Notice of Intent to Sole Source - TRM Labs

Project ID: None FederalOpportunitiesSpecial Notice

Overview

Agency	Immigration and Customs Enforcement
Deadline	06/11/26
Posted	06/08/26
Estimated Value	$750,000 - $2,500,000 (AI estimate)
Set Aside	None
NAICS	541519 - Other Computer Related Services
PSC	DH01 - IT And Telecom - Platform Support Services: Database, Mainframe, Middleware (Labor)
Location	Fairfax, VA United States

Description

Primary Latest Change

Notice of Intent to Sole Source

Consistent with Revolutionary FAR Overhaul (RFO) 5.101(c), FAR Class Deviation 25-17, Rev. 1, the U.S. Department of Homeland Security (DHS), Homeland Security Investigations (HSI), Office of Acquisition Management (OAQ) intends to solicit from a single source under the authority of RFO 6.103-1, FAR Class Deviation 25-11, Rev. 1 for FAR Part 6 to TRM Labs, Inc. for TRM forensic software and support services to support Homeland Security Task Force investigations. The intended period of performance for this effort is 12-months from time of award. The anticipated contract type will be a firm-fixed price contract for the required services. The Government has determined that the circumstances of the contract action deem only one source reasonably available based on the capabilities of the source. This notice is for informational purposes only and is not a Request for Quote (RFQ) or Proposal (RFP). This is NOT a request for competitive quotes or proposals. A determination by the Government not to compete this proposed action based upon responses to this announcement is solely within the discretion of the Government. Interested parties may express their interest and demonstrate their capabilities in relation to the Statement of Need by submitting a one-page response no later than Thursday, June 11, 2026, at 10:00 AM EST. The one-page response shall be Times New Roman and shall not exceed font size of 11.5. The Government reserves the right to evaluate all responses received and may determine an interested vendor not capable of performing the work required by the Statement of Need. Please be advised that this announcement may constitute the only notice that will be posted for this acquisition, based on the review of any responses to this notice. Marketing brochures and/or generic company literature will not be considered nor evaluated. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. All one-page responses shall be directed to the Contracting Officer, Greg Hermsen, at Gregory.M.Hermsen@ice.dhs.gov by the date specified in this notice.

Summary (Newest Update)

Background The U.S. Department of Homeland Security (DHS), specifically the Homeland Security Investigations (HSI) Office of Acquisition Management (OAQ), intends to solicit from a single source, TRM Labs, Inc., for forensic software and support services. This initiative aims to support Homeland Security Task Force investigations in response to evolving cyber threats. The contract is being pursued under specific deviations that allow for a sole source procurement due to the unique capabilities of TRM Labs. Work Details The contract will involve providing advanced technology solutions and operational support to the Homeland Security Task Force (HSTF) National Coordination Center (NCC) Cyber Disruption Center (CDC). Key tasks include: 1. Scam Disruption: - AI-powered triage of victim complaints and clustering of criminal syndicates. - Automated victim outreach and support services. - Real-time scam wallet screening for financial institutions and exchanges. - End-to-end asset recovery pipeline, including monitoring, tracing, freezing, and forfeiture. - Targeting and mapping of transnational criminal organizations with verification of victim claims and restitution documentation. 2. Cybercrime Disruption and SLTT Resilience: - Development of a unified knowledge base and threat graph for cybercrime, including ransomware and extortion. - Creation of an indicator of compromise (IOC) database with a natural-language query interface. - Provision of intelligence packages to support enforcement actions, ransomware asset recovery, and detection of infrastructure overlaps. - AI-enabled incident response and threat reporting for state, local, tribal, and territorial entities. 3. Sextortion Disruption: - Targeting and mapping of criminal networks and infrastructure operators. - Asset recovery and tracing proceeds across payment rails with expansion to consumer messaging platforms and financial institution partners. - Integration of freeze pipelines and evidence packaging along with engineering support for victim identification and perpetrator attribution. Additionally, the NCC requires the ability to rapidly scale operational capacity for surge events or new partnerships while ensuring compliance with privacy and security requirements. Period of Performance The intended period of performance is 12 months from the time of award. Bidder Requirements Bidders must demonstrate capabilities in cryptocurrency tracing, blockchain analytics, open-source intelligence tools, as well as experience in supporting law enforcement investigations related to cybercrime. Incumbent Analysis (see Incumbents section for more detail) This opportunity appears to have a confirmed incumbent, TRM Labs, based on prior DHS/HSI awards under 70CMSD22D00000002 and related contract actions (e.g., $9,259,228 for 08/11/22–08/10/27, plus multiple follow-on periods in 2024–2026). The prior work centers on forensic software and services for blockchain analytics supporting HSI investigations, including concurrent user licenses used to trace and analyze NFTs across multiple cryptocurrency blockchains. The current requirement for forensic software and support to enable cybercrime/scam disruption and asset recovery pipelines similarly relies on blockchain tracing and related investigative analytics, suggesting continuity of the same core forensic capability.

Contacts