RFI: centralised national tolling solution for SANRAL – strategic technology partner sought

• All communication and technical questions (must be in writing):

• Attention: Procurement
• Reference: SANRAL HO CTROM001/2026
• Email: [email protected]

• Briefing session access:

• MS Teams link: https://teams.microsoft.com/meet/364620261343880?p=mUwyhuVLAiv4Hg8cAA
• Meeting ID: 364 620 261 343 880
• Passcode: X4oq7x3M

Submission requirements:

• Submit one (1) hard copy and one (1) USB with an electronic copy (PDF format) of the RFI response.
• All documents must be in English.
• Include a signed company letter with the submission.
• Endorse the envelope with the closing date, company/respondent name, and return address.

Mandatory content for RFI response:

• Company registration details, organisational profile, and consortium/partner details (if applicable).
• Pricing assumptions, cost drivers, and pricing structure.
• Examples of large-scale tolling, transport, payment, revenue assurance, or equivalent high-volume transactional solutions implemented or supported.
• Narrative on how the proposed solution addresses functional, technical, integration, security, and operational requirements.
• Position on IP ownership, source code escrow, documentation, knowledge transfer, support model, exit transition, and indicative cost drivers.
• Current tax compliance status.
• B-BBEE status information (certificate or sworn affidavit if applicable).
• Indexed and properly referenced supporting documents.

Submission logistics:

• Delivery address: Reception area, 36 Assegai Wood Road, Rooihuiskraal, Centurion, Gauteng.
• Deadline: 26 June 2026 at 12:00 PM (South African Time). No late submissions accepted.
• Only submissions on issued tender documentation will be considered.
• Telephonic, telegraphic, telex, facsimile, or e-mailed tenders are NOT accepted.
• Respondents must ensure their names and contact details are on the cover page.
• SANRAL reserves the right to request additional information. All costs for response preparation are the respondent’s responsibility.

Evaluation focus areas (RFI responses are for market insight only, not for award):

• Market intelligence: Experience in large-scale tolling, payment, or high-volume transactional systems.
• Technical capability: Ability to design, implement, and support a centralised national tolling ecosystem.
• Compliance: Must adhere to PCI DSS, POPIA, ISO/IEC 27001, and SANRAL cybersecurity policies.
• Response quality: Clarity, completeness, and relevance of submitted information.
• Feasibility: Practicality of proposed solutions, cost structures, and implementation approaches.
• Risk and delivery readiness: Identification of potential risks, dependencies, and mitigation strategies.

Note: This is a Request for Information (RFI), not a bid. No contract will be awarded based on RFI responses.

Scope:

• Provision of a centralised national tolling solution to replace fragmented systems with a unified platform under SANRAL governance.

Core operational ecosystem components (respondents must address capability for each):

• Roadside lane management system (manual, automatic, card, ETC, mixed, extra-wide lanes).
• Vehicle detection and classification (AVC, ANPR, HD imaging, V-Tolling fallback).
• Electronic toll collection (5.8 GHz DSRC tags, EMV chip-and-PIN/contactless, fleet cards).
• Payment processing (banking systems, PCI DSS compliance, EFT, prepaid top-ups).
• Central Back-Office (CBO): Unified customer accounts, CRM, multi-channel notifications, self-service portals.
• Billing, invoicing, and payments: Tariff application, discounts/exemptions, tax invoices, third-party agency invoicing, automated reconciliation.
• Fraud detection and revenue assurance: AI-driven tools, TCH validation, tamper-proof audit trails, violation record management.
• Reporting and analytics: Standard/real-time/ad-hoc reports, operational dashboards, KPIs.
• Integration: TCH, RTMC (NaTIS), VPC, SANRAL ERP/BI platforms, banks, fleet payment systems.

Architecture and deployment requirements:

• Modular, scalable, cloud-ready (SANRAL private cloud or South African hosting with data residency).
• Secure, standards-based APIs for all integrations.
• Continuous operation (24/7/365) with full redundancy, automatic failover, and disaster recovery (RTO ≤ 2 hours, RPO ≤ 15 minutes).
• Minimum 99.5% system uptime and 99.9% transaction reconciliation accuracy.
• Handle projected transaction volumes without degradation and support future expansion.

Security and compliance:

• POPIA compliance for customer data.
• PCI DSS compliance with end-to-end encryption (E2EE) and tokenisation.
• ISO/IEC 27001 and SANRAL cybersecurity policy compliance.
• PASA rules and standards adherence.
• Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) for administrative access.

Operational model:

• Platform must operate as a shared national service for multiple toll concessionaires under SANRAL governance.
• Financial risk for lost revenue (system failure/fraud) is borne entirely by the contracted plaza operator.
• SANRAL retains custody of financial transactions, operational data, system documentation, and IP where applicable.

Mandatory functional capabilities (M):

• Offline lane operation for ≥72 hours with automated reconciliation post-restoration.
• Cash payments with float management and cash-up functionality.
• High-accuracy ANPR for South African and foreign license plates.
• Automated transaction records for every vehicle passage.
• Unified national customer account structure and single customer view.
• Automated multi-channel notifications (email, SMS, in-app).
• Configurable tariff/discount/exemption rules without vendor intervention.
• Tamper-proof audit trails for all transactions and user activities.

Innovation (encouraged):

• AI/ML for pattern detection, forecasting, automation.
• Predictive analytics (traffic, revenue, maintenance).
• Smart mobility enablement (MaaS, dynamic tolling).
• Emerging technologies (GNSS, smartphone-based tolling).

Pricing and commercial information required:

• Pricing models (fixed price, time-and-materials, outcome-based).
• Software licensing approaches (perpetual, subscription, usage-based).
• Development, maintenance, and support cost structures (SLA tiers, response times).
• Hosting and infrastructure costs (cloud consumption, colocation).
• Managed services options and cost recovery models.
• Revenue sharing models (if applicable).
• Total Cost of Ownership (TCO) estimates over 5–10 years.
• Pricing assumptions, cost drivers, and pricing structure for the proposed solution.

Payment and financial integration:

• Must integrate with banking systems (EMV standards, PCI DSS compliance).
• Support automated prepaid top-ups via credit card, debit order, or EFT.
• Automated reconciliation tools for payments and customer accounts.

Financial risk:

• Contracted plaza operators bear full financial risk for lost revenue due to system failure or fraud.

Mandatory compliance and certifications:

• POPIA (Protection of Personal Information Act) for customer data handling.
• PCI DSS (Payment Card Industry Data Security Standard) with end-to-end encryption (E2EE) and tokenisation.
• ISO/IEC 27001 (Information Security Management Systems).
• PASA (Payment Association of South Africa) rules and standards.
• SANRAL cybersecurity policies.

Access control and data governance:

• Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) for administrative access.
• South African data residency for all hosting and data storage.
• Secure, standards-based APIs for all integrations.

Documentation and status requirements:

• Current tax compliance status (must be provided).
• B-BBEE status information (certificate or sworn affidavit if applicable).
• Company registration details and organisational profile.
• Consortium/partner details (if applicable).

Integration and interoperability:

• Must integrate with existing Transaction Clearing House (TCH) and comply with its governance rules.
• Secure real-time integration with RTMC (NaTIS) for vehicle/owner verification.
• Integration with SANRAL ERP and Business Intelligence (BI) platforms.
• Compliance with AARTO (Administrative Adjudication of Road Traffic Offences) for violation processing.