Merchant Payment Acceptance Services Tender by Cerisma Private Limited, PSO Subsidiary

Cerisma (Private) Limited, a wholly-owned subsidiary of Pakistan State Oil and an SBP-approved Electronic Money Institution, has floated a Request for Quotation (RFQ No. CRZ0013SIR, SAP No. 6100017405) for Merchant Payment Acceptance Services in Sindh and across its nationwide PSO retail network. The scope covers supply, deployment, integration and managed operation of an all-in-one 2,000 Smart POS/QR payment acceptance device estate, starting at PSO fuel stations and expanding to associated merchant locations, with pricing structured across five monthly transaction count tiers ranging from 1 to over 50,000,000 transactions.

Eligible bidders should be qualified technology service providers capable of end-to-end device supply, application development, secure API integration, SIM/connectivity provisioning, and fully hosted cloud or data-centre infrastructure compliant with SBP data localisation rules, PCI DSS, ISO 27001 and the SBP Cloud Outsourcing Framework. Vendors must also handle post-deployment managed services including hardware maintenance, consumables and reporting. This tender follows PPRA Rules, 2004 and relevant SBP guidelines, though no specific bid security amount is stated on the form.

Interested vendors must submit quotations for all listed items by 28.07.2026, addressed to Cerisma (Private) Limited's Head Office. The contract runs for two years from Operational Acceptance, extendable up to five years subject to satisfactory performance and mutual agreement, with a mandatory six-month lock-in period. Bidders should contact Cerisma's procurement department for the complete tender document and submission instructions.

This is a large-scale, technology-heavy managed services contract rather than a simple hardware supply order — the winning vendor takes on hosting, PCI DSS/ISO 27001 compliance, and multi-year device amortization risk (36 months) with only an option, not obligation, for Cerisma to buy out devices at contract end. The tiered pricing by monthly transaction volume suggests a revenue-share or per-transaction commercial model rather than flat pricing, which SMEs should model carefully before bidding, especially given the 2-year base term with possible 5-year extension.

Who can bid: The notice does not specify formal eligibility criteria, but for an EMI-linked fintech infrastructure contract of this scale, bidders would typically need SECP registration, valid NTN, demonstrated PCI DSS and ISO 27001 compliance capability, SBP outsourcing framework familiarity, and prior experience in POS/QR device deployment and managed services.