Evaluation of third parties 2027

Acquisition of a SaaS third-party evaluation solution on behalf of the Legal and Compliance Department. In France, Law No. 2016-1691 of December 9, 2016 on transparency, the fight against corruption and the modernization of economic life (hereinafter "SAPIN II Law") mandates the implementation of measures to prevent and combat corruption and influence peddling.

Among the measures to be implemented, companies must assess their third parties (clients, suppliers, partners, intermediaries, etc.) prior to entering into a business relationship. Several foreign laws with extraterritorial jurisdiction impose similar obligations on companies.

In addition, French Law No. 2017-399 of March 27, 2017 on the corporate duty of vigilance of parent and ordering companies, codified in Articles L 225-102-4 and L 225-102-5 of the French Commercial Code (hereinafter the "Duty of Vigilance Law"), requires parent companies to ensure that all their subsidiaries, subcontractors, and suppliers respect "human rights and fundamental freedoms, the health and safety of persons, and the environment." The SNCF Group must also comply with applicable French, European, or foreign laws and regulations regarding economic sanctions and export controls, as well as those related to the fight against money laundering and terrorist financing.

SNCF Group entities wish to acquire an information system that enables a comprehensive assessment of their third-party portfolios, with a depth of analysis that varies according to several criteria, such as the category of third party and the third party's risk profile, in order to comply with the regulatory requirements set out above. This document constitutes a statement of requirements specification.

Its purpose is to describe the main expected functionalities of the information system dedicated to third-party assessment. The objective is to have a solution that automates the assessment of 90% of the total third-party portfolio to minimize the use of internal resources within SNCF entities, enable operational staff (Level

1. to concentrate their efforts on assessing the remaining 10% of third parties, and allow compliance officers (Level
2. to focus their efforts on evaluating medium- or high-risk third parties, representing an estimated maximum of approximately 5% of the total third-party portfolio to be assessed. The purpose of this consultation is to select a service provider who will be responsible for:
   • Providing the software solution,
   • Adapting this solution as necessary to SNCF's specific needs,
   • Providing support and maintaining the solution in operational condition,
   • Assisting in steering the implementation of the solution within the SNCF context,
   • Producing the technical and functional documentation necessary for deploying the solution,
   • Providing support for training and rollout of the solution across SNCF. The solution must enable the user entity to have a comprehensive assessment of third parties (legal entities and individuals: clients, suppliers, intermediaries, subcontractors, partners, etc.) prior to entering into a business relationship or as part of ongoing monitoring of an active business relationship. The third-party assessment must make it possible to identify and evaluate the specific risk arising from the planned or ongoing business relationship in the following areas:
   • Integrity, corruption: the solution ensures compliance with the provisions of the Sapin II Law, the UKBA (UK), and the FCPA (USA). It must be compatible with the recommendations of the French Anti-Corruption Agency (AFA) regarding third-party evaluation;
   • Anti-money laundering and combating the financing of terrorism (AML/CFT): the integrity of the third party must be assessed with regard to any potential convictions or investigations for money laundering or terrorist financing offenses;
   • International economic sanctions and export control: (international financial or economic sanctions lists, in particular those issued by Fran…