Integrated regulatory information management system (iris) – supply, implementation, and maintenance services

05 November 2026: RFP document issued.

13 November 2026, 10:00 to 11:00: Compulsory briefing session, online via MS Teams.

07 December 2026 at 11:00 AM sharp CAT: Closing date and time for proposal submission.

08 December 2026: Preliminary evaluation and evaluations by the Evaluation Committee.

25 January 2027: Adjudication Committee meeting.

01 February 2027: Appointment.

Enquiries

• Email: [email protected]

Submission and delivery address

• National Credit Regulator
• 127-15th Road
• Randjiespark
• Halfway House
• Midrand

Fraud and corruption reporting

• KPMG Ethics Line (toll-free): 800 53 17

Submission method and venue

• Proposals must be submitted as two hard copies (original and copy) plus one memory stick containing the entire proposal.
• Documents must be placed in a sealed envelope and deposited in the tender box at the reception area, National Credit Regulator, 127-15th Road, Randjiespark, Halfway House, Midrand.
• The tender box is available between 08:00 and 16:30 on weekdays, excluding public holidays.
• The envelope must be clearly labelled with RFP No: NCR1056.11.2026, the tender title, and the closing date.
• Closing time: 11:00 AM sharp CAT on 07 December 2026. Late submissions are not considered under any circumstances.
• Each page must be initialled and the proposal signed and dated in black ink by the bidder or an authorised representative.
• Only one RFP may be contained in each envelope.
• Failure to submit all required documentation may result in the submission being discarded and not evaluated.

Returnable forms and documents

• SBD 1 (Invitation to Bid): complete and sign; omission leads to disqualification.
• SBD 4 (Declaration of Interest): complete and sign; omission leads to disqualification.
• SBD 6.1 (Preference Point Claim): submit to claim specific goals points; non-submission results in zero points for specific goals.
• Proof of registration on the Central Supplier Database (CSD) with a vendor number starting with MAAA; omission leads to disqualification.
• Written confirmation that SARS may disclose the bidder's tax compliance status on an ongoing basis; omission leads to disqualification.
• Acceptance of the General Terms and Conditions (Annexure B and B.1, downloadable from the NCR website); omission leads to disqualification.

Scoring system

• 80/20 preference points system: 80 points for price, 20 points for specific goals.

Specific goals points

• Black ownership: 81%–100% = 7 points; 51%–80% = 5; 31%–50% = 3; 0%–30% = 1.
• Disability ownership: 50%–100% = 3 points; 30%–49% = 2; 0%–29% = 1.
• Women ownership: 81%–100% = 7 points; 51%–80% = 5; 31%–50% = 3; 0%–30% = 1.
• Youth ownership: 50%–100% = 3 points; 30%–49% = 2; 0%–29% = 1.

Evidence for specific goals

• Points are awarded only on evidence submitted. Acceptable evidence includes share certificates, ID copies stamped by a commissioner of oaths, sworn affidavits, B-BBEE certificates, proof of disability and CIPC documents.

Functionality evaluation

• A minimum functionality threshold of 70% is recommended before a bidder proceeds to price and preference evaluation.
• Functionality weighting: functional fit to the regulatory lifecycle and integrations 25%; configurability, maintainability and NCR's ability to extend without vendor dependence 15%; MVP and implementation approach credibility 20%; relevant solution experience and reference sites 15%; local support model, service levels and ongoing maintenance 10%; security, POPIA, data ownership, resilience and exit arrangements 10%.

Mandatory requirements

• Bids failing a mandatory requirement may be regarded as non-responsive and excluded from functionality evaluation.
• Shortlisted bidders may be required to make a detailed presentation to the Adjudication Committee with at least two days' notice.

Solution and delivery model

• Configurable commercial off-the-shelf (COTS) or established low-code platform delivered as Software-as-a-Service (SaaS).
• Cloud-hosted SaaS with logical segregation of NCR data and separate environments for development/configuration, test/UAT and production.
• Greenfield custom development of core functionality is not acceptable; changes to vendor core source code are not permitted.

Availability and security

• Minimum 99.5% monthly service availability, excluding agreed maintenance windows.
• Single sign-on with the NCR identity provider and multi-factor authentication for all internal users.
• Role-based access control at module, action and record level; least privilege and separation of duties.
• POPIA-aligned processing, consent and access controls; disclosure of hosting locations, sub-processors and cross-border transfers.
• Documented information-security management approach; independent assurance such as ISO/IEC 27001 or SOC 2 Type II; annual independent penetration testing.
• Encryption of NCR data in transit and at rest using current industry-standard cryptography.
• Daily or better backups and documented disaster recovery with committed RPO and RTO.
• Tamper-evident audit logs for material user and system actions, searchable and exportable by authorised NCR users.
• Configurable record retention and disposal rules aligned to the NCR file plan.
• Public-facing portal must be mobile responsive and target WCAG 2.1 AA accessibility.

Integrations

• Two-way integration with the NCR Financial System using documented and secure APIs for sales orders, invoicing and payment/receipt status.
• Integration with a South African payment gateway supporting card, EFT and/or instant EFT.
• Integration with NCR identity services for single sign-on and multi-factor authentication.
• Integration with email and SMS notification services.
• Secure publishing mechanism for the NCR website and public register.
• Documented standards-based REST APIs for future integration and controlled data export.

Data migration

• Migration of agreed legacy records, active and historical registrations, payment history, documents, open applications and open complaints or cases.
• Data profiling, cleansing support, mapping, de-duplication, trial migrations, reconciliation and exception management.
• Defined cut-over strategy, rollback provisions and NCR sign-off before production migration.

MVP and implementation

• Production-usable MVP accepted by NCR no later than the end of Month 6 from project commencement.
• Twelve mandatory MVP requirements covering secure SaaS environment, entity master, applicant portal, screening, workflows, approvals, registration lifecycle, public register, notifications, audit trail, data migration and UAT/training.
• Phased implementation: mobilisation and design (weeks 1-4), MVP build and configuration (months 1-4), MVP integration, UAT and production go-live (months 4-6), post-MVP full-scope implementation (from month 7), full go-live and transition, and three months of hypercare.

Functional modules

• Twelve integrated modules: entity and account management; applicant self-service; automated submission screening; pricing, payment and financial integration; administrative screening and work management; application review and approval; advisory committee management; registration and certificate lifecycle; public register and verification; complaints, investigations and enforcement; activity timeline and audit; reporting and analytics.

Training and support

• Role-based end-user training, train-the-trainer sessions, user guides and recorded content.
• Structured skills transfer enabling NCR administrators to manage users, roles, fee tables, templates, reports and simple workflow changes without routine vendor intervention.
• Local South African first-line support during NCR business hours with defined escalation.
• Vendor-managed platform upgrades, security patches and corrective maintenance included in the subscription or support service.

Implementation approach

• The service provider must propose, supply, configure, implement, test, evidence, operate, monitor, maintain and continuously improve proportionate security and privacy measures throughout the full service lifecycle.
• Security must be embedded in the solution architecture, implementation methodology, project plan, resourcing, pricing, risk approach, testing, acceptance, support, subcontractor management and exit arrangements.
• Configuration over custom development: core functionality must be delivered primarily through standard product capability and configuration.
• One integrated regulatory platform: separate business modules must operate on common entity, document, workflow, timeline and audit foundations.
• MVP first: the implementation must prioritise a usable end-to-end registration and verification service acceptable for production use by the end of Month 6.

Phased implementation plan

• Mobilisation and design (weeks 1-4): project mobilisation, confirmed scope and backlog, solution design, configuration catalogue, integration and migration design, security plan, and detailed delivery and acceptance plans.
• MVP build and configuration (months 1-4): configure the priority end-to-end registration service, MVP integrations, trial migration, technical testing, training preparation and change or adoption activities.
• MVP integration, UAT and production go-live (months 4-6): complete integration testing, migration rehearsal, user acceptance testing, remediation, production cut-over and NCR acceptance. The MVP must be accepted no later than the end of Month 6.
• Post-MVP full-scope implementation (from month 7): complete remaining contracted modules and capabilities, including complaints and disciplinary management, committee workflows and advanced reporting.
• Full go-live and transition: full-scope UAT and sign-off, final production release, remaining migration, knowledge transfer and transition to support.
• Hypercare (3 months after full go-live): enhanced support, defect remediation, adoption monitoring, performance review and operational stabilisation.

Bidding constraints

• Bidders may propose a faster delivery plan but may not move the MVP milestone beyond the end of Month 6 without explicit NCR approval.
• Post-MVP milestones must be clearly defined in the bidder's project plan and may not be changed without formal change control once approved by NCR.
• Delays attributable to supplier resourcing, product readiness or subcontractors do not constitute grounds for automatic milestone extension.

Key project team

• Bidders must identify proposed key personnel and provide CVs demonstrating relevant qualifications, platform experience and comparable delivery experience.
• The team must cover, at minimum: Project Manager, Solution Architect, Business/Process Analysis, Configuration Lead, Integration Lead, Data Migration Lead, Testing/Quality Lead, Security Lead and Training/Change Lead.
• One person may cover more than one role only where the bidder demonstrates that delivery capacity and segregation of responsibilities will not be compromised.

Solution maturity and references

• The proposed platform must be commercially available or established and already in live production or implementation at a minimum of three reference sites.
• At least two reference sites must be regulatory, oversight, professional or membership bodies with materially comparable processes.
• Bidders must submit signed reference letters or independently verifiable client references showing modules, go-live or implementation status and contact details.

Testing and acceptance

• MVP acceptance gate: all MVP requirements must be linked to tested configurations and accepted by NCR business and ICT representatives.
• User acceptance testing must be completed against approved test scenarios, with NCR issuing written acceptance or conditional acceptance that does not prevent safe production use.
• No open Severity 1 or Severity 2 defect may exist at go-live; lower-severity accepted defects must have agreed remediation dates.
• Production identity and access controls, logging, backups and recovery arrangements must be active and evidenced before go-live.
• All security measures committed in the proposal and required by NCR must be implemented and evidenced; security testing and remediation must be complete with no open critical or high-risk vulnerabilities unless NCR has formally accepted the residual risk in writing.
• MVP integrations required for live processing must successfully complete agreed end-to-end tests.
• Priority migrated data must be reconciled to agreed totals or controls and signed off by NCR.

Quality documentation

• The service provider must maintain a test/defect register and a change register.
• A testing and quality pack (D8) must be delivered per release, including test strategy and scripts, results, defect register, NCR UAT sign-off and security evidence.
• Security evidence must cover secure-configuration review, access-control testing, vulnerability scanning, penetration testing where applicable, remediation verification, logging and monitoring validation, and backup or restore testing.
• Weekly implementation status reporting is required through full go-live, covering progress against milestones, budget, risks, issues, dependencies, decisions, resource status and next-period activities.
• All changes to approved scope, schedule or cost must follow formal change control and require NCR approval before implementation.

Pricing currency and basis

• Pricing must be submitted in South African Rand (ZAR), inclusive of VAT unless the bid invitation prescribes otherwise.
• Pricing must enable NCR to establish the total cost of ownership over the maximum contract period of five years.
• Hidden or unquoted mandatory costs will not be accepted.

Cost components

• Annual subscription or licence: state the pricing basis (for example named users, concurrent users, modules, transactions or records) and all platform or environment charges.
• Implementation and configuration: fixed price with a milestone breakdown, including the Month 6 MVP and all subsequent full-scope implementation deliverables.
• Data migration: fixed price by agreed migration scope or wave, including cleansing support, trial migrations and reconciliation.
• Integrations: price each required integration separately, identifying once-off and recurring charges.
• Training and skills transfer: include in pricing.
• Optional modules or services: identify separately; optional pricing must not obscure the price of mandatory scope.

Pricing schedule requirement

• Submit pricing schedules and total cost of ownership for the maximum five-year period, with assumptions and exclusions clearly stated.

No bid security, bond, guarantee, retention amount or payment terms are stated in the document.

Mandatory registration and tax compliance

• Central Supplier Database (CSD) registration: the service provider must be registered on the CSD and submit proof of registration with a vendor number starting with MAAA.
• SARS tax compliance: valid tax compliance status is required, together with written confirmation that SARS may disclose the bidder's tax compliance status on an ongoing basis during the contract tenure.
• CIPC registration: required where the bidder relies on a South African implementation or support partner under MR4.

Returnable forms

• SBD 1 (Invitation to Bid): complete and sign; omission leads to disqualification.
• SBD 4 (Declaration of Interest): complete and sign; omission leads to disqualification.
• SBD 6.1 (Preference Point Claim): submit to claim specific goals points; non-submission results in zero points for specific goals.
• Acceptance of the General Terms and Conditions (Annexure B and B.1 from the NCR website): omission leads to disqualification.

Mandatory bidder and solution requirements (MR1 to MR8)

• MR1: proposed platform must be commercially available and in live production at a minimum of three reference sites, of which at least two are regulatory, oversight, professional or membership bodies with materially comparable processes.
• MR2: core scope must be delivered through standard functionality and configuration on the proposed product or platform; no greenfield custom build.
• MR3: signed commitment to NCR acceptance of a production-usable MVP no later than the end of Month 6, supported by a detailed project plan, resources, dependencies and MVP acceptance approach.
• MR4: bidder must be registered in South Africa or have a South African implementation or support partner accountable for the full contract term; submit CIPC/CSD details and, where applicable, a signed partnership or subcontracting agreement.
• MR5: full support, maintenance, security patching and vendor-managed upgrades for the contract term.
• MR6: comprehensive role-based training and skills transfer with sample materials.
• MR7: complete security and privacy proposal with control matrix mapped to Section 8, solution architecture and data flows, certifications (ISO/IEC 27001 or SOC 2 Type II), recent penetration-test summary, and confirmation that all mandatory security costs are included in the bid price.
• MR8: bidder must meet applicable SARS tax-compliance and Central Supplier Database requirements.

Key personnel

• CVs required for: Project Manager, Solution Architect, Business/Process Analysis, Configuration Lead, Integration Lead, Data Migration Lead, Testing/Quality Lead, Security Lead and Training/Change Lead. One person may cover more than one role only where delivery capacity and segregation of responsibilities are not compromised.

Contract duration

• Initial contract term of three years from the effective date.
• NCR has an option to extend for up to a further two years, subject to satisfactory performance, continued business need, budget availability and applicable governance requirements.

Deliverables and acceptance

• D1: Mobilisation pack and detailed project plan within 10 business days of commencement.
• D2: Solution design and requirements traceability matrix by Month 1.
• D3: MVP configured in test/UAT during months 1-5.
• D4: MVP production release no later than the end of Month 6, subject to all MVP acceptance-gate criteria and NCR acceptance.
• D5: Full configured solution in accordance with the NCR-approved post-MVP implementation plan.
• D6: Data migration and reconciliation; MVP priority set by Month 6, remaining set by full go-live.
• D7: Integrations; MVP-priority integrations by Month 6, remaining by full go-live.
• D8: Testing and quality pack per release.
• D9: Training and adoption pack before each production release.
• D10: Go-live and support readiness pack before each go-live.
• D11: Skills transfer completion report by end of full go-live.
• D12: Monthly service and usage report monthly during the support term.
• D13: Exit and transition pack on expiry, termination or when requested under exit provisions.
• NCR acceptance is in writing and does not waive latent defects, security obligations, data integrity requirements or warranty and support obligations.

Support and service levels

• Local South African first-line support during NCR business hours with defined escalation to specialist or vendor support.
• Vendor-managed platform upgrades, security patches and corrective maintenance included in the subscription or support service.
• Continuous security operations including monitoring, alerting, privileged-access review, vulnerability scanning, patching, incident and breach response, backup verification, periodic recovery testing, annual independent penetration testing and monthly security-status reporting.
• Minimum service availability of 99.5% per calendar month, excluding approved maintenance.
• Service credits and corrective action plans apply to repeated or material service level failures.

Data ownership and exit

• All NCR data, documents, metadata, audit logs and NCR-specific configurations remain the property of NCR.
• NCR must be able to export its data during the contract in documented formats without loss of material meaning or relationships.
• On expiry or termination, the service provider must return all NCR data, documents and audit logs in a documented, non-proprietary format within 30 days or another period agreed in the contract, provide reasonable transition assistance, and certify deletion after NCR confirms successful handover.
• Bidders must disclose whether source-code escrow or equivalent continuity arrangements are available and any associated cost; NCR ownership of vendor core source code is not required.

Governance and change control

• The service provider must appoint a suitably experienced Project Manager as the single accountable delivery lead.
• A joint project governance structure must be established at mobilisation, including project and steering meetings, workstream leads, decision paths, issue and risk escalation, and reporting cadence.
• Weekly implementation status reporting is required through full go-live.
• All changes to approved scope, schedule or cost must follow formal change control and require NCR approval before implementation.
• The service provider remains accountable for subcontractors, platform vendors and implementation partners.

Preference points system

• 80/20 preference points scoring system: 80 points for price and 20 points for specific goals.

Specific goals points

• Black ownership: 81%–100% = 7 points; 51%–80% = 5; 31%–50% = 3; 0%–30% = 1.
• Disability ownership: 50%–100% = 3 points; 30%–49% = 2; 0%–29% = 1.
• Women ownership: 81%–100% = 7 points; 51%–80% = 5; 31%–50% = 3; 0%–30% = 1.
• Youth ownership: 50%–100% = 3 points; 30%–49% = 2; 0%–29% = 1.

Evidence

• Points are awarded only on evidence submitted. Acceptable evidence includes share certificates, ID copies stamped by a commissioner of oaths, sworn affidavits, B-BBEE certificates, proof of disability and CIPC documents.
• Non-submission of the SBD 6.1 Preference Point Claim form results in zero points for specific goals.

Functionality evaluation

• A minimum functionality threshold of 70% is recommended before proceeding to price and preference evaluation.
• Weighting: functional fit 25%; configurability and maintainability 15%; MVP and implementation approach 20%; relevant solution experience 15%; local support and service levels 10%; security, POPIA, data resilience and exit 10%.
• Mandatory requirements MR1 to MR8 are assessed before functionality; failure may render a bid non-responsive.