MSUA PURCHASE ORDERS PRESENTED Tuesday, October 1, 2019 VENDOR DESCRIPTION INVENTORY ANIXTER INSULATED CAP (PO#20-00196) 1,330.00 BALDWIN POLE & PILING CO

MSUA PURCHASE ORDERS PRESENTED Tuesday, October 1, 2019 VENDOR DESCRIPTION INVENTORY ANIXTER INSULATED CAP (PO#20-00196) 1,330.00 BALDWIN POLE & PILING CO. 40' CLASS 3 POLES (PO#20-00225) 10,906.00 BORDER STATES 400 WATT METAL HLIDE (PO#20-00344) 3,861.40 BORDER STATES FLOODLIGHT, MOUNT (PO#20-00374) 3,950.00 STUART IRBY COPPER & ALUMINUM WIRE (PO#20-00376) 629.17 UTILITY SUPPLY RISER RINGS (PO#20-00353) 1,374.00 UTILITY SUPPLY TUFF TUBE, MANHOLE EXT. (PO#20-00280) 1,549.00 23,599.57 CUSTOMER SERVICES FUELMAN FUEL USAGE 8/26/19 16.94 KELLY HEADLEE MEAL PERDIEM (PO#20-00351) 24.00 KIM RUNDELL MEAL PERDIEM (PO#20-00350) 24.00 64.94 ADMINISTRATIVE SERVICES MIKE ADDINGTON PERDIEM OMCTFOA (PO#20-00359) 91.00 JILL FITZGIBBON PERDIEM OMCTFOA (PO#20-00360) 105.25 BROOKE TESTERMAN PERDIEM OMCTFOA (PO#20-00358) 105.25 DAVIS WRIGHT TREMAINE PENSACOLA RELICENSING (20-00339) 22,137.50 MAILFINANCE LEASE PAYMENT (PO#20-00389) 1,167.00 MIAMI NEWS RECORD CC PROCESSING AND MERCHANT SERVICES 74.71 OLSSON GENERAL ENGINEERING (PO#20-00162) 10,314.32 33,995.03 METERING FUELMAN FUEL USAGE 8/26-9/9/19 269.27 MATT MOSLEY PERDIEM CLASS (C LICENSE (PO#20-00373) 50.50 OTA TOLL FEES 8/1-8/31/19 14.40 334.17 IT CONTROL SCAN SPG PACKAGE - AIRPORT 34.95 MUNICODE ONLINE CODE HOSTING (PO#20-00375) 700.00 UTILITY METER-READER INTERFACE TYLER TECHNOLOGIES MAINTENANCE (PO#20-00400) 636.70 UNITAS GLOBAL CLOUD BACKUP (PO#20-00342) 2,089.42 3,461.07 ELECTRIC FASTENAL SAFETY GLASSES 129.12 FUELMAN FUEL USAGE 8/26-9/9/19 836.85 WIRING, LIGHTING, POLES, RECEPTACLES (PO#20- HK ELECTRIC 00399) 6,565.32 KARNES PRO TIRE FLAT REPAIR 45.00 LOCKE SUPPLY SOCKET ADAPTER, SCREWDRIVER, BATTERY 211.18 O'REILLY DEF FLUID 19.98 PINKLEY SALES TRAFFIC SIGNAL ASSEMBLY (PO#20-00301) 10,766.40 SIGNAL TEK TRAFFIC SIGNAL REWIRE (PO#20-00303) 12,280.00 SIGNAL TEK LOAD SWITCH, RACK MOUNT (PO#20-00398) 1,227.60 THE COFFEYVILLE JOURNAL 2X6 DISPLAYS 327.00 VANCE FORD RESTRICTOR, TUBE ASSEMBLY, RESTRICTOR 89.53 32,497.98 ROW FUELMAN FUEL USAGE 8/26-9/9/19 284.06 INDEPENDENCE DAILY REPORT 2X6 CLASS DISPLAYS 352.00 LOCKE SUPPLY CHAIN SAW W/ BATTERY 449.00 POWERUP RENTAL SCISSOR LIFT 80.00 1,165.06 WATER PRODUCTION PERDIEM - ENTRY LEVEL (D) WATER OPERATOR ALEXANDER NORTHAM CLASS (PO#20-00322) 55.50 PERDIEM - ENTRY LEVEL (D) WATER OPERATOR JORDAN BUXTON CLASS (PO#20-00321) 55.50 ACCURATE ENVIRONMENTAL WATER SAMPLING 1,061.00 BRENNTAG CHLORINATOR (PO#20-00329) 1,950.00 3,122.00 WATER DISTRIBUTION ACCURATE ENVIRONMENTAL CLASS D WATER CLASS (PO#20-00319) 810.00 ACTION GRAPHICS DOOR HANGERS 259.64 B&L WATERWORKS TAPPING SADDLE 405.36 B&L WATERWORKS PUMP, CAP, PIPE, TAPPING SADDLES 1,432.99 B&L WATERWORKS PLUGS, TEES, VALVES, ANCHOR (PO#20-00270) 4,437.60 PERDIEM - ENTRY LEVEL (D) WATER OPERATOR DECKER TODD CLASS (PO#20-00323) 55.50 FUELMAN FUEL USAGE 8/26-9/9/19 932.02 KARNES PRO TIRE FLAT REPAIR/ MOUNT 187.97 M&D LUMBER LUMBER 24.10 GATE VALVES, DIP CAP, CURB & GUTTER (PO#20- NEECE CONCRETE 00426) 6,355.50 NEO CONCRETE CONCRETE IN FRONT OF ARVEST BANK 132.00 NEO CONCRETE CONCRETE 844 A NW 264.00 O'REILLY SENSOR, BLOWER 102.17 SADDLES, COUPLINGS, METER LIDS 3255 UTILITY SUPPLY CENTRAL AVE. PROJECT (PO#20-00223) 8,219.37 23,618.22 POLLUTION CONTROL AIR SERVICE PLUS HEAT & AIR UNIT REPAIR (PO#20-00082) 573.00 FUELMAN FUEL USAGE 8/26-9/9/29 138.81 HAWKINS PRESS POLYMER (PO#20-00242) 2487.24 HAYNES SCADA COMPUTER REPAIR (PO#20-00286) 1932.20 LOCKE SUPPLY LED BULBS 137.74 PACE ANALYTICAL WEEKLY EFFLUENT 25.00 5293.99 WASTE WATER COLLECTION FUELMAN FUEL USAGE 8/26-9/9/19 389.23 389.23 SOLID WASTE AIR MASTER DEODORIZER SERVICES 12.71 ALERT 360 MONITORING SERVICES 30.00 FUELMAN FUEL USAGE 8/26-9/9/19 3031.98 MIAMI INDUSTRIAL HYDRAULIC HOSE, HOSE COVER 127.26 SOONER PRINTING INK CARTRIDGES 4.70 SUMMIT TRUCK GROUP 2011 INTERNATIONAL REPAIRS (PO#20-00168) 2794.76 TRI STATE DIPSTICK 7.78 YELLOWHOUSE LOADER BUCKET PINS (PO#20-00328) 1410.82 7420.01 COMMUNITY DEVELOPMENT ADMIRAL EXPRESS OFFICE SUPPLIES 310.74 FUELMAN FUEL USAGE 8/26/19 31.99 342.73

FINAL UTILITY REFUNDS 561.43 MSUA CREDIT CARDS 8/1-8/15/19 63,422.15 MSUA CREDIT CARDS 8/16-8/31/19 5,848.74 TOTAL MSUA CLAIMS 205,136.32 SPECIAL UTILITY AUTHORITY October 1, 2019 AUGUST 1, 2019 - AUGUST 15, 2019

INVENTORY - ELECTRIC LOCKE-ADAPTER $64.44 TOTAL $64.44

INVENTORY - MISCELLANEOUS LOCKE-PVC CEMENT $21.00 TOTAL $21.00

CUSTOMER SERVICE PEREGRINE-PRINTING $249.65 PEREGRINE-POSTAGE $520.65 TOTAL $770.30

METERING OREILLY-WIPER BLADES #134 $15.98 KARNES-OIL CHANGE #132 $50.72 CLEAN UNIFORM-RENTAL $35.42 VERIZON-METERING MIFI $37.85 WALMART-CALCULATORS $17.58 TOTAL $157.55

INFORMATION TECHNOLOGY VERIZON-IT/COUNCIL IPADS $227.10 BOLT-PHONE SERVICE $6,535.38 CANON-COPIER CONTRACT $177.45 CANON-COPIER CONTRACT $3,460.72 TOTAL $10,400.65

ELECTRIC WALMART-ORGANIZERS $39.52 IRBY-ELECTRIC BOLTS $390.00 LOCKE-AUGER BIT/DRIVER $457.01 FASTENAL-DRIVER KIT $359.66 FARWEST-CLIMBING GEAR $2,338.34 AUTOZONE-ADAPTER CONNECTORS $44.96 B&B-BATTERY CHARGER $50.00 B&B-CABIN AIR/CONNECTORS $149.70 B&B-CABIN AIR $55.64 ACE-VELCRO/ADHESIVE $41.97 FASTENAL-GALVANIZED BOLTS $95.03 BORDER STATES-INSULATED CAPS $477.44 LOCKE-CLAMP METER $296.14 VERIZON-ELECTRIC MIFI $75.70 SPECIAL UTILITY AUTHORITY October 1, 2019 AUGUST 1, 2019 - AUGUST 15, 2019

EXPEDIA-COLLISION DAMAGE $30.00 EXPEDIA-CANCELLATION PLAN $70.00 AA-SUB TRAINING/CLINE PITTSBURGH $490.00 AA-SUB TRAINING/LOLLAR PITTSBURGH $490.00 HOLIDAY INN-SUB TRAINING/T CLINE $257.33 HOLIDAY INN-SUB TRAINING/D LOLLAR $257.33 AVIS-RENTAL CAR $174.04 CLAREMORE NEWSPAPER-AD $190.00 TOTAL $6,829.81

RIGHT-OF-WAY VERIZON-ROW MIFI $75.70 TOTAL $75.70

WATER DISTRIBUTION WALMART-WATER/OFFICE SUPPLIES $261.39 ACE-TRANSDUCER FREIGHT $19.05 VERIZON-OPC/WATER MIFI/CELL $63.72 TOTAL $344.16

POLLUTION CONTROL ACE-TOOLS $137.54 ALFA LAVAL-SEAL $358.19 TOTAL $495.73

SOLID WASTE AMAZON-TOW ROPE $499.07 TSC-CLEVIS $29.99 FIVE STAR-LAWNMOWER BELT $61.50 WCA-TIPPING FEES $42,569.52 TOTAL $43,160.08

COMMUNITY DEVELOPMENT PIONEER PRINTING-STAMP $16.43 HOME DEPOT-TAPE LIGHTS $43.17 TOTAL $59.60

STORMWATER DEQ-AIRPORT FEE $347.71 DEQ-TSTATION FEE $347.71 DEQ-WWTP FEE $347.71 TOTAL $1,043.13

GRAND TOTAL $63,422.15 MIAMI SPECIAL UTILITY AUTHORITY October 1, 2019 AUGUST 16, 2019 - AUGUST 31, 2019

INVENTORY - ELECTRIC IRBY-BOLTS $210.00 TOTAL $210.00

INVENTORY - MISCELLANEOUS BORDER-WASHERS $400.50 TOTAL $400.50

CUSTOMER SERVICE PEREGRINE-PRINTING $377.55 PEREGRINE-PRINTING $292.09 PEREGRINE-POSTAGE $787.41 PEREGRINE-POSTAGE $609.18 TOTAL $2,066.23

METERING CLEAN UNIFORM-RENTAL $18.44 CLEAN UNIFORM-RENTAL $18.44 TOTAL $36.88

INFORMATION TECHNOLOGY WALMART-KEYBOARD/MOUSE COMBO $42.97 TOTAL $42.97

ELECTRIC HERCULOCK-HERCULES PADLOCKS $437.51 CLEAN UNIFORM-RENTAL $91.82 CLEAN UNIFORM-RENTAL $91.19 TOTAL $620.52

RIGHT-OF-WAY MIAMI IND-NITRILE GLOVES $14.79 KATNER-BATTERY SHUT OFF $43.49 CLEAN UNIFORM-RENTAL $38.44 CLEAN UNIFORM-RENTAL $39.07 TOTAL $135.79

WATER PRODUCTION S&H-BLOWN ENGINE REPAIR $171.02 LOCKE-FILTER $47.27 TOTAL $218.29 MIAMI SPECIAL UTILITY AUTHORITY October 1, 2019 AUGUST 16, 2019 - AUGUST 31, 2019

WATER DISTRIBUTION TSC-JACK/EXTENSION $87.98 USA BB-LIQUID TESTS REAGENT $494.74 CLEAN UNIFORM-RENTAL $8.80 CLEAN UNIFORM-RENTAL $8.80 CLEAN UNIFORM-RENTAL $9.24 CLEAN UNIFORM-RENTAL $8.80 CLEAN UNIFORM-RENTAL $9.24 CLEAN UNIFORM-RENTAL $8.80 SPARKLIGHT-CABLE $89.79 TOTAL $726.19

POLLUTION CONTROL AQUIONICS-SLEEVES $414.39 USA BB-LAB SUPPLIES $362.84 TOTAL $777.23

SOLID WASTE ACE-WRENCH $11.17 WALMART-DRILL $49.88 BO'S-SERV CALL/TIRE REPAIRS $375.00 MIAMI IND-HYDRAULIC HOSE $65.47 CLEAN UNIFORM-RENTAL $38.81 CLEAN UNIFORM-RENTAL $38.81 ALERT 360-SLD WSTE MONITORING $35.00 TOTAL $614.14

GRAND TOTAL $5,848.74

THE MIAMI SPECIAL UTILITY AUTHORITY (MSUA) MET IN REGULAR SESSION SEPTEMBER 17, 2019, IN THE MIAMI CIVIC CENTER COUNCIL CHAMBERS AT 5:30 PM WITH THE FOLLOWING MEMBERS PRESENT:

Rudy Schultz, Chairman Dean Kruithof, Trust Manager (Absent) Doug Weston, Trustee Ben Loring, Trust Attorney Ryan Orcutt, Trustee Melissa Moore, City Clerk Brian Forrester, Trustee Vicki Lewis, Trustee

The agenda for the meeting was posted in the main lobby and the north outside entryway of the Miami Civic Center at 2:45PM on September 16, 2019.

THE TRUST MAY DISCUSS, CONSIDER, AND VOTE ON ANY ITEM LISTED IN THIS AGENDA:

Call to Order Chairman Schultz called the meeting to order at 5:30PM.

Invocation Invocation by Chief of Miami Fire Department, Robert Wright

Pledge of Allegiance Trustee Orcutt led the Pledge of Allegiance

Public Input and Unscheduled Personal Appearances None.

CONSENT AGENDA By unanimous consent the public body may designate noncontroversial items to be considered in one motion and one vote. The public body may add items from the regular agenda and approve. Posted agenda items not added to the consent docket will be considered separately in their regular order. Staff recommends that Item 6 through Item 7 be placed on the consent agenda. Trustee Lewis moved to transfer Item #6 (Approve Claims: $1,737,667.17) through Item #7 (Approve Minutes: September 03, 2019 (Regular)) to the consent agenda and approve as presented. The motion was seconded by Trustee Weston. The Trust was polled with the following results.

Lewis, Aye Weston, Aye Forrester, Aye Orcutt, Aye Schultz, Aye

Chairman Schultz declared the motion carried.

Approve Claims: $1,737,667.17 Moved to consent agenda.

Approve Minutes: September 03, 2019 (Regular) Moved to consent agenda.

Accept or Reject Olsson and Associates Work Order Number 19/20-2 for Highway 69A Utility Relocation to be Reimbursed by Oklahoma Department of Transportation (ODOT) Tyler Cline reported that Olsson & Associates would provide engineering to relocate the electric and water line between the low water crossing to the railroad tracks on Highway 69A. The cost would be reimbursed by Oklahoma Department of Transportation (ODOT).

MSUA Page 1 of 8 September 17, 2019 Trustee Weston made a motion to accept Olsson and Associates work order number 19/20-2. The motion was seconded by Trustee Forrester. The Trust was polled with the following results:

Weston, Aye Forrester, Aye Lewis, Aye Orcutt, Aye Schultz, Aye

Chairman Schultz declared the motion carried.

Oklahoma Department of Environmental Quality (ODEQ) Form 2MI for Permit to Discharge Municipal/Domestic Wastewater Todd Murphree explained this application is for the permit to discharge Municipal/Domestic wastewater and is due November 2, 2019. Pages nine (9) and ten (10) are left blank due to there not being any permitted industries in Miami, and water is not reclaimed. Along with the application, it is required to publish a public notice in the Miami News Record. Once the application is reviewed by Oklahoma Department of Environmental Quality (ODEQ) a site visit will be scheduled.

Trustee Forrester made a motion to approve application for submission. The motion was seconded by Trustee Orcutt. The Trust was polled with the following results:

Forrester, Aye Orcutt, Aye Weston, Aye Lewis, Aye Schultz, Aye

Chairman Schultz declared the motion carried.

Other New Business, if any, Which has Arisen Since the Posting of the Agenda and Could not Have Been Anticipated Prior to the Time of Posting (25 O.S. § 311(9)) None.

Staff Reports (Written report included in packet, if available staff is present for questions) None.

Trustee Community Announcements None.

Adjournment Trustee Weston moved to adjourn the meeting. The motion was seconded by Chairman Schultz. The Trust was polled with the following results:

Weston, Aye Schultz, Aye Forrester, Aye Lewis, Aye Orcutt, Aye

Chairman Schultz declared the meeting adjourned at 5:34PM.

______Trustee Lewis Trustee Orcutt Trustee Weston

______ATTEST: ______Trustee Schultz, Chairman Trustee Forrester Melissa Moore, City Clerk

MSUA Page 2 of 8 September 17, 2019 MSUA PURCHASE ORDERS PRESENTED Tuesday, September 17, 2019 (JUNE 30) VENDOR DESCRIPTION

INVENTORY FERGUSON WATERWORKS COUPLINGS, VALVE (PO#19-01290) 9,496.76 M&K OUTDOOR PRODUCTS BAR & CHAIN OIL, GAS MIXTURE (PO#19-00279 242.50 9,739.26 ELECTRIC CONCRETE REPAIR IN ALLEY BETWEEN 2ND & 3RD MAIN COLLINS CONSTRUCTION AND A. ST NW 3,200.00 CRAFTON PUMP SERVICES BORE IN INDUSTRIAL PARK (PO#19-01635) 1,750.00 NEECE CONCRETE ART PARK PROJECT (PO#19-01641) 3,500.00 8,450.00 WATER DISTRIBUTION OLSSON WATERLINE IMPROVEMENTS (PO#19-01655) 5,332.91

OLSSON CENTRAL AVE. WATERLINE REPLACEMENT (PO#19-01686 7,747.28 UTILITY SUPPLY 8" POLY PIPE (PO#19-01674) 22,440.00 35,520.19

TOTAL MSUA CLAIMS 53709.45

MSUA PURCHASE ORDERS PRESENTED Tuesday, September 17, 2019 VENDOR DESCRIPTION

INVENTORY BRENNTAG CHLORINE CYLINDERS (PO#20-00214) 1,071.00 1,071.00 CUSTOMER SERVICES DHS LIHEAP OVERPAYMENT 296.00 OFFICIAL PAYMENTS CHECK RETURNS 15.00 311.00 ADMINISTRATIVE SERVICES GOODELL, STRATTON, EDMONDS RULE CURVE CHANGE (PO#20-00260) 5,005.62 GRDA PURCHASED POWER 8/1-8/31/19 949,553.72 954,559.34 IT CDW GOVERNMENT DELL OPTIPLEX COMPUTERS (PO#20-00213) 194.79 MICROSOFT RELICENSING RENEWAL SHI INTERNATIONAL (PO#20-00330) 63,651.00 TANGENT REMOTE DESKTOP RENEWAL (PO#20-00268) 3,598.00 RECEIPT PRINTER & OUTPUT PROCESSOR (PO#20- TYLER TECHNOLOGIES 00269) 3,005.54 70,449.33

MSUA Page 3 of 8 September 17, 2019 ELECTRIC BORDER STATES POLE ARM (PO#20-00317) 591.15 COLE EXCAVATION BORE FOR ELECTRIC (PO# 20-00282) 6,000.00 GLOBAL RENTAL EQUIPMENT RENTAL (PO#20-00288) 6,600.00 PURCHASED .6 ACRES OF EASEMENT JAY CALAN (PO#20-00325) 10,000.00 LOCKE SUPPLY SOCKET, PHOTO CELL, AUGER BIT 256.79 LOCKE SUPPLY POCKET PARK (PO#20-00253) 521.11 MAIN STREET CAR WASH CAR WASH - ELECTRIC 10.14 MIAMI NEWS RECORD SUBSTATION BID 194.96 MIAMI NEWS RECORD SUBSTATION EXPANSION 191.10 OLSSON SUB 1 CONSTRUCTION (PO#20-00264) 2,165.72 OLSSON SUB 2 CONSTRUCTION (PO#20-00265) 23.87 PENNSYLVANIA TRANSFORMER SUBSTATION1 TRANSFORMER (PO#20-00326) 187,396.30 STEOPLE GROUP ASSESSMENT FOR ADMIN POSITION 285.00 UNIVERSAL FIELD SERVICES ROW & ACQUISITION SERVICES (PO#20-00324) 797.95 215,034.09 ROW ACE HARDWARE GARDEN SPRAYER 29.98 ARVEST LEASE PAYMENT 9/19 786.01 M&K OUTDOORS CHAIN 15.84 831.83 WATER PRODUCTION FRIENDSHIP HOUSE BAGS OF RAGS 24.00 24.00 WATER DISTRIBUTION ACE HARDWARE MAGNESIUM, MAIL CENTER 171.56 ARVEST LEASE PAYMENT 9/19 1,224.54 B&L WATERWORKS CLAMP, PVC PIPE 762.81 B&L WATERWORKS 8" TAPPING SADDLES (PO#20-00247) 647.29 FASTENAL BLADES, CABLE TIES 305.35 JOPLIN GLOBE WATER CREWMAN I - AD 291.56 KATNER MILLS BATTERY 120.99 KEMP STONE CRUSHER ROCK 185.46 MAIN STREET CAR WASH CAR WASH - WATER 10.44 MIAMI AUTO SUPERCENTER FRONT GRILL ASSEMBLY, MOLDING 476.22

NEECE CONCRETE 12" HDPE WATERLINE TRENCHING (PO#20-00327) 30,232.80 WATERLINE TRENCH, GATE VALVES, 8" MJ DIP TEE, NEECE CONCRETE 4" CONCRETE SIDEWALK (PO#20-00327) 83,096.50 OTA TOLL FEES 8/1-8/31/19 0.30 O'REILLY TRACTOR FUEL 99.98 117,625.80 POLLUTION CONTROL ARVEST LEASE PAYMENT 9/19 1512.65 KATNER MILLS HOSE/HOSE END 426.04 MSUA Page 4 of 8 September 17, 2019 OKLAHOMA NATURAL GAS GAS USAGE 7/30-8/30/19 22.34 PACE ANALYTICAL WEEKLY EFFLUENT 50.00 2011.03 SOLID WASTE AIRE MASTER DEODORIZER SERVICES 12.71 HUGOS INDUSTRIAL JUMBO ROLL TISSUE 23.10 MIAMI PEST & TERMITE CONTROL REG. SERVICES 60.00 OKLAHOMA NATURAL GAS GAS USAGE 7/30-8/30/19 38.88 SOUTHERN TIRE MART 11R22.5 TIRES (PO#20-00206) 1507.00 WELCH STATE BANK LEASE PAYMENT 9/19 2018 MACK TRUCK 10653.36 WELCH STATE BANK LEASE PAYMENT 9/19 MACK ROLL OFF TRUCK 5818.67 YELLOWHOUSE MACHINERY HYDRAULIC OIL/ FILTERS 485.73 18599.45 COMMUNITY DEVELOPMENT OFMA RENEWAL/MEMBERSHIP DUES ( KM-CR) 150.00 150.00 STORMWATER COLLINS CONSTRUCTION REPLACE STORM DRAIN (20-00119) 2450.00 M&D LUMBER MORTAR MIX, DOUGLAS FIR, BAR TIES 36.28 NEO CONCRETE INTAKE CONCRETE 88.00 PACE ANALYTICAL SOIL TEST 50.00 SCURLOCK DOUBLE STEEL LID 498.00 3122.28

BANK OF OKLAHOMA OWRB FAP LOAN PAYMENT 9/19 41,511.75 FINAL UTILITY REFUNDS 2,825.14 SALARIES & BENEFITS 8/29/19 118,073.65 SALARIES & BENEFITS 9/12/19 121,239.14 MSUA CREDIT CARDS 7/15-7/31/19 16,518.89 TOTAL MSUA CLAIMS 1,683,957.72

SPECIAL UTILITY AUTHORITY September 17, 2019 JULY 15, 2019 - JULY 31, 2019

CUSTOMER SERVICE PEREGRINE-PRINTING $663.29 PEREGRINE-PRINTING $313.79 PEREGRINE-POSTAGE $1,383.33 PEREGRINE-POSTAGE $654.42 FRED PRYOR-EXCEL TRNG/K RUNDELL/K HEADLEE $158.00 FRED PRYOR-CRITICISM/DISCIPLINE/H BAILEY $149.00 TOTAL $3,321.83

MSUA Page 5 of 8 September 17, 2019 ADMINISTRATIVE SERVICES SANTA FE GARAGE-PARKING/APT $30.00 RENAISSANCE-APT CON/J FITZGIBBON $417.69 RENAISSANCE-APT CON/B TESTERMAN $417.69 RENAISSANCE-APT CON/M ADDINGTON $417.69 TOTAL $1,283.07

METERING CLEAN UNIFORM-RENTAL $36.64 CLEAN UNIFORM-RENTAL $17.71 ACCURATE-WATER C/M MOSLEY $270.00 DEQ-EXAM FEE/M MOSELY $62.00 TOTAL $386.35

INFORMATION TECHNOLOGY CANON-CONTRACT INSURANCE $3,460.72 CANON-CONTRACT INSURANCE $177.45 WALMART-SPEAKERS/HEADPHONES $62.52 WALMART-SPEAKERS $12.88 AMAZON-MEMORY CARD $36.99 TOTAL $3,750.56

ELECTRIC FASTENAL-DRIVER KIT $372.29 ACE-CHAINSAW TOOLS $62.96 LOCKE-AUGER BIT CUTTER $50.23 FASTENAL-REFUND/TAX CHARGED ($372.29) FASTENAL-DRIVER KIT $339.99 LOCKE-IMPACT $485.25 B&B-LUG ADAPTER $26.50 FASTENAL-INSULATED COOLERS $49.98 LOCKE-COOPER GROUND ROD $126.63 BORDER STATES-PHOTOCELL $420.00 CLEAN UNIFORM-RENTAL $69.80 CLEAN UNIFORM-RENTAL $69.80 CLEAN UNIFORM-RENTAL $69.80 AMAZON-PRIME CANCELLATION ($119.00) TOTAL $1,651.94

RIGHT-OF-WAY ACE-POLE SAW $649.99 TSC-LEAF RAKES $53.97 TSC-MANIFOLD REPAIR KIT $6.99 B&B-TRAILER PLUG $13.50 CLEAN UNIFORM-RENTAL $39.80 CLEAN UNIFORM-RENTAL $39.80 CLEAN UNIFORM-RENTAL $39.80 MSUA Page 6 of 8 September 17, 2019 TOTAL $843.85

WATER PRODUCTION WALMART-CLEANING SUPPLIES $289.00 DEQ-RENEWAL/J RICHARDSON $92.00 DEQ-RENEWAL/R THOMPSON $138.00 TOTAL $519.00

WATER DISTRIBUTION BASS PRO-RAIN BOOTS $209.98 UTILITY-MAIN ST 8" VALVE $822.23 CLEAN UNIFORM-RENTAL $8.80 CLEAN UNIFORM-RENTAL $8.80 SPARKLIGHT-JULY CABLE $89.79 DEQ-RENEWAL/J CRAWFORD $92.00 DEQ-RENEWAL/R HENRY $92.00 DEQ-RENEWAL/A OBRIEN $92.00 DEQ-RENEWAL/C STEPHENS $92.00 TOTAL $1,507.60

POLLUTION CONTROL ACE-FLASH LIGHT $14.99 ACE-CUTOFF BLADE $7.99 ACE-TER KIT/CONN $110.90 ACE-CREDIT/ROOF COAT ($14.99) LOCKE-FLASHING $20.99 LOCKE-CAP,PIPE,FLEX $42.43 PACE-SLUDGE TESTING/EFFLUENT $260.00 ALLIED-PROC CONTROLLER $124.60 USA BB-CARBOY/FILTER/BUFFER $411.00 USA BB-PH ELECTRODE $348.41 WALMART-LAB/CLEANING SUPPLIES $202.87 WALMART-BAG SEALER $108.76 TOTAL $1,637.95

WASTEWATER COLLECTION DEQ-RENEWAL/J WALDON $92.00 TOTAL $92.00

SOLID WASTE ACE-MONITOR SHIPPING $13.91 MIAMI INDUST-WORK GLOVES $138.00 ACE-CUTTING PLIERS $18.39 TRI STATE-G5 FILTER $168.26 WOODSHED-DEF FUEL $499.50 LOCKE-COUPLING/BIB $11.73 LOCKE-LIGHT BULBS $184.80 MSUA Page 7 of 8 September 17, 2019 IRON WORKS-2YD RETRO FIT $185.00 CLEAN UNIFORM-RENTAL $37.19 CLEAN UNIFORM-RENTAL $37.19 TOTAL $1,293.97

STORMWATER BOW WOW-WASTE BAGS $230.77 TOTAL $230.77

GRAND TOTAL $16,518.89

MSUA Page 8 of 8 September 17, 2019

MIAMI SPECIAL UTILITY AUTHORITY ACTION/DECISION REQUEST

MSUA MEETING Oct. 1, 2019 DATE:

AGENDA TITLE: Accept or Reject Change Order #2 for C18-110 With Neece Concrete for Central Avenue Street Improvements for Additional Working Days Due to Weather and for Replacement of Section of Sewer Not to Exceed $2,300.00

BACKGROUND:

Neece Concrete Construction bid with change orders for a total cost of $1,085.299.65.

Change Order requesting 60 calendar days due to weather and additional work at the request of the MSUA for additional water valves and sanitary sewer replacement.

Change Order also includes $2,300 in labor for the replacement of 50’ of PVC Sanitary Sewer adjacent to the proposed Storm Sewer.

STAFFS RECOMMENDATION:

Staff recommends approval of Change Order #2 for C18-110.

PRESENTER(S):

Shaun McConnaughey

Change Order No. 2

Date of Issuance: October 1, 2019 Effective Date: October 1, 2019 Owner: City of Miami/ Miami Special Utility Authority Owner's Contract No.: C18-110 Contractor: Neece Concrete Construction Contractor’s Project No.: Engineer: Olsson Engineer's Project No.: Project: Central Ave. Street Improvements Contract Name:

The Contract is modified as follows upon execution of this Change Order: Description:

• Remove existing sanitary sewer along proposed storm sewer and replace with 12” PVC. Lump Sum cost includes equipment and labor only. Owner will provide all materials. • Request of 40 weather days and additional 20 days changing the substantial completion date to November 10, 2019, with a final completion date of December 1, 2019.

Attachments: [List documents supporting change] • Change Order cost • Time Extension Request

CHANGE IN CONTRACT PRICE CHANGE IN CONTRACT TIMES Original Contract Price: Original Contract Times: Substantial Completion: September 12, 2019 $ 1,071,162.15 Ready for Final Payment: October 12, 2019 days or dates [Increase] from previously approved Change Orders No. 1 [Increase] from previously approved Change Orders No. to No. 1 : to No. : Substantial Completion: 0 $ 11,767.50 Ready for Final Payment: 0 days Contract Price prior to this Change Order: Contract Times prior to this Change Order: Substantial Completion: September 12, 2019 $ 1,082,929.65 Ready for Final Payment: October 12, 2019 days or dates [Increase] of this Change Order: [Increase] of this Change Order: Substantial Completion: 60 $ 2,300.00 Ready for Final Payment: 21 days Contract Price incorporating this Change Order: Contract Times with all approved Change Orders: Substantial Completion: November 10, 2019 $ 1,085,229.65 Ready for Final Payment: December 1, 2019 days or dates

______9/23/2019______SUBMITTED ENGINEER DATE APPROVAL PROJECT MANAGER DATE

______APPROVAL OWNER DATE APPROVAL PROJECT MANAGER DATE EJCDC® C-941, Change Order. Prepared and published 2013 by the Engineers Joint Contract Documents Committee. Page 1 of 1

58300 E 100 Rd Miami, OK 74354 918-540-2259 (Fax) 918-542-7677 www.neececoncreteconstruction.com

9/6/2019 Change Order: C18-1102-2

City of Miami Phone: (918) 542-6685 129 5th Ave NW Fax: Miami, OK Project: Central Ave

We propose to furnish all labor, material, and equipment to complete the following:

Sanitary Sewer Replacement (In Alley Behind Brown Winters): Remove existing clay tile and replace with approximately 50’ of 12” PVC. This includes equipment and labor only. City to provide all materials. $2,300.00

We agree hereby to make change(s) specified above at this price:……………………...……$2,300.00 Previous Conctract Amount:……………………………………………………………...... ……..$1,082,929.65 Revised Contract Total:……………………………………………………………...... …………..$1,085,229.65

Note: This change order becomes part of, and in conformance with the existing proposal

Authorized Signature:

The above contract terms are accepted, and Neece Concrete Construction is authorized to do the work as specified above.

Date of Acceptance:______Signature:______

Sign and Return Via Fax or Mail Printed Name:______

Office: 918.540.2259 58300 E 100 Rd Fax: 918.542.7677 Miami, Ok 74354 www.neececoncreteconstruction.com

September 16, 2019

This letter is in reference to a contract extension for The City of Miami Central Ave. Project. We are requesting additional days to complete the project for the following reasons:

 We were given a letter to proceed with a projected start date of April 15, 2019. On or around April 15th, we received a call from Tyler Cline asking us if it would be possible to hold back our start date so the city could look into different financing for the project. Zeb told Tyler that would be fine however we would have to start other projects while the City made their decision on the financing. Our excavation/boring contractor mobilized in on May 29th.  During installation of storm sewer, we encountered some unexpected rock issues that needed to be jackhammered out which added two weeks of additional work.  Since the project has been in process, we have received approximately 40 days of rain. The rain stops and or slows down our productivity.  There are also additional water line tie-ins not shown on the plans that are now needing installed.

We are estimating this project will have a substantial completion date of November 10, 2019 and a final completion date of December 1, 2019. MIAMI SPECIAL UTILITY AUTHORITY ACTION/DECISION REQUEST

MSUA MEETING 10/01/19 DATE:

AGENDA TITLE: Adding Section 27-8 (Credit Cards and Debit Cards) of Chapter 27 (Budget and Finance); Regarding Accepting Credit Cards and Debit Cards, and Collecting a Service Fee From the Customer

The Finance Division question over the past few years is, “How can we legally and financially accept credit cards as payment for all City services?” Below is the processor we are recommending and how it came about:

In the Past: • The City of Miami customer service center (CSC) accepted credit cards in person as a form of payment from all utility customer; residential, commercial, or industrial. However, when corporate credit cards began being used for large payments, the credit card fees to the City could no longer be absorbed, so the practice of accepting credit cards in-person was discontinued and we contracted with a company to take payments over the phone and online. • At that time, the following options were explored: o Raise utility rates to pay for the credit card fees. - This was turned down as we projected the annual cost to increase from $3,000/year to approximately $100,000/year. o Charging a service fee for the convenience of using credit cards. - Our City attorney cited two things that could prevent this: 1) State statute language was problematic; and 2) language within the contracts with the credit card companies themselves prevented us from charging a fee. Currently: • Working with our State Representative/City Attorney Ben Loring, he proposed House Bill 1425 that allowed a municipality to charge a credit card service fee. It was approved, signed into law, and will become effective 11/01/19. • Since passage of HB 1425, staff has: o Created, published/distributed, and reviewed submittals from a Request For Proposal (RFP) for credit card services in-person, over the phone, and online. o We received a total of five (5) responses, but only two (2) were determined to be valid. Based upon review of the two valid responses received, staff recommends Retail Lockbox Merchant Services, LLC to provide these services. ▪ This decision was based on: • The card processing fees (Retail Lockbox - 2.9% plus $.20, Point and Pay – 3%); • The cost of equipment (Retail Lockbox - $131.00, Point and Pay - $200.00); • Wireless terminal (Retail Lockbox - $450.00, Point and Pay - $350 plus $10 per month); • Retention of transaction data (Retail Lockbox - indefinitely, Point and Pay – 24 months); • Training and Implementation: Retail Lockbox stated they would be onsite for the installation of card readers and training. Point and Pay stated they would have online/web sessions with our staff for instructor-led training. • We are working with the City attorney to create the necessary ordinance(s) with the following possible ordinance highlights: o We are looking for it to be written in such a way that if the processor costs change, we will not have to change the ordinance. o Staff is requesting that we do not accept credit cards for deposits. o Requesting that, if applicable, the customer will be responsible for any fees associated with a payment dispute o After three (3) payment disputes, the customer can no longer use a credit card to make a payment to the City. • The service fee will be collected and kept by the awarded processor’s terminal. The City will not handle the service fee, nor will it be in our possession. This also works well for our IT Department. • Staff will input the payment by hand into Incode, a receipt will be generated, then the card will be put into the terminal to include the payment amount and the service fee. (2.9% plus $.20) A second receipt will be created for the customer showing the City’s fees and with the processor fees separately. • Initially, payments for utility, court, and community development will us this processor and, as soon as possible, all other applicable departments will be brought online. • Staff asks that you approve awarding the RFP to Lockbox Merchant Services, LLC and staff will begin working with them on a contract to bring back to the council for approval.

STAFFS RECOMMENDATION:

Approve award of credit card processing services to Lockbox Merchant Services, LLC

PRESENTER(S): Ben Loring/Jill Fitzgibbon

ORDINANCE NO. 2019- 15

AN ORDINANCE OF THE MAYOR AND CITY COUNCIL OF THE CITY OF MIAMI, OKLAHOMA ADDING SECTION 27-8 (CREDIT CARDS AND DEBIT CARDS) OF CHAPTER 27 (BUDGET AND FINANCE) OF THE CODE OF ORDINANCES; PROVIDING SEVERABILITY; PROVIDING FOR CONFLICTING PROVISIONS; AND ESTABLISHING AN EFFECTIVE DATE.

WHEREAS, Article 2, Section 6, subparagraph 2 of the City Charter provides that the council may enact municipal legislation subject to limitations as may now or hereafter be imposed by the Oklahoma Constitution and law; and

WHEREAS, Title 11, Oklahoma Statutes, Section 14-101 allows a municipality to enact ordinances not inconsistent with the Constitution and laws of Oklahoma for carrying out its municipal functions; and

WHEREAS, Title 14A, Oklahoma Statutes, Section 2-417 allows a municipality and all public trusts with a municipality as its beneficiary to accept the use of a credit card or debit card for any payment in lieu of payment by cash, check, or similar means and may charge a service fee for the use of such credit or debit card to the cardholder; and

WHEREAS, the City of Miami, acting by and through the City council, determines that as a matter of convenience for those persons or entities doing financial transactions with the City, or any public trust wherein the City is a beneficiary, it will accept the use of a credit card or debit card, provided however, all the costs associated with same shall be borne by the person or entity deriving that benefit.

NOW, THEREFORE, BE IT ORDAINED BY THE MAYOR AND CITY COUNCIL OF THE CITY OF MIAMI, OKLAHOMA:

Section 1 (New Law)

Section 27-8 shall be enacted to read as follows:

Sec. 27-8. Credit cards and debit cards.

The City of Miami, in all of its departments, and all public trusts or authorities where the City of Miami is a beneficiary, hereinafter collectively called “City,” shall be able to accept the use of a credit card or debit card as an alternative to cash, check or similar means, on the following terms and conditions:

(1) The City may enter into one or more contracts with one or more credit and/or debit card processor(s) to accept payments from any person or other legal entity, hereinafter called “customer,” on behalf of the City at one or more such locations as may be agreed upon in such contract(s).

(2) Such processor(s) shall be able to charge and collect a service fee from the customer on such fees, terms, and conditions as are set forth in said contracts, provided the customer must be advised in advance that they will be paying such service fee in return for the convenience of using the credit and/or debit card. Such use of a credit and/or debit card and the associated service fee may be applied in online, including, but not limited to internet or telephone transactions, or in-person transactions.

(3) The service fee charged to the customer shall equal the bank processing fees, the financial transaction fees, the cost of providing for a secured transaction, portal fees and fees necessary to compensate for increased bandwidth, all as set out and limited by the City’s contract with the processor(s), and no more.

Page 1 of 3

(4) The processor(s) will charge and collect all monies involved in the transaction and remit same to the appropriate financial department of the City on such terms and conditions as set out in the contract(s). The processor(s), acting contractually as the agent of the City will charge, collect, and retain the service fee. The service fee will never be in the possession of the City.

(5) In the event a customer should dispute or otherwise cancel a credit and/or debit card transaction with the City for any reason or in any fashion, the amount of the transaction will be considered to have never been paid, and if applicable, shall be reinstated on any account of the customer. Unless the transaction occurred through no fault of the customer, including, but not limited to a fraudulent or unauthorized use of the credit and/or debit card, the service fee and any and all associated penalties and charge back fees will also be added to the account of the customer. The City reserves the right to utilize all legal means available to collect all funds wherein a customer should dispute or otherwise cancel a credit and/or debit card transaction with the City for any reason or in any fashion, including, by way of example and not limitation, such actions as discontinuance of the customer’s utility service, if otherwise authorized by applicable ordinance and/or policies and procedures.

(6) The City reserves the right to enact policies and/or procedures governing and regulating all aspects of the use of such credit and/or debit card. The City reserves the right to refuse to accept payment by a credit and/or debit card for any reason that is not otherwise illegal.

(7) To the extent otherwise allowed by law, in order to protect both the City and the customer from fraud, the City reserves the right to require the customer desiring to use a credit and/or debit card to prove identity through a government issued identity document.

Section 2 - Severability

If any provision, paragraph, word, Section or Article of this Ordinance is invalidated by any court of competent jurisdiction, the remaining provisions, paragraphs, words, Sections, Articles and Chapters shall not be affected and shall continue in full force and effect.

Section 3 - Conflicting Provisions

If any provision, paragraph, word, Section, Article or Chapter of this Ordinance conflicts with the provisions of any other Ordinance, then the provisions of this Ordinance shall be deemed to have superseded all conflicting provisions previously entered into effect.

Section 4 - Effective Date

[Choose One (1)]

______Pursuant to 11 O.S. §14-103, this Ordinance shall take effect thirty (30) days from its final passage unless the City Council specifies a later date:

______

[OR]

______EMERGENCY CLAUSE. For the immediate preservation of the public peace, health and safety, an emergency is hereby declared to exist whereby this Ordinance shall take effect immediately upon passage and publication as required by law. The question of emergency must be ruled upon separately and approved by the affirmative vote of at least ¾ of ALL the members of the City Council (4 affirmative votes required). As required by 11 O.S. §14-103, an emergency measure must state in a separate section why it is necessary that the measure become effective immediately; the reason for the emergency measure is as follows:

______

Page 2 of 3

______

PASSED AND APPROVED this 1st day of October, 2019.

______Rudy Schultz, Mayor

ATTEST: APPROVED:

______Melissa Moore, City Clerk Ben Loring, City Attorney

Page 3 of 3 MIAMI SPECIAL UTILITY AUTHORITY ACTION/DECISION REQUEST

MSUA MEETING 10/01/19 DATE:

AGENDA TITLE: Award Credit Card Processing Services

STAFFS RECOMMENDATION:

Approve award of credit card processing services to Lockbox Merchant Services, LLC

PRESENTER(S): Jill Fitzgibbon/Mike Addington

Proposal for

Credit Card Processing and Merchant Services RFP# 19-50

August 22, 2019 | 2:00 PM CST

Kevin C. Connell, Chief Executive Officer | 110 State Street East, Oldsmar, FL 34677 | 888.891.6064 | [email protected]

Table of Contents

2 SCOPE OF SERVICES ...... 1 2.1 Flexibility and Configuration ...... 3

3 PROPOSER QUALIFICATIONS ...... 3 3.2 RFP Assurance and Abilities...... 10

4 SPECIFICATIONS ...... 13 4.1 Point-of-Sale Terminal Support of Various Functions ...... 13 4.2 Web Page Functionality ...... 14 4.3 Additional Requirements ...... 32 4.4 Settlement Proceeds Requirements ...... 40 4.5 Security ...... 40 4.6 Disaster Recovery ...... 44

5 PROPOSAL REQUIREMENTS ...... 46 5.1 Exhibit A.1 ...... 46

City of Miami, OK i RFP 19-50_CCPMS

2 Scope of Services

OBJECTIVE: The purpose of this RFP is to engage a full-service vendor(s) experienced in the development, installation and operation of a credit and debit card processing service for the City. The proposer will provide Visa (credit/debit), MasterCard (credit/debit), and Discover card merchant processing contract and transaction processing systems and services for the City.

For RFP# AD 19-50, Point & Pay understands the City of Miami seeks a full-service vendor experienced in the development, installation and operation of a credit and debit card processing service for the City. We also recognize the vendor needs to provide a merchant processing contract and transaction processing systems and services for the City to enable payment acceptance of credit/debit for Visa, MasterCard, and Discover card.

The Point & Pay suite of products and services, coupled with our expert team of highly experienced, highly capable industry veterans, will deliver on the needs referenced in RFP# AD 19-50. Not only do our payment processing capabilities include serving all departments for government agencies nationwide, but we have also completed seamless integrations with clients’ billing and/or financial management software systems. We recognize the City’s Scope of Services and identifies key points of our proposal to demonstrate how the City would benefit from implementation of our proposed solution.

1 Intuitive Customer Experience Point & Pay’s solution drives new levels of customer engagement with a dynamic, user-friendly interface that offers a convenient way to pay at any time, from anywhere, and on any device. 2 Efficient Administrative Operations Our payment solution will allow the City to streamline revenue collection, increase the receipt of payments, and lower costs to customers. 3 Scalable Payment Processing Solution to Meet Current and Future Needs A proprietary feature of the Point & Pay payment solution is our advanced technology that ensures a continuous flow of transaction processing, especially during critical collection periods. 4 Extensive Integration Expertise For nearly two decades, Point & Pay has integrated numerous payment solutions with hundreds of software vendors nationwide, and we are fully capable of achieving a successful and seamless integration with the City’s existing and/or future software applications. 5 Comprehensive Reporting System Point & Pay’s suite of robust reporting tools enables real time, ad hoc, and file-based reporting with 24/7 access using our secure and password-protected website. 6 Training to Support the Solution Effectively Point & Pay’s training team will use direct training for City staff, including classroom-style sessions, instructor led Web conference sessions, hands-on, practical learning in the Point & Pay

City of Miami, OK 1 RFP 19-50_CCPMS

demo environment, and recorded training via URL. Training revolves around all system functionality for processing and reconciliation of payments. 7 PCI-DSS and SSAE 18 Type II Compliant and Certified We undergo annual audits for both PCI-DSS and SSAE 18 Type II compliance and utilize several secure methods to encrypt sensitive customer data, as well as configure permission-based, hierarchy controls to further efforts of security. 8 Exceptional Customer and Technical Service Support Point & Pay makes it a priority to provide exceptional customer and technical service support to our clients’ and their customers. We receive positive feedback consistently on how our specialists exceed customer expectations.

Proven Results Point & Pay’s goal is to provide the best user experience for our clients’ customers, the most efficient management experience for the client, and to deliver the highest levels of electronic payment utilization of any agency in their state. Our product line gives government agencies access to an unparalleled menu of payment products – mobile, recurring, eBilling, etc. – featuring the most polished and modern user interfaces available and equipped with bulletproof integration tools. Our mobile-dynamic BillPay solution recently delivered the statistics below.

Treasurer’s Office at Franklin County, Ohio – Columbus Metro

 25% increase in customer utilization of electronic payment options  49% growth in online transactions processed for tax payments  57% growth in online dollar volume

Highline Water District – Seattle, Washington

 57% of registered customers opted into electronic billing (eBill)  34% increase in customer utilization of electronic payment options  $27K annual savings on supplies

We are confident in our products’ capabilities to achieve the same results for others, thereby setting a new standard for government agencies in Oklahoma. Point & Pay invites the City of Miami to embark on a new partnership with us to identify opportunities to save time, reduce operational costs, and ultimately enhance the customer experience.

City of Miami, OK 2 RFP 19-50_CCPMS

2.1 Flexibility and Configuration

1. The City will charge a convenience fee. The convenience fee should be calculated by the processor. A split payment gateway (meaning our bank only receives the principal amount of a transaction and the convenience fee goes to the processor) shall be utilized by the processor for all processing methods. The City will utilize payment the following processing methods: in‐person credit/debit, on‐the‐phone credit/debit, and on‐line credit/debit.

Point & Pay understands and complies with this requirement. The proposed package of payment solutions includes our fully hosted gateway solutions for web, in-person, IVR, and integrated transactions. Our processing platform was designed uniquely for government clients and as such, supports virtually every possible use case for convenience fees/service fees. In addition, our POS terminal solutions run our proprietary EPXPay software, which supports convenience fee all-in-one easy interactions with the customer. Our APIs and other integration techniques likewise fully support these options.

Point & Pay’s convenience fee model is compliant with all major credit card rules and regulations, and may be based on percentages, flat dollar amounts, tiered systems, and various hybrids. The configurations for convenience fees versus absorbed and the specific structures applied can be made at any tier in our hierarchy, all the way down to specific payment types and channels, which ultimately enables full tailoring for the City.

2. The processor shall host a web page allowing on‐line credit/debit payments to be made through that web page.

Our proposed web page is a Point & Pay-hosted, cloud-based Software-as-a-Service (SaaS) solution, available via variety of connection methodologies (SSL, IP, etc.) that allows for real-time payment processing for credit and debit cards, as well as eChecks.

3 Proposer Qualifications

The City seeks proposals from stable, reputable organizations with a track record of ongoing customer support and satisfaction. Identify and describe in summary your organization’s performance of services similar in nature, scope, and size to that requested by this RFP within the last two years. Integration into our utility billing system is NOT required for acceptance.

Point & Pay was founded in 1999 to specifically address the payment processing needs of government agencies. We specialize in developing unique payment solutions for online, phone, in-person, and mobile technologies that present bills, capture payments, and post, settle, and reconcile via centralized points of integration, with the highest security standards and compliance as their foundation. These solutions enable our clients to accept electronic payments from consumers and businesses anytime, anywhere. Most of our clients utilize all of our packaged payments solutions, thus the experience gained has enhanced our capability to implement these products rapidly.

City of Miami, OK 3 RFP 19-50_CCPMS

North American Bancard (NAB) acquired Point & Pay in May 2010; however, we are a wholly-owned subsidiary of NAB and operate independently. NAB serves as one of the nation’s leading merchant services provider, dedicated to delivering state-of-the-art payment processing services to more than 250,000 businesses, with over $20 billion in transactions every year. As part of NAB’s family of companies, Point & Pay leverages their economies of scale by functioning as a service provider, acquirer, processor, and biller for clients. We are also able to offer highly competitive rates on transaction processing and payment hardware for clients.

Our steady growth since 2010 has enabled us to gain additional partnerships with governments, utilities, courts, nationwide to build and integrate specialized payment solutions to meet each client’s unique needs and requirements.

Point & Pay’s hosted payment platform Steady Growth since 2010 facilitates the needs of small and large multi- faceted governments, thereby offering several opportunities to extend the City of Miami’s capabilities in key areas with the latest products. With that in mind, we are pleased to offer a flexible approach in delivering a best in class payments solution that provides convenient customer experiences and efficient operations to ensure complete satisfaction.

Operating Name: Point and Pay, LLC d/b/a Point & Pay | Corporate Ownership: North American Bancard, LLC

Headquarters: Oldsmar, FL (Tampa Bay) | Secondary Office: Portland, OR

3.1.A Extensive Experience and Qualifications Point & Pay possesses a strong belief in serving our clients as a solution builder, payment expert, and consulting resource. We uphold this belief by immersing ourselves in our client’s organizations, learning their unique needs, and customizing a solution to address all aspects appropriately and efficiently. Point & Pay’s products and services offered, coupled with our highly experienced payment experts, highly capable industry veterans, will deliver on the City’s daily service requirements and needs.

Serving large, multi-department governments has been our specialty from the beginning. Today, Point & Pay provides more than 3,800 clients nationwide with sophisticated electronic payment solutions that enable their customers to pay for several services online, over the phone, and in-person. Point & Pay’s portfolio for like or similar projects includes more than 500 utility clients nationwide. We are pleased to provide the City of Miami with a sample of clients below.

City of Miami, OK 4 RFP 19-50_CCPMS

Highline Water District – Seattle, Washington

Contact and Title: Greg Wilson, Customer Service Supervisor Phone Number: 206.592.8914 Email: [email protected]

Project Description: In early 2016, the Highline Water District sought to implement a new interface for customers to pay their utility bills, including electronic billing and payment services. Point & Pay responded with our latest online solution to provide their customers with a new, modernized, and Highline Water District Online Payment Portal functional payment system. As a result, they have achieved an adoption rate of 60% for customers who have converted to paperless billing.

Testimonial: “We repeatedly receive compliments from our customers that the functionality of Point & Pay’s web portal is extremely user-friendly and easy to navigate. Overall, Point & Pay has exceeded my expectations in how efficient and streamlined the payment process is for our customers.”

City of Flagstaff, Arizona – Utilities Department

Contact and Title: Sandy Corder, Revenue Director Phone: 928.213.2252 Email: [email protected] Project Description: The City of Flagstaff wanted a new vendor to develop an efficient, streamlined payment portal online that had a modernized, yet customizable look and feel to it. After our team demonstrated our payment solution’s capabilities, Point & Pay implemented the latest advancements to our online solution that involved integrating with the City’s Innoprise Harris Utility billing software. Testimonial: “We are excited about the new, innovative design of the Point & Pay utility payment solution, as well as offering residents with mobile payment capabilities. This is a huge leap forward for the City of Flagstaff.” Log In for Account Management

City of Miami, OK 5 RFP 19-50_CCPMS

Davidson County, North Carolina (Lexington Metro) Contact and Title: Christy Leonard, Deputy Tax Collections Manager Phone: 336.242.2176 | Email: [email protected] Project Summary: Point & Pay has served Davidson County, North Carolina since June 2013. At that time, we implemented online, IVR, and point-of-sale payment acceptance for the County’s customers to pay their annual real estate and property taxes. We also provide the County with our IVR and POS/Counter payment solutions for those needing to pay the County for building and other miscellaneous permit fees.

Testimonial: “We are extremely pleased with Point & Pay's services as a whole for both our staff and taxpayers. Transitioning to the new payment solution went very smoothly and both our IT department and their team worked well together. Point & Pay's online solution is extremely user friendly and many customers have relayed positive remarks. They more than met Davidson County's expectations and I would highly recommend Point & Pay's services for processing credit/debit card payments."

Hamilton County, Ohio (Cincinnati Metro) Contact and Title: Michael Lonneman, Chief Deputy Treasurer Phone: 513.946.4792 | Email: [email protected]

Project Summary: In 2011, Point & Pay acquired Hamilton County, the 3rd most populous county in Ohio, and implemented our web/online, IVR, and POS/Counter payment solutions. The project took approximately 48 days to implement all of the solutions. We serve the County’s Tax Office, Public Health, Juvenile Court, Law Library, Child Support, Criminal Court, Common Pleas Court, Probate Court, Soil & Water Conservation District, Building & Development, Adult Probation, Civil Court, and the Clerk of Court.

Testimonial: “We have had Point & Pay as our third party payment service provider for several years. During that time, they have worked with us to improve their products and services which have allowed us to better serve the taxpayers of Hamilton County.”

King County, Washington (Seattle Metro) Contact and Title: Anthony Laberge, Electronic Payments Coordinator, Finance & Business Operations Phone: 206.263.1624 | Email: [email protected] Project Summary: Point & Pay acquired King County, the state’s most populous county with over two million people, through competitive solicitation during 2016. Most recently, we began providing payment processing services to several County departments, including their Tax Office, Wastewater Treatment Division, Superior Court, Fire Districts. Point & Pay provides these department with payment capabilities via online, in-person, and IVR/phone. These include custom integration efforts, EMV terminals, and other services to facilitate providing the County with efficient efforts to process payments for various services.

City of Miami, OK 6 RFP 19-50_CCPMS

Point & Pay is proud to share that in March 2018, King County received a Technology Achievement Award from the Department of Executive Services for the “Countywide Electronic Payment Project”. They received this outstanding recognition because the project surpassed the County’s expectations for implementation of a new county-wide system for electronic payments processing. To achieve this milestone, we collaborated with County officials to implement over 20 new and unique payment applications within the first year of contract execution.

Orange County, Florida (Orlando Metro) Contact and Title: Scott Randolph, Tax Collector Phone: 407.836.2705 | Email: [email protected] Project Summary: Point & Pay has been providing multiple payment solutions to Orange County since 2013. Serving more than one million customers, Point & Pay provides the county with integrated payment processing services for their Tax division and DMV offices. We have also implemented custom settlement and reconciliation processes and universal cashiering solutions.

Testimonial: “Overall, we are extremely pleased with the level of professionalism, ingenuity, and service that we have received from Point & Pay. They guaranteed we would be up and processing within 30 days Orange County Online Tax Payments of signing, which we thought was very ambitious. They delivered.”

City of Miami, OK 7 RFP 19-50_CCPMS

Cowlitz County Public Works Contact and Title: Truly Paollili, Finance Phone: 303.577.3030, ext. 6533 Email: [email protected]

Project Description: In January 2015, Point & Pay executed a contract with Cowlitz County Public Works, another Washington utility agency, to implement the Electronic Bill Presentment & Payment (EBPP) component of our online solution.

Project Success: Approximately 40% of Cowlitz County customers have registered as an account user with the EBPP solution, including e- Billing notifications and the Autopay (or recurring) functionality. Cowlitz County Account Sign In

Diablo Water District, California Contact and Title: Jennifer McCoy, Accounting Operations Manager Phone: 925.625.0484 Email: [email protected]

Project Description: Point & Pay’s partnership with Diablo Water District began in March 2017 when we implemented our latest online payment solution for their customers, with electronic billing and presentment capabilities. We also performed a custom integration with their Conduent utility billing software system.

Point & Pay also negotiated a reasonable rate for the Diablo Water District since they absorb the processing fee for customers’ transactions.

Home Page for Online Payment Portal

City of Miami, OK 8 RFP 19-50_CCPMS

Franklin County, Ohio (Columbus Metro) Contact: Julie Grimes, Director of Financial Operations Phone: 614.525.3267 | Email: [email protected] Project Summary: In 2016, Point & Pay acquired the most populous county in Ohio through competitive solicitation. They chose the latest advancement to our online payment solution via an API integration, which provides the County’s taxpayers with electronic billing and extended payment options, such as mobile capabilities. Registered users have access to a wide array of account functionality, such as selecting the option to have paperless bills emailed, set up Autopay for recurring payments, future- dated payments, etc. We also provide Franklin County with our IVR Online Payments via Search-to-Pay and POS/Counter payment solutions for taxpayers who want other options.

Portage County, Ohio Contact and Title: Brad Cromes, Treasurer Phone: 330.297.3586 | Email: [email protected] Project Summary: Point & Pay acquired the Portage County Treasurer’s Office through competitive bid solicitation in April 2017. They chose our latest advancement to our online payment solution via an API integration, which provides the County’s taxpayers with electronic billing and payment options. Registered users have access to a wide array of account functionality, such as the option to have paperless bills emailed, set up Autopay for recurring payments, future-dated payments, etc. We also provide Portage County with our IVR/phone and In- person/counter solutions. Portage County Online Payments

City of Miami, OK 9 RFP 19-50_CCPMS

3.2 RFP Assurance and Abilities

1. This RFP seeks assurance of the following. Briefly discuss your firm’s ability to provide: a. Timely implementation; b. System stability; c. Software reliability and performance; d. Equipment quality and performance; e. Operator‐ and user‐friendliness; f. Maintainability; g. Quality training for users and technicians; and h. Quality service and maintenance.

Point & Pay is pleased to assure the City of Miami with the items outlined above to enable credit card processing and merchant services.

3.2.A Timely Implementation Point & Pay’s standard implementation methodology and timelines allow for expansion of the project scope and added time in key steps depending on the components ultimately selected by the City. Point & Pay’s structures our implementation teams around a project management philosophy that stresses ownership, communication, and process transparency. Point & Pay considers implementation the most critical phase and is mainly for the online system integration for the new payment solution. Our Program Manager will hold a zero defects meeting to verify the application performs efficiently and meets quality standards. The team expects to encounter minimal production fixes, and the schedule should allow for fixing the defects found in production.

Overall, the structure, methodologies, and quality of the individuals involved have allowed us to deliver a 98%+ on-time rate of project delivery for over 300 implementation projects per year.

3.2.B System Stability Point & Pay’s core platform is able to accommodate tens of millions of transactions daily. Our equipment and data centers are scalable, thereby providing the ability to add new equipment when necessary along with the support staff, if required.

Average number of daily 20 TPS based on 10 minute average; peaks of 250TPS+ for 1-hr duration transactions processed

Greatest number of We can scale horizontally to increase as volume capacities increase as transactions processed hourly needed. We have experienced TPS volumes up above 1,000 TPS for specific intervals, with nothing sustained over numerous hours or days. Please note that this number varies on the card network, transaction type, and bandwidths.

City of Miami, OK 10 RFP 19-50_CCPMS

Average annual merchant • $23.4 Billion in Visa volume, driven by 940 million transactions volume for credit cards • $7.2 Billion in MasterCard volume, driven by 290 million transactions • $3.6 Billion in American Express volume, driven by 145 million transactions • $1.8 Billion in Discover volume, driven by 75 million transactions

Maximum annual merchant Our capacity is always monitored to ensure our systems’ can handle volume for credit cards excess capacities of an additional 35% to 50% spikes in volume. Please note actual maximum volumes depend on the card network, transaction type, and bandwidths.

3.2.C Software Reliability and Performance Point & Pay’s average transaction response time is under one (1) second. Any variance in latency between transactions would typically be affected by factors outside of our control, such as varying internet latencies from the transaction origination point to and/or from us, and varying issuer response times.

Transaction times vary marginally depending on the type of transaction, what it does, and who it does it with. Capture transactions that only operate locally within our systems’ naturally complete more quickly (230 millisecond average) than transactions that require issuer authorizations (705 millisecond average), while AVS transactions fall in the middle as expected (493 millisecond average) due to less work at the issuer. The issuer responses can also vary. Visa authorizations are generally faster (436 millisecond average) than MasterCard (588 millisecond average), for instance.

3.2.D Equipment Quality and Performance Point & Pay offers PCI-encrypted MagTek swipe card readers, as well as, P2PE-encrypted Ingenico and Verifone EMV terminals for in-person/POS payment acceptance. For the chip-based terminals, our solution is unique in that it enables clients to be compliant with the EMV liability shift while still performing all of the transaction processing needs of government agencies, like split transaction routing for convenience fees. Features include:

 Support and installation for fully-featured multimedia terminals

 SDKs and methodologies for integrating with cashiering solutions

 Unique on-screen presentation of convenience fees and capture of fee acceptance

3.2.E Operator and User-Friendliness Point & Pay offers all of our solutions in a fully hosted, cloud based, secure environment that allows for a customizable and flexible implementation, reporting, and interfaces/integration, featuring a dynamic

City of Miami, OK 11 RFP 19-50_CCPMS

user-friendly experience for both consumers and City staff. Our easy to navigate web-based screens guide the user through the payment process in a simplified and straightforward manner.

Point & Pay receives consistent, positive feedback from our clients that our web and mobile payment processing solutions prove to be an effective tool based on the merits of our user experience design.

3.2.F Maintainability Point & Pay is able to process payments 24 hours a day, 7 days a week and performs any necessary ongoing maintenance updates remotely. Our platform easily accommodates tens of millions of transactions daily, and our equipment and data centers are scalable, thereby enabling us to add new equipment as necessary, along with the associated support staff, if required.

To maintain continuous payment processing services during normal business hours, we do not schedule updates between 6 AM and 8 PM, Monday through Friday, EST. We will provide the City with 24-hour, 7 days a week maintenance to ensure minimal “down” time and maximum availability of the services to customers. We also provide seven (7) days advance notice of any scheduled maintenance that will result in system unavailability, as well as send email notifications for change outages weekly to designated City representatives.

3.2.G Quality Training for Users and Technicians Point & Pay details the training we will provide to staff to perform all necessary functions of the new solution in Section B.9 Implementation and Training of Exhibit B - Questionnaire. We will provide the City with training efforts during implementation to include on-site visits, technical assistance, and user manuals. Point & Pay will also provide training throughout the life of the contract.

Point & Pay offers our solutions with a full training package, including multiple online/web sessions with our staff to accommodate work schedules, instructor led training to accommodate staff prior to implementation, as well as dedicated support prior throughout the roll out process. To further training efforts, we typically furnish materials to our clients, such as user guides, product-specific specifications, security policies and best practices, as well as desktop reference cards.

3.2.H Quality Service and Maintenance Point & Pay is committed to providing our clients and their customers with quality service and maintenance from the very beginning, as well as the duration of the contract. We reserve two windows per week for code releases and system maintenance. These occur on Thursday’s and Sunday’s between 2:00 AM – 5:00 AM, EST. Though these windows are reserved, a typical month may only have two (2) to three (3) instances of scheduled maintenance take place. Due to system redundancy, the vast majority of our maintenance windows contain no impact to our clients’ payment processing capabilities and are transparent to users.

City of Miami, OK 12 RFP 19-50_CCPMS

4 Specifications

The successful Proposer will furnish and install all applicable software and equipment, and provide services related to the installation and optimization of the system, subsystems, and other ancillary devices described by this RFP. Proposals must describe all software components, hardware components, services, and tasks required to implement a working, fully functional system, whether supplied by Proposer or City. Any and all components – whether hardware or software – required to make the system usable and fully operational that are not described in the proposal documents as being necessary, shall be provided at Proposer’s expense.

Point & Pay understands and complies with this requirement. Please refer to the following sections for detailed description on our proposed solutions.

4.1 Point-of-Sale Terminal Support of Various Functions

1. The Proposer’s point‐of‐sale terminal software must support the following functions: a. Transaction processing for Visa, MasterCard, and Discover; b. Automatic capture of payment details; c. Authorization of payment amounts; d. Void and refund; e. Dual‐copy receipt; f. Decline notification message; g. Rejection detail for non‐authorized transactions; h. Update, add, or delete clerk and/or supervisor; and i. Determination of batch cutoff time by location.

Point & Pay’s proposed POS payment solution provides terminal support of the functions referenced above for items A – I.

Point & Pay’s proposed solution includes POS payment acceptance available for all departments. Our experience and capability as an in-person payment service provider is a strength of our business and a frequent differentiator for our clients. Point & Pay’s solution architecture consolidates critical payment processing functions through a single provider. We deploy our own interfaces for collection of payments over the web, phone, and virtual terminal products while consolidating transactions from POS terminals and other external products. We also integrate this process with our clients’ software applications to ensure real-time transaction posting, account balance updates, and continual coordination.

 Point & Pay WorkBench – Point & Pay offers a fully featured cloud-based interface for fast, easy, in-person checkout. Staff can access the application by login/password and it connects to payment peripherals, including PCI-encrypted card-readers and printers.

City of Miami, OK 13 RFP 19-50_CCPMS

 Embedded Checkout – Point & Pay offers an embeddable interface to supplement existing cashiering applications with direct electronic payments capabilities. This integration component allows for PCI scope reduction while still residing within the City’s software.

 API Payments Gateway – We can expose an API for in-person payments generated by external software, terminals, or other checkout applications. In this way, the City can utilize existing systems or preferred hardware while still taking advantage of our processing capabilities and integration benefits.

Features of our in-person services include:

 Strong encryption controls  Unique approach to handle convenience fee transactions on card readers or terminals  Electronic access to support functions like voids, refunds, etc.  Options for installation/configuration support

4.2 Web Page Functionality

2. The Proposer’s web page must support the following functions: a. Transaction processing for Visa, MasterCard, and Discover; b. Automatic capture of payment details; c. Authorization of payment amounts; d. Decline notification message; e. Rejection detail for non‐authorized transactions; f. Determination of batch cutoff time by location; and g. Confirmation number to customers.

Point & Pay’s proposed web pages of our online payment solutions provide the functionality referenced above in items A – G, and more.

Online Payment Solution for City Utilities/Water Department To enable online/web payment capabilities for the City of Miami, Point & Pay proposes our best-in-class, BillPay solution with an intuitive, real time platform that engages users, is available 24/7/365, and accepts all credit cards, debit cards, and electronic checks. The City will experience the benefits below since our BillPay solution:

1 Enhances customer engagement with the best payment experience in the industry 2 Drives electronic utilization by offering valuable tools and efficient services 3 Leverages the latest technologies with advanced features 4 Modernizes the City’s approach

City of Miami, OK 14 RFP 19-50_CCPMS

With Point & Pay’s BillPay solution, the City is able to customize field settings, business rules and validations. We also utilize the strongest security and encryption controls that meets or exceeds PCI standards and integrates seamlessly with government systems. Features and benefits include:

 Customizable mobile-dynamic formatting to present pages clearly on any device  Accommodating over 100 language options  One time, future-dated, and recurring payment capabilities  Electronic/paperless billing option  Display of billing and payment history, with PDF download of statements and print options  Manage personal profile, including storing payment methods  Email and text messaging and Ad-hoc customer communication tools  Shopping carts for managing multiple payments in the same checkout  Display of convenience fee for each type of payment method prior to customer selection

Solution Highlights Point & Pay’s mobile-dynamic dashboard personalizes every aspect of the payment process in a simplified and streamlined manner that engages users and creates return customers for account management. After clicking on a link from the City’s website, the customer will be able to search for their bills from the payments home page, and are able to choose the payment type before entering the payment details.

They will also be presented with the option to login with their personal email and generate a password for identification. However, if they want to expedite the process and use existing sign on credentials from social media accounts, they have this ability via Facebook or Google (shown below). With this capability, the process proves faster for customers to sign up for account services with those credentials.

City of Miami, OK 15 RFP 19-50_CCPMS

Search-to-Pay Functionality for a One-Time Payment

City of Miami, OK 16 RFP 19-50_CCPMS

Shopping Cart Functionality

Point & Pay’s proposed BillPay solution offers customers two options in using a credit card, pin-less debit card, and/or electronic check to make payments directly to the City. Our goal was to make the payment process simple and streamlined, but most importantly, to engage customers so clients experience increased utilization. 1 For a quick, one-time payment without logging in, the solution presents the customer with the option to select their preferred payment method and displays the convenience fee associated with each type. By automatically displaying this fee on screen, the customer is able to instantly view the cost associated with each method (as shown in the following image).

2 If the customer registers as an account user, they will be able to save multiple payment methods under the ‘Profile’ tab of their dashboard. When they decide to make a payment or schedule a specific payment frequency, they simply select the ‘Saved Payments’ option, which displays all of their saved payment types (i.e., credit card, debit card, e-Check information). Just like option 1 above, Point & Pay’s BillPay solution displays the convenience fee associated with each type.

City of Miami, OK 17 RFP 19-50_CCPMS

Payment Options

City of Miami, OK 18 RFP 19-50_CCPMS

Review Payment Details

City of Miami, OK 19 RFP 19-50_CCPMS

With Point & Pay’s proposed BillPay solution, the customer will not only be able to view all payment details on the confirmation page, but the system will automatically email a receipt that includes the transaction date, amount of their bill, the processing/convenience fee, total amount paid, a unique confirmation number, as well as the option to print a receipt. We can also set up other data fields if the City prefers to display additional payment information.

Payment Confirmation with Option to Print

City of Miami, OK 20 RFP 19-50_CCPMS

Future-Dated Payments Point & Pay’s proposed BillPay solution provides customers with the ability to schedule future-dated payments by displaying a user-friendly calendar icon during the payment process. We can also tailor the solution to recognize specific due dates required by the City and other required payment timelines. However, if the City does not want to offer this feature, we can simply turn it off. Please see the following images as an example.

User-friendly Calendar Icon (above) and Confirmation of Scheduled Payment (below)

City of Miami, OK 21 RFP 19-50_CCPMS

Recurring and Other Scheduled Payment Capabilities To establish automatic recurring payments, registered customers can enable this functionality for a defined schedule, so they can set it and forget it based on their preferred billing frequency, payment method, total amount due, specific amount, or an “up to” limit. With this convenient functionality, the customer avoids having to log in each month and manually pay their bill.

This efficient feature allows customers’ payments to process automatically at a specific time each month, such as the due date, prior to the due date, weekly, monthly, quarterly, or yearly. It also offers the option to process payments every one (1) to six (6) weeks or one (1) to six (6) months. Once activated, this feature automatically populates the next three (3) payment dates and displays those dates on screen for the customer to view.

At any point the Recurring Schedule (above) and Other Payment Schedule (below) customer decides to stop their recurring schedule, they only have to change the toggle switch from ‘On’ to ‘Off” – it’s that simple.

City of Miami, OK 22 RFP 19-50_CCPMS

Account Activity & Statement History Customers are able to view account activity that includes successful, scheduled, and cancelled payments with all associated payment data. They will also be able to access up to 24 months of their statement history which displays an image of their electronic bill by selecting the PDF icon. Please note we can enable this feature as long as we receive the necessary data files from the City during implementation.

City of Miami, OK 23 RFP 19-50_CCPMS

Customer Notifications via Email or Text Point & Pay’s proposed BillPay solution provides an unlimited amount of customer notifications/alerts within the communications platform (listed below), and the system is able to send these alerts via email and/or text. The City will be able to edit such notifications and customize the solution with our technical specialists during the configuration phase of implementation.

 Confirmation of account registration

 Enrollment in paperless billing

 Enrollment in recurring payments Notification of Account Enrollment (above) and Notification of  Reminder of a new Recurring Payment Schedule (below) eBill, regardless of frequency

 Scheduled payments

 Cancelled payments

 Confirmation of successful payments

 Confirmation of unsuccessful payments

 Declined payment methods

 Expired payment methods

 Invalid payment methods

City of Miami, OK 24 RFP 19-50_CCPMS

 Email batch notifications (shown below) – limitless possibilities for staff to send notices to groups of customers with registered accounts, such as high balance delinquency, weather events, etc.

Email Batch Notification Options for Staff

City of Miami, OK 25 RFP 19-50_CCPMS

BillPay Reporting Options Our advanced online BillPay solution offers City staff additional reporting options to monitor Future Payments, Bounced Emails, Paperless Billpayers, and Active Billpayers. After selecting the button ‘Generate Report’, the system automatically sends an email to their inbox in a spreadsheet format. The fields included within a report for payments includes Account ID, Billpayer Name, Billpayer Email, Total Order Amount, Description, Order Created Date/Time, Order Scheduled Date, Order Cancelled Date, Payment ID, and Error Message (if applicable).

Report Options - Future Payments, Bounced Emails, Paperless Billpayers, and Active Billpayers

City of Miami, OK 26 RFP 19-50_CCPMS

Self-Service Help Options Point & Pay understands customers may require assistance during account registration and/or the payment process. As such, we designed our solutions to accommodate those customers’ needs at any time with automated help functionality available to them with one simple click online, or who to contact by phone.

City of Miami, OK 27 RFP 19-50_CCPMS

Online Payment Solution for Other City Departments We are pleased to offer the Point & Pay-hosted online payment solution that is mobile-responsive across all devices available in the market today and includes payment acceptance of Visa, MasterCard, Discover, and American Express credit card, debit cards, and electronic checks (eCheck). The solution also accepts prepaid cards, gift cards, promotional cards, corporate cards, international credit cards, and other emerging options, as long as those cards include the logo from the major brands above.

We are able to enable this online capability by integrating seamlessly with the City’s software application that utilizes the strongest security and encryption controls that meets or exceeds PCI standards. Each City department is also able to customize field settings, business rules, and validations.

Features and benefits include:

 Real-time authorization for all payments types  Customizable mobile-dynamic formatting to present pages clearly on any device  Display of convenience fee for each card type prior to submitting payment  Shopping cart functionality  Validation of card number as its typed  Real-time reporting capabilities

City of Miami, OK 28 RFP 19-50_CCPMS

Point & Pay-Hosted Payments Page

City of Miami, OK 29 RFP 19-50_CCPMS

Payment Method Entry with Display of Fee for Each Type

City of Miami, OK 30 RFP 19-50_CCPMS

Review Payment Details (above) and Payment Approval with Email Confirmation and Option to Print (below)

City of Miami, OK 31 RFP 19-50_CCPMS

4.3 Additional Requirements

3. Additional Requirements: a. System availability 7 days per week, 24 hours per day including holidays; b. POS training and support; c. Toll‐free authorization number; d. Toll‐free problem resolution number; e. Storage of payment detail and summary records for a minimum of two years; f. Capability to view and export transaction files and reports from website; g. Capability for transaction inquiry by transaction date or amount, card type, card number, or merchant ID; h. Ability to view, export, and customize reports; i. Detail and appropriate response time for chargebacks; and j. Determination of user access privileges by the City.

Point & Pay recognizes the importance of system uptime and availability in government payment processing. Collections are frequently driven by key due dates and we understand that we serve as a front line to customers and that our performance is a reflection on the City. Therefore, Point & Pay’s platform is able to process payments 24 hours a day, 7 days a week and easily accommodates tens of millions of transactions daily. Our equipment and data centers are scalable, thereby enabling us to add new equipment as necessary, along with the associated support staff, if required.

Training and Support Point & Pay will provide the City of Miami with ongoing support during implementation to include training, technical assistance, user manuals, and on-site visits, as needed. Point & Pay offers our solutions with a full training package, including multiple online/web sessions with our staff to accommodate work schedules, instructor led training to accommodate City staff prior to implementation, as well as dedicated support prior throughout the roll out process. Key areas of our training initiatives include:

 Administrative Application: User management, views of real time and other reports, search for payments, and similar issues

 Online Components: Managing bills, batches, and customer interactions

 Counter Application: Methods for accepting, voiding, and refunding payments

 Settlement, Reporting, and Reconciliations: Principles of Point & Pay reporting products, identify settlements, and reconcile your payments

Toll-Free Client/Customer Service Support Point & Pay will provide the City of Miami with customer service support staff via phone and email. We understand that only part of a project’s success stems from successfully deploying the system on time and within budget. It also measures project success in terms of vendor support, by offering the highest

City of Miami, OK 32 RFP 19-50_CCPMS

level of customer service possible. Point & Pay best illustrates our commitment to quality by our willingness to meet City staff and customer needs.

We currently offer responsive, U.S.-based customer support and help desk assistance on a 24/7/365 basis. Our help desk support staff follows rigorous standards, leading to swift and thorough resolution of all customer issues and concerns. Point & Pay divides our customer and client service support calls into first and second level support, based on the complexity and urgency of the issue.

Customer Services – 1st Level Support

 Making payments “Point & Pay definitely exceeded my expectations in providing  Scheduling payments excellent account management  Accessing customer accounts from day one. Not only do they address our needs adequately and  Void/Refund/Chargeback questions and support efficiently, but they also provide superior customer service.”  General questions and issues Client Services – 1st Level Support Michael Finney Trial Court Administrator  Assistance with Passwords/Logins Baker County Justice Court, OR

 Help with Reports/Settlements/Deposits  Assistance with payments “Working in the customer service industry, I know what it takes to do  Chargebacks, refunds, voids, and returned check support a good job and the customer service at Point & Pay is  Report an issue outstanding.” Operations Lines – 2nd Level Support Greg Wilson,  Complex customer issues Customer Service Supervisor

 Modify a configuration

 Validation, duplicate check, and exclusion configurations

 Banking/Settlement Changes

 Adding services

 Advanced Troubleshooting

Online Reporting Component Point & Pay’s suite of robust, real-time reporting tools enables all the requested details, filters, and parameters. As a Software-as-a-Service (SaaS) solution, our reporting component does not require clients to utilize a specific software to receive and view reports. We provide real time/ad hoc reporting and file- based reporting, and are able to deliver a payment file daily and make online reports available for download in Excel, CSV, and PDF formats. We can also customize batch or end-of-the-day reporting to fit the City’s needs and ensure we satisfy all specific report requirements, including access rights and appropriate permissions for all employees. Designated users can create real time, online reports based

City of Miami, OK 33 RFP 19-50_CCPMS

on any of the following data fields: 1) Date range, 2) Product, 3) Channel, 4) Status, 5) Payment method, 6) Office location, and 7) Settlement/deposit data.

Point & Pay’s reporting component is also comprehensive and customizable. During implementation, our technical team can customize flexible configurations for the City’s reports to “roll up” or “drill down” directly within the online reporting tool by selecting various levels of report parameters customized for content, format, and frequency.

The system is also able to map MIDs and deposit configurations to individual payment types, and the payments and records are perpetually linked for all secondary service interactions like voids, refunds, etc.

The Point & Pay system is able to manage an unlimited hierarchy and control settlement and reporting per client instructions from any tier of that structure.

Custom Report Parameters

City of Miami, OK 34 RFP 19-50_CCPMS

Please see a sample daily batch summary and daily batch detail report below. Both of these reports are available in real time via the Point & Pay online reporting component. We can also configure the solution to send these reports electronically via email.

Daily Batch Detail Report

Daily Batch Summary Report

The Payment Report (shown on the following page) allows for flexible grouping and filtering parameters where the City can run them on an Enterprise level or in segregation. The report displays the details for each group/filter.

City of Miami, OK 35 RFP 19-50_CCPMS

The system can also display this report for all payment channels.

City of Miami, OK 36 RFP 19-50_CCPMS

Secure Online Reporting – Sample Payment Report

City of Miami, OK 37 RFP 19-50_CCPMS

Sample Bar Graph and Pie Chart from Payment Report

City of Miami, OK 38 RFP 19-50_CCPMS

Payment Search Functionality & Storage of Payment History for Staff Point & Pay’s proposed solution provides users with the ability to search for payment in real time to view current and past payment data. From the Payments drop-down menu, staff and other designated users are able to search for payments in several ways, such as Payment ID, Account Number, Credit Card Number, total amount, payment amount, customer name, and approval code.

Point & Pay’s solution stores account information securely within our environment for a period of two (2) years and this data is available to clients immediately via our online tools. We retain all records for a minimum of seven (7) Payment Search Functionality years, in accordance to industry rules and regulations.

Role-Based Access for Report & Transaction Management Point & Pay’s Workbench is username/password accessed with a role-based permission system that controls the content and functionality available to users. Generally, tasks and functions are aggregated into categorical roles (e.g. supervisor, accounting, etc.), but individual functional permissions can also be dictated. Additionally, the City can manage all of the permissions from a hierarchical perspective.

As an example, Point & Pay can configure administrative accounts to view activity across all of the sub- divisions/payment types, but a manager configured to a lower tier in the hierarchy (e.g. Business Licenses) Management of System Access and Reporting would only see activity related to their area. In the same way, individual representatives can be limited only view activity they have performed.

City of Miami, OK 39 RFP 19-50_CCPMS

4.4 Settlement Proceeds Requirements

a. Settlement for Visa, MasterCard, and Discover, will be by Automated Clearing House (ACH) credit directly into a bank account specified by the City. In no event shall any of the settlement proceeds be made into the Provider’s bank accounts. Please specify and discuss the timing of the availability of funds, especially as it relates to pricing.

Point & Pay understands and complies with this requirement. Point & Pay processes settlements via ACH and we are able to support direct, next day settlement for the City of Miami. However, we offer other settlement timing, configuration, and methodology choices.

b. The City will receive sufficient detail in the ACH credit records to tie receipts down to Merchant ID and Merchant Name within the City.

Point & Pay understands and complies with this requirement. Our reporting component described in Section 4.3 Additional Requirements provides this level of detail and more.

c. Vendor will deduct all Visa, MasterCard, and Discover discounts and processing fees from settlement proceeds.

Point & Pay understands and complies with this requirement.

4.5 Security

a. The contract will require adherence to Payment Card Industry Data Security Standard (PCI DSS). The Proposer must include acknowledgement of responsibility for the security of cardholder data and provide validations of PCI compliance. A link to the certification and/or a hard copy of the compliance certification must be provided.

Point & Pay is proud to share that we are PCI-DSS and SSAE 18 (SOC 1) Type II compliant and certified. The SOC 1 Type II standard extends the security considerations covered by PCI and adds operational and financial controls. Point & Pay is proud to report full SOC 1 Type II compliance since 2012 with no exceptions reported in the last seven years.

Please refer to our two current certificates on the following page.

City of Miami, OK 40 RFP 19-50_CCPMS

City of Miami, OK 41 RFP 19-50_CCPMS

b. The agreement will require “Red Flag” mandate compliance. The successful Proposer must develop and implement an Identity Theft Prevention Program to include reasonable policies and procedures for detecting, preventing, and mitigating identity theft.

Point & Pay understands the agreement requires “Red Flag” mandate compliance, and we will develop and implement an Identity Theft Prevent Program for the City that includes reasonable policies and procedures for detecting, preventing, and mitigating identity theft.

We are familiar with the laws and practices for fraud detection. We built our system to consist of many controls (duplicate detection, exception management, real time authorization, etc.) in addition to fraud detection features provided through the card process networks, such as unusual activity, AVS, CVV, instant cancellation, consumer protection policies, etc. Point & Pay has experience implementing policies and procedures to conform to the versions of these protocols in place for several states and we are confident in our ability to do the same for the City of Miami.

c. What would be the vendor’s response to security breaches or loss of information? Please provide a comprehensive review of the vendor’s internal and external security procedures. Please describe Internet sign‐on and multi‐factor identification procedures.

Point & Pay follows PCI and other industry standards to control access to information (key cards, passwords, encryption, need to know rules, etc.) to aid in prohibiting access to this data. At the City’s site, we control access to the Point & Pay administrative interface by passwords, which give employees access to only the information needed to perform their jobs. During system configuration, the Point & Pay account manager configures this hierarchy of security. Point & Pay will work with the City to ensure we designate the appropriate permissions and access rights to employees. In addition, the Point & Pay administration application logs out automatically after 30 minutes.

Additionally, Point & Pay is proud to share we have never had an incident/breach occur in the past and we look forward to completing this potential contract with that record intact; however, should an event occur, it is our philosophy to involve the City in the remediation process from the beginning, with full transparency, as we make decisions that affect our shared customers.

Point & Pay follows a formal incident response plan upon detection of a breach or other security event. Our Incident response plan covers the appropriate steps for managing the incident through the following key steps: communication, identification, severity classification, containment, eradication, recovery, and root cause analysis resulting in improvement of security controls. Our Information Security Department takes the following actions as soon as they identify and classify an incident.

Stage 1 – Detection, Containment, and Monitoring 1 System detection of an incident/breach 2 Generate a high-priority notification through the event communication process to internal and external stakeholders.

City of Miami, OK 42 RFP 19-50_CCPMS

3 Establish a conference bridge for real-time communication between stakeholders and decision-makers, both internal and external. 4 If possible, record the user, IP address, and domain of intruder. 5 Utilize approved technology controls to block the intruder’s access temporarily or permanently. 6 Maintain vigilance for future break-in attempts from this user or IP address.

Stage 2 – Contain, Monitor, and Warn 1 Collect and protect information associated with the intrusion. 2 Utilize approved technology controls to block the intruder’s access temporarily or permanently. 3 Research the origin of the connection. 4 Contact ISP and ask for more information regarding the attempt and intruder. 5 Research potential risks related to intrusion method attempted and re-evaluate for higher classification and incident containment, eradication, and recovery as described for Level 3 incident classifications. 6 Upon identification, inform malicious user of our knowledge of their actions and warn of future recriminations if user attempts to repeat their actions. If an employee is the malicious user, management will work with Human Resources to address the Acceptable Use violation appropriately. Stage 3 – Contain, Eradicate, Recover, and Conduct Root Cause Analysis

1 If the incident involves credit card systems, we will notify the Acquirer and applicable card associations. 2 Contain the intrusion and decide the appropriate actions to implement. Consider unplugging the network cables, applying highly restrictive ACLs, deactivating or isolating the switch port, deactivating the user ID, terminating the user’s session/change password, etc. 3 Collect and protect information associated with the intrusion via offline methods. In the event that forensic investigation is required, the Information Security Department will work with legal and management to identify appropriate forensic specialists. 4 Notify management of the situation and maintain notification of progress at each following step. 5 Eliminate the intruder's means of access and any related vulnerabilities. 6 Research the origin of the connection. 7 Contact ISP and ask for more information regarding attempt and intruder, reminding them of their responsibility to assist in this regard. 8 Research potential risks related to or damage caused by the intrusion method used.

City of Miami, OK 43 RFP 19-50_CCPMS

d. What would be the City’s liability in the event of a security breach, loss of data, or default by the payment card service provider or third‐party portal?

Point & Pay would not hold the City liable in the event of security breach, loss of data, or default by the payment card service provider or third-party portal.

e. Please describe the position of Visa, MasterCard, and Discover with regard to a merchant’s (City’s) ability to require a purchaser to provide identification.

Visa, MasterCard, and Discover do not require for the merchant to request identification from the purchaser if the back of the credit or debit card is signed. However, if the credit or debit card is not signed, the merchant can ask the purchaser to show a government-issued ID and sign the card on the spot, in their presence.

In general, the card associations operating rules and regulations agree that a government-issued ID should not be used as a condition of accepting a purchase if all other standard acceptance criteria are met. However, as we have frequently experienced in the support of other government payment programs, there is separation between the concept of the “purchase” and the “purchase transaction.” If the merchant or the City requires an identification standard for certain purchases (e.g. Passport issuance, official records requests, etc.), that requirement is considered separate from the requirements of the financial transaction that completes the purchase. The merchant may enforce its own rules with regards to the requirements to provide goods and services, regardless of the transaction methodology used to complete the procees.

4.6 Disaster Recovery

The Proposer will be required to provide a description of backup procedures in the event that terminals or communication links are not operational.

Point & Pay’s proposed solution includes full hardware and location redundancy so that no single point of failure can cause downtime, and even in the case of a catastrophic loss of an entire hosting facility, traffic would route to the backup hosting facility automatically. Point & Pay maintains 24/7 connectivity for all interfaces, including online and IVR, using our hosted data center provider. Critical platform components are redundant, and provide dedicated human supervision of critical processes, especially those that are client facing, or involve the movement of funds. Point & Pay features a robust set of monitoring tools that continually monitor the availability of critical system components, metrics, and processing pathways.

Point & Pay provides a comprehensive recovery process that minimizes recovery time and restores the ability to process payments and remit settlements as soon as possible. The goal of our disaster recovery plan is to restore remittance capabilities within the same banking day of any disaster event and electronic payment processing within 48 hours of the event. We maintain multiple ISPs and VPN links to our data center. Fueled standby generators are onsite to ensure a power source in the event of a power

City of Miami, OK 44 RFP 19-50_CCPMS

disruption. To ensure continual availability of all systems, even in the case of a disaster that disables our entire primary data center, Point & Pay has a fully redundant backup “hot” site to guarantee data integrity and rapidly restore services. In the case that the primary site goes down, the traffic volume automatically transfers to the backup site.

Point & Pay’s Business Continuity Plan and Incident Management Plan identifies our back up facilities that mirror our standard site in the event of a disaster. In addition to an unforeseen disaster, we have added additional safeguards for our clients during critical collection periods. Point & Pay tests this plan annually, and continually reinforces responsibilities with key managers and new hires. We have developed a detailed and tested business continuity plan which includes the orders of succession for the Account/Relationship Manager and Project Manager should our business and technical contacts become unavailable during a disaster event. Upon award of contract, we will furnish the City with regular and emergency phone number and e-mail addresses for all individuals in the succession.

Point & Pay recognizes that your customers, especially those online and in your offices, cannot be inconvenienced by any sort of downtime or slowdown. We are the front line for your customers, and their ability to pay when they need to is a reflection on you. We take that responsibility seriously, and as such, have invested in this new technology to ensure your customers can always pay on demand.

City of Miami, OK 45 RFP 19-50_CCPMS

5 Proposal Requirements

COMPLIANCE WITH LAWS, STANDARDS AND PRACTICES: Proposals must comply with all federal, state, county, and municipal laws. Materials and workmanship must conform to the highest standards of manufacturing and engineering practices. All items used must be new and unused in first class condition, of current manufacture and be of the type generally accepted for the proposed use.

Point & Pay understands and complies with all laws, standards, and practices as referenced above.

PRICING: Provide a price schedule for the services described in the RFP – which would also include the pricing for any service fees to be assessed. Please discuss any special rules pertaining to service fees or credit/debit card fees. Include any one‐time fees, research fees and all other fees that will or could be charged (e.g., interchange rates by location, regular and ad hoc reporting costs).

Point & Pay understands and complies with this requirement. Please see Exhibits A.1, A.2, and A.3 for detailed information.

5.1 Exhibit A.1

1. Outline all fees in Exhibit A.1 which include card processing fee (as basis points), card transaction fee (dollar amount per transaction), and chargeback fee (dollar amount per transaction, monthly fees, annual fee, and one‐time fee.

Point & Pay provides proposed fees in Exhibits A.1 as requested for the City of Miami.

City of Miami, OK 46 RFP 19-50_CCPMS SECTION 5 – PROPOSAL REQUIREMENTS

1. Outline all fees in Exhibit A.1 which include card processing fee (as basis points), card transaction fee (dollar amount per transaction), chargeback fee (dollar amount per transaction, monthly fees, annual fee, and one‐time fee.

EXHIBIT A.1 TRANSACTION FEES Instructions: * Populate only fields highlighted in green * For fees not included below, list them in the Other Fees section /tab * Explain changes from year‐to‐year on a separate page, as required. Proposals without a fee schedule specific for each contract term (first term of six years and the two optional terms of two years) indicate that your prices will be fixed for the two optional terms. Proposer: Point and Pay, LLC d/b/a Point & Pay Item Fee Notes Card Processing Fee (as basis points)*** The proposed fee schedule will be for the life of the contract.

$0-$300.00=$2.95, The pricing is for all card types and is Visa then $3 every $100 based on a convenience fee model. MasterCard $0-$300.00=$2.95, The pricing is for all card types and is then $3 every $100 based on a convenience fee model. Discover $0-$300.00=$2.95, The pricing is for all card types and is then $3 every $100 based on a convenience fee model. American Express $0-$300.00=$2.95, The pricing is for all card types and is then $3 every $100 based on a convenience fee model. Debit Card $0-$300.00=$2.95, The pricing is for all card types and is then $3 every $100 based on a convenience fee model.

Card Transaction Fee (dollar amount per transaction) Visa $0.00 Because the pricing offer is a convenience fee, there is no per transaction fees.

Page 9 of 23

MasterCard $0.00 Discover $0.00 American Express $0.00 Debit Card $0.00

Chargeback Fee (dollar amount per transaction) Card Chargeback fee $0.00

E‐check Transaction Fee (dollar amount per $0.95 transaction) Return Fee (Dollar amount per transaction $0.00 Chargeback Fee (Dollar amount per $0.00 transaction) Reserve (dollar amount) $0.00

Notice of Change $0.00

Monthly Fees Monthly Account Fee $0.00 e‐check Monthly Fee $0.00 Mobile Application Fee $0.00

Annual Fee PCI Validation Fee $0.00

Maintenance Fee (Please Explain) $0.00

Compliance Fee (Please Explain) $0.00

One‐Time Fee e‐check Account Setup Fee $0.00 Existing Terminal Encryption Fee $0.00 Shipping Equipment Fee $0.00 Set‐up Merchant fee $0.00 Customize Reporting Fee $0.00 Shipping Equipment Fee $0.00

Page 10 of 23

2. Include both purchase and lease prices for stand‐alone credit card processing units which include EMV‐enabled terminal, wireless terminal, and credit card swipe reader. See Exhibit A.2. Please list any other fees for any additional equipment needed on exhibit A.3.

EXHIBIT A.2 EQUIPMENT FEES Instructions:

* Attach equipment specifications and a price list for any additional equipment that you offer and specifications * For fees not included below, list them in the Other Fees section/tab * Explain changes from year‐to‐year on a separate page, as required. Proposals without a fee schedule specific for each contract term (first term of six years and the two optional terms of two years) indicate that your prices will be fixed for the two optional terms. Proposer: Point and Pay, LLC d/b/a Point & Pay Item Price Notes Purchasing Price EMV‐Enabled Terminal/Printer (ING‐iCR220 or similar) EMV ‐ Enabled Terminal/Printer (Other $200.00 Ingenico ICT-220 Model ‐Explain) EMV ‐ Enabled Terminal/Printer (Other Model ‐Explain)

Wireless Terminal $350.00 plus $10 PayAnywhere Smart Terminal Wireless Terminal (Other Model ‐ Explain) month software fee Credit Card Swipe Reader‐ Wireless (Explain) $50.00 PayAnywhere 2-1 reader Credit Card Swipe Reader ‐ Jack (Explain)

Leasing Price (Monthly fee) EMV‐Enabled Terminal/Printer (ING‐ iCR220 or similar) EMV ‐ Enabled Terminal/Printer (Other $20.00 per month Ingenico ICT 220 Model ‐Explain) EMV ‐ Enabled Terminal/Printer (Other Model ‐Explain) Wireless Terminal Wireless Terminal (Other Model ‐ Explain) $30.00 per month PayAnywhere Smart Terminal

Credit Card Swipe Reader‐ Wireless (Explain) Credit Card Swipe Reader ‐ Jack (Explain) N/A

Page 11 of 23

EXHIBIT A.3 OTHER FEES Instructions:

* Attach equipment specifications and a price list for any additional equipment that your offer and specifications * Other Fees ‐ Populate all fields and provide a detail explanation in the notes field (e.g. monthly, annual, transaction fee, etc.) * Explain changes from year‐to‐year on a separate page, as required. Proposals without a fee schedule specific for each contract term (first term of six years and the two optional terms of two years) indicate that your prices will be fixed for the two optional terms. Proposer: Point and Pay, LLC d/b/a Point & Pay Item Frequency Fee Notes There are no other fees associated with the Point & Pay product offerings, the fees presented will be valid for the life of the agreement.

Page 12 of 23

3. Submission of a proposal shall be conclusive evidence that the Proposer has investigated and is satisfied as to the conditions to be encountered in performing the work. The proposed pricing structure will apply to any and all City operational areas. However, the City makes no representation that individual departments will utilize services of any particular service provider under the master agreement to be established as a result of this RFP, or that present card processing activity levels presented in this RFP will remain constant.

4. Failure to submit all required pricing information will result in the proposal being considered non‐responsive. Proposers are required to hold prices firm for a minimum of 120 days in order that an award be made.

Page 13 of 23

Client References

Provide three (3) references of comparable clients to whom your firm has provided credit card processing services. Refer to Exhibit A.2 for requested information for each client. The evaluation committee will ascertain from the references their satisfaction with your service, systems and implementation processes, as well as your organization’s perceived responsiveness.

Highline Water District – Seattle, Washington

Contact and Title: Greg Wilson, Customer Service Supervisor Phone Number: 206.592.8914 Email: [email protected]

Project Description: In early 2016, the Highline Water District sought to implement a new interface for customers to pay their utility bills, including electronic billing and payment services. Point & Pay responded with our latest online solution to provide their customers with a new, modernized, and functional payment system. As a result, they have achieved an Highline Water District Online Payment Portal adoption rate of 60% for customers who have converted to paperless billing.

Testimonial: “We repeatedly receive compliments from our customers that the functionality of Point & Pay’s web portal is extremely user- friendly and easy to navigate. Overall, Point & Pay has exceeded my expectations in how efficient and streamlined the payment process is for our customers.”

City of Miami, OK 1 RFP 19-50_CCPMS

City of Flagstaff, Arizona – Utilities Department

City of Miami, OK 2 RFP 19-50_CCPMS

Hamilton County, Ohio (Cincinnati Metro) Contact and Title: Michael Lonneman, Chief Deputy Treasurer Phone: 513.946.4792 | Email: [email protected]

City of Miami, OK 3 RFP 19-50_CCPMS

Cowlitz County Public Works Contact and Title: Truly Paollili, Finance Phone: 303.577.3030, ext. 6533 Email: [email protected]

City of Miami, OK 4 RFP 19-50_CCPMS

Diablo Water District, California Contact and Title: Jennifer McCoy, Accounting Operations Manager Phone: 925.625.0484 Email: [email protected]

Point & Pay also negotiated a reasonable rate for the Diablo Water District since they absorb the processing fee for customers’ transactions.

Home Page for Online Payment Portal

City of Miami, OK 5 RFP 19-50_CCPMS

City of Miami, OK 6 RFP 19-50_CCPMS POINT & PAY, LLC E-PAYMENT SERVICES AGREEMENT

Parties:

Point & Pay, LLC (“PNP”) City of Miami, OK (“Client”) A subsidiary of NAB, doing business in Delaware

Terms 1.4 Service Promotion SECTION 1 E-PAYMENT SERVICES Client will use reasonable efforts to promote the Services and build awareness of the Services with its customers through 1.1 Access to Payment Modules various media including, but not limited to: 1.1.1 Pursuant to this E-Payment Services Agreement (this • Print: Bill inserts, counter displays, and “Agreement”), PNP grants Client a limited, non-exclusive, non- announcements in Client’s newsletter transferable and terminable license for the duration of the Term • Online: Home page announcements with an easily to use the electronic payment services (the “Services”) and accessible, one-click link to payments page. payment modules (each, a “Module”) chosen in the attached • product application (“Product Application”) to enable Client’s Phone/IVR: Pre-recorded message with the ability to customers (“Customers”) to make payments to Client using a transfer to payments IVR (e.g., “Press 2 to make a Payment Device. “Payment Device” means the payment type(s) payment”) or provide the IVR phone number to call. chosen by Client on the Product Application. A description of all • Joint Press Releases: The parties shall mutually agree Modules, Services, training and support offered by PNP is upon press releases announcing the availability of attached as Exhibit A (the “Services Description”). electronic payment services and the partnering of Client and PNP. 1.1.2 At the time of Client’s execution of this Agreement, Client 1.5 Trademark License shall also return the completed Client Application to PNP. Subject PNP grants Client a limited, non-exclusive, non-transferable to the terms and conditions of this Agreement, the Services may license to use the PNP trademarks, service marks and logos be also be used by the affiliated offices, bureaus, agencies or provided by PNP to Client (the “Trademarks”) solely in departments of Client (“Affiliates”). Each Affiliate shall complete connection with Client’s promotion of the Services to Customers. a Client Application prior to commencement of the Services. Client shall not alter the Trademarks nor use the Trademarks in any way which is disparaging, dilutive or otherwise adversely 1.2 Client Representatives affects the reputation of PNP. PNP will provide Client’s authorized representatives with a logon and password to access the Counter Module. Client shall be 1.6 Client Logo License solely responsible for maintaining the confidentiality and security Client grants PNP a limited, non-exclusive, non-transferable of the logons and passwords provided by PNP. Client will cause license to use its applicable logos, copyrighted works and each of its representatives to change the initial password, keep trademarks (“Client Marks”) solely in connection with the the passwords confidential, refrain from sharing passwords Services provided to Client. Client shall provide the Client Marks and/or logon information with any unauthorized user, and use no to PNP for use with the Services. Client represents that it has all other password to access the Counter Module. PNP shall be intellectual property rights required for Client’s and PNP’s use of entitled to rely on any communications it receives under Client’s Client Marks, and shall indemnify PNP against any third party passwords, logon information, and/or account number as having claims that the Client Marks infringe the intellectual property been sent by Client, without conducting any further checks as to rights of a third party. the identity of the user of such information. PNP will not be responsible for the operability or functionality of any of Client’s computer equipment, system, browser or Internet connectivity.

1.3 Payment Device Transactions All Payment Device transactions using the Services will be processed through a secured link. The parties to each Payment Device transaction will be the Customer cardholder, the Client and PNP.

PNP E-Payment Services Agreement v2.0 rev 071008 1 SECTION 2 COMPENSATION and other proprietary rights, protected or protectable, under the laws of the United States, any foreign country, or any political 2.1 Services Transaction Fee subdivision thereof, including (a) all trade names, trade dress, PNP will charge the transaction fee to use the Services set forth trademarks, service marks, logos, brand names and other on the Product Application. If Services fees are charged directly identifiers, (b) copyrights, moral rights (including rights of to Customers by PNP, Customers will receive a notice each time attribution and rights of integrity), (c) all trade secrets, inventions, they use the Services stating that the Services are provided by discoveries, devices, processes, designs, techniques, ideas, PNP and that a convenience fee is charged for use of the know-how and other confidential or proprietary information, Services. PNP may change the amount of such fee by notifying whether or not reduced to practice, (d) all domestic and foreign Client of such new amount at least thirty (30) days prior to such patents and the registrations, applications, renewals, extensions change. and continuations (in whole or in part) thereof, and (e) all goodwill associated with any of the foregoing and (f) all rights and causes 2.2 Activation Fee of action for infringement, misappropriation, misuse, dilution or If applicable, Client shall pay the one-time Activation Fee set forth unfair trade practices associated with (a) through (d) above. on the Product Application. If the Activation Fee or any portion of the Activation Fee is waived by PNP and the Client does not 3.2 Ownership and Use of PNP Materials implement the Service under this Agreement within six months Any software developed by or on behalf of PNP for use in after the Effective Date, other than due to a material breach by connection with the Services remains the exclusive property of PNP, the waived portion of the Activation Fee shall become PNP. Client will not sell, transfer, barter, trade, license, modify immediately due and payable. or copy any such software. Web pages accessible through use of the Services are the copyrighted intellectual property of PNP 2.3 Charge-backs and Returns and may not be copied in whole or part by anyone. Any training Unless otherwise specified in the Product Application, PNP will materials (including, but not limited to, webinars and manuals) set off (a) the amount of any charge-backs, refusals to pay and provided to Client by PNP shall remain the exclusive property of returns from any amounts otherwise owing by PNP to Client and PNP. PNP grants Client and Client’s personnel a limited, non- (b) a transaction handling fee for charge-backs and non-sufficient exclusive, non-transferrable license to use and to make copies of funds (NSF) as specified in the Product Application. the training materials with its personnel solely in connection with the Services. Training materials may not be modified by Client or 2.4 ACH Debit of Fees its personnel or disclosed to any third party, including Client’s Client hereby authorizes PNP, and any subsidiary or successor end-user customers. Client shall ensure all personnel shall thereof, solely with respect to amounts due pursuant to this complete and review all training materials prior to using the Agreement and any subsequent agreements between Client and Services. PNP, including but not limited to service fees, transaction fees, charge-backs and returns as set forth in Sections 2.1 and 2.3 of 3.3 Reverse Engineering this Agreement, to initiate Automated Clearing House (“ACH”) Client will not reverse engineer, reverse assemble, decompile or Authorizations to credit and debit Client’s bank account as set disassemble any of PNP’s intellectual property, nor will Client forth on the Banking Authorization Form attached hereto as attempt to do so or enable any third party to do so or otherwise Exhibit B or otherwise provided by Client. Client acknowledges attempt to discover any source code, modify the Service in any that it will be subject to a $25 reject fee if items are returned for manner or form, or use unauthorized modified versions of the insufficient funds. Service, including (without limitation) for the purpose of building a similar or competitive product or service or for the purpose of SECTION 3 INTELLECTUAL PROPERTY; obtaining unauthorized access to the Service. Client is expressly CONFIDENTIALITY prohibited from sublicensing use of the Service to any third parties. If Client becomes aware that any person has engaged 3.1 No Transfer or License or is likely to have engaged in any of the activities described in Except for the rights expressly granted to Client in this this Section 3.3, Client will promptly notify PNP. Agreement, no PNP Intellectual Property Right is transferred or licensed to Client pursuant to this Agreement, by implication or otherwise. PNP reserves and retains all rights, title and interests in and to the PNP Intellectual Property Rights, and all copies, revisions, modifications, updates, and upgrades thereof. Client agrees not to remove, alter or destroy any copyright, patent notice, trademark or other proprietary markings or confidential legends placed on or within any portion of the PNP Intellectual Property Rights. For purposes of this Agreement, “Intellectual Property Rights” means all the intellectual property, industrial PNP E-Payment Services Agreement v2.0 rev 071008 2

3.4 Confidential Information appropriate remedy or waive compliance with the confidentiality 3.4.1 Any Confidential Information provided by PNP to Client provisions of this Agreement. pursuant to this Agreement will remain the exclusive property of PNP. Client will disclose such Confidential Information only to 3.6 Failure to Comply those of its representatives and employees who need to know If Client fails to comply with any of its obligations pursuant to this such Confidential Information for purposes of performing this Section 3, PNP will have the right to immediately terminate this Agreement, who are informed of the confidential nature of the Agreement by providing written notice of such termination to Confidential Information and who agree, for the benefit of PNP, Client. to be bound by the terms of confidentiality in this Agreement. Client will, and will cause each of its representatives and 3.7 Survival employees, to keep confidential and not to disclose in any The rights and obligations of the parties provided for in this manner whatsoever any Confidential Information provided by Section 3 will survive any expiration or termination of this PNP pursuant to this Agreement, and not to use such Confidential Agreement or its term. Information, in whole or in part, directly or indirectly, for any purpose at any time other than for the purposes contemplated by this Agreement. Notwithstanding the foregoing, if Client is a city, SECTION 4 WARRANTIES; DISCLAIMER county, township or similar entity, or government agency or department thereof, Client may disclose Confidential Information 4.1 Warranties as necessary to comply with applicable public records laws. 4.1.1 Each party represents and warrants that it has the full legal right, authority and power to enter into this Agreement and

perform its obligations hereunder. 3.4.2 For purposes of this Agreement, “Confidential

Information” means all nonpublic or proprietary information of 4.1.2 PNP represents and warrants that the Services will be PNP, including proprietary, technical, development, marketing, provided in a professional, workman-like manner consistent with sales, operating, performances, cost, know-how, business and industry standards. process information, computer programs and programming techniques, security features (including, without limitation, multi- 4.2 Disclaimers level access and log-in features, audit trail setup, interfaces 4.2.1 PNP does not represent that Client’s or its Customers use between the Counter Module and the Internet or IVR Modules), of the Services will be uninterrupted or error-free, or that the all record bearing media containing or disclosing such information system that makes the Services available will be free of viruses and techniques, and anything marked confidential, that is or other harmful components resulting from the Internet or any disclosed by PNP to Client pursuant to this Agreement. third party providers or products outside the control of PNP. Confidential Information also includes the terms and conditions of this Agreement. 4.2.2 EXCEPT FOR THE WARRANTIES EXPRESSLY SET FORTH IN THIS SECTION 4, PNP DISCLAIMS ALL 3.5 Exclusions WARRANTIES, EXPRESS OR IMPLIED, STATUTORY OR The term Confidential Information will not apply to information OTHERWISE, INCLUDING, WITHOUT LIMITATION, that: (a) is or becomes generally available to the public other than WARRANTIES OF MERCHANTABILITY, FITNESS FOR A as a result of a disclosure by Client in breach of this Agreement; PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE (b) was within Client’s possession prior to its disclosure by or on SERVICE IS PROVIDED TO CLIENT ON AN “AS IS” AND “AS behalf of PNP, provided that the discloser of such information was AVAILABLE” BASIS, AND IS FOR COMMERCIAL USE ONLY. not known by Client to be bound by a confidentiality agreement with, or other contractual, legal or fiduciary obligation of confidentiality to, PNP with respect to such information; (c) becomes available to Client on a non-confidential basis from a source other than PNP, provided that such source is not known by Client to be bound by a confidentiality agreement with, or other contractual, legal or fiduciary obligation of confidentiality to, PNP with respect to such information; or (d) is developed independently by Client, as demonstrated by the written records of Client, without use of such information. The confidentiality obligations of Client pursuant to this Agreement will not apply to any Confidential Information of PNP that Client is legally compelled to disclose. In the event Client becomes legally compelled to disclose any Confidential Information provided pursuant to this Agreement, Client will provide PNP with prompt written notice so that PNP may seek a protective order or other PNP E-Payment Services Agreement v2.0 rev 071008 3

SECTION 5 LIMITATIONS OF LIABILITY AND SECTION 8 TERM AND TERMINATION OBLIGATION 8.1 Term 5.1 Damages and Liability Limit The initial term of this Agreement will commence on the Effective IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE Date and will end on the third (3rd) anniversary of the Effective OTHER PARTY OR ANY THIRD PARTY IN CONNECTION Date (the “Initial Term”). This Agreement will automatically WITH THIS AGREEMENT FOR INDIRECT, INCIDENTAL, renew for successive one (1)-year terms (each, a “Renewal CONSEQUENTIAL, RELIANCE, SPECIAL, EXEMPLARY OR Term,” and the Initial Term and any Renewal Term may be PUNITIVE DAMAGES, INCLUDING DAMAGES FOR LOST referred to as a “Term”). The term of this Agreement will PROFITS, EVEN IF THE OTHER PARTY HAS BEEN ADVISED terminate at the end of the Initial Term or any subsequent OF THE POSSIBILITY OF SUCH DAMAGES. EACH PARTY Renewal Term if either party provides written notice of such RELEASES THE OTHER PARTY AND ALL OF THE OTHER termination to the other party at least sixty (60) days prior to the PARTY’S AFFILIATES, EMPLOYEES, AND AGENTS FROM expiration of the applicable Term. ANY SUCH DAMAGES. IN NO EVENT WILL PNP HAVE OR INCUR ANY LIABILITY TO CLIENT OR ANY THIRD PARTY IN 8.2 In the Event of Breach; Effect on Affiliates EXCESS OF THE AGGREGATE COMPENSATION RECEIVED 8.2.1 Subject to the opportunity to cure set forth below, either BY PNP FOR THE SIX-MONTH PERIOD IMMEDIATELY party may terminate this Agreement upon sixty (60) days written PRECEDING THE EVENT GIVING RISE TO A CLAIM FOR notice to the other party in the event of a material, uncured SUCH LIABILITY. THE FOREGOING EXCLUSIONS AND breach of any provision of this Agreement by the other party. LIMITATIONS WILL APPLY TO THE MAXIMUM EXTENT Such notice by the complaining party shall expressly state all of PERMITTED BY APPLICABLE LAW, EVEN IF ANY REMEDY the reasons for the claimed breach in sufficient detail so as to FAILS ITS ESSENTIAL PURPOSE. provide the alleged breaching party a meaningful opportunity to cure such alleged breach (“Notice”). 5.2 Refusals of Payment PNP will not be liable for charge-backs or other refusals of 8.2.2 Following receipt of Notice, the alleged breaching party payment initiated by any Customer. All such charge-backs and shall have sixty (60) days to cure such alleged breach. Upon other refusals of payment will be refunded by PNP to the termination or expiration of this Agreement, Client shall have no Customer and Client will mark and otherwise treat the related rights to continue use of the Service or the Modules. Expiration Customer account as “unpaid.” or termination of the Agreement by Client or PNP shall also terminate the Affiliates’ rights under the Agreement unless 5.3 Errors and Omissions otherwise agreed by the parties in writing. PNP may terminate PNP will not be liable for any errors or omissions in data provided the Agreement solely with respect to an individual Affiliate by Client or Customers. Client will be responsible for the without affecting the rights and obligations of Client and other accuracy of data provided to PNP for use in providing the Affiliates under the Agreement. Services. 8.3 Modification to or Discontinuation of the Service 5.4 Bank Actions PNP reserves the right at any time and from time to time to PNP will not be liable for any errors, omissions or delays modify, temporarily or permanently, the Service (or any part attributable to the acts or omissions of any bank or other third thereof). In addition, PNP will have the right to discontinue party involved in the processing of any Payment Device payment. accepting any Payment Device by providing not less than ten (10) days’ written notice to Client. In the event that PNP modifies the SECTION 6 CARDHOLDER DATA SECURITY Service in a manner which removes or disables a feature or To the extent applicable, each of the parties shall be required to functionality on which Client materially relies, PNP, at Client’s comply at all times with the Payment Card Industry Data Security request, shall use commercially reasonable efforts to Standard Program (“PCI-DSS”) in effect and as may be amended substantially restore such functionality to Client. In the event that from time to time during the term of the Agreement. The current PNP is unable to substantially restore such functionality within PCI-DSS specifications are available on the PCI Security sixty (60) days, Client shall have the right to terminate the Standards Council website at Agreement. Client acknowledges that PNP reserves the right to https://www.pcisecuritystandards.org. discontinue offering the Service and any support at the conclusion of Client’s then-current Term. Client agrees that PNP SECTION 7 EXCLUSIVITY shall not be liable to Client nor to any third party for any Client agrees that PNP will be the exclusive provider of fee-based modification of the Service as described in this Section. electronic payment services and that Client will not procure similar such services from any other party.

PNP E-Payment Services Agreement v2.0 rev 071008 4

SECTION 9 PAYMENT DEVICE TRANSACTION MISCELLANEOUS DEPOSITS The headings of sections and subsections of this Agreement are The exact amount of each approved Payment Device transaction for convenience of reference only and will not be construed to will be electronically deposited into the Client bank account alter the meaning of any provision of this Agreement. PNP is an identified on the Client Application. PNP shall initiate such independent contractor and nothing in this Agreement will be deposits as specified on the attached Client Application. PNP will deemed to create any agency, employee-employer relationship, provide Client’s authorized employees with access to PNP’s partnership, franchise or joint venture between the parties. online transaction reports for reconciliation purposes. Except as otherwise specifically provided in this Agreement, neither party will have, or represent that it has the right, power or SECTION 10 FORCE MAJEURE authority to bind, contract or commit the other party or to create PNP will not be responsible for its failure to perform under this any obligation on behalf of the other party. Each of the parties Agreement due to causes beyond its reasonable control, will have any and all rights and remedies available to them under including acts of God, wars, riots, revolutions, acts of civil or all applicable laws. The remedies provided for in this Agreement military authorities, terrorism, fires, floods, sabotage, nuclear will be deemed to be non-exclusive and in addition to any other incidents, earthquakes, storms, or epidemics. If the provision of available remedy at law or in equity. All rights and remedies are Services under this Agreement is delayed by such an event or cumulative and may be exercised singularly or concurrently. condition, PNP will promptly notify Client thereof. PNP will use Client may not assign or transfer any of its rights or delegate any commercially reasonable efforts to overcome any such cause for of its obligations under this Agreement to any third party, by delay as soon as is reasonably practicable. operation of law or otherwise, without the prior written consent of PNP. Any attempted assignment or transfer in violation of the SECTION 11 GOVERNING LAW foregoing will be void. This Agreement will be binding upon, and This Agreement will be interpreted, construed and enforced in inure to the benefit of, the successors and permitted assigns of all respects in accordance with the laws of the State of the parties. Client shall comply with all applicable laws, rules, Oklahoma without reference to its conflicts of law principles. treaties, and regulations in its performance of this Agreement. If any provision of this Agreement is held by a court of law to be SECTION 12 NOTICES illegal, invalid or unenforceable, the remaining provisions of this All notices or other communications required or permitted by this Agreement will not be affected and the illegal, invalid, or Agreement must be in writing and will be deemed to have been unenforceable provision will be deemed modified such that it the duly given when delivered personally to the party for whom such intention of the parties to the fullest extent possible. No notice was intended, or upon actual receipt if sent by facsimile or amendment or modification of this Agreement will be effective delivered by a nationally recognized overnight delivery service, or unless it is in writing and executed by both of the parties. Nothing at the expiration of the third day after the date of deposit if contained in this Agreement establishes, creates, or is intended deposited in the United States mail, postage pre-paid, certified or to or will be construed to establish or create, any right in or registered, return receipt requested, to the respective parties at: obligation to any third party. This Agreement, the Exhibit(s) and the Client Application set forth the entire agreement and understanding of the parties with respect to the subject matter If to Client: See Merchant Application hereof and supersedes any and all prior or contemporaneous understandings and agreements, whether written or oral, If to PNP: Point & Pay, LLC between the parties with respect to such subject matter. 110 State St. E, Suite D Oldsmar, FL 34677

The parties have duly executed this Agreement as of the date of the last signature below (the “Effective Date”).

Point & Pay, LLC City of Miami, Oklahoma

By: ______By: ______

Name: ______Name: ______

Title: ______Title: ______

Date: ______Date: ______

PNP E-Payment Services Agreement v2.0 rev 071008 5 Exhibit A Services Description

The following is a description of all Services and Modules offered by PNP. PNP shall provide the Services to Client and its end-user customers via the specific Modules and Payment Devices chosen by Client in the Client Application. Applicable fees, if any, for Client’s elections are set forth on the Client Application. The Services include support and training outlined below at no additional charge to Client.

Service Modules • Counter Module. The Counter Module allows customers to make payments to Client in a face-to-face environment or over the phone using a Payment Device. PNP will issue unique confirmation numbers to customers who have completed a payment transaction using the Counter Module. The Counter Module also enables Client’s staff to access reports via the web. The Counter Module is required to access the PNP Services. The Counter Module may be used in conjunction with or independently of point- of-sale (POS) terminals.

• Web Module. The Web Module allows customers to make payments to Clients online using a Payment Device via a secure website hosted by PNP. Customers who elect to make payments via the Internet can follow a link from the Client website to the Client-branded, PNP-hosted web pages to submit a payment. PNP will issue unique confirmation numbers to customers who have completed a payment transaction using the Web Module. Client may elect bill presentment and account validation functionality for the one-time set-up fee set forth on the Client Application under “Data File Integration.”

• Interactive Voice Response (IVR) Module. The IVR Module allows Customers to make payments to Clients over the phone using a Payment Device. The Customer calls a toll-free phone number provided and managed by PNP to access the Client branded IVR. The IVR system recognizes Customer instructions through making a payment; the phone keypad is used to enter Payment Device numbers. The IVR system is configured and tested by PNP. PNP will issue unique confirmation numbers to customers who have completed a payment transaction using the IVR Module. Election of the IVR Module includes a Client-branded IVR environment and, if applicable, Client shall pay the one-time IVR set-up fee for the IVR Module set forth on the Client Application. In addition, Client may elect to have bill presentment and account validation functionality enabled through the IVR for the one-time set-up fee on the Client Application under “Data File Integration.”

Customer Payment Devices Each of the Modules can provide the Customer with the ability to pay by Credit Card, Debit Card and/or Electronic Check.

Training PNP shall provide instruction manuals and up to four (4) hours of webinar training to Client and Client personnel in connection with the Modules chosen by Client.

Support The following support shall be provided to Client and Client’s customers at no additional charge during the term of the Services:

• First Level Support. PNP shall provide first-level support to Customers via PNP’s call center. Customer service representatives shall be available 8 a.m. EST to 10 p.m. EST M-F, to handle customer inquiries. • Second Level Support. PNP shall provide first-level support to Client via telephone. Second level support shall be available Monday through Friday during normal business hours.

Support availability shall be exclusive of downtime due to scheduled maintenance or events out of PNP’s control. Support for the Products may be modified, suspended or terminated in PNP’s sole discretion upon prior written notice.

PNP E-Payment Services Agreement v2.0 rev 071008 6 Exhibit B

Client Application

Client Bank Banking Application

Product Application

PNP E-Payment Services Agreement v2.0 rev 071008 7 (Shaded areas are for internal use only) Partner Code:

Submission Account Representative: Date: Price per Target Live Card Readers Quantity: $ reader: Date: Client Profile Client Legal Name as filed with the IRS: Federal Tax ID:

DBA: Physical Address: City: State: Zip: Website Address: Phone # to display on customer receipts: Contacts Primary Contact Name: Primary Phone #: Primary Email:

Accounting Contact: Accounting Phone #: Accounting Email:

Payment Types Visa MasterCard Discover AMEX Electronic Check Utility Program (Absorbed) Fee Summary Fees Absorbed by Client Fees Paid by Customer Tiered Fees Auto Debit Manual Billing Credit Card – Flat Fee $ Debit Card – Flat Fee $ Credit Card – Percentage Fee % Credit Card – Minimum Fee $ E-check – Flat Fee $ Credit Card – Chargeback Fee $ Credit Card - Tiered Fees: Fee = $ for payments between $0.01 to $50.00 Fee = $ for payments between $50.01 to $100.00 Fee = $ for payments between $100.01 to $150.00 Fee = $ for payments between $150.01 to $200.00 Fee = $ for payments between $200.01 to $250.00 Fee = $ for payments between $250.01 to $300.00 Fee of an additional $ for payments between the next $50 range as outlined Fee = $ for payments between $0.01 to $100.00 Fee = $ for payments between $100.01 to $200.00 Fee = $ for payments between $200.01 to $300.00 Fee = $ for payments between $300.01 to $400.00 Fee = $ for payments between $400.01 to $500.00 Fee = $ for payments between $500.01 to $600.00 Fee of an additional $ for payments between the next $100 range as outlined

Manual Billing Fees: Call-In/Web Payment Mail-In/Check Billing Contact Info: Debit/Net settlement Product Summary Software Partner/Contact Info: Total Annual Average Highest Product Name Payment Channel Collections Payment Payment POS IVR WEB EBPP 1 $ $ $ Other POS Other WEB POS IVR WEB EBPP 2 $ $ $ Other POS Other WEB POS IVR WEB EBPP 3 $ $ $ Other POS Other WEB POS IVR WEB EBPP 4 $ $ $ Other POS Other WEB POS IVR WEB EBPP 5 $ $ $ Other POS Other WEB POS IVR WEB EBPP 6 $ $ $ Other POS Other WEB POS IVR WEB EBPP 7 $ $ $ Other POS Other WEB POS IVR WEB EBPP 8 $ $ $ Other POS Other WEB POS IVR WEB EBPP 9 $ $ $ Other POS Other WEB POS IVR WEB EBPP 10 $ $ $ Other POS Other WEB Banking Summary Deposit Structure: Net Settlement Debit If Debit: Same account in which funds were deposited Use specific account ending in Product Name (or # from above) Bank Name Routing # Account # Account Type Checking Savings Checking Savings Checking Savings Checking Savings Checking Savings Checking Savings Checking Savings Checking Savings Checking Savings Checking Savings Notes

Signature The undersigned agrees to abide by the Terms and Conditions of the Global Merchant Services Agreement, viewable at www.pointandpay.com/agreement.

Signature Title

Name Date

iCT 220

Sophisticated merchant services in a compact standalone countertop device

• Provide merchants with a compact payment device using minimum countertop space.

• Offer a unique payment experience from an ergonomic, intuitive device.

• Accept all electronic payment methods including EMV chip & PIN, magstripe.

GPRS 3G audio jack contactless magstripe security smartcard tablet mobile POS smartphone color display barcode signature multimedia touch rugged color connectivity gps NFC ready connectivity text text capture screen backlit

GPRS GPRS 3G 3G audio jack contactless magstripe audiosecurity jack contactlesssmartcard magstripetablet mobilesecurity POS smartphonesmartcard colortablet display mobilebarcode POS smartphonesignature colormultimedi displaya barcodetouch signaturerugged multimedicolor a connectivitytouch ruggedgps NFCcolor ready connectivityconnectivity gpstext NFCtex readyt connectivity text text capture screen capture backlit screen backlit

GPRS GPRS 3G 3G audio jack contactless magstripe audiosecurity jack contactlesssmartcard magstripetablettablet mobilesecurity POS smartphonesmartcard colortablet displaydisplay mobilebarcode POS smartphonesignature colormultimedi displaay barcodetouchtouch signatureruggedrugged multimedicolor a connectivitytouch ruggedgps NFCcolor ready connectivityconnectivity textgpstext NFCtextex readytt connectivity text text capture screen capture backlit screen backlit

GPRS GPRS 3G 3G audio jack contactless magstripe audiosecurity jack contactlesssmartcard magstripetablettablet mobilesecurity POS smartphonesmartcard colortablet display mobilebarcode POS smartphonesignature colormultimedi displaay barcodetouchtouch signatureruggedrugged multimedicolor a connectivitytouch ruggedgps NFCcolor ready connectivityconnectivity textgpstext NFCtextex readytt connectivity text text capture screen capture backlit screen backlit

GPRS GPRS 3G 3G audio jack contactless magstripe audiosecurity jack contactlesssmartcard magstripetablettablet mobilesecurity POS smartphonesmartcard colortablet display mobilebarcode POS smartphonesignature colormultimedi displaay barcodetouchtouch signaturerugged multimedicolor a connectivityconnectivitytouch ruggedgpsgps NFCNFCcolor ready ready connectivityconnectivityconnectivity textextgpst NFCtextex readytt connectivity text text capture screen capture backlit screen backlit

GPRS GPRS 3G 3G audio jack contactless magstripe audiosecurity jack contactlesssmartcard magstripetablet mobilesecurity POS smartphonesmartcard colortablet display mobilebarcode POS smartphonesignature colormultimedi displaay barcodetouch signaturerugged multimedicolor a connectivitytouch ruggedgps NFCcolor ready connectivityconnectivity gpstext NFC texreadyt connectivity text text capture screen capture backlit screen backlit

GPRS 3G compatible with compatible with compatible with audio jack contactless magstripe security smartcard tablet mobile POS smartphone color display barcode signature multimedia touch rugged color connectivity gps NFC ready connectivity text text capture screen backlit

iOS android iOS android

compatible with compatible with compatible with

iOS android iOS android

compatible with compatible with compatible with

iOS android iOS android The iCT220 is the most convenient and reliable standalone payment device on the market.

Highest Security All Connectivity & Communication The iCT 220 meets the highest security requirements and is PCI PTS 2.x Equipped with an unparalleled array of communication technologies such and 3.x certified with SRED and Open protocol modules. The optional PIN as high speed modem or Ethernet, the iCT 220 delivers anytime, anywhere privacy shield provides additional PIN entry confidentiality. connectivity.

All Payment Options Telium 2 Accept all electronic payment methods including EMV chip & PIN, and Powered by the Ingenico Group, Telium 2 technology is the result of 30 magstripe. years’ experience in the payment industry. Secure, highly integrated and fast, Telium 2 is the world’s best platform for secure payment services. Designed for Merchants Telium 2 is the fully scalable, reliable operating system embedded into Ingenico Group’s 27 million terminals deployed worldwide. Among the world’s smallest and lightest devices, the iCT 220 is designed for easy handling and robust daily use. The backlit keypad makes PIN entry and menu navigation easy and intuitive. Large keys and power buzzer speed transactions and reduce PIN entry errors.

Feature Description

Processor ARM 9 & ARM 7 •

Memory 16 RAM /16 Flash •

32 RAM /128 Flash Option

SAM 2

Card readers Smart card •

Magstripe •

Display Size & Resolution Black and white, 2.7’’ graphic 128 x 64 pixels

Backlit •

Terminal connectivity Dial-up modem •

Ethernet •

Keypad Backlit operational keys 15

Navigation keys 4

Audio Buzzer •

Thermal printer Speed in lines/second 18 l/s

Connections on terminal RS232 1

USB host 1

USB slave 1

Power supply connector 1

Power supply External power supply 110V 60Hz

Terminal size L x W x H 7.28 x 3.26 x 2.48

Weight Terminal without paper roll/cable 11.46 oz

Privacy shield Option

Customization Lens marking Option

Printer cover flap Option

Top casing Option

Connections on Magic Box (optional) Power supply connector 1

RS232 1

Line in 1

Ethernet 1

Environment Operating temperature 41°F to 113°F

Storage temperature 4°F to 131°F

Relative humidity, non-condensing 85% HR at +104°F

www.ingenico.us Build your app. Power your payments with PayAnywhere.

Deliver a seamless payment experience in your app using a simple integration and diverse hardware options with the PayAnywhere SDK for Android and iOS.

AVAILABLE FOR

Industry leading features.

Expanded payment acceptance Enhanced security Unrivaled versatility Keyed, swiped, EMV chip card, and Protect your business and safeguard Custom amounts, pre-auths, recurring contactless payments, including Apple Pay sensitive cardholder data with point-to- payments, and refunds — whatever and Samsung Pay. Accept whatever form of point encryption, tokenization, two-factor type of transaction you need to run, the payment your customers prefer. authentication, and the latest in PCI PayAnywhere SDK allows you to do so compliance. quickly, securely, and intuitively. Integrate with the payments platform that means business.

Our simple SDK, rich functionality, unparalleled developer support, and diverse hardware options make PayAnywhere the perfect partner for a seamless and secure payment integration.

PayAnywhere 2-in-1 Bluetooth 3-in-1 Bluetooth Accessories Smart Terminal Reader Reader  Cash drawer and Bluetooth  EMV chip cards  EMV chip cards  EMV chip cards receipt printer

 Contactless payments  Traditional magstripe cards  Contactless payments  Bluetooth barcode scanner

 Traditional magstripe cards  Traditional magstripe cards  Kitchen printer

 Built-in receipt printer

“PayAnywhere made the integration process very easy! We worked with their development team to build custom features specifically for our brand, including recurring payments. The team was thorough and very responsive. We would highly recommend PayAnywhere to any other integrators.”

-Givehub

©2018 PayAnywhere, LLC. All rights reserved. PayAnywhere (“PA”) is a registered Third Party Agent of BMO Harris N.A., Chicago, IL. American Express may require separate approval. PA is currently available only in the United States. iPhone and iPad are registered trademarks of Apple Inc. App Store is a service mark of Apple Inc. Android and Google Play are trademarks of Google Inc. Other designated trademarks and brands are the property of their respective owners. PayAnywhere Smart Terminal. Introducing the wireless smart terminal that runs on PayAnywhere’s point-of-sale software.

The perfect bridge between a traditional terminal and a complex POS system, the sleek, versatile, and portable PayAnywhere Smart Terminal combines:

A compact design featuring a Built-in receipt printer and front and 5” touchscreen, EMV chip card, NFC back cameras for easy barcode scanning. contactless, and magstripe reader.

Payment acceptance on your counter, 4G and Wi-Fi connectivity. around your location, or on the road.

The PayAnywhere Smart Terminal comes with access to PayAnywhere Inside, the online portal with the data and tools to power your business.

Accept online payments and create recurring invoices. Manage employee permissions, customers, and chargebacks. View, compare, and export real-time data for sales, customers, employees, and products. Accept payments. Run your business.

Terminal theme Retail theme Tickets & tabs For quicker transactions, Create a custom item library Open a ticket, run a card to start use a simple interface that with categories, modifiers, a tab, and close it out when the works like a traditional multiple prices, and customer is ready. Perfect for credit card terminal. stock management. bars and restaurants.

Time clock Sign & tip Built-in receipt printer We’ve teamed up with Give customers the opportunity to Allows for printable, Homebase to offer a free tip with preset options or a custom emailable, and time clock and employee amount when they are signing for textable receipts. scheduling functionality. their transaction.

© 2018 PayAnywhere, LLC. All rights reserved. PayAnywhere (“PA”) is a registered Third Party Agent of BMO Harris N.A., Chicago, IL. American Express may require separate approval. PA is currently available only in the United States. iPhone and iPad are registered trademarks of Apple Inc. App Store is a service mark of Apple Inc. Android and Google Play are trademarks of Google Inc. Other designated trademarks and brands are the property of their respective owners.

Exhibit B – Questionnaire

B.1 Merchant Credit Card Processing

Describe your company’s authorization method and list and describe alternative authorization methods.

As a standard, Point & Pay’s solution performs real-time authorization on-line and it occurs in a matter of seconds. Under on-line processing, the system authorizes each transaction separately as it occurs and returns the authorization status immediately after submitting the transaction for approval. If the system declines an on-line authorization, a system prompt will display and make the cardholder aware that their transaction did not process with the card used for payment.

Batch authorization is for a large number of batched transactions that the system transmits on a scheduled basis, typically at the end of the day. Batch authorization is best suited for programs where the service or product is not provided to the customer at the time the card number is presented or when the cardholder is not directly communicating with the agency, such as a mail order transaction. In the event of a declined batch authorization, the agency must contact the customer to pursue authorization (e.g., using a different card) or inform them that the system will not complete their transaction.

What are the procedures to reverse an incorrect authorization?

Within Point & Pay’s robust Workbench tool, there are permission-controlled functions for voids, including authorization release. Designated City staff with the appropriate access level can void a payment the same day a customer submits it and the void results in no transaction(s) to the customer or client. City staff can do this by searching for the customer’s name or confirmation number and then selects the option to void it. The system will prompt the user to confirm the action. The process of voiding a payment happens in real- time and posts to the Void Payment client’s payment report immediately, but does not affect their funding. Furthermore, a void implies that no funds will debit from the customer’s card/account.

City of Miami, OK B-1 RFP 19-50_CCPMS

Are there limitations on the number of transactions processed daily?

No, there are no limitations on the number of transactions processed daily.

What are the procedures to correct duplicate transactions?

Point & Pay’s system prevents duplicate payments by detecting them as a proprietary internal validation step that occurs prior to authorization. Should unique circumstances allow duplicates to process, we offer editing capabilities, as well as the ability to reverse/refund payments electronically. Our system also has built-in duplicate and other error prevention features that prevent these transactions from happening.

Describe the monitoring and notification process if a transmission fails.

If a transaction fails, depending on the circumstances of the failure, the system will either catch it in real time based on the authorization response (or lack thereof) or identify it in the reconciliation processes attached to batch confirmation. In both cases, the transactions generate alerts, which then routes the transaction to a management queue for follow up. In the case that the system could not process the transaction due to gateway availability, it will automatically be re-queued for processing once the gateway becomes available.

Point & Pay’s notification system is event driven for configurable responses. We can add City representatives to the distribution list for relevant alerts.

Outline the security measures in place for the protection of data transmitted for processing.

Please see the following security practices in place that Point & Pay adheres to in protecting data transmitted for processing. Authentication and Encryption Configurations Point & Pay utilizes hashing for authentication management to the processing application. Our standard encryption configuration utilizes RSA 2048 for encryption of VPN traffic, and AES-256 for data at rest. We also use Triple DES DUKPT to encrypt communication between our card acquiring devices. Point & Pay also encrypts all data transmitted off site.

Logging / Auditing Capabilities

 Over 40 automated processes and tools continuously monitoring system activity

 Over 180 manual, human-driven security checkpoints throughout the year

 Verbose logging of all user activity with immediate availability for 90 days

 Quarterly information security review by Point & Pay InfoSec Committee

City of Miami, OK B-2 RFP 19-50_CCPMS

 File integrity monitoring in place on all systems 24/7

 Intrusion detection/prevention systems monitoring all network entry points

 Annual audit for PCI DSS Level 1 compliance performed by certified QSA, which included verification of logging capability

Network Transmission Security (LAN and VPN) The Point & Pay platform is hardened against network transmission vulnerabilities by application of the following practices and standards:

 System builds based on CIS and SANS standards

 Web application firewalls protecting all systems 24/7

 Enterprise-grade firewalls in use in multi-layered, segmented network topology

 Information Security Management approach derived from the ISO/IEC 27001

 Development standards based on OWASP and SANS best practices

 All firewall changes required to undergo formal change control review

What process do you use to ensure that transactions qualify for the lowest interchange category? Please describe in detail.

Point & Pay ensures that transactions qualify for the lowest interchange category by optimizing transaction coding and processing methodologies for the best possible cost. We continually compare MID performance against portfolio baselines to monitor performance and our finance department analyzes all data related to downgrades, assessment, or transactions qualifying in sub-optimal interchange categories (e.g. standard, EIRF, etc.). Any upticks in these categories from baseline results in a performance review to help identify opportunities to improve qualification rates.

City of Miami, OK B-3 RFP 19-50_CCPMS

B.2 Third Party Processing

Explain your Company’s role; are you an acquirer, processor, other?

Point & Pay is an ‘All-in-One’ payments company, serving clients as an acquirer, processor, gateway, and biller. In this role, we are able to consolidate all functions in a typical government payments workflow.

Do you rely on third parties to process your merchant credit card transactions? If so, explain and provide the years of service you have been doing business with them and describe your relationship with your third party processor.

No, Point & Pay does not rely on third parties to process merchant credit card transactions; we process them in-house.

Describe in detail how your services are integrated with third party software, websites and gateways.

Point & Pay is able to capture specialized remittance data elements in real time that is required by each department needing to post customer payments. We utilize a wide array of integration methodologies with techniques designed to address needs from all parts of the integration spectrum: from those looking for a backend gateway, to those who want to perform complete customer handoff. In addition to the base specifications, Point & Pay has the ability to write to client specifications to perform many of the same data in/out functions described here, in clients’/partners’ native formats. Add-on components are also available, like single sign-on, dynamic cart exchanges, etc.

City of Miami, OK B-4 RFP 19-50_CCPMS

One of our most common methods is Parameter Passing, in which we provide a real-time interface that transfers customers to the Point & Pay-hosted payments page. This integration method allows for an efficient checkout process, and alleviates the City from any security threats or concerns. Parameter passing also offers the ability to lock fields and apply business rules as appropriate.

Other common integration methods include those referenced below.

 The Point & Pay Postback, posts customer payment status information in real time to the client’s system and provides multiple configuration options for clients, depending on their unique needs.

 The Point & Pay API Payments Gateway with Tokenization allows for fast, efficient, and secure payment processing by using single-use tokens to store a depiction of the customer’s card data. The Point & Pay API also accepts payments from any customer user interface, performs calls for fee calculation, and supports transaction querying based on a variety of inputs, including date ranges. We are able to configure the data associated with transactions using an unlimited quantity of client defined fields and attributes.

 Point & Pay also offers our API Connectors for real-time bill/balance lookup, customer information lookup, post payment notifications, and custom behavior flags (i.e., budget billing, escrow, restrictions, etc.). One of our advanced integration techniques involves developing custom API connectivity modules.

 Point & Pay offers a customizable Inbound File Exchange for driving bill/balance presentment and customer validation via “print files” and/or “balance update files”.

 With our Outbound File Exchange, we are able to customize the process for driving transaction results, settlement information, and other reporting functions via generation and delivery of files.

 With Point & Pay’s Real Time Query option, we send a request to look up the customer’s account balance and the client responds with a matching item.

 Embedded Payment with Tokenization allows our client/partner to embed a small payments widget within their cashiering screen and the payment posts within that frame by accepting input from external hardware. By incorporating tokenization, the client can capture a payment method and tokenize it for future applications without conducting a transaction at that time.

 Point & Pay further provides an Image Archive Exchange for clients by exchanging bill image locations via links, through a defined link-building logic, and/or an exchange of bulk PDF archives which we can parse and index automatically at our location.

City of Miami, OK B-5 RFP 19-50_CCPMS

B.3 Settlement

Can you provide next day settlement for Visa, MasterCard, and Discover Card network transactions? If not, what settlement schedules do you offer for each network? What factors will you consider in order to provide a more favorable schedule?

Yes, Point & Pay can provide next day settlement for Visa, MasterCard, and Discover transactions.

What is the latest time (hour) that sales transactions can be transmitted to meet these settlement times?

Point & Pay must configure cutoff times to allow enough time for batches to generate and transmit in time for an 11:00 PM EST submission deadline.

Please describe how settlement amounts will be listed on the bank statement or will they appear as one lump sum (meaning one amount for Visa, MasterCard, and Discover Card, one amount for American Express?)

Within the Reports component of the Point & Pay solution, settlement amounts display both a summary line at the bottom and details at the top. City staff users can manage and/or filter these details by card type, check, and payment channel (i.e., web/online, IVR, etc.). Configurations are available that enable a wide variety of settlement choices below. One example of how the settlement descriptor can be identified is: “PNPBILLPAY8888916064XXX.”

 Consolidated/aggregated settlement

 Department specific settlements

 Unique settlements by payment type, physical location, and/or channel (e.g., web vs. in-person)

 Individual and consolidated weekend settlements

Describe any limitations on the number of files/transactions: *Number of transactions contained in a batch? *Number of files transmitted daily?

With the Point & Pay proposed solution, there are no limitations on the following:

 Number of transactions contained in a batch

 Number of files transmitted daily

 Number of transactions or dollar limits per batch or file

 Settlement amounts

City of Miami, OK B-6 RFP 19-50_CCPMS

B.4 Disputes and Chargebacks

Provide a detailed description on how your company handles disputes, retrieval, and chargeback requests.

Point & Pay supports credit card chargebacks or other debit adjustments netted from daily proceeds and debited separately; we can accommodate the City’s preferred method. Point & Pay receives chargebacks in two categories:

 Allocation chargebacks are related to authorization and/or fraud, and we process those immediately, or as soon as we receive notification through our CRM system.

 Collaboration chargebacks are related to processing errors, customer disputes, or similar, and we handle these requests in an overnight process.

As soon as Point & Pay receives notification of a chargeback, the customer has received a temporary credit. Our standard procedure is to notify the merchant the same day we receive the chargeback. Less than 1% of all Point & Pay transactions are chargebacks. The internal process involves handling first-level follow up with the City of Miami by sending a detailed email about the chargeback and within 10 days of that notification, our system will reverse it.

Staff can view the reversal on the payment report and the payment details section displays it specifically as a chargeback. The City can dispute chargebacks in the same manner by providing us with the appropriate documentation, as well as the necessary signatures. Point & Pay will submit this documented evidence to our Finance Department, and as soon as they research the item, we will continue to communicate the outcome to a designated City representative. During this time, we hold the reversal until all associated actions are complete. Current card association guidelines indicate a chargeback resolution timeframe of 30 days. When considering the card association guidelines, Point & Pay’s overall process fits well within the association rules stipulating a 30 day cycle.

Full or Partial Customer Refunds Point & Pay offers real-time access to refund processing across the enterprise through our administrative Workbench tool. Using our search interface or by linking through our ad-hoc reporting tool, designated City staff can view transaction details and select the void or refund options appropriate to the transactions in question. These tools cover all transactions for all channels, including card-not present. We can restrict access to the void/refund functions to specific permissions within the user hierarchy.

As an enhanced option, Point & Pay also offers the ability to process partial refunds. We built business rules into this functionality to control the payments it is applicable for and the amounts. We also track and report on the reason codes. The City departments will have access to this functionality in processing refunds, however, if the City prefers to handle refunds internally, we will direct customers to contact the City instead.

City of Miami, OK B-7 RFP 19-50_CCPMS

What are your retrieval compliance timeframes?

Point & Pay provides an online, real time download of historical information regarding transactions, refunds, and chargebacks. Point & Pay’s system allows for immediate online access by the City for up to 24 months prior. Beyond that, we can provide additional historical reports within 24 hours of request.

B.5 Online Information Reporting Services

Describe all reports available and the software used to receive and view reports. Provide an overview of reporting cycles, procedures, and capabilities.

As the City is aware, Point & Pay’s proposed solution is comprised of a Software-as-a-Service (SaaS) infrastructure; therefore, the reporting component does not require use of a specific software to receive and view reports. Please see the following daily batch summary and daily batch detail reports. Both of these reports are available in real time via the Point & Pay online reporting component. We can also configure the solution to send these reports electronically via email.

Point & Pay’s suite of robust, reporting tools enables all the requested details, filters, and parameters. We provide real time/ad hoc reporting and file-based reporting. Point & Pay will deliver a payment file daily and make online reports available for download in Excel, CSV, and HTML formats. We can also customize batch or end-of-the-day reporting to fit the needs of the City and ensure we satisfy all specific report requirements, including access rights and appropriate permissions for all employees. Designated users can create real time, online reports based on any of the following data fields: 1) Date range, 2) Product (i.e. payment types), 3) Channel (online, IVR, counter), 4) Status 5) Payment method, 6) Office location, and 7) Settlement/deposit data.

Point & Pay provides a vast array of reports, including those listed below.

• Batch Detail • Merchant Disbursement by Bank • Batch Summary • Net Revenue • Order Detail • Net Revenue Details • Order Item Detail • Processor Deposit • Order Summary • Refund Detail • Invoice Detail • Refund Summary • Invoice Item Detail • Return Detail • Invoice Item Summary • Return Summary • Invoice Summary • Settlement Batch & Detail

City of Miami, OK B-8 RFP 19-50_CCPMS

Daily Batch Detail Report

Daily Batch Summary Report

City of Miami, OK B-9 RFP 19-50_CCPMS

Secure Online Reporting – Sample Payment Report

City of Miami, OK B-10 RFP 19-50_CCPMS

Describe the download capabilities, level of customization, and drill down capabilities available on online reporting and reports.

With Point & Pay’s proposed solution, we determine the standard delivery time that best meets the City’s needs and schedule those reports accordingly in collaboration with designated City officials. We can also establish multiple delivery methods, including the ability to send via email or placed in an FTP folder. Our robust reporting tools provide the City of Miami with access to all data in real time.

During implementation, our technical team can customize flexible configurations for the City’s reports to “roll up” or “drill down” directly within the online reporting tool by selecting various levels of report parameters customized for content, format, and frequency, as shown to the right.

Custom Report Parameters

Describe how multiple merchant numbers are reported.

Point & Pay features a full set of hierarchy control features for chaining accounts together and rolling up to higher levels of aggregation and accounting. Users can “roll up” or “drill down” reporting directly within the online reporting tool by selecting their view, filters, and groupings.

City of Miami, OK B-11 RFP 19-50_CCPMS

Is your Company’s online information reporting system owned and operated internally? Or, is the system outsourced through a third party? If through a third party, please identify the third party.

We own and operate our real time online information reporting system internally and no part of it, or the system, is outsourced through a third party.

Describe the security measures used to prevent unauthorized user access to the system or data.

B.6 Business Continuity and Disaster Recovery

Describe your local backup and/or redundant systems.

Point & Pay chose our hosting locations because both centers have redundant power and telecom circuits as well as local generators that can keep our platforms up during all, but the most severe disruptions. Point & Pay maintains an infrastructure that is redundant at every tier. We utilize server clustering technologies to ensure transparent processing in the event of any failure, and also utilize industry standard disaster recovery practices to ensure geographic redundancy in the event of large-scale failure.

Describe your “hot-site” backup capabilities in the event of a complete site failure.

Point & Pay provides a comprehensive recovery process that minimizes recovery time and restores the ability to process payments and remit settlements as soon as possible in the event of a complete site failure. To ensure continual availability of all systems, even in the case of a disaster that disables our entire primary data center, Point & Pay has a fully redundant backup “hot” site to guarantee data

City of Miami, OK B-12 RFP 19-50_CCPMS

integrity and rapidly restore services. In the case that the primary site goes down, the traffic volume automatically transfers to the backup site.

Point & Pay’s formal disaster recovery plan includes the steps we follow to restore remittance capabilities within the same banking day of any disaster event and electronic payment processing within 48 hours of the event. Point & Pay’s comprehensive recovery process minimizes recovery time, restores the ability to process payments, and remit settlements as soon as possible. We maintain multiple ISPs and VPN links to Point & Pay’s data center. Fueled standby generators are onsite to ensure a power source in the event of a power disruption.

Describe the last time that the use of your backup system was required, the circumstances, and the length of time the backup system was in use.

There have been no instances where Point & Pay has required use of our backup systems.

What is the expected time frame for becoming operational should a catastrophic event occur?

Since Point & Pay has implemented a virtualized, redundant cloud infrastructure, there should be no impact to customer availability for most types of disaster. In extreme cases, where all computing must be migrated, or restored from backup, a rollover target of two (2) hours is identified in our plan.

Point & Pay will offer immediate assistance by deploying resources to handle calls and questions from the City of Miami and the City’s customers. If a catastrophic event was to occur at a merchant site, funding and settlement will continue to process efficiently. There should be no disruption of service in any operational area. Upon recovery, Point & Pay will assist the City with reconciliation, reporting, and other operational aspects to bring the system current with any updated data.

On average, how many service disruptions have your customers experienced in the past twelve (12) months. What type of errors occurred and how long did it take to correct them?

Point & Pay experienced very minor incidents having to do with our DNS service that led to intermittent downtime on various components for periods of several minutes. This was resolved with the DNS provider and we have subsequently moved to a more robust service with failover capabilities.

Additionally, we are able to process payments 24 hours a day, 7 days a week and perform any necessary ongoing maintenance updates remotely. Our platform easily accommodates tens of millions of transactions daily, and our equipment and data centers are scalable, thereby enabling us to add new equipment as necessary, along with the associated support staff, if required.

City of Miami, OK B-13 RFP 19-50_CCPMS

B.7 Retention and Accessibility

How long are transaction data stored in your system?

Point & Pay provides customers up to 24 months of transaction data available from our system on- demand.

How long are transaction data accessible to merchants?

Point & Pay provides merchants up to 24 months of transaction data available from our system on- demand.

B.8 Payment Card Industry Data Security Standards

Describe your PCI-DSS compliance status and program.

City of Miami, OK B-14 RFP 19-50_CCPMS

What is your role in supporting merchant PCI compliance and how do you help a client like the City of Miami maintain its compliance?

Point & Pay will take an active role in guiding the City’s compliance efforts. We have engineered our solutions to reduce scope. Wherever possible, Point & Pay suggests to:

 Utilize solutions that hand customers off to Point & Pay for critical processing steps

 Use tokenization strategies instead of storing card information

 Use PCI-encrypted solutions to prevent clear text transmission across the City networks

 Use embedded solutions for working within existing cashiering solutions

B.9 Implementation and Training

Describe the merchant implementation process (e.g., steps in the process of bringing a merchant into production).

Point & Pay approaches client relationships as a partnership. As a company whose success is based on usage of payment systems, we work diligently to make sure that our discussions are engaging, provide

City of Miami, OK B-15 RFP 19-50_CCPMS

value, and result in satisfied customers. For each new partnership, as part of our kickoff meeting, one of the artifacts developed from the discussion is a project plan. We also position ourselves as the payments company that helps its clients achieve their long-term goals to enhance the customer experience and increase electronic engagement. Our plans are structured around the lifecycle of the contract, or longer, and include a multi-phased approach.

Point & Pay’s project team possesses over 30 years’ experience in delivering, implementing, and managing large-scale projects for government agencies nationwide, including some that are considered the most populous within their State. As part of our mission, we make it a priority to meet the timelines and milestones for all of our projects, regardless of size. We are proud of our history in completing our electronic billing payment solutions 100% on budget.

Point & Pay recognizes the importance of an effective project plan and will work closely with representatives from the City to customize the methodology, while maintaining core best practices and high quality of service. Formal project management practices begin upon agreement of terms and services, but ideally, Point & Pay involves the personnel assigned to deliver on the implementation as early as possible in the process. The preferred timing for assignment of a project lead is after commitment from the partner/City; however, in some cases a project lead participates in the close phase of the agreement (provided upon request from the City).

Point & Pay’s project management approach involves five phases outlined below:

1 Planning: During this phase, we define the program and project scope. We work closely with designated City personnel to prioritize the work and build the schedule baseline. 2 Configuration and Build: Point and Pay’s platform architecture is such that our primary setup is configuration however we will provide development resources for customization work when applicable, both of which will occur during this phase. 3 Test: The Point & Pay platform offers a robust production like environment (Demo) for client and partner testing. We typically perform all non-production test activities during this phase; however, by request of the client and partner, we can offer isolated test environments to satisfy specific request for customer development and integrations. Point & Pay provides a standard set of test scripts and scenarios that exercise the new setups and configurations. If we complete custom development or integrations as part of the project, the client or partner would develop and approve new scripts.

4 Training: We will provide training for Point & Pay tools, as well as any third-party engagement upon client approval of test results. The training is all-inclusive and designed specifically with any client requirements as identified during the planning phase.

5 Go-Live: During the Go-Live phase the project team will review the implementation plan, confirm no critical open items remain, receive final approval from the project stakeholders, and complete any system cut-overs.

City of Miami, OK B-16 RFP 19-50_CCPMS

Additionally, Point & Pay recognizes the need to expand or customize the project management approach. To that end, our diverse team of project leads is familiar with the applicable standards and adjusts this approach as necessary to match our clients’ project management governance model.

Scope Management Point & Pay will participate in kickoff meetings with the City. During those meetings, we will meet with designated representatives to discuss their individual needs and scope implementation. The assigned implementations lead is responsible for capturing the project scope and documenting it as meeting notes for each agency kickoff meeting.

At a point determined by the implementation team, which will overlap between the planning phase and configuration/build phase, the scope documentation serves as the requirements baseline for each agency.

Schedule Management Point & Pay will determine a milestone and task level schedule for each department that is a part of the overall program schedule. The schedule consists of the following six tiers: 1) Client, 2) Wave, 3) Department (Agency), 4) Phase, 5) Milestone, and 6) Task. Segmenting line items is a schedule management best practice and allows for simple detection of cross dependency issues, as well as task synchronization. Each task has an assigned duration and potentially a predecessor that subsequent tasks may be linked to, which drive the associated dependencies.

The implementation lead will meet weekly via phone conference with task owners and track performance against the delivery baseline. For tasks with long durations, the project lead will capture the percentage complete in the agency’s schedule and compare it to the end date. If the lead feels the task is at risk of not being complete by the defined end date, the project lead must work with the task owner and define a recovery plan, escalate the risk to the program manager, and prepare for a potential change control request (please see Change Control below for additional details).

Implementation Plan Point & Pay considers implementation the most critical phase for the City’s new payment solution. During this phase, the implementation team will promote the code to production. The team will conduct more testing of the code in production. Our Program Manager will hold a zero defects meeting to verify the application performs efficiently and meets quality standards. The team expects to encounter minimal production fixes, and the schedule should allow for fixing the defects found in production. After the testing for defects, the team manages change control. Near the end of the implementation phase, we hold another turnover meeting with the project team in preparation for the final release. After the meeting, the Program Manager will sign off on the readiness of the final application and then conduct a training webinar for the client. After we complete training, the team will turn on the permissions for the client and release the product/deliverable to the client.

We will also have representatives to provide key steps in this process, including the Project Manager, Technology Director, Implementation Specialist/Leader, and Account/Relationship Manager. Additionally, our finance team will participate in each department’s first reconciliation with the deliverable of

City of Miami, OK B-17 RFP 19-50_CCPMS

completing that reconciliation successfully and document the steps in the process for ongoing use. We will also meet every day post-transition for two weeks to troubleshoot new developments or questions and concerns. Point & Pay documents the results of the transition process.

Testing and Quality Assurance During the Testing and Quality Assurance part of the project, we identify appropriate testing methods, acceptable metrics, and procedures to exercise throughout the lifecycle of the project. Specifically, we designate a team of our technical specialists that will perform several aspects of system testing for end- to-end functionality of the new system for the City. The plan includes:

 System Testing – ensure all backend aspects of the functionality, including database information are accurate and according to requirements

 User Acceptance – ensure conformance to requirements

 Regression/Performance Testing – produce detailed scripts to ensure that new development does not impact current functionalities and/or system performance

 Production Testing – verification that new functionality behaves as expected and checks for regression to ensure current system behavior and performance are not negatively impacted Project Communications Point & Pay prides itself on effective communication with all stakeholders to facilitate an understanding of how we conduct meetings, reports, and other communications during implementation for the City’s departments. We will maintain the following communications protocol for the City.

1 Communications with the Sponsor – the Implementation Lead will meet with the sponsor on a bi- weekly basis to provide updates, as well as a weekly status report to the sponsor. 2 Communications with Functional Management – we include Functional Managers (members from the City and Point & Pay) in all communications. The implementation team will meet with the Functional Manager on a weekly basis for updates. Our functional managers will provide a weekly status report to the Implementation Lead. 3 Communications with the City – the Implementation Lead is responsible for communications with the City’s Lead. 4 Communication Tools – the Implementation Lead is responsible for communications to all stakeholders, via an agreed upon tool or method, i.e., e-mail, wiki, document repository, etc. 5 Customer Relationship Management (CRM) – Point & Pay will use CRM operational tools via SalesForce’s Service Cloud to store all relevant documentation with the following functions:

 Announcements – post messages on the project workspace home page

 Calendar – keeps the team informed of upcoming meetings, and other important events

 Links – links to web pages that the team may find useful for the project

 Discussion – on-line threaded discussions across the team

 Tasks – list to keep track of tasks to complete

City of Miami, OK B-18 RFP 19-50_CCPMS

6 Email – we will create an e-mail distribution list of the internal stakeholders, and all internal e- mails related to the project will use the specific e-mail address we establish specifically for the City’s implementation. 7 Teleconferences (toll-free) – we will schedule phone meetings via Google Hangout with dial-in numbers and web conferencing available to all stakeholders. 8 Scheduled Meetings – Upon award, Point & Pay will review with the City all other required meetings and TBD dates based on the project start date. Please see the table below for the standard meetings we conduct with clients.

Topic Attendees Frequency Dates (TBD)

Project Team, Sponsor and Kick-off for Planning and Design Once Client Stakeholders

Review Charter, Scope baseline and Project Team, Sponsor and As needed Requirements Client Stakeholders

Project Team, Sponsor and Demos and Show & Tells As needed Client Stakeholders

Turnover Meeting – UAT to Production Project Team Once

Turnover Meeting – Final Release Prep Project Team Once

Review and Approve Project Completion Project Team, Sponsor and Once Statement Client Stakeholders

Electronic Payments Project Updates Weekly Steering Committee

Change Control Change Control Board As needed

Point & Pay’s Implementation Lead will notify all stakeholders of changes to scope and schedule and document these changes in the Change Log to track communications appropriately.

Change Control The primary purpose of the change control process is to review, approve, or make recommendations for an alternative approach to change impacting department requirements and related delivery timeframes. The City’s assigned Implementation Lead handles the change process by: 1 Identifying a potential change item, 2 Documenting the potential change and impact to the project’s scope/schedule, 3 Communicating it to the Program Manager, who adds it to the weekly status meeting, and 4 Presenting the item and analysis to the change control board.

City of Miami, OK B-19 RFP 19-50_CCPMS

The Change Control Management Board (CCB) will consist of City IT personnel and Point & Pay project members who are responsible for reviewing and approving all changes to the implementation schedule. The CCB then accounts for these changes in the change register, and ensures that all levels of change and accompanied analysis during discovery is within an appropriate timeframe. When a board member communicates the decision to the Implementation Lead, he/she updates all associated documentation and communicates the decision to all appropriate parties.

Explain the process for adding new locations and closing existing locations (e.g., assignments of merchant’s IDs or biller locations, toll-free phone numbers, communications, turnaround time to add/delete locations).

Point & Pay manages the complete process for adding new locations and closing existing locations; this is a standard functionality, with most changes of this nature completed overnight. Our system will generate a ticket in Salesforce for the new assignment of MIDs, with associated information (i.e. toll-free phone number, communications, etc.). To close an existing location, we are typically able to handle this on the same day of request, up to 24 hours. For the assignment of a new MID, it generally takes 2-3 days.

Describe support provided during implementation, including training, technical assistance, user manuals and on-site visits.

Point & Pay will provide the City of Miami with ongoing support during implementation to include training, technical assistance, user manuals, and on-site visits, as needed. Point & Pay offers our solutions with a full training package, including multiple online/web sessions with our staff to accommodate work schedules, instructor led training to accommodate City staff prior to implementation, as well as dedicated support prior throughout the roll out process. Key areas of our training initiatives include:

 Administrative Application: User management, views of real time and other reports, search for payments, and similar issues

 Online Components: Managing bills, batches, and customer interactions

 Counter Application: Methods for accepting, voiding, and refunding payments

 Settlement, Reporting, and Reconciliations: Principles of Point & Pay reporting products, identify settlements, and reconcile payments

Point & Pay will also provide operation and procedure manuals for use by City staff involved in the program. As a SaaS platform, Point & Pay provides an online Document Library, as well as other materials referenced below.

 User Guide Online Support with a Document Library  Product Specifications

City of Miami, OK B-20 RFP 19-50_CCPMS

 Security Policies and Best Practices

 Service Documentation and Testing Procedures

 Desktop Reference Cards

Describe on-going training and technical assistance after implementation.

Point & Pay designates David Meibert as the City’s continued account/relationship manager to serve as the primary point of contact, responsible for maintain ongoing communications with key stakeholders at the City. We also utilize the Salesforce CRM tool to maintain visibility with all business/project issues that may arise. Mr. Meibert can be reached via mobile at 775.527.8939 and email at [email protected].

Additionally, Point & Pay utilizes a multi-tiered communication strategy so that we conduct appropriate, immediate, and relevant communications through all tiers of our organization.

Daily Operations and Implementation

 Dedicated project manager

 24 x 7 Agency support by toll-free phone or email

 Ticket Management system issues through their lifecycle and escalates to management when items age beyond acceptable timeframes

 Ensures constant communication with automated email check-ins

Sophisticated System Administration and Monitoring

 Alert distribution list for system issues and maintenance scheduling

 Escalation to Management

 24 x 7 Support & engineering

Describe how you implement system upgrades.

To maintain continuous payment processing services during normal business hours, we do not schedule system upgrades between 6 AM and 8 PM, Monday through Friday, EST. We also provide seven (7) days advance notice of any scheduled maintenance that will result in system unavailability, as well as send email notifications for change outages weekly to designated City representatives.

Point & Pay reserves two time windows per week for code releases and system maintenance. These occur on Thursday’s and Sunday’s between 2:00 AM – 5:00 AM, EST. Though these windows are reserved, a typical month may only have two (2) to three (3) instances of scheduled maintenance take place. Due to system redundancy, the vast majority of our maintenance windows contain no impact to our clients’ payment processing capabilities and are transparent to users.

City of Miami, OK B-21 RFP 19-50_CCPMS

B.10 Customer Service & Quality

How and when is the customer notified of adjustments to association fees?

Generally, Point & Pay is notified by the associations 90 days in advance of adjustments to fees, therefore, we are able to commit to notifying customers 60 days in advance for most changes, especially if it affects them directly. Please note, we have not raised our fees to our clients in the past five years.

Describe your customer service organizational structure. Is the customer service function performed in- house or is it outsourced?

Point & Pay provides customer service support in-house, and we have several, multilingual customer service support specialists to respond to questions and calls for assistance, and available by toll-free telephone from 7 AM to 8 PM. We also have customer support specialists at our parent corporation, North American Bancard, to assist clients with any additional customer service needs.

Will a specific customer service representative be assigned to handle this business? Describe the responsibilities of the customer service personnel, including the chain of command for problem resolution.

David Meibert, Senior Account Manager, will serve as the City’s main point of contact throughout the contract. He will communicate any and all circumstances with our Manager of Client Services and Customer Service Team Lead to ensure the City receives a prompt response from our team, timely follow up, as well as any additional communication to ensure complete satisfaction from both the City and its customers.

Chain of Command for Problem Resolution & Escalation Support When customer service issues escalate, Point & Pay’s specialists communicate the issue to their supervisor and the department manager. If those individuals are unable to resolve the problem, they involve executive leadership to discuss and rectify any issues. In the following graphic, we provide more information on our escalation procedures for problem resolution.

Point & Pay is generally amicable to SLA’s for up time to 99.999%, as well as responsiveness to issues in the priority breakdown referenced in our graphic below. Point & Pay defines “critical” incidents as any event that affects a client’s ability to process transactions. This includes system downtime, integration issues, hardware issues, and even customers struggling to access our virtual terminal application with username and password challenges.

City of Miami, OK B-22 RFP 19-50_CCPMS

What are the hours of operation for the customer service unit? Specify time zone.

Point & Pay’s standard customer support hours are between 7 AM – 8 PM EST; however, we can also accommodate customer support issues outside of the standard timeframe.

Provide complete warranty information for hardware offered, including term, processing procedures, and all other terms.

Point & Pay will warranty encrypted MagTek swipe card readers for the life of the contract and replace them if they malfunction. The Ingenico ICT-220 and PayAnywhere terminals are supplied with their respective one-year manufacturer warranty.

Do you offer technical support for the hardware you offer? Please describe.

Yes, Point & Pay is committed to providing the City with superior technical support for the hardware we offer, as well as other issues that may arise throughout the life of the contract. We do this by utilizing a Network Operations Center (NOC) charged with monitoring system performance, maintenance, troubleshooting, and responding to technical support calls on a 24/7/365 basis with on-call representatives and after-hours escalation procedures. The NOC also services:

 Integration Support

 File Format/Data Exchange questions

City of Miami, OK B-23 RFP 19-50_CCPMS

 Technical maintenance and troubleshooting

 Release management and networking

 Maintenance and testing of the Business Continuity and Incident Management Plan

Describe how you implement terminal updates and roll out of new equipment.

Point & Pay is able to implement terminal updates through a phased implementation strategy with off- hours support and training to minimize impact to business operations. As part of the NAB family of companies, Point & Pay has instant access to the latest equipment, including proprietary in-house devices. We are able to roll out new equipment as soon as our technical team sufficiently tests those terminals and meet our clients’ requirements, in general offering several new device options every year.

City of Miami, OK B-24 RFP 19-50_CCPMS

B.11 Project Schedule & Proposed Timetable

The implementation of a service for an organization of this size and complexity is a significant undertaking. Consideration must be given to the day‐to‐day operations of the City which must not be adversely disturbed or which must not interrupted. The following represents significant events and the associated proposed timetable from release of this RFP to award of contract: Request for Proposal to Prospective Proposers: August 02, 2019 Proposal Due Date: By 2:00pm, August 22, 2019 Recommendations to Miami City Council: September 17, 2019 Estimated Project Contract Award: September 17, 2019 The target timeframe to begin accepting credit cards is November 1, 2019. The Proposer will provide an implementation plan by phase.

Point & Pay understands and acknowledges the City’s target timeframe to begin accepting credit cards is November 1, 2019. We provide our implementation plan by phase in Section B.9 Implementation and Training. On the following pages, we provide our implementation timeline and responsibility matrix for the City of Miami, including our responsibilities, as well as the City’s.

As such, we propose an estimated timeline of 30 - 60 days for implementation of the new payment solution. However, depending on the level of detail for system requirements, configuration, and receipt timing of the associated data files, the implementation timeframe may vary. In an effort to avoid unnecessary delays, City resources need to be available during the appropriate phases, with proper advance notice to minimize adjustments in the project schedule timeline.

Responsibilities Matrix for Implementation Tasks The following table details the responsibilities of the project team for the tasks associated with implementing the new solution. Please reference the key below for the identification of task roles.

L = Leader A = Action of R = Responsible for I = Input from

City of Miami, OK B-25 RFP 19-50_CCPMS

ANAGER NALYST NGINEER ANAGER PECIALIST E A M S

TASK ACTIVITY M TAKEHOLDER NGINEER NTEGRATION I S ANAGER E

PECIALIST M S ELATIONSHIP R QA USINESS ROJECT ROGRAM ROGRAM ERMINAL B OFTWARE YSTEM GENCY P P T S S A

PLANNING Discovery I L R I I I I I I

Agency Scope Document I L R I I I I I I

Client Application I L R I A

Reports I L R I I I

CONFIGURATION/BUILD System & Financial Configuration I R A I

Webpage Configuration I R A I

POS Configuration I A R I

Integration (i.e., API, Postback) I L R A I I I

Integration (3rd party software) I L R A I I I

Reports I R I I

TEST Integration Testing (i.e. API, etc.) I R I A I

POS Terminal Testing I R I A I

Reports Testing I R I A I

IMPLEMENTATION Go-Live Planning Call I L I I I I I I I

Client Operations Training I I I

GO LIVE

Implementation Requirements Point & Pay will provide the City with the necessary installation documentation to designated staff once determined. For information on our setup parameters, please see the below list of key milestones for a file integration with the party responsible for completing the item.

City of Miami, OK B-26 RFP 19-50_CCPMS

Discovery (Client and Point & Pay) 1. Client provides data requirements (CLIENT) a. File specs b. File samples i. Daily balance file ii. Bill print (raw data file) iii. Bill PDFs (or provide URL algorithm) c. File rules d. Necessary credentials 2. Define file integration (P&P OPS) - 8-16 hours 3. Project management (P&P OPS) - 8 hours 4. Generate SOW Development Requirements Met (Client) - must be met in order for development to begin 1. Review and execute SOW 2. Setup P&P SFTP and test transmission 3. Configure file transmission and delivery at least two production files of the following (automated job is preferred): a. Daily balance file b. Bill print (raw data file) c. Bill PDFs (or provide URL algorithm) Marketing and Customer Education Planning (Client and Point & Pay) 1. Design Website Integration (P&P OPS) - 2 hours 2. Design Paper Mail Artifacts (P&P OPS - 8 hours 3. Design Email Campaign (P&P OPS) - 8 hours 4. Provide list of email addresses for target (CLIENT) Financial Configuration (Point & Pay) 1. Set up Client Profile in Partner Builder 2. Request Merchant ID’s 3. Client Update for MID’s and Profile Configuration 4. Setup banking 5. Receive notification that banking test can be performed 6. Complete Bank Test 7. Confirm Deposit from Test w/Agency 8. Refund if necessary 9. Setup Admin Users

City of Miami, OK B-27 RFP 19-50_CCPMS

Data File Integration (Point & Pay Development) 1. Setup Client SFTP - 4 hours 2. Configure file transmission - 4 hours 3. Program daily account balance import file - 16 hours 4. Program paper suppression file - 8 hours 5. Program payment file - 8 hours 6. Testing - 24 hours 7. QA (P&P OPS) - 24 hours 8. Project management (P&P OPS) - 8 hours 9. Custom messaging/requests outside standard application - TBD Bill Print File Integration (Point & Pay Development) 1. Setup Print Vendor SFTP (or Client depending on who is providing the files) - 4 hours 2. Configure file transmission - 4 hours 3. Program data import file - 8 hours 4. Program PDF split process - 36 hours 5. Host PDFs - 4 hours 6. Configure e-Bill batches - 16 hours 7. Configure e-Bill email template - 8 hours 8. Program usage table - 16 hours 9. Run Testing - 24 hours 10. QA (P&P OPS) - 24 hours 11. Project management (P&P OPS) - 8 hours 12. Client email customizations outside of standard application - TBD General Onboarding (Point & Pay) 1. Establish connection (API/SFTP) - 4 hours 2. Client Configuration - 4 hours 3. Configure Company settings - 8 hours 4. Test settings, including fee - 8 hours 5. Customize email templates - 4 hours 6. Update logo and branding - 8 hours 7. Project management (P&P OPS) - 4 hours Training (Point & Pay and Client) 1. Complete EBPP end-user training 2. Complete EBPP manager training 3. Complete P&P Admin portal training 4. P&P provides demo environment for additional training and testing

City of Miami, OK B-28 RFP 19-50_CCPMS

Account Review & Testing (Client) 1. Review bill print integration and test key functions 2. Review data integration and test key functions 3. Review/test key bill payer functions as end-user AND manager: a. Complete non-logged in payment b. Account creation c. Make a logged in payment d. Enable/disable recurring e. Enable/disabled paper suppression f. Password reset/login change 4. Apply payment (revenue) file to CIS 5. Provide feedback to P&P Launch (Client and Point & Pay) 1. P&P launches client to production environment (P&P DEV) 2. P&P implements email campaign (P&P OPS) 3. Client implements print campaign (CLIENT) 4. Client implements website integration (CLIENT) 5. Client receives first payments (CLIENT) 6. Client posts first production payment (revenue) file (CLIENT) 7. Client executes SOW project completion agreement (CLIENT)

City Resources and Availability In an effort to fulfill the proposed contract efficiently, Point & Pay would prefer one designated representative from the City as a primary point of contact. We would also prefer availability to at least two individuals, one primary and one secondary IT staff member from the City’s Management Information Systems Department, to coordinate technical aspects appropriately and answer questions that may arise related to programming and testing associated tasks during the integration and implementation process of the new payment solution.

We expect that the primary point of contact (POC) should provide ownership of the City’s contributions to the final, mutually agreed Scope of Work (SOW). As such, that individual will also provide final “acceptance” of the provided solutions, certifying they adhere to the requirements and meet the City’s needs. The POC will also be responsible for the Charge Request process. To manage contract performance, the POC will be given access to our performance tracking tools, which include project management resources and documentation during the implementation phase. It is typical that we include the POC on Point & Pay’s distribution lists for system alerts and critical communications. The POC will also collaborate with David Meibert, the City’s Account/Relationship Manager, to coordinate the scheduling and agendas of the quarterly performance review meetings.

City of Miami, OK B-29 RFP 19-50_CCPMS

Point & Pay Resources and Responsibilities We will provide the City with the necessary project management and technical resources to configure, develop, and maintain the new solution prior to implementation, as well as for the life of the contract. Our agreements include a mutually-drafted Scope of Work (SOW) inclusive of key points, such as:

 Provisioning of key project staff

 Provisioning of support staff for the full contract lifecycle

 Technical integration

 Reporting per City specifications

 Initial setup of City users and permissions

 Tools for ongoing management of users and permissions

 24/7 Customer and Technical support services

 Single point of relationship and contract management

 Quarterly meetings to review performance and opportunities for improvement

 Delivery of system scale to support the City’s watermarks for concurrent users

 A fully, PCI-DSS Type 1 compliant payment processing system

 A technology solution that fully meets the City’s User Acceptance Testing (UAT) requirements

 Full lifecycle support (on-boarding, training, operation, management, and transition)

City of Miami, OK B-30 RFP 19-50_CCPMS

Retail Lockbox Merchant Services, LLC

PO Box 84451 Seattle, WA 98124

In Partnership with: Mike Bast:

Payment Processing Proposal for:

Credit Card Processing and Merchant Services RFP 19-50

Attention: Krista Duhon, Purchasing Agent City of Miami P.O. Box 1288 129 5th Ave. NW Miami, OK 74355‐1288 [email protected] 918‐541‐2224

Presented By

Craig Dawson President Retail Lockbox, Inc. 206-624-9424 [email protected]

1 Retail Lockbox Merchant Services PO Box 84451 Seattle, WA 98124 206-624-2871

Mike Addington, Municipal Finance Manager City of Miami P.O. Box 1288 129 5th Ave. NW Miami, OK 74355‐1288

Dear Mr. Addington,

Retail Lockbox Merchant Services, LLC (RLMS) in conjunction with Mike Bast are pleased to submit our proposal for your Credit Card Merchant Services RFP. RLMS is a premier provider of online payments, point-of-sale debit/credit card processing, online bill presentment and payment, ACH Processing, and phone payments. Headquartered in Seattle, RLMS has provided quality AP/AR customized solutions for business throughout the Pacific Northwest since 2006. Retail Lockbox Merchant Services is a sister company to Retail Lockbox, Inc. Retail Lockbox, Inc. has been providing high quality customizable lockbox services in the Pacific Northwest since 1994.

We believe in making your company more efficient so you can focus on your core business. We look at the entire receivables process and develop customized, secure solutions to managing your company’s merchant service needs. Education and support play a key role in products and services from RLMS, and we provide on-site implementation and continual customer service for each of our clients. We believe that our services are a long term partnership with our customers and we look forward to the opportunity to work with the City of Miami.

Over the last two years, we’ve invested over $500,000 to develop and enhance our online services to make them secure and compatible with multiple systems, A/R processes, and payment modalities. Our technologies and services streamline multiple payment channels through one source, providing cohesive reports and posting files compatible with your accounting systems.

Thank you again for the opportunity to respond to this RFP and for your consideration of Retail Lockbox Merchant Services for your merchant service needs. We look forward to building a long and mutually beneficial relationship with the City of Miami. Please feel free to call me directly at (206) 624-9424 with any questions, or email me directly at [email protected].

Sincerely,

Craig Dawson, President

Retail Lockbox Merchant Services PO Box 84451 Seattle, WA 98124 GENERAL TERMS AND CONDITIONS OF PROPOSALS

These items apply to and become a part of the proposal.

1. Proposals must be submitted on our forms only, including a signature of authorized agent. Be sure envelope is completely and properly identified and sealed.

2. No Proposer may withdraw their proposal for a period of thirty (30) days after the date and hour set for the opening of proposals.

3. The Proposer shall show in the proposal both the unit prices and total amount, where required, of each item listed. In the event of error or discrepancy in the mathematics, the unit prices shall prevail.

4. Any exceptions or deviations from written specifications shall be shown in writing and attached to the Proposal form.

5. The enclosed forms regarding non‐collusion and financial interest must be signed, notarized, and returned with the Proposal.

6. The City of Miami reserves the right to reject any and all Proposals and to waive any technicalities in the Proposal.

7. Proposal price shall be valid for a period of thirty (30) days after the opening date.

2 AWARD OF PROPOSAL This Proposal shall be awarded to the firm whose proposal is judged most responsive and is most advantageous to the City of Miami, considering the factors identified in the Proposal

1. The Miami City Council shall have the authority to award the contract.

2. The contract shall be awarded to the lowest and most responsible secure Proposer meeting specifications. In determining "best and lowest secure proposer", in addition to price, the following factors shall be considered:

 The ability, capacity, skill and experience of the Proposer to fulfill the terms of the contract or provide the service required.

 Whether the Proposer can fulfill the terms of the contract or provide the service promptly or within the time specified without delay or interference.

 The character, integrity, reputation, judgment, experience and efficiency of the Proposer.

 The quality of fulfillment of the terms of previous contracts or services.

 The previous and present compliance of the Proposer with laws and ordinances relating to the contract or service.

 The sufficiency of the financial resources and ability of the Proposer to fulfill the terms of the contract or provide the services required.

 The quality, availability and adaptability of the contractual services to the particular use required.

 The number and scope of the conditions attached to the Proposer.

CONTRACTOR/BIDDER INFORMATION SHEET To be completed by all Bidders/Proposers for contracts with the CITY OF Miami, OKLAHOMA (Please print or type)

Description:

Legal Identity (Corporation, Partnership, Individual, etc.):

Address:

Telephone No:

Fax No:

Taxpayer Identification No:

Contact Person:

Phone Number:

E‐mail Address:

Website Address:

INDEX ‐ The following sections are contained in this RFP:

Section I General Specifications Section II Contractor Minimum Qualifications, Requirements and Financial Capability Section III Contractor Services Section IV Contract Terms and Conditions Section V Fees and Other Charges Section VI Format for Required Information Section VII Appendices

4 CREDIT CARD PROCESSING AND MERCHANT SERVICES CONTRACT

S pe cificat ions

REQUEST FOR PROPOSAL (RFP 19‐50)

SECTION I. GENERAL SPECIFICATIONS

The City of Miami (City) is incorporated under the applicable laws of the State of Oklahoma and operates under a charter as a Council‐Manager form of government. The City and its related component units provide municipal services necessary for the health and well‐being of its citizens, including police and fire protection, comprehensive land use planning and zoning services, code enforcement; streets and drainage, recreation and parks, cultural and nature services, transportation services, water, wastewater, electric and sanitation services, and necessary administrative services to support these activities.

The City is seeking proposals from qualified organizations to provide credit card processing services for its Customer Service Center for all payments accepted therein. The solution should improve the City’s ability to efficiently and accurately conduct various types of credit card collection transactions, manage financial information, allow for integration into existing City operations, interact and interface with existing City computer systems, improve workflow, maintain data integrity, etc. The City is seeking proposals from organizations with a proven history of success within the credit card processing industry. The City intends to award one contract to a single vendor. The proposal should include interface solutions if a single or multiple third‐party application is presented.

This Request for Proposal (RFP) sets forth requirements for these services and solicits a detailed response from firms to include functional and technical requirements, implementation services, on‐going software maintenance and support, and pricing.

The City currently utilizes multiple vendors to process credit and debit card transactions with multiple gateways. The transactions currently settle into multiple bank accounts.

Customer Service: The City’s Customer Service Center currently has a third‐party vendor that handles all credit card transactions for utility bill payments. Currently, the City offers the following payment methods through that third‐party vendor for Utility Accounts:

1. On‐line, non‐recurring credit/debit card payments through the City’s third‐party vendor, Official Payment Center (OPC).

2. On‐line, Direct draft from a bank account (ACH) through the City’s third‐party vendor, OPC. These are not credit card transactions.

Page 5 of 23 3. Over‐the‐phone, non‐recurring credit/debit card payments through the City’s third‐ party vendor, OPC.

4. Over‐the‐phone, direct draft from a bank account (ACH) through the City’s third‐ party vendor, OPC. These are not credit card transactions.

Cemetery: The City of Miami currently does not accept credit cards for products and services, but will begin accepting credit cards November 1, 2019.

The successful proposer will interact frequently with representatives from the City’s Finance Division who will be the administrator for the credit card processor and the City’s Information Technology Department who will provide technical and system support for the credit card processing service.

SECTION 2 – SCOPE OF SERVICES

OBJECTIVE: The purpose of this RFP is to engage a full‐service vendor(s) experienced in the development, installation and operation of a credit and debit card processing service for the City. The proposer will provide Visa (credit/debit), MasterCard (credit/debit), and Discover card merchant processing contract and transaction processing systems and services for the City.

Flexibility and Configuration

2. The processor shall host a web page allowing on‐line credit/debit payments to be made through that web page.

SECTION 3 – PROPOSER QUALIFICATIONS

RESPONSE: Retail Lockbox Merchant Services has provides merchant services to clients of similar nature, scope and size to that requested by this RFP within the last two years. We provide these clients with our suite of products and services including merchant accounts, Paystation® Non-Logon electronic payment portals, Paystation® Electronic Bill Payment and Presentment sites, and Interactive Voice Response (IVR) systems. We have provided references for three (3) of these clients in Appendix B of this proposal. COMPLIED

1. This RFP seeks assurance of the following. Briefly discuss your firm’s ability to provide:

a. Timely implementation;

Page 6 of 23 RESPONSE: Retail Lockbox Merchant Services will provide timely implementation for the City of Miami’s merchant services. The implementation of merchant accounts, Paystation® Non-Logon electronic payment portals, and IVR systems can be accommodated within 1-2 weeks. Paystation® Electronic Bill Payment & Presentment sites can be implemented in 6-8 weeks. COMPLIED b. System stability; RESPONSE: Retail Lockbox Merchant Services will provide the City of Miami with stable and secure systems. Our servers are backed up nightly and are on redundant systems in case of hardware failure. Our data is backed up several times during the day. Backups of our data and servers are synchronized offsite in case of a site failure. Either the hosts can be brought up at the offsite facility or they can be done elsewhere of our choosing. COMPLIED c. Software reliability and performance; RESPONSE: Retail Lockbox Merchant Services will provide the City of Miami with reliable software solutions. We offer customizable, proprietary software solutions that are effective, efficient and industry (PCI DSS) compliant. COMPLIED d. Equipment quality and performance; RESPONSE: Retail Lockbox Merchant Services will provide the City of Miami with reliable equipment solutions. One month ago, a host server went down, forcing failover to another host server. This is the only time when we suffered from a failure causing us to use another system. However, no data recovery was required. COMPLIED e. Operator‐ and user‐friendliness; RESPONSE: Retail Lockbox Merchant Services will provide the City of Miami and its customers with products and services that are both operator and user friendly. Most of our clients require minimal training and time investment in learning to use and maintain our back-end systems. We also strive to make our products and services simple and easy for the end-user, where the average time a user spends on our Paystation® Electronic Bill Payment and Presentment site is less than five minutes logging in, reviewing their bill, and making a payment. On our Paystation® Non-Logon platform, users spend an average of 3 mins and 13 seconds from landing on the webpage, to having a receipt emailed to them and the payment being complete. COMPLIED f. Maintainability; RESPONSE: Retail Lockbox Merchant Services maintains our systems and software solutions through regular upgrades and improvements. System upgrades are tested via PCI- validated methodology and then deployed into the live environment with no down-time for the end user. COMPLIED g. Quality training for users and technicians; RESPONSE: Retail Lockbox Merchant Services will provide the City of Miami with quality training for users and technicians throughout the initial implementation of your

Page 7 of 23 products and services, including structured training via video conference as well as on-site visits. Ongoing training and technical assistance will be available to the City of Miami as needed throughout the life of the contract. COMPLIED

h. Quality service and maintenance. RESPONSE: Retail Lockbox Merchant Services will provide the City of Miami with quality service and maintenance. Our customer service functions are performed in-house, and the City of Miami will be assigned a Customer Service Representative to handle any support matters that may arise. Changes initiated by the City of Miami will be implemented though our established Change Request process, where the City of Miami will be kept in the loop throughout the implementation. COMPLIED

SECTION 4 – SPECIFICATIONS

1. The Proposer’s point‐of‐sale terminal software must support the following functions:

a. Transaction processing for Visa, MasterCard, and Discover;

b. Automatic capture of payment details;

c. Authorization of payment amounts;

d. Void and refund;

e. Dual‐copy receipt;

f. Decline notification message;

g. Rejection detail for non‐authorized transactions;

h. Update, add, or delete clerk and/or supervisor; and

i. Determination of batch cutoff time by location.

2. The Proposer’s web page must support the following functions:

a. Transaction processing for Visa, MasterCard, and Discover;

b. Automatic capture of payment details;

c. Authorization of payment amounts;

d. Decline notification message;

Page 8 of 23 e. Rejection detail for non‐authorized transactions;

f. Determination of batch cutoff time by location; and

g. Confirmation number to customers.

3. Additional Requirements: a. System availability 7 days per week, 24 hours per day including holidays;

b. POS training and support;

c. Toll‐free authorization number;

d. Toll‐free problem resolution number;

e. Storage of payment detail and summary records for a minimum of two years;

f. Capability to view and export transaction files and reports from website;

g. Capability for transaction inquiry by transaction date or amount, card type, card number, or merchant ID;

h. Ability to view, export, and customize reports;

i. Detail and appropriate response time for chargebacks; and

j. Determination of user access privileges by the City.

4. Settlement Proceeds Requirements:

RESPONSE: Funds are typically available within 48 hours from the time of payment; however, funds availability times can vary. Retail Lockbox Merchant Services has provided our Funding Availability Schedule in Appendix D. COMPLIED

b. The City will receive sufficient detail in the ACH credit records to tie receipts down to Merchant ID and Merchant Name within the City.

RESPONSE: Retail Lockbox Merchant Services will provide sufficient detail in the ACH credit records to tie receipts down to Merchant ID and Merchant Name within the City. COMPLIED

c. Vendor will deduct all Visa, MasterCard, and Discover discounts and processing fees from settlement proceeds.

RESPONSE: Retail Lockbox Merchant Services will deduct all Visa, MasterCard, and Discover discounts and processing fees from settlement proceeds. COMPLIED

Page 9 of 23 5. Security:

RESPONSE: Retail Lockbox Merchant Services has attached a copy of our PCI DSS compliance certification at the end of this proposal. COMPLIED

RESPONSE: Retail Lockbox Merchant Services will acquire “Red Flag” mandate compliance. We will develop and implement an Identity Theft Prevention Program to include reasonable policies and procedures for detecting, preventing, and mitigating identity theft. COMPLIED

RESPONSE: Retail Lockbox Merchant Services response to a security breach or loss of information would be to immediately shut the site down to assess the level of severity of the breach. We would then employ our security protocols to mitigate the threat. Retail Lockbox Merchant Services is PCI Level 1 compliant. We have hardware and software security tools in place to monitor our site for any malicious activity. Our staff in combination with our Managed Service Provider monitors our surveillance tools on a constant basis.

We have several levels of authentication for our various products. They begin with a non- logon environment that allows anyone to pay a bill without verification. We can add validation files to these systems to authenticate the users that are coming in based on various data elements including account number, ZIP code, invoice number or other as mutually defined by Retail Lockbox Merchant Services and the City of Miami. Our electronic bill payment and presentment logon environment uses multi factor user identification with a used ID and password. COMPLIED

d. What would be the City’s liability in the event of a security breach, loss of data, or default by the payment card service provider or third‐party portal?

RESPONSE: Retail Lockbox Merchant Services is insured against security breaches and loss of data. Our Certificate of Liability Insurance is provided in Appendix E. COMPLIED

Page 10 of 23 e. Please describe the position of Visa, MasterCard, and Discover with regard to a merchant’s (City’s) ability to require a purchaser to provide identification.

RESPONSE: The final step in the card acceptance process for transactions is to verify the cardholder’s signature, PIN or other methods as required in the Visa Rules. Visa supports a range of cardholder verification methods including signature, PIN, and PIN-less methods such as CDCVM (Consumer Device Cardholder Verification Method). 1. Signature – Verify that the signature on the Card matches the signature on the Transaction Receipt and on any identification required and presented 2. PIN – Verification using an acceptance device with electronic capability accepts a cardholder’s PIN rather than a signature. The merchant must not ask the cardholder to reveal the PIN. 3. CDCVM – a verification that is performed on the consumer’s payment device, independent from the reader (such as a mobile phone). COMPLIED 6. Disaster Recovery:

The Proposer will be required to provide a description of backup procedures in the event that terminals or communication links are not operational. SECTION 5 – PROPOSAL REQUIREMENTS

Proposer: Retail Lockbox Merchant Services Item Fee Notes Card Processing Fee (as basis points)*** Page 11 of 23 2.9% Terminal, Merchant Services, Paystation® Electronic Visa Payments, & Interactive Voice Response (IVR).

MasterCard $0.20 Terminal, Merchant Services, Paystation® Electronic Payments, & Interactive Voice Response (IVR). Discover $0.20 Terminal, Merchant Services, Paystation® Electronic Payments, & Interactive Voice Response (IVR). American Express $0.20 Terminal, Merchant Services, Paystation® Electronic Payments, & Interactive Voice Response (IVR). Debit Card $0.20 Terminal, Merchant Services, Paystation® Electronic Payments, & Interactive Voice Response (IVR).

Chargeback Fee (dollar amount per transaction) Card Chargeback fee $20.00

E‐check Transaction Fee (dollar amount per $2.95 Paystation® Electronic Payments & Interactive Voice transaction) Response (IVR). Return Fee (Dollar amount per transaction) $20.00 Chargeback Fee (Dollar amount per N/A transaction) Reserve (dollar amount) $0.00

Notice of Change $0.00

Monthly Fees Monthly Account Fee $0.00 Included

e‐check Monthly Fee $0.00 Included Mobile Application Fee $0.00 Included

Annual Fee PCI Validation Fee $0.00 Included

Maintenance Fee (Please Explain) $0.00 Included

Compliance Fee (Please Explain) $0.00 Included

One‐Time Fee e‐check Account Setup Fee $0.00 Existing Terminal Encryption Fee $0.00 Shipping Equipment Fee As Billed Set‐up Merchant Fee $600.00 One-Time Fee Customize Reporting Fee As Billed Per Specification Shipping Equipment Fee As Billed

Page 12 of 23 2. Include both purchase and lease prices for stand‐alone credit card processing units which include EMV‐enabled terminal, wireless terminal, and credit card swipe reader. See Exhibit A.2. Please list any other fees for any additional equipment needed on exhibit A.3.

EXHIBIT A.2 EQUIPMENT FEES Instructions: * Attach equipment specifications and a price list for any additional equipment that you offer and specifications * For fees not included below, list them in the Other Fees section/tab * Explain changes from year‐to‐year on a separate page, as required. Proposals without a fee schedule specific for each contract term (first term of six years and the two optional terms of two years) indicate that your prices will be fixed for the two optional terms. Proposer: Retail Lockbox Merchant Services Item Price Notes Purchasing Price EMV‐Enabled Terminal/Printer (ING‐iCR220 or $131.00 VeriFone VX520 similar) EMV ‐ Enabled Terminal/Printer (Other $270.00 VeriFone VX805 Model ‐Explain) EMV ‐ Enabled Terminal/Printer (Other $400.00 VeriFone VX820 Model ‐Explain) $450.00 VeriFone E355 Wireless Terminal

Wireless Terminal (Other Model ‐ Explain) Credit Card Swipe Reader‐ Wireless (Explain) $50.00 MagTek Dynamag (non-encrypted) Credit Card Swipe Reader ‐ Jack (Explain)

Leasing Price (Monthly fee) EMV‐Enabled Terminal/Printer (ING‐ n/a iCR220 or similar) EMV ‐ Enabled Terminal/Printer (Other n/a Model ‐Explain) EMV ‐ Enabled Terminal/Printer (Other n/a Model ‐Explain) Wireless Terminal n/a Wireless Terminal (Other Model ‐ Explain) n/a Credit Card Swipe Reader‐ Wireless n/a (Explain) Credit Card Swipe Reader ‐ Jack (Explain) n/a

Page 13 of 23 EXHIBIT A.3 OTHER FEES Instructions: * Attach equipment specifications and a price list for any additional equipment that your offer and specifications * Other Fees ‐ Populate all fields and provide a detail explanation in the notes field (e.g. monthly, annual, transaction fee, etc.) * Explain changes from year‐to‐year on a separate page, as required. Proposals without a fee schedule specific for each contract term (first term of six years and the two optional terms of two years) indicate that your prices will be fixed for the two optional terms. Proposer:

Item Frequency Fee Notes

Page 14 of 23

5. Please answer all questions in the following table:

EXHIBIT B ‐ QUESTIONNAIRE:

Merchant Credit Card Processing

Page 15 of 23

1. CC authorizations are routed through TSYS at Describe your company’s authorization the time of sale, decline/approval is returned method and list and describe alternative from the issuing bank. authorization methods?

2. Voids and refunds can be initiated as What are the procedures to reverse an necessary through the online web portal. incorrect authorization?

3. No. Are there limitations on the number of transactions processed daily?

4. Void or refund. What are the procedures to correct duplicate transactions?

5. Any single transaction that fails to transmit Describe the monitoring and notification will return an “Unsuccessful” error message. process if a transmission fails.

6. Retail Lockbox Merchant Services and partner Outline the security measures in place for the entities are PCI DSS compliant, protection of data transmitted for processing. documentation is available upon request. 7. All Utility providers are assigned a MCC of What process do you use to ensure that 4900, guaranteeing the lowest possible transactions qualify for the lowest utilities interchange rate available. interchange category? Please describe in detail.

Third Party Processing

8. Retail Lockbox Merchant Services is a Explain your company’s role; are you an provider of software and merchant accounts. acquirer, processor, other?

9. Retail Lockbox Merchant Services is Do you rely on third parties to process your partnered with Usio, who provides integrated merchant credit card transactions? If so, processing and gateway services. Trisource, explain and provide the years of service you whom we have been working with for eight have been doing business with them and years, ultimately settles the merchant describe your relationship with your third‐ deposits. party processor.

10. Retail Lockbox Merchant Services software Describe in detail how your services are securely transmits CC data via API calls to the integrated to/with third party software, Usio gateway/processor. websites, and gateways.

Settlement

11. Retail Lockbox Merchant Services can provide Can you provide next day settlement for Visa, a settlement window of 48 hours for each MasterCard, and Discover Card network network. transactions? If not, what settlement schedules do you offer for each network? What factors will you consider in order to provide a more favorable schedule?

Page 16 of 23

12. As long as the transaction is submitted before What is the latest time (hour) that sales the batch cutoff time, it will be settled transactions can be transmitted to meet according to the settlement schedule. these settlement times?

13. CC deposits will be as two lump sums, one for Please describe how settlement amounts will Visa, MC, Discover, and one for Amex. be listed on the bank statement or will they appear as one lump sum (meaning one amount for Visa, MasterCard, and Discover Card, one amount for American Express)?

14. No. Are there limitations on the number of files/transactions:

15. No. *Number of transactions contained in a batch? 16. No. *Number of files transmitted daily?

Disputes and Chargeback

17. Chargebacks can be disputed via mailed Provide a detailed description on how your correspondence or online chargeback tool. company handles disputes, retrieval, and Retail Lockbox Merchant Services is available chargeback requests. to assist with any documentation requirements. 18. Chargeback disputes must be responded to by What are your retrieval compliance the merchant within 30 days. timeframes? Online Information Reporting Services

19. PDF transaction reports are emailed daily and Describe all reports available and the a custom posting file setup can be software used to receive and view reports. implemented. Provide an overview of reporting cycles, procedures, and capabilities. 20. The merchant can query by any number of Describe the download capabilities, level of relevant fields within the Retail Lockbox customization, and drill down capabilities Merchant Services proprietary software. available on online reporting and reports. These reports can be exported as CSV files. 21. All of the merchant’s transaction data can be Describe h o w m u l t i p l e m e r c h a n t accessed in one location, regardless of n u m b e r s are reported. merchant number. 22. Transaction data is contained within Retail Is your online information reporting system Lockbox Merchant Services’s proprietary software owned and operated internally? Or, is the and also at the processor level (Usio). system outsourced through a third party. If through a third party, please identify the third party. 23. Retail Lockbox Merchant Services is PCI DSS Describe the security measures used to compliant, which is the industry standard for CC prevent unauthorized user access to either data security. the system or the data.

Page 17 of 23

Business Continuity and Disaster Recovery 22. Our Merchant Services servers are backed up Describe your local back up and/or nightly and are on redundant systems in case of redundant systems. hardware failure. Our data is backed up several times during the day. 23. Backups of our data and servers are Describe your “hot‐site” back up capabilities synchronized offsite in case of a site failure. Either in case of a complete site failure. the hosts can be brought up at the offsite facility or they can be done elsewhere of our choosing. 24. One month ago, a host server went down, Describe the last time that use of your back forcing failover to another host server. This is the up system was required, the circumstances, only time when we suffered from failure causing us and the length of time the backup system was to use another system. However, no data recovery in use. was required. 25. Depending on the magnitude, the timeframe What is the expected timeframe to become could be anywhere from 30 minutes to 24 hours. operational should a catastrophic event The most realistic outcome is somewhere between occur? the 1-12 hour range. 26. We had 2 interruptions in the last year. On average, how many service disruptions i. Datacenter made a mistake doing network have your customers experienced in the past maintenance and our service was disrupted for an twelve (12) months. What type of errors hour at midnight. occurred and how long did it take to correct ii. Managed Service Provider hosted them? environment suffered a host server failure. Massive network traffic on redundant systems caused slowness to services for an hour in the morning. Retention and Accessibility 27. Indefinitely How long are transaction data stored in your system? 28. Indefinitely How long are transaction data accessible to merchants? Payment Card Industry Data Security Standards

29. Compliant. Yearly audits are conducted through Describe your PCI‐DSS compliance status and a Qualified Security Assessor. program.

30. PCI Compliance at the merchant level is What is your role in supporting merchant PCI conducted yearly through an online tool. Retail compliance and how do you help a merchant Lockbox Merchant Services is available at every step like the City of Miami maintain its to walk the merchant through this process compliance?

Implementation and Training 31. Merchant Application is approved; then the Describe the merchant implementation online platform is developed and tested. Once process (e.g., steps in the process of bringing the merchant signs off on the platform, training a merchant into production). and installation finalizes the setup.

Page 18 of 23

32. The process will vary by location based on Explain the process for adding new locations what is required, as with the turnaround time. and closing existing locations (e.g., Most changes can be accommodated within 1 -2 assignments of merchant’s IDs or biller weeks. locations, toll‐free phone numbers, communications, turnaround time to add/delete locations).

33. Retail Lockbox Merchant Services will provide Describe support provided during structured training via video conference. There implementation, including training, technical will be on-site visits for the installation of card assistance, user manuals, and on‐site visits. readers and training. 34. Retail Lockbox Merchant Services is available Describe on‐going training and technical for any on-going training and technical assistance assistance after implementation. as requested by the merchant. 35. System upgrades are tested via PCI-validated Describe how you implement system methodology and then deployed into the live upgrades. environment with no down-time for the end user. Customer Service & Quality

36. “Site Messages” can be created on the How and when is the customer notified of Electronic Bill Payment & Presentment site, which adjustments to association fees? are displayed to customers when they log in. 37. All customer service functions are performed Describe your customer service in-house. organizational structure. Is the customer service function performed in‐house or is it outsourced?

38. The merchant will be assigned a Retail Will a specific customer service Lockbox Merchant Services CSR for any support representative be assigned to handle this issues that may arise. Mike Bast with provide business? Describe the responsibilities of the local support for setup, training and ongoing customer service personnel, including the support. Any outstanding issues will be escalated chain of command for problem resolution. until resolved. 39. 9am – 5pm, M – F (PT). What are the hours of operation for the customer service unit? Specify time zone.

40. Retail Lockbox Merchant Services guarantees Provide complete warranty information for the warranty on any hardware provided per the hardware offered, including term, processing expected lifetime of the device. procedures, and all other terms.

41. Retail Lockbox Merchant Services will support Do you offer technical support for the the provided hardware as much as possible. hardware you offer? Please describe. Some issues may need to be escalated to the TSYS Help Desk by the merchant (ex. If a DLL download is required for a terminal). 42. Retail Lockbox Merchant Services will give the Describe how you implement terminal merchant step-by-step documentation, provide updates and roll out of new equipment. guidance over the phone, or arrange a site visit as necessary. Page 20 of 23

PROJECT SCHEDULE: The implementation of a service for an organization of this size and complexity is a significant undertaking. Consideration must be given to the day‐to‐day operations of the City which must not be adversely disturbed or interrupted. The following represents significant events and the associated proposed timetable from release of this RFP to award of contract:

PROPOSED TIMETABLE:

Request for Proposal to Prospective Proposers: August 02,

2019 Proposal Due Date: By 2:00pm, August 22, 2019

Recommendations to Miami City Council: September 17,

20119 Estimated Project Contract Award: September 17, 2019

The target timeframe to begin accepting credit cards is November 1, 2019. The Proposer will provide an implementation plan by phase.

INSTRUCTIONS:

1. Proposal Format: A complete and thorough response is encouraged, as this RFP and response will be incorporated into the final contract by reference. The proposal should be structured as outlined below:

a. Cover letter from authorized individual responsible for response and proposal content.

b. Official Proposal Forms and all requested information provided in a sealed envelope marked “Credit Card Processing Services.” Refer to the following RFP sections for required responses:

i. Section 2 ‐ Scope of Services: please indicate ability to meet each individual requirement

ii. Section 3 ‐ Proposer Qualifications: please respond with requested information

iii. Section 4 ‐ Specifications: please discuss your ability to meet the identified specifications

iv. Section 5 ‐ Proposal Requirements (pricing, project schedule & timetable): please respond to all questions and requests of information. Refer to Exhibits A.1‐A.3 and B. for official forms.

a. Provide three (3) references of comparable clients to whom your firm has provided credit card processing services. Refer to Exhibit A.2 for requested information for each client. The evaluation committee will ascertain from the references their satisfaction with your service, systems and implementation processes, as well as your organization’s perceived responsiveness.

b. Make available any service agreements required prior to the commencement of services. Page 21 of 23

c. Present sample documents and reference manuals that would be provided to the City upon selection. d. Please include a copy of your firm’s most recent audited financial statements.

e. Vendor questions in Section 5.5.

2. Submission: One (1) original marked as such and One (1) digital copy of proposals must be delivered in sealed envelopes labeled “Credit Card Processing Services” by 2:00 p.m. on August 22, 2019 at the following location:

City of Miami PO Box 1288 129 5th Ave NW Miami, OK 74355‐1288 Attn: Krista Duhon, Purchasing Agent

Proposals received after 2:00 p.m. on August 22, 2019, will not be considered and will be returned unopened. There will be no exceptions to this policy.

All proposals will remain on file at least forty‐eight (48) hours. The City reserves the right to reject any and all proposals.

3. Communication with the City: Proposers shall designate one (1) representative to serve as liaison with the City. This individual’s name and contact information should be included in the proposal response. All communication between the City and the Proposer will be directed though this individual and shall be in writing. Email correspondence will be accepted. Any inquiries concerning the contents of this RFP should be directed as follows:

Mike Addington, Municipal Finance Manager City of Miami P.O. Box 1288 129 5th Ave. NW Miami, OK 74355‐1288 [email protected] 918‐541‐2221

4. Other Services: Evaluation of proposals will be based on current services; however, any new, enhanced or innovative services available will also be considered. Proposer may offer suggestions and pricing for alternative services offered.

5. Unit Pricing: Proposals must include pricing based on data in Exhibit A.1 and A.3.

6. Joint Proposals: Proposers shall respond by and on behalf of their organization only. No joint proposals will be considered. Please provide details on any third‐party arrangements necessary for any services to be primarily provided by your institution.

7. Proposal Expenses: Expenses incurred in the preparation of the proposal are the responsibility of the Proposer.

Page 22 of 23 EVALUATION

The proposals will be evaluated by a committee based on the following considerations: 1. Selection of a processor, as a result of this evaluation, is subject to the successful execution of a contract and other service agreements between the processor and the City.

a. Complete response to all required items on the official forms provided;

b. Service cost that is most advantageous to the City meaning all services requested, not just price alone;

c. Ability to provide timely, responsive service;

d. Ability to meet current and projected service requirements over the term of the agreement;

e. Cost of conversion to new processor will also be considered; and

f. References.

2. Terms and Conditions:

a. The City reserves the right to reject any and all proposals, to waive any irregularities or informalities in any proposal or in the proposal procedures and to accept or reject any item or combination of items. The award will be to the Proposer whose proposal, in the opinion of the City, is the best proposal taking into consideration all aspects of the proposer’s response. Exceptions to any specification must be submitted in writing with the proposal and will be considered in the final analysis of the proposal.

b. Proposers shall thoroughly examine and be familiar with these specifications. The failure or omission of any proposer to receive or examine this document shall in no way relieve the proposer of obligations with respect to this proposal or the subsequent contract.

c. Proposers shall in no way make unauthorized changes to the specifications, forms or terms. Doing so may render the response invalid.

d. Record retention outlined in these specifications must meet City policy and State statute requirements.

Page 23 of 23

Retail Lockbox Merchant Services, LLC PO Box 84451 Seattle, WA 98124 206-624-2871

Appendix A: Retail Lockbox Merchant Services – Products & Services *The followings products and services are being proposed to the City of Miami in conjunction with its Credit Card Processing and Merchant Services Request for Proposal (RFP 19-50).* Paystation® Non-Logon Paystation® Non-Logon is a quick and easy product that allows consumers to make “one-time” or “anonymous” payments without registering or logging into a system.  One-time payments, no registration required  ACH, Debit, and Credit Cards  All major associations supported  Integration with your current systems Paystation® Non-Logon is available as both a standalone product and integrated with Paystation® EBPP. Non-Logon payments can be combined into the posting file with other payments made on an EBPP site.

Paystation® Logon with Electronic Bill Payment and Presentment (EBPP) Paystation® EBPP provides increased flexibility in the timing and methods used to make payments, providing a more robust payment experience. A user can make a one-time payment, set a scheduled payment for a date in the future, or enroll in auto debit where the full amount owed is paid on a predetermined schedule (Auto Debit). The collection burden is reduced for your customer and for City of Miami by reducing the amount of times the payment has to be managed.

Online statements are proven to reduce the overall cost of collection and improve customer experience for customers that prefer this option. The time to collect is reduced because payments are made immediately without float time in the mail. With Paystation® EBPP, your customers will logon to a secure portal and see an online invoice which looks exactly like the invoice that would be sent to them in the mail.

When RLMS uploads City of Miami billing files, your customers will automatically be sent an email notification that a current statement is available, with a link to the secure portal to logon. Once a subscriber has logged into the bill presentment system, their current and historical invoices are presented to them.

Security and PCI Compliance

Built on leading edge web technologies and designed in house, Paystation® has a new security framework. An outside firm put Paystation® through external penetration testing and it passed on the first round, with no errors found. This was an outstanding accolade of the system that our PEN testers said had only happened one other time in the history of their security firm. The Paystation® system is reviewed in annual audits for compliance with the PCI (credit card) audit. On Paystation®, payer and biller information is treated as confidential. In today’s volatile world of security that you read about in the headlines on an almost daily basis, we have a strong commitment to security and the obligation to keep our customers data safe and secure. Retail Lockbox Merchant Services, LLC PO Box 84451 Seattle, WA 98124 206-624-2871

Customer Payment Profiles A user can change the billing method or billing payment preference by storing multiple credit cards or eCheck accounts in their Paystation® “profile”. A profile can be used for any of the one-time payment, scheduled payment plan, or recurring billing payments. When making a one-time payment it is easy to select any of the profiles, and the user’s billing preference is indicated by selecting the payment method of choice. If a user wants to change the account that is used for recurring billing, a user just needs to select another payment profile that is stored by that user. If there is a recurring billing or payment plan, the profile can be changed to the desired method of payment.

Reports There are several reports available for credit card and ACH payments. For Paystation® there is a standard report provided on a daily basis that shows daily transactions. There is also the ability to look up transactional information in the Paystation® administrative interface. City of Miami will receive, on a daily basis, a report of everything that was successfully processed online.

Interactive Voice response (IVR) RLMS has developed an outsourced IVR solution that operates with Paystation® payment processing services where call routing software allows a caller to verify account info and then be presented the outstanding balance. From there the user can make a payment via eCheck or credit card. Software and hardware is maintained offsite and optimized for bandwidth and availability. A software interface can route calls from the IVR system to Help Desk or Customer Service centers or to a routing table configured to client specifications.

Retail Lockbox Merchant Services, LLC PO Box 84451 Seattle, WA 98124 206-624-2871

Statement of Work Paystation® Non-Logon Terminal RLMS will create an external facing website that does not require users to register or login. The website will allow users to make one-time payments for amounts owed to City of Miami. RLMS suggests the creation of a “Pay Now” link on City of Miami’s website that links to the payment page for City of Miami on Paystation®. As users make payments, RLMS will gather both the billing information for the payment and the information required for posting to City of Miami’s accounts receivables system. The website will be built and hosted by RLMS.

There will be a series of four steps to make a payment: 1. Account Details 2. Payment Details 3. Confirm Details 4. Payment Confirmation/receipt

Standard branding includes customer logo, sample statement, and company name. City of Miami will receive a daily report of everything that is processed online successfully.

Paystation® Logon Terminal with EBPP RLMS will build an external facing website for City of Miami to present invoices to users. The invoice will be presented once a user logs into the website. The invoice presented online will match the invoice sent by City of Miami in the mail. One-time and recurring credit or ACH payments may be made, as directed by City of Miami. City of Miami will send a Payment Data / Billing file to RLMS for upload into the system once per week. The file can be the same file that is sent to the invoice printer. Timing of the file will be determined during implementation. The system will include the following standard features for a user: User Features  Notification of bill payment due  Account Details  Account Summary  Forgot Password and Username Reset and Recovery (Without admin aid)  Maintain Bank Account Information  Maintain Credit Card Information  Pay Now (ACH and Credit Card)  Recurring Payment / Auto Debit  Payment Details  Payment Summary (Transaction History)  Payment Type Configuration On/Off (Only ACH vs. ACH & VISA & MASTERCARD)  Schedule/Delete/Edit/View a Future Payment  Opt out of Paper Statement  Email confirmation of payment Retail Lockbox Merchant Services, LLC PO Box 84451 Seattle, WA 98124 206-624-2871

Admin Features  Admin able to add and edit payment profiles  Assign/Remove Accounts from users.  New Account Set up  Admin able to make a payment + future payment (+ Recurring Billing)  Recurring Payment / Auto Debit  Payment History + Search customer online payment history (only online bill presentment payments)  Account / Policy Inactive vs. Active Status. (Based off client provided Payment Data / Billing File)  Search for customers by Account Number, Customer Name, Amount, and Statement Date  Secure Password Reset + Force User Password Change on Login  Daily Detail and Summary Report  Update Transaction Display Type (Pending, NSF, Successful, Com Failure)  User Group Controls (Dynamic Menu’s and Permissions per user Group)  View User Invoices.  Web Grids convert to CSV/Excel File

Site Features  Time Zone Control (Must match Observance of Daily Savings Time)  User Lockout/Admin Unlock (Automatic Unlock)

Interactive Voice Response

 Retail Lockbox Merchant Services will provide Interactive Voice Response (IVR) services for City of Miami o City of Miami will be provided with a phone number which customers wishing to make a payment to City of Miami can call . Customers will follow prompts to enter applicable information necessary to complete a transaction  Customer will be prompted for their account number  IVR system will prompt back with the amount owed  Customer will be prompted for payment method  Customer will enter payment details  IVR system will provide a confirmation number  Call flow will end with successful completion o Payments can be made via credit card or e-check (ACH)

Retail Lockbox, Inc. PO Box 84451 Seattle, WA 98124 206-624-2871

Appendix B: References Morgan Dennis Lakehaven Utility District 31627 1st Avenue South Federal Way, Washington 98063 (253) 945-1615 [email protected] 2015-Present

Andrea Fontenot Calcasieu Waterworks District #8 6407 Hwy 3059 Lake Charles, LA 70615 (337) 582-3064 [email protected] 2018-Present

Bobbie Alberty Rogers County Rural Water District #3 13277 South Ash. Claremore, OK 74017 (918) 341-0854 [email protected] 2018-Present Funding Schedule Credit Card Batch Timing - Visa, MasterCard, Discover

Pacific Standard Time

Federal Reserve Batch must be TSYS sends Funds sent for Funds sent to Day Transactions send funds to settled by cut-off batch by 5:00 funding by 2:00 Federal Reserve are run Merchants Bank time 2:00 AM AM PM by 4:00 PM early morning

Monday Tuesday Tuesday Tuesday Tuesday Wednesday Tuesday Wednesday Wednesday Wednesday Wednesday Thursday Wednesday Thursday Thursday Thursday Thursday Friday Thursday Friday Friday Friday Friday Monday Friday Saturday Saturday Saturday Monday Tuesday Saturday Sunday Monday Monday Monday Tuesday Sunday Monday Monday Monday Monday Tuesday

E- Check Batch Timing

ACH Submitted Batched Out and Federal Reserve Day Transactions to Banking Funds sent to ACH Created by send funds to are run Stream by 5 PM Federal Reserve 4 PM PST Merchants Bank PST Monday Tuesday Tuesday Tuesday Wednesday Tuesday Wednesday Wednesday Wednesday Thursday Wednesday Thursday Thursday Thursday Friday Thursday Friday Friday Friday Monday Friday Monday Monday Monday Tuesday Saturday Monday Monday Monday Tuesday Sunday Monday Monday Monday Tuesday

Note: Any banking holiday will extend the ACH submittal date to the next business day.

*ACH Transfers are not sent on Federal Holidays CERTIFICATE OF LIABILITY INSURANCE DATE (MM/DD/YYYY) 8/15/2019 THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER. IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must be endorsed. If SUBROGATION IS WAIVED, subject to the terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). PRODUCER CONTACT NAME: Annie Santorelli FAX PHONE (425)740-5201 Degginger McIntosh and Associates (A/C, No, Ext): (425)740-5200 (A/C, No): E-MAIL PO Box 1400 ADDRESS: [email protected] 3977 Harbour Point Blvd SW INSURER(S) AFFORDING COVERAGE NAIC # Mukilteo WA 98275 INSURER A : Hartford Casualty Insurance Co 29424 INSURED INSURER B : Beazley Insurance Company, INC. Retail Lockbox Merchant Services, LLC INSURER C :

PO Box 84451 INSURER D :

INSURER E :

Seattle WA 98124 INSURER F : COVERAGES CERTIFICATE NUMBER:CL1981532325 REVISION NUMBER: THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. INSR ADDL SUBR POLICY EFF POLICY EXP LTR TYPE OF INSURANCE INSD WVD POLICY NUMBER (MM/DD/YYYY) (MM/DD/YYYY) LIMITS X COMMERCIAL GENERAL LIABILITY EACH OCCURRENCE $ 2,000,000 DAMAGE TO RENTED A CLAIMS-MADE X OCCUR PREMISES (Ea occurrence) $ 300,000 52SBANX6727 3/18/2019 3/18/2020 MED EXP (Any one person) $ 10,000

PERSONAL & ADV INJURY $ 2,000,000

GEN'L AGGREGATE LIMIT APPLIES PER: GENERAL AGGREGATE $ 4,000,000 PRO- X POLICY JECT LOC PRODUCTS - COMP/OP AGG $ 4,000,000 OTHER: $ AUTOMOBILE LIABILITY COMBINED SINGLE LIMIT $ (Ea accident) ANY AUTO BODILY INJURY (Per person) $ ALL OWNED SCHEDULED BODILY INJURY (Per accident) $ AUTOS AUTOS NON-OWNED PROPERTY DAMAGE $ HIRED AUTOS AUTOS (Per accident) $

UMBRELLA LIAB OCCUR EACH OCCURRENCE $

EXCESS LIAB CLAIMS-MADE AGGREGATE $

DED RETENTION $ $ WORKERS COMPENSATION PER OTH- STATUTE ER AND EMPLOYERS' LIABILITY Y / N ANY PROPRIETOR/PARTNER/EXECUTIVE E.L. EACH ACCIDENT $ OFFICER/MEMBER EXCLUDED? N / A (Mandatory in NH) E.L. DISEASE - EA EMPLOYEE $ If yes, describe under DESCRIPTION OF OPERATIONS below E.L. DISEASE - POLICY LIMIT $

B Data/Breach Protection and V10D28191001 3/18/2019 3/18/2020 Limit $1,000,000 Technology Services Prof. Liab Aggregate $1,000,000

DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (ACORD 101, Additional Remarks Schedule, may be attached if more space is required) is included as Additional Insured per attached form with respect to operations of the Named Insured. All endorsements apply per required Written Contract.

CERTIFICATE HOLDER CANCELLATION

SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN ACCORDANCE WITH THE POLICY PROVISIONS.

AUTHORIZED REPRESENTATIVE

L David Tyner, III/RI © 1988-2014 ACORD CORPORATION. All rights reserved. ACORD 25 (2014/01) The ACORD name and logo are registered marks of ACORD INS025 (201401) DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Payment Card Industry (PCI) Data Security Standard

Attestation of Compliance for Onsite Assessments – Service Providers Version 3.2.1 June 2018

DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Section 1: Assessment Information

Instructions for Submission This Attestation of Compliance must be completed as a declaration of the results of the service provider’s assessment with the Payment Card Industry Data Security Standard Requirements and Security Assessment Procedures (PCI DSS). Complete all sections: The service provider is responsible for ensuring that each section is completed by the relevant parties, as applicable. Contact the requesting payment brand for reporting and submission procedures.

Part 1. Service Provider and Qualified Security Assessor Information Part 1a. Service Provider Organization Information Company Name: Retail Lockbox Merchant DBA (doing Services, LLC business as): Contact Name: Craig Dawson Title: President and CEO Telephone: 206.624.9424 E-mail: [email protected] Business Address: 105 14th Ave City: Seattle State/Province: WA Country: USA Zip: 98122 URL: http://www.retaillockbox.com/

Part 1b. Qualified Security Assessor Company Information (if applicable) Company Name: Schellman & Company, LLC Lead QSA Contact Name: Matt Crane Title: Senior Associate Telephone: 866.254.0000 ext. 292 E-mail: [email protected] Business Address: 4010 W Boy Scout City: Tampa Boulevard, Suite 600 State/Province: FL Country: USA Zip: 33607 URL: https://www.schellman.com/pci-dss-validation

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 1 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Part 2. Executive Summary Part 2a. Scope Verification Services that were INCLUDED in the scope of the PCI DSS Assessment (check all that apply): Name of service(s) assessed: Merchant Services Type of service(s) assessed: Hosting Provider: Managed Services (specify): Payment Processing: Applications / software Systems security services POS / card present Hardware IT support Internet / e-commerce Infrastructure / Network Physical security MOTO / Call Center Physical space (co-location) Terminal Management System ATM Storage Other services (specify): Other processing (specify): Web Security services 3-D Secure Hosting Provider Shared Hosting Provider Other Hosting (specify):

Account Management Fraud and Chargeback Payment Gateway/Switch Back-Office Services Issuer Processing Prepaid Services Billing Management Loyalty Programs Records Management Clearing and Settlement Merchant Services Tax/Government Payments Network Provider Others (specify): Note: These categories are provided for assistance only, and are not intended to limit or predetermine an entity’s service description. If you feel these categories don’t apply to your service, complete “Others.” If you’re unsure whether a category could apply to your service, consult with the applicable payment brand.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 2 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Part 2a. Scope Verification (continued) Services that are provided by the service provider but were NOT INCLUDED in the scope of the PCI DSS Assessment (check all that apply): Name of service(s) not assessed: Lockbox Services Type of service(s) not assessed: Hosting Provider: Managed Services (specify): Payment Processing: Applications / software Systems security services POS / card present Hardware IT support Internet / e-commerce Infrastructure / Network Physical security MOTO / Call Center Physical space (co-location) Terminal Management System ATM Storage Other services (specify): Other processing (specify): Web Security services 3-D Secure Hosting Provider Shared Hosting Provider Other Hosting (specify):

Account Management Fraud and Chargeback Payment Gateway/Switch Back-Office Services Issuer Processing Prepaid Services Billing Management Loyalty Programs Records Management Clearing and Settlement Merchant Services Tax/Government Payments Network Provider Others (specify): Provide a brief explanation why any checked services Retail Lockbox's traditional lock box remittance were not included in the assessment: services do not store, process, or transmit cardholder data. Further, all of the merchant solutions are within a segmented environment.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 3 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Part 2b. Description of Payment Card Business Describe how and in what capacity your business Retail Lockbox Merchant Services (RLMS) provides stores, processes, and/or transmits cardholder data. a customer portal called Paystation for debit/credit card payment processing, online bill payment and presentment, ACH processing, and online payments for a variety of industries and customers. RLMS customers are provided with a hosted web application with a dedicated URL for them to collect payment from cardholders. All payment transactions are immediately sent over HTTPS to Phoenix Managed Networks (PMN), a third party payment processor. After processing, PMN returns a token which is stored in a Microsoft SQL database for future transactions. All recurring payments are executed using the token, as the PAN is never stored in the RLMS environment. RLMS also accepted mail order payments. Upon receipt, RLMS employees input the data into the customer portal in the same manner that a customer would. The mail-in forms are redacted prior to scanning and then destroyed using a third party shredding service provider.

Describe how and in what capacity your business is Not applicable. otherwise involved in or has the ability to impact the security of cardholder data.

Part 2c. Locations List types of facilities (for example, retail outlets, corporate offices, data centers, call centers, etc.) and a summary of locations included in the PCI DSS review. Type of facility: Number of facilities Location(s) of facility (city, country): of this type Example: Retail outlets 3 Boston, MA, USA Corporate Office for Mail Order Receiving 1 Seattle, WA ByteGrid Data Center 1 Lynnwood, WA

Part 2d. Payment Applications Does the organization use one or more Payment Applications? Yes No Provide the following information regarding the Payment Applications your organization uses: Payment Application Version Application Is application PA-DSS Listing Expiry Name Number Vendor PA-DSS Listed? date (if applicable)

N/A N/A N/A Yes No N/A

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 4 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Part 2e. Description of Environment

Provide a high-level description of the environment Retail Lockbox Merchant Services, LLC covered by this assessment. interacts with cardholder data through physical mail order forms processed at the For example: corporate office and the following applications • Connections into and out of the cardholder data as part of its service offering: environment (CDE). • Critical system components within the CDE, such as POS - www.paystation.com devices, databases, web servers, etc., and any other - www.bill.paystation.com necessary payment components, as applicable. The core system components supporting the applications and services include: - Firewalls - Hypervisors - Servers - Databases (for token storage) - Intrusion Prevention System (IPS) - Centralized log management system

Does your business use network segmentation to affect the scope of your PCI DSS Yes No environment? (Refer to “Network Segmentation” section of PCI DSS for guidance on network segmentation)

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 5 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Part 2f. Third-Party Service Providers

Does your company have a relationship with a Qualified Integrator & Reseller (QIR) for Yes No the purpose of the services being validated?

If Yes:

Name of QIR Company: Not applicable.

QIR Individual Name: Not applicable.

Description of services provided by QIR: Not applicable.

Does your company have a relationship with one or more third-party service providers (for Yes No example, Qualified Integrator Resellers (QIR), gateways, payment processors, payment service providers (PSP), web-hosting companies, airline booking agents, loyalty program agents, etc.) for the purpose of the services being validated?

If Yes:

Name of service provider: Description of services provided:

Phoenix Managed Services Credit Card and ACH gateway. Credit card data is sent to the service (PMN) provider and cardholder data is stored in their infrastructure. Token returned to RLMS for any future payment or recurring billing. Network Technology Systems administration, IT security administration, incident monitoring and Solutions, LLC (Net-tech) alerting, patch management and systems implementation management, performance of vulnerability assessments, and risk analysis services. ByteGrid Holdings, LLC Colocation / data center services Mitel Network Corporation IVR payment services for telephone orders Iron Mountain Shreds remittance coupons from mail order transactions that may have cardholder data written on them Network Merchant Inc (NMI) Credit Card and ACH gateway. Credit card data is sent to the service provider and cardholder data is stored in their infrastructure. Token returned to RLMS for any future payment or recurring billing. Paysafe Merchant Services, Payment processing and tokenization services Corp Note: Requirement 12.8 applies to all entities in this list.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 6 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Part 2g. Summary of Requirements Tested For each PCI DSS Requirement, select one of the following:  Full – The requirement and all sub-requirements of that requirement were assessed, and no sub- requirements were marked as “Not Tested” or “Not Applicable” in the ROC.  Partial – One or more sub-requirements of that requirement were marked as “Not Tested” or “Not Applicable” in the ROC.  None – All sub-requirements of that requirement were marked as “Not Tested” and/or “Not Applicable” in the ROC. For all requirements identified as either “Partial” or “None,” provide details in the “Justification for Approach” column, including:  Details of specific sub-requirements that were marked as either “Not Tested” and/or “Not Applicable” in the ROC  Reason why sub-requirement(s) were not tested or not applicable Note: One table to be completed for each service covered by this AOC. Additional copies of this section are available on the PCI SSC website.

Name of Service Assessed: Merchant Services

Details of Requirements Assessed Justification for Approach PCI DSS (Required for all “Partial” and “None” responses. Identify which Requirement Full Partial None sub-requirements were not tested and the reason.) Requirement 1: 1.2.2 - N/A: RLMS did not utilize routers connected to the CDE. 1.2.3 - N/A: RLMS did not utilize wireless networks directly connected to the CDE. 1.3.6 - N/A: RLMS does not store cardholder data.

Requirement 2: 2.1.1 - N/A: RLMS did not utilize wireless networks directly connected to the CDE. 2.2.3 - N/A: RLMS did not use any insecure services, daemons, or protocols. 2.6 - N/A: RLMS was not a shared hosting provider.

Requirement 3: 3.4.1 - 3.6.8 - N/A: RLMS stored the truncated PAN only. The truncation process was handled by Phoenix Managed Networks. No cardholder data was stored post authorization. 3.2 - N/A: RLMS was not an issuer and did not support issuing services. 3.4 - N/A: RLMS stored the tokens only. The tokenization process was handled by Phoenix Managed Networks. No cardholder data was stored post authorization, and no RLMS employee had the ability to access or view the full PAN in any application.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 7 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Requirement 4: 4.1.1 - N/A: RLMS did not utilize wireless networks directly connected to the CDE.

Requirement 5:

Requirement 6:

Requirement 7:

Requirement 8: 8.5.1 - N/A: RLMS did not maintain separate customer environments and did not have remote access to customer premises 8.7 - N/A: RLMS did not maintain any databases which stored cardholder data.

Requirement 9: 9.1.2 - N/A: RLMS did not have any publicly accessible network jacks. 9.5.1 - N/A: RLMS did not produce backup media which contained cardholder data. 9.6 - 9.6.3 - N/A: Observed that credit card numbers in mail-in order forms were redacted immediately after processing. RLMS sent mail-forms back to some clients via redacted forms. 9.7 - 9.7.1 - N/A: Observed that no physical or paper media was maintained at the corporate office, the third party data center, or transferred offsite with the exception of paper remittances that were sent to some customers via secure courier and with redacted credit card numbers. Paper forms were placed in an Iron Mountain shred bin after processing. 9.8.2 - N/A: RLMS stored truncated PANs only. The truncations process was handled by Phoenix Managed Networks (PMN). 9.9 - 9.9.3 - N/A: RLMS did not maintain any card- interaction devices.

Requirement 10: 10.2.1 - N/A: RLMS did not store cardholder data. 10.5.5 - N/A: Logs within the log management server were read-only and not alterable by any user.

Requirement 11: 11.1.1 - N/A: RLMS did not utilize wireless networks directly connected to the CDE.

Requirement 12:

Appendix A1: All of Appendix A1: RLMS is not a shared hosting provider.

Appendix A2: All of Appendix A2: RLMS did not use SSL / early TLS or maintain any card-interaction devices.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 8 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Section 2: Report on Compliance

This Attestation of Compliance reflects the results of an onsite assessment, which is documented in an accompanying Report on Compliance (ROC).

The assessment documented in this attestation and in the ROC was completed January 25, 2019 on: Have compensating controls been used to meet any requirement in the ROC? Yes No

Were any requirements in the ROC identified as being not applicable (N/A)? Yes No

Were any requirements not tested? Yes No

Were any requirements in the ROC unable to be met due to a legal constraint? Yes No

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 9 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Section 3: Validation and Attestation Details

Part 3. PCI DSS Validation

This AOC is based on results noted in the ROC dated January 25, 2019. Based on the results documented in the ROC noted above, the signatories identified in Parts 3b-3d, as applicable, assert(s) the following compliance status for the entity identified in Part 2 of this document (check one):

Compliant: All sections of the PCI DSS ROC are complete, all questions answered affirmatively, resulting in an overall COMPLIANT rating; thereby Retail Lockbox Merchant Services, LLC has demonstrated full compliance with the PCI DSS.

Non-Compliant: Not all sections of the PCI DSS ROC are complete, or not all questions are answered affirmatively, resulting in an overall NON-COMPLIANT rating, thereby (Service Provider Company Name) has not demonstrated full compliance with the PCI DSS. Target Date for Compliance: An entity submitting this form with a status of Non-Compliant may be required to complete the Action Plan in Part 4 of this document. Check with the payment brand(s) before completing Part 4.

Compliant but with Legal exception: One or more requirements are marked “Not in Place” due to a legal restriction that prevents the requirement from being met. This option requires additional review from acquirer or payment brand. If checked, complete the following:

Affected Requirement Details of how legal constraint prevents requirement being met

Part 3a. Acknowledgement of Status Signatory(s) confirms: (Check all that apply) The ROC was completed according to the PCI DSS Requirements and Security Assessment Procedures, Version 3.2.1, and was completed according to the instructions therein. All information within the above-referenced ROC and in this attestation fairly represents the results of my assessment in all material respects. I have confirmed with my payment application vendor that my payment system does not store sensitive authentication data after authorization. I have read the PCI DSS and I recognize that I must maintain PCI DSS compliance, as applicable to my environment, at all times. If my environment changes, I recognize I must reassess my environment and implement any additional PCI DSS requirements that apply.

PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 10 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Part 3a. Acknowledgement of Status (continued) No evidence of full track data1, CAV2, CVC2, CID, or CVV2 data2, or PIN data3 storage after transaction authorization was found on ANY system reviewed during this assessment. ASV scans are being completed by the PCI SSC Approved Scanning Vendor McAfee

Part 3b. Service Provider Attestation

Signature of Service Provider Executive Officer  Date: 2/21/2019

Service Provider Executive Officer Name: Craig Dawson Title: President and CEO

Part 3c. Qualified Security Assessor (QSA) Acknowledgement (if applicable) If a QSA was involved or assisted with this Independent Assessor assessment, describe the role performed:

2/21/2019 Signature of Duly Authorized Officer of QSA Company  Date: Duly Authorized Officer Name: Douglas W. Barbin QSA Company: Schellman & Company, LLC

Part 3d. Internal Security Assessor (ISA) Involvement (if applicable) If an ISA(s) was involved or assisted with this assessment, identify the ISA personnel and describe the role performed:

1 Data encoded in the magnetic stripe or equivalent data on a chip used for authorization during a card-present transaction. Entities may not retain full track data after transaction authorization. The only elements of track data that may be retained are primary account number (PAN), expiration date, and cardholder name. 2 The three- or four-digit value printed by the signature panel or on the face of a payment card used to verify card-not-present transactions. 3 Personal identification number entered by cardholder during a card-present transaction, and/or encrypted PIN block present within the transaction message. PCI DSS v3.2.1 Attestation of Compliance for Onsite Assessments – Service Providers, Rev. 1.0 June 2018 © 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 11 DocuSign Envelope ID: 0B1AFB75-23DC-4BBE-BEB0-B11E8911EE1E

Part 4. Action Plan for Non-Compliant Requirements Select the appropriate response for “Compliant to PCI DSS Requirements” for each requirement. If you answer “No” to any of the requirements, you may be required to provide the date your Company expects to be compliant with the requirement and a brief description of the actions being taken to meet the requirement. Check with the applicable payment brand(s) before completing Part 4.

Compliant to PCI Remediation Date and PCI DSS DSS Requirements Actions Description of Requirement Requirement (Select One) (If “NO” selected for any YES NO Requirement) Install and maintain a firewall 1 configuration to protect cardholder data Do not use vendor-supplied defaults for 2 system passwords and other security parameters

3 Protect stored cardholder data

Encrypt transmission of cardholder data 4 across open, public networks Protect all systems against malware 5 and regularly update anti-virus software or programs Develop and maintain secure systems 6 and applications Restrict access to cardholder data by 7 business need to know Identify and authenticate access to 8 system components Restrict physical access to cardholder 9 data Track and monitor all access to network 10 resources and cardholder data Regularly test security systems and 11 processes Maintain a policy that addresses 12 information security for all personnel Additional PCI DSS Requirements for Appendix A1 Not applicable. Shared Hosting Providers Additional PCI DSS Requirements for Appendix A2 Entities using SSL/early TLS for Card- Not applicable. Present POS POI Terminal Connections