The U.S. Securities and Exchange Commission (“SEC” or “Commission”) seeks information from Vendors with interest in operating, as a designee of the Commission, the Lost and Stolen Securities Program (“LSSP” or “Program”). Described further herein, the Program provides, as a service to banks, brokers, dealers, and others, the collection and storage of reports of missing, lost, stolen, and counterfeit securities in order to make available information about these securities.

Section1. Background.  Section 17(f)(1) was enacted by Congress in 1975 as part of the Securities Exchange Acts Amendments to the Securities Exchange Act of 1934. Section 17(f)(1) and SEC Rule 17f-1  thereunder established  a program to curtail the existing trafficking in lost, stolen, missing, and counterfeit securities (the LSSP). The statute also gave the Commission the option to operate the LSSP itself or to designate another entity for this purpose. To implement Rule 17f-1, the Commission determined that a computer-assisted system should be used and that a non-Government entity should receive, process, and disseminate all information relating to the Program.

Section 2. Purpose. In continuous operations for over 40-years, Thomson Reuters Markets LLC has operated the LSSP at no-costs to the Commission. The designee funds the operations of the LSSP through the collection of fees – as specified in SEC Release 34-15289 – from “Direct Inquirers.” Direct inquirers report to and make inquiries of the LSSP. The other type of LSSP users are “Indirect Inquirers.” These users report certificates to the LSSP; however, they work with direct inquirer users (through agreements outside the scope of the LSSP) to make inquiries. While the LSSP includes two types of users, the fees collected to operate are imposed solely upon direct inquirers.

Fees collected to operate the LSSP:

Fee Type: Volume. Fee Details: The aggregate volume fees shall be the sum of: (a) $___ multiplied by the total sum of the number of certificates reported and the number of certificates inquried upon for each semi-annual period, plus; (b) $___ multiplied by the total sum of the number of certificates subject to Successor Transfer Agency and CUSIP change.

Fee Type: File Maintenance. Fee Details: The aggregate file maintenance fee shall be determined by multiplying the number of reports on the Lost & Stolen table for each semi-annual period by $___ and this portion assessed to each direct inquirer varies according to its size classification and ratio established in Securities Exchange Act Release #34-15289 (November 1, 1978).

Fee Type: Annual Registration. Fee Details: Direct Inquirers are charged a registration fee. The fee is based on the number and type of access stations designated by the direct inquirer on its registration form. For each primary access station, the fee is currently $___, and for each secondary access station the fee is currently $___.

Primary access station: each direct inquirer must have at least one primary access station from which reports and inquiries are made, and these access stations receive LSSP report/inquiry confirmations.

Secondary access station: a location from which a report or inquiry can be submitted to LSSP, but does not receive LSSP confirmations.

LSSP Annual Operating Metrics: The LSSP, as of December 31, 2019, includes the following metrics: (a) Storage of ~26 million certificates reported as lost, stolen, missing, or counterfeit; (b) ~370 direct inquirers registered (note: ~9,500 indirect inquirers); and (c) 300,000 certificates reported as lost, stolen, missing, or counterfeit.

The purpose of this Request for Information is to seek Vendors interested in providing, described further herein, the following services:

1. Operate the LSSP, as a designee of the Commission, with funding from industry in reasonable financial operating conditions.
2. Transition existing users to a new solution with minimum disruption to the 40+ years of continuous operations of the LSSP.
3. Transition-in LSSP data, including reported data, inquiry history, billing, user, and other administrative and system log information necessary to continuously operate the LSSP.
4. Design, develop, and release a technical solution that facilitates the receiving reports/inquiries on lost, stolen, missing, or counterfeit securities, processing of them in connection with the Program’s purpose, and relaying of response details on reports/inquiries details back to users.
5. Design, develop, and release a technical solution to facilitate registration, billing, and other LSSP administrative processes.
6. Design, develop, and release a technical solution for a public facing website for the LSSP
7. Transition-out LSSP data to a new Vendor at the end of potential contracting period.

Section 3. Potential Program Services. The SEC seeks information from potential vendors on the following LSSP program services:

• Allow industry members to submit requests for registration, both initial and amendments to, as direct inquirers or indirect inquire users of the LSSSP systems in order to submit reports and inquires on lost, stolen, missing, or counterfeit securities, which includes obtaining, from the Depository Trust & Clearing Corporation (“DTCC”), a Financial Industry Number Standard (“FINS”) number.
• Allow direct inquirer and indirect inquirer users to submit reports of lost, stolen, missing, or counterfeit securities in using Form x-17f-1a as required by SEC Rule 17f-1 in order for them to be stored by a system that allows users to inquire about them.
• Provide continuous monitoring of reported CUSIPs (i.e., subscribing to the Depository Trust Company (“DTC”) data feed) for changes occurring from industry changes and update the reported securities database to reflect these changes.
• Allow direct inquirer users to submit inquires, by entering the CUSIP and certificate number, on securities (individually, in multiples, or as a range) reported lost, stolen, missing, or counterfeit in order to view matches to securities reported lost, stolen, missing, or counterfeit by entering the CUSIP and certificate number, which may also include, for more specific searches, entering the prefix, shares, and issue date of the certificates.
• Allow direct inquirer user to view the results of inquiries into securities reported lost, stolen, missing, or counterfeit in order to see if there is (a) no-match between the securities searched and the securities reported; (b) match between the CUSIP and certificate searched with securities reported; and (c) match between the CUPIS, certificate entered, prefix, share, and issue date searched with securities reported.
• Provide continuous checking (i.e., daily) of user inquires against the databased of reported securities for a month after inquiry submission.
• Allow direct inquirer users to view a historical list of inquiries submitted, including the status of those inquiries (i.e., open or closed) and matching disposition.
• Allow direct inquirer users with a match between securities searched and securities reported to view information about the reporting institution in order to contact them about the lost, stolen, missing, or counterfeit security.
• Allow direct inquirer and indirect inquirer users to submit, and receive system confirmations of, reports and inquiries – direct inquirer users only – on a secure web interface or through secure web services.
• Allow administrative users to access-levels to support direct inquiry and indirect inquiry users on LSSP web browser interface or using web services.
• Provide system monitoring in order to determine the billing of LSSP users, and to use this monitoring to facilitate LSSP billing and collections.
• Provide a certified (i.e., by Certificate Authority) public web interface for the public to view information about the LSSP, registration, billing, and general LSSP questions.
• Provide support to LSSP registration, users, and general industry inquires on LSSP during, at a minimum, a 8:00 am to 5:00 pm day when the national securities markets are open.
• Provide operational reporting to the SEC which could include users, activity, and other metrics
• Secure system and government data in compliance with Federal Information Security Management Act (“FISMA”) low level control requirements.
• Obtain an SEC Security Authority to Operate.
• Operate in compliance with, and comply with security audits of, applicable Federal government requirements for security.
• Facilitate the transition of data, and LSSP program knowledge, from the legacy LSSP Vendor, including reported securities, inquiries submitted, users, registration and billing data, and other data necessary to continuously operate the LSSP.

Section 4. Program Transition. The Commission will require a transition period to complete an orderly transition, from the Incumbent Vendor to the Successor Vendor, of the LSSP database, including all necessary data, files, forms and other documentation. During the transition period, the Incumbent Vendor will continue to support, in general, the services described in Section 3.0 Potential Program Services section of this RFI while working in good faith to correct any deficiencies cited by the Commission during the transition period. The Incumbent Vendor will also act in good faith, and use its best efforts, to facilitate a smooth transition to the Future Vendor. At the completion of the transition period, the Incumbent Vendor will no longer operate the LSSP; in particular, the Incumbent Vendor will no longer collect fees to operate it.

Transition Costs: The Incumbent Vendor is responsible for its costs related to the transition.

Transition Activities: In general, transition activities will include the following:

1. A transition meeting between the Incumbent Vendor, Successor Vendor, and Commission Staff, convened by the LSSP Contracting Officer, with the goal to finalize outstanding technical and logistical issues involved in the transitioning of LSSP operations in a timely manner and without disruption to current subscribers. During the transition meeting, the parties shall work out an effective and efficient method for data transfer that enable the Successor Vendor to initially build a test database and subsequently evolve it to, using an acceptable data transfer mode to move data from the Incumbent Vendor’s database, a database that can simulate active live processes.
2. Transition activities consist of the Incumbent Vendor providing the Successor Vendor with required LSSP documentation, transferring related data from the Incumbent Vendor to the Successor Vendor, and the Incumbent Vendor providing support following data transitions. The Commission will, within thirty (30) days from the start of the transition period, provide the Incumbent and Successor Vendors with a transition schedule.
3. The Successor Vendor is responsible for transferring all current and historical data obtained by the Incumbent Vendor. The Successor Vendor shall transfer the existing database to its own systems during the transition period.
4. The Incumbent Vendor shall provide the Successor Vendor with the following: (a) the data from the database; (b) data from the subscriber file; (c) data from the audit file; (d) the X-17F-1A hard copy forms; (e) registration hardcopy forms; (f) all related microfiche records of the aforementioned data; and (g) a description of the database records consisting of field names, lengths, and data types. 
5. The Incumbent Vendor shall provide sufficient non-proprietary system documentation to adequately describe data types and structures, record formats, file designs, and database organization to facilitate an orderly transfer of all system data. This shall include, but may not be limited to, the Incumbent Vendor providing the following data, forms, records, and documentation in order to facilitate transfer of the system: (a) data: data from the database; data from the subscriber file; data from the audit file; (b) forms: X-17F-1A hard copy forms; registration hardcopy forms; and (c) records: all related microfiche records of the aforementioned data; a description of the database records consisting of field names, lengths, and data types.

6. During the transition period, the Incumbent Vendor shall work out an effective and efficient method for data transfer to initially build a test database, and subsequently evolve to an acceptable data transfer mode to enable creation of a database that can simulate active live processes.

7. Sixty (60) days prior to the expiration of the contract, the Incumbent Vendor shall request in writing disposition instruction of material and all other LSSP related information.

Section 5. Financial Requirements. The Contractor shall have the financial resources to meet the contract's startup costs and the ongoing costs and the other contingent costs and operating losses that may arise due to fluctuations in usage, inability to collect fees, inadequacies in its fee structure, or losses due to other causes (e.g., obligations relating to the Contractor’s own contractual liabilities or lawsuits involving negligence or other misconduct on the part of the Contractor). The importance of this contract to the public interest requires such precautions.

Section 6. RFI Disclaimer. This is a Request for Information (RFI), as defined in Federal Acquisition Regulation (FAR) 15.201 (e). The SEC is issuing this RFI in an effort to understand market availability of vendors interested in this program and their technical capabilities to perform these requirements.

Please note that this is for INFORMATIONAL and PLANNING purposes only and does not constitute a Request for Proposal (RFP). Responses to this RFI will not be accepted by the Government to form a binding contract. The Government will not pay for the information solicited or recognize any costs associated with the submission of the RFI. The purpose of this RFI is to provide an opportunity for industry to enhance the success of any future procurement to meet this requirement. Any information obtained as a result of this RFI is intended to be used by the Government for program planning and acquisition strategy development. A determination by the Government not to issue a solicitation based upon responses to this notice is solely within the discretion of the Government.  The SEC reserves the right to use any and all information submitted by, or obtained from, an interested firm in any manner the SEC determines is appropriate, including, but not limited to, the creation of a competitive solicitation. An interested party should avoid including any classified, business confidential, and/or proprietary information in its response.  If an interested firm must submit such information, however, the information must be clearly marked, and the interested firm must provide sufficient justification as to why such information is business confidential and/or proprietary.  The SEC will review the information and safeguard it appropriately.

Section 7. How to Respond. What to Provide: Firms that wish to respond to this RFI shall provide the following information: 1. Provide your firm’s capability statement and briefly describe your experience with the services described above or similar services; 2. Provide your firm’s social economic size/status; and 3. Briefly describe your understanding of the services requested.

Where to Send Questions: Questions regarding this RFI may be submitted by email to Julia Gallmon at [email protected] Kathleen Ferte at [email protected] by 4:00 p.m. EST, April 17, 2020.

Respondents shall also include the following information in their response: 1. Company Name; 2. Company Address; 3. Company Website; 4. Company Telephone Number; and 5. Point of Contact (POC) for this RFI (please include telephone numbers and email addresses).

Timeframe to Respond: Please submit responses via email to Kathleen Ferte at [email protected] and Julia Gallmon at [email protected] in by 4p.m. EST on May 1, 2020. File size should be not exceed 10MB. In addition, response shall be submitted in Word documents with 8.5” x 11” margins, double spaced, and not exceed 10-pages in length.