Kyc verification system – 36-Month contract – national tender (RFQ)

Closing

• 30 October 2026 at 12:00.

RFQ issued

• 16 October 2026.

Procurement enquiries

• Contact: Sijabulile Ntshangase
• Role: Procurement Officer
• Email: [email protected]
• Telephone: 031 372 3720

Technical and general queries

• Contact: Sphiwe Dlomo
• Email: [email protected]
• Telephone: 031 372 3720
• Hours: 08:00 to 16:30, Monday to Friday

Submission

• Method: email
• Submission email: [email protected]

Submission method

• Email to [email protected], marked for the attention of Sijabulile Ntshangase.
• Closing: 30 October 2026 at 12:00. Late submissions are not accepted.

Returnable documents

• Signed and completed RFQ document with the bidder's details.
• SBD 1 (Invitation to Bid): bidder and contact details, signed as the offer cover page.
• SBD 4 (Declaration of Interest): discloses whether any director, shareholder or member is employed by the state or connected to anyone at KZNGFA.
• SBD 6.1 (Preference Points Claim): claims points for the specific goals set out in the tender.
• Proof of registration on the National Treasury Central Supplier Database (CSD).
• Compliant tax status; a SARS tax compliance PIN must be submitted where the tax status is not compliant.

Joint ventures

• Both member companies must each submit completed and signed SBD 1, SBD 4 and SBD 6.1, their own tax PINs and their own CSD registrations.
• A consolidated joint B-BBEE certificate is required.
• The JV agreement must state which of the two entities' bank accounts will be used.

Disqualification risks

• Any mandatory document omitted or left unsigned renders the bid non-responsive.
• Bids received after the closing time are not accepted.

Mandatory

• Signed and completed RFQ document with the bidder's details.
• SBD 1, SBD 4 and SBD 6.1, signed and completed.
• Evidence of CSD registration and a compliant tax status; a SARS PIN must be submitted if the tax status is not compliant.

Non-mandatory

• Evidence of CSD registration and a compliant tax status.

Failure to provide any mandatory information renders the bid non-responsive.

Four-stage evaluation.

Stage 1 — Compliance

• Mandatory documents, CSD registration and tax status are checked first; failure renders the bid non-responsive.

Stage 2 — Functionality (50 points)

• Minimum qualifying score: 35 of 50. Below this the bid is disqualified from further evaluation.
• Company experience (20 points): less than 3 years = 5; 3 to 5 years = 10; 6 to 10 years = 15; more than 10 years = 20. No points if the year of establishment is absent from the company profile; the year is verified against CIPC or CSD.
• Reference letters (30 points): 3 relevant references = 30; 2 = 20; 1 = 10. At least five KYC verification references must be provided. Letters must be on client letterhead, signed, dated and not older than 5 years.

Stage 3 — Demo presentation (30 points)

• Minimum qualifying score: 21 of 30 (70%). Bidders below this are disqualified.
• Bidders set up a mock environment for KZNGFA representatives to walk through the solution.
• Assessed areas, 5 points each: identity and registration verification; sanctions, PEP and adverse media screening; AML, KYC and due-diligence compliance; credit, legal and financial checks; reporting and traceability.
• Ease of navigation and a full system demonstration are also assessed.

Stage 4 — Price and specific goals (100 points)

• 80/20 preference point system: price 80 points, specific goals 20 points.
• Specific goals points: black ownership 10; black women ownership 4; black youth ownership 3; disability 3.
• Proof for specific goals: B-BBEE certificate or B-BBEE affidavit, CSD report, ID documents of the company owners, and a doctor's certificate or disability database confirmation from the relevant institution.
• KZNGFA is not obliged to award to the lowest bidder or to any bidder.

Purpose

• Appointment of a service provider to implement a KYC verification system for KZNGFA, including background verification of companies.
• The platform must support end-to-end background, compliance and probity checks on natural and juristic persons.

Core functionality

• Client profiling and behaviour analysis.
• Transaction monitoring.
• Workflow for suspicious activities and transactions.
• Alerts when a client's risk profile changes.
• Case management.
• Screening (individual, batch and adverse media).
• Monitoring, reporting and analysis.
• Criminal record checks.
• Analytics tool.
• Record keeping in line with FICA.

Identity, registration verification and enhanced due diligence

• Verify natural persons' ID or passport details against compliant databases such as the Department of Home Affairs.
• Verify juristic persons through CIPC, including directors, entity status and registration history.
• Validate ultimate beneficial ownership.
• Validate information at the Deeds Office.
• Record and verify source of funds and source of wealth.

Sanctions, PEP and adverse media screening

• Screen individuals and entities against PEP lists, PIP lists, local and international sanctions lists (UN, OFAC, EU and others), public sector datasets, adverse media databases, and fraud, crime, court and police records.
• Identify relational links to PEPs, PIPs and high-risk individuals.
• Screen private and public platforms including NewsMonitor, Market IQ, CIPC/SA Company, Saflii.org/za, Legalbrief.co.za, Green Gazette, general internet (Google), Facebook, Who's Who and LinkedIn.

AML, KYC and due diligence

• Conduct AML, KYC and due-diligence checks aligned with FICA.
• Generate risk profiles and risk scores.
• Provide configurable KYC checklists and onboarding workflows.
• Store compliance documents securely with full audit trails.

Credit, legal and financial checks

• Integrate with credit bureaus such as TransUnion, Experian and XDS.
• Provide credit scores, judgments, high court listings, adverse listings and fraud databases.

Reporting and traceability

• Consolidated due-diligence reports.
• Audit logs for every check performed.
• Historical checks stored for future reference.

Customer risk rating

• Real-time classification of clients as high, medium or low risk based on their attributes.
• Risk-specific checklists assigned automatically, with re-categorisation in real time when a client's profile changes.

Investigate and report

• Flag and report clients as compliant, non-compliant, partially compliant, approved, rejected, terminated, suspended or frozen, pended, or reported (suspicious and unusual reporting, terror financing reporting, cash threshold reporting).
• Case management: investigate, adjudicate and report within the prescribed period.
• Quality assurance and compliance sign-off on all transactions for new and existing clients.
• Capture and record exited, rejected and terminated customers, the reasons and the dates.
• Records must be kept for five years in line with legislation.

Users

• Approximately 7 internal users with varying access permissions, mainly in the risk and projects department, plus risk and action owners, business unit leaders and risk and ethics champions.

Technical requirements

• Fully auditable system with immutable logs.
• Cloud-based (SaaS) or hybrid hosting.
• Web-based, securely accessible through standard browsers; multi-device and multi-browser compatible.
• Offline capability through exportable templates with later synchronisation.
• APIs for integration with internal systems (ERP, CRM, DMS, HR, finance), external verification databases (CIPC, DHA, credit bureaus, sanctions lists) and reporting and BI tools.
• Compliance with POPIA, PAIA, PFMA, FICA and King IV.
• Encryption of data at rest and in transit.
• Role-based access control and data masking for sensitive information.
• User-driven development with an active enhancement roadmap.
• Dedicated local support with helpdesk facilities.
• The provider must advise on enhancements and industry best practice.

Additional deliverables

• High-level implementation plan with timelines and key milestones.
• Onboarding and post-implementation handholding training for all users.
• Skills-transfer plan for internal IT.
• Data migration and full handover of all KZNGFA data on contract termination.

Implementation plan with timelines and key milestones.

Onboarding and post-implementation handholding training for all users.

Skills-transfer plan for internal IT.

Data migration and full handover of all KZNGFA data on contract termination.

The provider must advise on system enhancements and industry best practice to support continuous improvement.

Company experience (20 points)

• Less than 3 years: 5 points.
• 3 to 5 years: 10 points.
• 6 to 10 years: 15 points.
• More than 10 years: 20 points.
• No points if the year of establishment is not shown in the company profile; the year is verified against CIPC or CSD.
• Experience must be in a KYC and anti-money laundering control environment or related research or strategy development.

References (30 points)

• At least five KYC verification references must be provided.
• 3 relevant reference letters: 30 points; 2: 20 points; 1: 10 points.
• Letters must be on client letterhead, signed and dated, and not older than 5 years.

Minimum threshold: 35 of 50 on functionality; below this the bid is disqualified.

Annexure A is the pricing schedule. Unit prices are quoted for: director report; company report; Deeds Office DOTS search; Deeds Office document copy; Deeds Office document search; Deeds Office property search; Deeds Office person search; trust search (found); spider search; PEP search; TransUnion consumer profile; Experian consumer profile; TPN profile; Compuscan consumer profile; and other searches, for which details must be provided.

Sub-total, VAT at 15% and grand total must be completed.

The system is pay-as-you-use with no fixed amount.

The offer must remain valid for 90 calendar days from the closing date.

Prices must be fixed and inclusive of VAT and all disbursement and accommodation costs.

Pricing

• Fixed price required, inclusive of VAT and all costs relating to disbursements and accommodation.
• Pricing is submitted on Annexure A, a unit-price schedule covering 15 verification types: director report; company report; Deeds Office DOTS search; Deeds Office document copy; Deeds Office document search; Deeds Office property search; Deeds Office person search; trust search (found); spider search; PEP search; TransUnion consumer profile; Experian consumer profile; TPN profile; Compuscan consumer profile; and other searches, for which details must be provided.
• Sub-total, VAT at 15% and grand total must be shown.
• The system must be pay-as-you-use with no fixed amount.
• Offer validity: 90 calendar days from the closing date.

Registration and tax

• Registration on the National Treasury Central Supplier Database (CSD) is required; the CSD number must be provided.
• A compliant tax status is required; a SARS tax compliance PIN must be submitted where the status is not compliant. Where no PIN is available but the bidder is registered on CSD, the CSD number must be provided.
• Bidders in the service of the state, companies with directors in the service of the state, and close corporations with members in the service of the state will not be considered.

Mandatory returnable forms

• SBD 1 (Invitation to Bid): bidder details and signature.
• SBD 4 (Declaration of Interest): state employment and relationships of directors, shareholders and members.
• SBD 6.1 (Preference Points Claim): claims specific goals points.
• Signed and completed RFQ document with the bidder's details.

Joint ventures

• Each member must submit its own signed SBD 1, SBD 4 and SBD 6.1, tax PIN and CSD registration.
• A consolidated joint B-BBEE certificate is required.
• The JV agreement must direct which entity's bank account is used.

B-bbee

• A B-BBEE certificate or a sworn affidavit is required to claim preference points.
• Specific goals points: black ownership 10; black women ownership 4; black youth ownership 3; disability 3.
• Supporting proof: B-BBEE certificate or affidavit, CSD report, ID documents of the owners, and a doctor's certificate or disability database confirmation.

Disqualification

• Failure to provide any mandatory document or information renders the bid non-responsive.
• Bidders listed on the Register for Tender Defaulters or the List of Restricted Suppliers are disqualified.

Preference points are claimed for specific goals: black ownership 10 points; black women ownership 4 points; black youth ownership 3 points; disability 3 points.

Proof may include a B-BBEE certificate or B-BBEE affidavit, a CSD report, ID documents of the company owners, and a doctor's certificate or disability database confirmation from the relevant institution.

A B-BBEE certificate or sworn affidavit must be submitted to claim preference points.

Joint ventures must submit a consolidated joint B-BBEE certificate.

Contract duration: 36 months.

The successful bidder must complete and sign the written contract form (SBD 7).

The system is pay-as-you-use with no fixed amount.

On contract termination the provider must migrate and fully hand over all KZNGFA data.

Client records must be retained for five years in line with legislation.

KZNGFA is not obliged to award the contract to the lowest bidder or to any bidder.

The bid is subject to the Preferential Procurement Policy Framework Act, 2000, the Preferential Procurement Regulations, 2022 and the General Conditions of Contract.

Joint ventures: both member companies must submit completed and signed SBD 1, SBD 4 and SBD 6.1, their own tax PINs and their own CSD registrations.

A consolidated joint B-BBEE certificate is required.

The JV agreement must direct which of the two entities' bank accounts will be used.

Stage 1 — compliance with minimum requirements.

Stage 2 — functionality, 50 points, minimum 35 to proceed.

Stage 3 — demo presentation, 30 points, minimum 21 (70%) to proceed.

Stage 4 — price and specific goals on the 80/20 system: price 80 points, specific goals 20 points.

Functionality: company experience 20 points (less than 3 years = 5; 3 to 5 years = 10; 6 to 10 years = 15; more than 10 years = 20) and reference letters 30 points (3 letters = 30; 2 = 20; 1 = 10).

Demo: five areas at 5 points each — identity and registration verification; sanctions, PEP and adverse media screening; AML, KYC and due-diligence compliance; credit, legal and financial checks; reporting and traceability — plus ease of navigation and system demonstration.