclusion in the base price.
• Financial capacity evidence (e.g., audited statements, bank guarantees) is required as part of the returnable documents.

• Submit completed SBD 4 (Bidder’s Disclosure) and SBD 6.1 (Preference Claim Certificate) with supporting proof for claimed points.
• Comply with the Preferential Procurement Policy Framework Act and Regulations 2022.
• Meet payment industry standards: EMV, PCI DSS Level 1, P2PE.
• Adhere to the Public Finance Management Act (PFMA) and the Protection of Personal Information Act (POPIA) – provide POPIA compliance evidence, data residency in South Africa, and appoint an Information Officer.
• Provide CSD, tax clearance, B‑BBEE verification, CIDB registration, CIPC registration, and any required professional licences as part of the bidder’s disclosure.
• Failure to support mandatory bank transitions is a material breach and may lead to contract termination.

Closing date: 06 March 2026 at 11:00 SAST. Briefing sessions and correspondence details are in Annexure (page 65).

Submission address: 643 Leyds Street, Muckleneuk, Pretoria, 0001 (Main Gate: Tender Box). Technical enquiries: IEC Department. Bidding procedure enquiries: Supply Chain Management (SCM). Specific contact persons, telephone numbers, and email addresses are listed in SBD 1 (Invitation to Bid).

Submit bids on official forms (SBD 1, SBD 4, SBD 6.1, SBD 7.2, GCC) — do not re-type. Deliver to the tender box at 643 Leyds Street, Muckleneuk, Pretoria (Main Gate) by 06 March 2026 at 11:00 SAST. Late bids will not be accepted. The tender box is open 24/7. Bids must include all returnable documents (e.g., SBD 4, SBD 6.1 with proof for preference points, SBD 7.2). Disqualification risks: incomplete forms, late submission, or failure to use official forms.

Evaluation occurs in 4 phases: Phase 1 – Mandatory criteria (pass/fail). Phase 2 – Technical and functionality evaluation (points claimed). Phase 3 – Demonstration phase. Phase 4 – Pricing (80/20 preference point system: 80 points for price, 20 points for specific goals). The lowest compliant price wins after technical acceptance. Minimum thresholds apply per phase; failure in Phase 1 disqualifies the bid.

Scope: 5-year unified payment gateway for Card Present (CP) and Card Not Present (CNP) transactions across SANParks’ 19 parks and 100+ sites. Deliverables: unified gateway platform (CP: POS, front office, kiosks; CNP: web, mobile, e-commerce, Wild Card), real-time authorisation/settlement/refund/reversal, multi-acquirer support (FNB, Standard Bank, Absa, Nedbank), modern payment methods (contactless/NFC, digital wallets, QR, instant EFT), RESTful API integrations, webhooks/callbacks for S2S transactions, high-availability hosting (load-balanced, scalable), and fine-grained reporting (1 day to 12+ months, filterable by merchant, status, card type, etc.). Performance: ≤2s CP auth (95th percentile), ≤3s CNP auth, ≤1s contactless, 50 TPS sustained (150 TPS burst), 99.9% API uptime, <0.5% error rate. Security: PCI DSS Level 1, EMV, P2PE, 3D Secure 2.0, tokenisation, end-to-end encryption, fraud monitoring. Compatibility: Visa, Mastercard, Amex, Diners Club, China Union Pay. Infrastructure: dual ISP, 100 Mbps minimum bandwidth, 500 Mbps burst, network latency ≤100ms (gateway-to-acquirer). Reporting: real-time dashboards, CSV reconciliation files, audit logs. PEDs (physical terminals) are provided by the acquiring bank; gateway provider must ensure software integration only. Mandatory: support seamless transition to any of the 4 major SA banks within 90 days, zero data loss, max 4-hour downtime, no additional costs.

Pricing structure must cover: transaction processing fees (CP and CNP), gateway licensing, integration/setup costs, monthly minimum fees, support/maintenance. Contract term: 5 years. Pricing must be fixed or include a clear escalation formula. No hidden fees. Estimated volumes: CNP ~406,537 transactions/year (R1.57B), CP ~549,495 transactions/year (R844M). Pricing evaluated under 80/20 preference system (80 points price, 20 points specific goals).

Mandatory compliance: PCI DSS Level 1, EMV, P2PE, POPIA (lawful processing, data minimisation, consent notices, data subject rights, encryption, tokenisation, breach notification: T+4h to SANParks, T+72h to Information Regulator, prompt to data subjects), data residency in South Africa, sub-processor register, ISO 27001 (preferred). B-BBEE: minimum Level 1. Preferential Procurement Policy Framework Act and 2022 Regulations apply. Evidence required: multi-bank integration certifications (FNB, Standard Bank, Absa, Nedbank), at least one reference for a successful acquiring bank transition, fixed cost schedule for future transitions. CIDB registration may be required for construction-related elements (if applicable).