Inactive

SOURCES SOUGHT NOTICE Reference/Notice Number: SS-FIN-24-028 Project Title / Short Description: The Financial Crimes Enforcement Network (FinCEN), Title 31 Population Identification and Risk Scoring P... SOURCES SOUGHT NOTICE Reference/Notice Number: SS-FIN-24-028 Project Title / Short Description: The Financial Crimes Enforcement Network (FinCEN), Title 31 Population Identification and Risk Scoring Project (T31 Repository) Support Services The Government requires contractors possessing the technical capabilities to assist with a broad range of activities pertaining to the analysis, implementation, and operation of the T31 Repository. The contractor shall possess the capabilities: Research and gather data on all financial institutions and non-financial trades or businesses regulated under 31 CFR Chapter X (collectively, “T31 institutions”). Standardize and clean collected metadata and automate collection. Conduct exploratory data analysis to identify trends and patterns in the data. Analyze data to provide insight in determining different strategies to conduct the necessary risk analysis to identify entities’ potential non-compliance with the BSA. Assign a risk score to each of the T31 institutions. Create a Tool that will give users ability to interact and visualize data. Maintain and update the T31 Repository. Provide support using project/program management best practices. PSC code: DH01 IT and Telecom - Platform Support Services: Database, Mainframe, Middleware (labor) NAICS Code: 541511 Custom Computer Programming Services Release Date: November 15, 2023 Response Date: December 14, 2023 Primary Point of Contact: MW/MH Contact Information for Primary Point of Contact: Purchasing@fiscal.treasury.gov Description The Bureau of the Fiscal Service Division of Procurement Services, on behalf of the Financial Crimes Enforcement Network (FinCEN) is seeking small business vendors capable of providing Title 31 Population Identification and Risk Scoring Project (T31 Repository) Support Services. This is a Small Business Sources Sought notice (hereinafter Notice). This is NOT a solicitation for proposals, proposal abstracts, request for bids or quotations, nor a promise to issue a solicitation in the future. The purpose of this notice is to obtain information regarding the availability and capability of qualified small business sources (e.g. HUBZone small business; service-disabled veteran-owned small business (SDVOSB); 8(a) small business; veteran-owned small business; woman-owned small business (WOSB), including economically disadvantaged women-owned small business (EDWOSB) or small disadvantaged business concerns) for this potential requirement. Additionally, to assist the Government in determining whether or not a set-aside is possible. To qualify as a small business the NAICS code for this Sources Sought Notice is 541511 Custom Computer Programming Services with a size standard of $34M. An organization that is not considered a small business under the applicable NAICS code should not submit a response to this Notice. However, if a vendor feels that another NAICS code is more appropriate, please discuss that in your response. Requirement Background FinCEN’s implementing regulations are codified under Title 31 “Money and Finance: Treasury” of the Code of Federal Regulations (CFR). More specifically, FinCEN’s implementing regulations are contained in Chapter X “Financial Crimes Enforcement Network, Department of the Treasury.” The Government has interest in, and is seeking, small business vendors capable of providing Title 31 Population Identification and Risk Scoring Project (T31 Repository) support services. The T31 Repository will create the first repository containing all entities subject to FinCEN’s regulations under 31 CFR Chapter X (T31 Population), currently estimated at approximately 350,000 entities, design and implement a risk scoring methodology, and assign a risk score to each entity. The T31 Repository will serve as a dynamic source for the T31 population and associated risks. The T31 Population contained in the Repository will be continually updated as the source data for the population is updated. The risk score will be regulatory updated based on information from these data sources, as well as incorporating data from feedback loops. The T31 Repository will also include either: (1) a web-based application for users to view and create reports or (2) a series of standard reports for end-users, as well as a methodology for creating additional reports on demand for end users. The application, or back-end reports, will enable end users to perform tasks relevant to their job functions, such as examination case selection, stakeholder support, or Paperwork Reduction Act regulatory reporting renewal. 3.0 Tasks 3.1 Project Plan and Strategy The Contractor shall possess the capabilities to develop a coherent set of program activities designed to achieve the goals and objectives of the T31 Repository, using the phases and steps outlined herein as a guideline. This task shall assist in establishing the focus areas, objectives, milestones, timeframes, change management, and key performance indicators (KPIs) needed to successfully implement and manage the T31 Repository. The Project Plan and Strategy should include, but is not limited to: Gathering business and technical information through research and discussions with domestic and international regulatory partners, financial institutions, law enforcement, and other relevant entities in furtherance of evaluation and determination of T31 Repository requirements and best practices. Assisting in the evaluation and validation of business and technical requirements for the T31 Repository. Drafting for review a full-lifecycle implementation approach and operational strategy, to include timing, for the T31 Repository, including but not limited to business model, methodology, risk management, implementation milestone plan, user manuals, and standard operating procedures. Drafting for review and maintain a project plan for the T31 Repository. The project plan shall include, at minimum, a phased approach to completing all steps in the phased approach outlined in Section 3.0 “Tasks.” Drafting for review key performance indicators (KPIs) for each step of the T31 Repository, including those steps in the phased approach outlined in Section 3.0 “Tasks.” Drafting for review a Change Management Plan for the T31 Repository. The Change Management Plan shall include the approach to change during the project lifecycle (e.g., changes in approach, direction, staffing, etc.). Assisting in preparing meetings, briefings, reporting, etc. in support of this task. The contractor shall possess the capabilities to perform the following tasks during the phases identified below. The phases and steps below provide a general outline on the creation of the T31 Repository. Note: It is likely that the phases, and steps, will overlap with regard to timing and design, to some degree. T31 Repository Design Process 3.2 Phase 1: Identify and Clean Data; Populate Repository; Identify and Assign Risk Step 1: T31 Population Identification The contractor shall possess the capabilities to: Identify each entity subject to FinCEN’s regulations under 31 CFR Chapter X (T31 Population). This is currently estimated at approximately 350,000 entities. Identify existing data sources (e.g., Nationwide Multistate Licensing System & Registry (NMLS), FFIEC Central Data Repository’s Public Data Distribution). Identify data sources for entities (e.g., dealers in precious metals, precious stones, or jewels) which do not have a federal or state registration requirement (for example, Application Programming Interface (API) or public sources/subscription data). Work with the Government to negotiate and obtain access to relevant data sources. Step 2: Populate/Feed T31 Repository The contractor shall possess the capabilities to: Create a Repository to contain, maintain, and update the T31 Population. Standardize and clean collected metadata and automating collection. Create pipelines from outside data sources, to ingest into the Repository. Clean and standardize the data from the original data sources. Conduct entity resolution, particularly in cases in which there are multiple sources of data for a single entity or entity type (for example, FFIEC Central Data Repository and Bank Secrecy Act data exists for depository institutions). Develop a data strategy. The data strategy will be a coherent set of data management activities designed to ensure T31 Repository data is error-free and able to serve its intended purpose. This task shall assist to optimize the use of data to support decision making and actions that maximize the benefit to the T31 Repository. The data strategy will include, but is not limited to: Identifying internal and external data sources to support T31 Repository data requirements (e.g., BSA data, API data, Nationwide Multistate Licensing System (NMLS) data, FFIEC Central Data Repository). Identifying system(s) and methods to capture, store, maintain, and update data population. Ensuring the data quality (e.g. accurate, up-to-date, complete, trusted by stakeholders, etc.) for the T31 Repository data population. Using technical skills (e.g. Python, unstructured/structured data, and SQL/NoSQL databases, etc.) to create data pipelines to extract data from the raw source and incorporate it into the data pipeline. Drafting for review a data management approach for the T31 Repository, including but not limited to the identification, ETL (extract/transform/load), data integration, quality assurance, metrics, and change management for the T31 Repository. Drafting for review data management and data quality metrics, and standard reports for the T31 Repository. Drafting for review data management standard operating procedures. Assisting in preparing meetings, briefings, reporting, etc. in support of this task. Step 3: Identify Risk Factors, Design Risk Scoring Methodology, and Risk Score T31 Population: For the purpose of scoring each entity (currently estimated as approximately 350,000 entities) in the T31 Population contained in the T31 Repository, the contractor shall identify AML/BSA risk factors, design risk scoring methodology based on the risk factors identified and score each entity in the T31 Population. Develop a Risk Strategy and Approach. The Contractor shall evaluate and determine a common understanding of AML/BSA compliance risk across the T31 population for both registered and unregistered entities. Among other things, this task shall assist in maximizing the use of a limited number of examiners through the development of a comprehensive risk identification, scoring, and management (to include updates and maintenance) approach for the T31 Repository including, but not limited to: risk identification; risk assessment, scoring, and assignment; risk prioritization; risk management; risk analytics; and feedback loops. The Risk Strategy and Approach will include, but is not limited to: Interviewing internal and external sources with regard to best practices in identifying potential risk factors and risk scoring methodologies (for example, FinCEN subject matter experts (SMEs), financial institutions, domestic and international AML/BSA regulators such as the Federal Reserve and FINTRAC). Using the interviews and data sources identified in Step 1, among other sources, to identify relevant risk factors for identifying BSA/AML risk. Gathering and cleaning risk factor data (for example, asset size, geography, transaction churn, product type). Conducting exploratory data analysis to identify trends and patterns in the data. Determining different strategies to conduct the necessary risk analysis to identify entities that are not compliant with the BSA (e.g., conduct risk analysis on money services businesses (MSBs) within specific geographical area). Developing a scoring system to calculate risk score for each entity in the T31 population. Assigning a risk score to each entity in the T31 Repository, to be maintained and updated within the T31 Repository. Drafting for review standard operating procedures for the factors involved (e.g., risk scoring and metrics) in the risk strategy and approach for the T31 Repository. Drafting for review comprehensive user manuals for all aspects of the T31 Repository. Drafting for review a plan for ongoing maintenance and updates, to be conducted on a both a cyclical and ad hoc basis. Assisting in preparing meetings, briefings, reporting etc. in support of this task. 3.3 Process Improvement Throughout the creation and ongoing implementation of the T31 Repository, the Contractor shall monitor and evaluate T31 Repository processes to identify, analyze and address inefficiencies and opportunities for improvement (e.g. bottlenecks, updated mission priorities, etc.) and to implement new changes. This task shall assist in improving the efficiency and quality of processes for the T31 Repository including, but not limited to, business alignment, mission priorities, data quality, risk management, and change management. The Process Improvement will include, but is not limited to: Reviewing existing business and technical processes and their current role in the T31 Repository. Identifying broken and inefficient processes and draft for review recommendations to eliminate them or define how they could better align with T31 Repository. Defining and drafting for review how improved processes might add value to the T31 Repository. Drafting for review a process improvement methodology for the T31 Repository. Assisting in preparing meetings, briefings, reporting etc. in support of this task. 3.4 Phase 2: Build User Interface or Reporting System (T31 Repository Tool) Step 4: Create Tool (Web-Based Application or Back-end Reporting System) The contractor shall possess the capabilities to create a Web-Based Application Tool or Back-End Reporting System Tool. The contractor shall create a system for end users to use the information contained in T31 Repository to support and improve their job functions. In order for end-users to interact with the data and risk information contained in the T31 Repository, the contractor shall design and construct a tool to facilitate this process. The T31 Repository Tool is dependent upon the technological feasibility at FinCEN throughout the performance period. The T31 Repository may be developed by the contractor using one of the methods below, with the concurrence of the Government. The Contracting Officer’s Representative will notify the contractor to confirm available and approved technologies at FinCEN. Method 1 – Web-Based Application Tool The contractor shall create a web-based application that will give users ability to interact with, explore, and visualize T31 Repository data. The contractor shall: Work closely with FinCEN technical experts (e.g., data engineer, data scientist, etc.) to ensure that the data transformations and data models are incorporated into an automated data pipeline that will be fed into an application. Work closely with FinCEN business experts (e.g. BSA/AML subject matter expert, business users, etc.) to ensure that the data transformations and data models are incorporated into an automated data pipeline that will be fed into an application. Develop an application/tool to provide the user the ability to explore the data. The user capabilities shall include: Gain insight on certain higher risk T31 entities filtered by specific industries and locations based on the models created by the BSA expert and data scientist. Gain insight on pedigree information (that may not be actively used in a model) on T31 entities to help support investigations (e.g., identify financial institution EINs, branches, or other data has been collected during the data integration process in Step 2). Explore and evaluate options regarding capabilities for using the application/tool on various device types. Ensure user requirements are incorporated into the application. The contractor shall survey stakeholders (within FinCEN and possibly external) on how they would like to use this application. Design, launch, and manage a flexible (e.g. ability to edit/update; ability to function across multiple web browsers; potential accessibility by FinCEN and non-FinCEN users) web-based application. Ensure application is accurate, error-free, and complete. Draft for review application standard operating procedures. Draft for review application user manual. Draft for review a plan for ongoing maintenance and updates, to be conducted on both a cyclical and ad hoc basis. Assist in preparing meetings, briefings, reports, etc. in support of this task. Method 2 – Back-End Reporting System Tool The contractor shall develop and execute a series of standard reports for end-users, as well as a methodology for creating additional reports on demand. The contractor shall: Develop a series of reports and developing a methodology for creating reports upon request. The function of the reports will include, but are not limited to: Gaining insight on certain higher risk T31 entities filtered by specific industries and locations based on the models created by the BSA expert and data scientist. Gaining insight on pedigree information (that may not be actively used in a model) on T31 entities to help support investigations (e.g., identify financial institution EINs, branches, or other data has been collected during the data integration process in Step 2 of Section 2.0 Overview and Scope). Ensure user requirements are incorporated in the reports. The contractor shall survey stakeholders (within FinCEN and possibly external) on how they would like to use these reports. Ensure reports and reporting methodology is accurate, error-free, and complete. Draft for review standard operating procedures. Draft for review user manual. Assist in preparing meetings, briefings, reports, etc. in support of this task. 3.5 Phase 3 – Step 5: Maintain and Update - The contractor shall continually update and maintain the T31 Repository. The contractor shall: Monitor effectiveness and update the T31 Repository data sources, intake, and output on both a cyclical and ad hoc basis. Conduct interviews of users and other stakeholders regarding effectiveness and needs on both a cyclical and ad hoc basis. Update methodologies (e.g., risk factors, risk scoring, etc.) on both a cyclical and ad hoc basis. Update user manuals on both a cyclical and ad hoc basis. Update the T31 Repository using feedback loops (e.g., fine tune the risk model and assessment with exam findings and changes in risk measures (e.g., changes in size/profile of institutions). Security Requirement: The Contractor Company must possess a minimum of a final Secret facility clearance (FCL) at the time of award. All contractor personnel supporting this contract must possess a minimum of a final Secret personnel security clearance. Interim clearances of any type will not be accepted. Key Personnel Labor Categories and Minimum Qualifications: Program Manager shall be responsible for ensuring satisfactory performance of all services on a day-to-day basis and shall be available to address any performance issues. Also includes: 3+ years of experience directly related to managing or performing responsibilities similar to those described herein. Coaching, leadership skills, time management, facilitation, and organizational skills. Interpersonal, customer service, problem-solving, verbal, and written communication skills, and conflict resolution skills. Must be proficient with Microsoft Office (Word, Excel) (Experience using MS Sharepoint and Dynamics). Familiarity and understanding of the Scrum framework, including roles, events, and artifacts. Experience in applying Scrum principles to software development or project management is a plus. Data Engineer (Back-End) shall include a minimum of three years of Back-End Development experience creating components and features on the server-side, indirectly accessed by a user through a front-end application or system. Also includes: Experience with full-lifecycle web application methodology. Experience creating, maintaining, testing, and debugging the entire back-end application or system. Experience working with relational databases such as SQL Server, Oracle SQL, PostgreSQL Strong technical and coding skills using Python and object-oriented programming. Experience developing data pipelines. Experience analyzing, transforming and querying large datasets. Problem solving skills. Experience working closely with Agile software development teams. Ability to technically write concisely and clearly with minimal editing required (e.g. technical manuals, standard operating procedures, etc.) Data Engineer (Front-End) shall include a minimum of three years of Front-End Development experience planning, designing, building, and implementing the user interface systems of websites, software programs, and web-based applications. Also includes: Experience with full-lifecycle web application methodology. Experience using modern technologies for development frameworks (e.g. Flask, Django, NodeJS). Experience creating, maintaining, testing, and debugging the entire front-end application or system. 3+ years’ experience building a web application using JavaScript, HTML and CSS or other higher level JavaScript libraries (e.g. React, Angular, etc.) Experience using data visualization tools in Python and JavaScript (e.g. D3js, ChartJS, Matplotlib, Seaborn, etc.) Experience designing and implementing User Interface (UI) and User Experience (UX) Strong understanding of the software development life cycle Experience transforming large and complex datasets to impactful visualizations. Experience working closely with Agile software development teams. Strong software testing skills Problem solving skills. Ability to technically write concisely and clearly with minimal editing required (e.g. user manuals, standard operating procedures, etc.) Ability to work closely with a multi-disciplinary team (e.g. developers, subject matter experts, business users, project managers, etc.) Ability to work directly with business users and subject matter experts to understand business needs and turn them into technical reality. Experience architecting intuitive and interactive front-end systems that drive complex web applications. Data Scientist shall include a minimum of three years of experience cleaning and transforming complex and messy data and developing machine learning models to deliver key insights to customers. Also includes: Experience with full-lifecycle web application methodology. 3+ years’ experience in Python using machine learning. Experience with Python machine learning libraries (scikit-learn, keras, TensorFlow, PyTorch, XGBoost) Experience using machine learning models for anomaly detection. Experience working closely with Agile software development teams. Experience using Natural Language Processing (NLP) techniques, as well as NLP libraries in Python (NLTK, gensim) Experience with data visualization libraries in Python or Javascript. Bachelor’s or master’s degree in STEM is desirable. Business Data Analyst (AML Support) shall include a minimum of three years Bank Secrecy Act / Anti-Money Laundering (BSA/AML) or other regulatory or compliance experience. Also includes: Experience with full-lifecycle web application methodology. Knowledge of Bank Secrecy Act or similar regulations and how these regulations are implemented by regulated institutions. Knowledge or experience in the analysis of compliance programs and the ability to identify instances of non-compliance. Experience with identifying solutions and presenting options to get the result for the client. Knowledge or experience in conducting investigations, examinations, or audits of financial institutions. Knowledge or experience in investigating and documenting instances of non-compliance by financial institutions. Knowledge or experience in the analysis of people, activities, methods or trends, including money laundering, financial crime or other illicit activities. Ability to provide dedicated Bank Secrecy Act / Anti-Money Laundering (BSA/AML) subject matter expertise to the T31 Repository data scientist/engineer(s) Excellent communicator with superb written and spoken communication skills. Excellent ability to intermediate/bridge the gap between the user/business community and the technical development team(s) Problem solving skills. Customer service oriented Ability to write concisely and clearly with minimal editing required (e.g. requirements, presentations, etc.) Place of Contract Performance: The Contractor will perform most duties at the FinCEN Washington, DC and Vienna, VA locations. Remote work (e.g. Contractor's location) may be permitted with the approval of the Contracting Officer’s Representative. Additionally, the Contractor’s location must be within the DC Metropolitan area so the Contractor can attend onsite meetings at the FinCEN location(s). INSTRUCTIONS TO PROSPECTIVE RESPONDENTS: Interested firms are asked to provide the following in their response to this Sources Sought Notice: The Name, location, Unique Entity Identifier (UEI), and point-of-contractor information for the respondent’s firm. Information regarding respondent’s: (a) in-house staff expertise and their availability, experience, and formal/other training for each labor category; (b) current in-house capability and capacity to perform the work; (c) prior completed projects of similar nature; (d) corporate experience and management capability; and (e) examples of prior completed Government contracts, references, and other related information. A brief response including a description of the respondent’s firm’s standard line of business and relative experience as well as an example of one previous government project performed by the respondent’s firm of similar or comparable size and complexity. Graphs/charts are acceptable to include in the response. The respondent’s firm business size under 541511 Custom Computer Programming Services with a size standard of $34M. If your firm holds any Government Wide Acquisition Vehicle (GWAC) or GSA Schedule Contracts, that information shall be included in the submission of your capability statement. Any other information that may be helpful. Vendor’s technical and administrative points of contact, including names, titles, addresses, telephone and fax numbers, and e-mail addresses. Any questions about this Sources Sought Notice will not be entertained, as a vendor pool is all that is being sought at this time. Questions and Answers will be fielded during the solicitation period in the future. Respondents shall provide their response fully illustrating their ability to meet the PWS requirements to: Purchasing@fiscal.treasury.gov with the subject line stating, SS-FIN-24-028 MW/MH, T31 Repository no later than 10:00am (ET) on December 14, 2023. Submissions after this date will not be considered. Terms and Conditions regarding this Notice: This Notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. All costs associated with responding to this Notice are solely at the responding party's expense. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Further, the Government may contact the vendor for additional information regarding the information submitted as part of this market research effort. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation may be published in the Government Point of Entry or other similar source (GSA e-Buy). However, responses to this notice will not be considered adequate responses to a solicitation. Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract or agreement. The Government will not be obligated to pursue any particular acquisition alternative as a result of this notice. Responses to the notice will not be returned. Not responding to this notice does not preclude participation in any future solicitation, if one is issued. No proprietary, classified, confidential, or sensitive information should be included in responses to this Notice, unless otherwise appropriately marked by the Respondent. The Government reserves the right to use any non-proprietary technical information received in response to this Notice in any resultant solicitation(s). Do Not Submit any Proposals/Offers in response to this Notice