The National Credit Regulator seeks a service provider to supply, configure, implement, integrate, migrate, train and support a SaaS-based regulatory information management system. A production-ready MVP is required by Month 6, with a 3-year contract and a 2-year extension option.
The National Credit Regulator (NCR) is seeking a suitably qualified service provider to deliver an Integrated Regulatory Information Management System (IRIS). The system will digitise the full regulatory lifecycle for credit providers, credit bureaus, credit bureau resellers, debt counsellors and payment distribution agents. It will replace current processes that rely on manual activities, spreadsheets and legacy systems. The required solution must be a configurable commercial off-the-shelf (COTS) or established low-code platform delivered as Software-as-a-Service (SaaS). Custom greenfield development is not acceptable. Core functionality must be delivered through standard product capability and configuration, and NCR administrators must be able to make routine changes without vendor code intervention.
The scope covers twelve integrated modules. These include entity and account management, applicant and registrant self-service, automated submission screening, fees and payment integration with the NCR Financial System, administrative and review workflows, advisory committee management, registration and certificate lifecycle, a no-login public register with QR verification, complaints and enforcement case management, a unified activity timeline with tamper-evident audit logs, and reporting and analytics. Required integrations include two-way exchange with the NCR Financial System, a South African payment gateway supporting card and EFT payments, single sign-on and multi-factor authentication through NCR identity services, email and SMS notifications, public register publishing, and documented REST APIs. The service provider must also migrate legacy records, registrations, payment history, documents and open cases, and must deliver role-based training, train-the-trainer sessions and structured administrator skills transfer.
The delivery timeline is a mandatory milestone. A production-usable MVP covering core registration and verification must be accepted by NCR no later than the end of Month 6, and prototypes or sandbox environments will not qualify. Full-scope delivery follows in NCR-approved phases, with three months of hypercare after full go-live. The contract runs for an initial three years, with an NCR option to extend by up to two years. Security, privacy and POPIA compliance are mandatory throughout the lifecycle. Bidders must provide ISO/IEC 27001 or SOC 2 Type II assurance, annual independent penetration testing, daily backups, documented disaster recovery with committed RPO and RTO, 99.5% minimum monthly availability, and data portability in non-proprietary formats. Bidders must also demonstrate solution maturity with at least three reference sites, two of which should be regulatory, oversight, professional or membership bodies. A South African registration or local implementation and support partner is required for the full contract term. Evaluation uses an 80/20 price and preference point system, with a minimum functionality threshold of 70%. Functionality is assessed through written proposals and a scripted live demonstration for shortlisted bidders. A compulsory briefing session is scheduled for 13 November 2026 via Microsoft Teams, and the closing date is 7 December 2026.
This tender suits established ICT firms, software vendors and certified implementation partners with experience delivering configurable COTS or low-code case management, workflow or regulatory platforms. Strong candidates will have verifiable references from at least three live implementations, including at least two regulatory, oversight, professional or membership bodies. They should be able to commit to a production MVP within six months, and should hold ISO/IEC 27001 or SOC 2 Type II certification or equivalent assurance. Applicants must be registered on the Central Supplier Database, hold a valid SARS tax clearance, and either be registered in South Africa or partner with a South African implementation and support provider for the full contract term. Businesses with strong POPIA, security and data-migration capability, and those able to provide local first-line support and skills transfer, are best placed to compete. Smaller firms may qualify as subcontractors or consortium members, provided that all joint venture, subcontracting and third-party arrangements are fully disclosed and supported by signed agreements. Businesses should attend the compulsory briefing on 13 November 2026 and should confirm they can meet the mandatory requirements before preparing a bid.
Starter gives you this tender's documents, requirements, location and buyer contacts, plus every new tender matched to your business, for R199/month.
Cancel anytime · No contract · Secure checkout by Paystack
See your matched tenders before you pay, then get their documents and buyer contacts straight away. Cancel anytime, no contract.
