1. Home
  2. |Insights
  3. |GSA Clarifies Permissibility of Upfront Payments for Software-as-a-Service Offerings

GSA Clarifies Permissibility of Upfront Payments for Software-as-a-Service Offerings

Client Alert | 1 min read | 04.18.24

On March 15, 2024, the General Services Administration (GSA) issued Acquisition Letter MV-2024-01 providing guidance to GSA contracting officers on the use of upfront payments for acquisitions of cloud-based Software-as-a-Service (SaaS).  Specifically, this acquisition letter clarifies that despite statutory prohibitions against the use of “advance” payments outside of narrowly-prescribed circumstances, upfront payments for SaaS licenses do not constitute an “advance” payment subject to these restrictions when made under the following conditions:

  • access to the software is granted contemporaneously with payment (i.e., delivery of the license is made contemporaneously with payment);
  • the license is acquired under a fixed-price or fixed-price with economic price adjustment, even if other portions of the task order or contract are not fixed price;
  • the license is priced at a single seat, multi-seat, unit, or subscription price covering a fixed term, defined as “a limited period of time”;
  • the license’s pricing/billing model allows for no utilization or consumption metric other than quantity to affect the costs incurred over the negotiated term;
  • the license does not require any upfront payment other than the fixed seat, unit, or subscription cost as a prerequisite for access or a pricing discount; and
  • within end user or other license agreements, the licensed service is continuous and uninterrupted for the negotiated term of access to the license.

This guidance follows Acquisition Letter MV-21-06, which permitted federal agencies to order cloud computing services on a consumption basis through GSA’s Federal Supply Schedule program (and eliminated application of the Price Reductions Clause to such offerings), and it represents the latest in a series of steps by GSA to better align the federal government’s acquisition practices for information services with customary commercial practices.

Insights

Client Alert | 6 min read | 09.11.26

It’s LIVE: The Cyber Resilience Act Reporting Is Mandatory as of Today - 11 September 2026

The wait is over. As of today, manufacturers of connected products (both hardware and software) must comply with the Cyber Resilience Act’s (“CRA”) vulnerability and incident reporting obligations. The CRA’s Single Reporting Platform (“SRP”), operated by the European Union Agency for Cybersecurity (“ENISA”), is now the EU-wide gateway through which those notifications must flow....