Tender Details
Description / Scope of Work
CERISMA (Private) Limited, Sindh, invites quotations for the provision of Internet Payment Gateway (IPG) services under RFQ CRZ-0015SJ, SAP No. 6100018013. The service requirement spans integration of payment gateway APIs with CERISMA's PCI-DSS certified systems to enable top-up and e-commerce transactions via bank cards across mobile applications (Android, iOS) and websites. The scope includes 12 enterprise agreements for PCRZ Payment Gateway services at CERISMA's Head Office location. The service provider must establish robust infrastructure supporting 3D Secure authentication, real-time transaction processing, settlement on T+1 basis without MDR deduction at source, and comprehensive transaction reconciliation and reversal mechanisms compliant with card-scheme and regulatory timelines.
Eligibility mandates that the service provider must be either a licensed commercial bank under the State Bank of Pakistan (SBP) or hold formal partnership with an SBP-licensed commercial bank, supported by documentary proof such as valid license or partnership letter. The provider must hold valid merchant acquiring licenses or certifications from VISA, Mastercard, China UnionPay (CUP), and PayPak. Critical mandatory certifications include current PCI-DSS (Payment Card Industry Data Security Standard) certification, 3D Secure (3DS) authentication capability evidenced by card-scheme certification or technical compliance letter, and documented Business Continuity and Disaster Recovery (BCP/DR) arrangements. Bidders must submit an undertaking on Rs. 100 stamp paper affirming non-blacklist status and accuracy of all provided information, with penalty of immediate disqualification for false claims.
Quotations must be submitted by 11 September 2026. The Request for Quotation document, containing detailed technical specifications, service provision requirements, security protocols, data protection obligations, and commercial terms, is available from PSO Dummy Vendor in Pakistan. Integration shall proceed via dedicated User Acceptance Testing (UAT) sandbox environment with joint written sign-off of results before go-live. The bank must provide 30 days advance notice for API specification changes and maintain backward compatibility for 90 days. All cardholder data and transaction details must remain within Pakistan unless expressly permitted under State Bank regulations and applicable data localization requirements.
For Bidders: Our Analysis PAKISTANTENDER INSIGHT
Independent analysis by PakistanTender — not part of the official notice. Always confirm details against the original tender document.
CERISMA seeks a payment gateway partner—typically a licensed SBP bank—to process top-up and e-commerce card transactions across 12 enterprise touchpoints.
The contract demands full PCI-DSS and 3DS certification, T+1 settlement without MDR deduction, and flawless transaction reconciliation. Notably, the tender is dated August 2026 with a September 2026 deadline, suggesting urgency. Data must remain in-country. This is a high-security, compliance-heavy engagement requiring established banking infrastructure and technical integration capability.
Who can bid: Must be SBP-licensed commercial bank or formally partnered with one (documentary proof required). Must hold VISA, Mastercard, CUP, and PayPak merchant acquiring licenses. Must maintain current PCI-DSS and PA-DSS certifications, 3D Secure capability, and BCP/DR arrangements. Typical requirements include NTN registration, good standing with State Bank, and security audit history.