[Federal Register Volume 63, Number 170 (Wednesday, September 2, 1998)]
[Proposed Rules]
[Pages 46719-46728]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-23559]



[[Page 46719]]

=======================================================================
-----------------------------------------------------------------------

POSTAL SERVICE

39 CFR Parts 111 and 502


Manufacture, Distribution, and Use of Postal Security Devices and 
Information-Based Indicia

AGENCY: Postal Service.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: This proposal would add new sections to the Domestic Mail 
Manual (DMM) and title 39, Code of Federal Regulations (CFR), to 
reflect policies and regulations pertaining to the Information-Based 
Indicia Program (IBIP). The proposed policies and regulations were 
originally published for public review and comment in the March 28, 
1997, Federal Register (62 FR 14833). As a result of comments received 
on that original proposal, the regulations have been revised to reflect 
two significant changes. The first is that the proposed regulations 
only address ``open'' systems. It is the intent of the Postal Service 
to address ``closed'' systems at a future date. The second is a 
clarification on refund procedures. In addition, the March 3, 1998, 
Federal Register (63 FR 10419) provided information regarding potential 
alternative approaches to the physical nature and location of a 
security device. The proposed regulations have been amended to reflect 
these alternatives. These proposed IBIP policies and regulations are 
interim and may be revised after experience has been gained with the 
testing and implementation of the first of the Information-Based 
Indicia (IBI) systems.

DATES: Comments must be received on or before November 2, 1998.

ADDRESSES: Written comments should be mailed or delivered to the 
Manager, Metering Technology Management, 475 L'Enfant Plaza SW, Room 
8430, Washington DC 20260-2444. Copies of all written comments will be 
available at the above address for inspection and photocopying between 
9 a.m. and 4 p.m., Monday through Friday.

FOR FURTHER INFORMATION CONTACT: Nicholas S. Stankosky, (202) 268-5311.

SUPPLEMENTARY INFORMATION: The Information-Based Indicia Program (IBIP) 
involves the development of new technology to produce forms of postage 
evidencing through the use of two-dimensional barcodes, human-readable 
information, and cryptographic services to produce postage evidence 
from personal computers. This technology will support Postal Service 
efforts to reduce fraud, provide a convenient access to postage, and 
provide an opportunity for customer defined ``value added'' services.
    There are five primary elements to an IBI. The indicia includes:
     Town circle information.
     Postage amount applied.
     Device identifier.
     Two-dimensional barcode.
     Optional advertising art.
    The Postal Service has classified potential IBIP PC Postage 
products into four major categories:
    1. Stand-alone system products.
    2. Local Area Network (LAN) system products.
    3. Wide Area Network (WAN) system products, and
    4. Hybrid system products.
    The proposed regulations pertain to current IBI stand-alone system 
performance criteria and will also be applied to the other potential 
categories as Providers present their systems for evaluation and 
approval.
    Core security functions, such as digital signature generation and 
verification and the management of registers, are performed on a stand-
alone system by a physical Postal Security Device (PSD). On all other 
systems these functions are performed remotely through another form of 
logical security element. Some customer and Provider requirements may 
differ according to each alternative system. The host system controls 
the customer infrastructure in system authorization, system audits, 
postage resetting and production of the indicia.
    The IBIP key management component employs a public-key certificate-
based digital signature that features a data integrity service and 
provides the means to validate the indicia. Finally, the product/
service Provider infrastructure provides support for all IBIP functions 
including licensing, PSD production, maintenance of other logical 
security elements, and life cycle support, and provides an interface 
with both the customer and the Postal Service infrastructure. The 
Postal Service interface involves the issuance of licenses, updating 
licensee information, product/device inventory and tracking, resetting 
support and account reconciliation, lost and stolen/irregularity 
monitoring, and the assignment of digital certificates.
    The following is a summary of the Postal Service's position on the 
general interest IBIP policy issues. In this document, the USPS will 
only address ``open'' systems. ``Closed'' systems will be addressed 
separately at a future date.
     Any proposed open system product or device must be 
submitted for approval under proposed ``Metering Technology Management 
Metering Product Submission Procedures'' (September 1, 1998 Federal 
Register). These procedures include specifics on letters of intent, 
nondisclosure agreements, the Provider's concept of operations and 
infrastructure, documentation requirements, product submissions, and 
most testing activities.
     In an attempt to use the existing Postal Service 
infrastructure as much as possible, customer licensing and product/
device tracking will be included in the Centralized Meter Licensing 
System (CMLS). A license must be obtained prior to the use of a device. 
A customer already licensed to use postage meters will not have to 
apply again for an additional license. The Postal Service will simply 
update the customer's file.
     All IBIP-specific system components must be leased.
     Until the Postal Service has captured historical data on 
reliability and security, the total amount of postage in a descending 
register will be limited to a maximum of $500. Ascending registers must 
show all postage printed over time.
     Authorized Providers must keep records of the 
distribution, control, and maintenance of all IBIP systems throughout 
the complete lifecycle of the product. This includes tracking of all 
PSDs, including newly manufactured PSDs, active leased PSDs and 
inactive unleased PSDs, as well as lost and stolen PSDs.
     Indicia produced from the IBIP system may be used to 
indicate postage for single-piece rate First-Class Mail (including 
Priority Mail), Express Mail, and Standard Mail classes. Mail bearing 
the indicia is entitled to all privileges and subject to all conditions 
applying to these classes of mail.
     Providers are responsible for audit functions. The Postal 
Service will not take over this function but may at times participate 
in or review the audit process. PSDs and other logical security 
elements must be audited at least once every 3 months.
     Providers must perform an analysis of each submitted 
customer mailpiece as part of the Provider's Mailpiece Quality 
Assurance program to ensure the quality and readability of the indicia. 
The Provider must notify the customer and the Postal Service of any 
deficiencies.
     All postage downloads or settings will be made under the 
provisions of the Computerized Remote Meter Resetting System (CMRS). 
The Postal Service will conduct periodic audits of a Provider's 
resetting system to ensure that the system is operating correctly and 
that postal revenues are protected.

[[Page 46720]]

     Physical inspections of PSDs will be made at the time of 
submission for approval and if there is a subsequent suspicion of a 
security problem.
     The Postal Service will provide refunds for unused 
postage, for any balance remaining on a PSD or other logical security 
element, and for any balance remaining in the licensee's CMRS account.
     All approved systems must have the capability to update 
postage rates efficiently when such changes are announced.
     There are provisions in the IBIP regulations for the 
correction of postage and dates. These are similar to those used for 
metered postage. For date correction, the facing identification mark 
(FIM) and barcode will be suppressed; for postage correction, the FIM 
will be suppressed.
     Cautionary labels such as those affixed to postage meters 
will not be affixed to PSDs. However, Providers must make their 
customers aware of this information through their supplied software, 
and documentation.
    Although exempt from the notice and comment requirements of the 
Administrative Procedure Act (5 U.S.C. 553(b), (c)) regarding proposed 
rule-making by 39 U.S.C. 410(a), the Postal Service invites public 
comments on the following proposed amendments to the Domestic Mail 
Manual, incorporated by reference in the Code of Federal Regulations. 
See 39 CFR part 111.

List of Subjects in 39 CFR Parts 111 and Part 502

    Administrative practice and procedure, Postal Service.

    Accordingly, Parts 111 and 502 of title 39, CFR are amended as 
follows:

PART 111--[AMENDED]

    1. The authority citation for 39 CFR part 111 continues to read as 
follows:

    Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 3001-
3011, 3403-3406, 3621, 3626, 5001.

    2. Add the following sections to the Domestic Mail Manual as set 
forth below:

P050  Information-Based Indicia

1.0  BASIC INFORMATION

1.1  Description of IBI

    The IBI system prints an authorized USPS Information-Based Indicia 
that shows evidence of postage. The indicia consists of a USPS-approved 
two-dimensional barcode and certain human-readable information such as 
city and state, 5-digit ZIP Code of licensing post office, device ID 
number, date, and amount of postage. The IBI system includes as a 
primary component a physical Postal Security Device (PSD), or another 
form (e.g., remote) of logical security element depending on the 
installed IBI system version, that provides critical functionality for 
accounting for postage with a computer-based host system. The security 
device and host system interact to generate the indicia. The security 
device is remotely set and requires the customer to have funds on 
deposit with the USPS before initial setting or resetting.

1.2  Provider Responsibilities

    The IBI system is available only through a lease agreement from a 
USPS-authorized Provider. The USPS holds Providers responsible for the 
life cycle, control, operation, maintenance, and replacement of their 
IBIP products and devices.

1.3  Possession

    A customer must have a USPS-issued license and a valid lease 
agreement to use the IBI system.

1.4  Classes of Mail

    Indicia produced from the IBI system may be used to indicate 
postage for single-piece rate First-Class Mail (including Priority 
Mail), Express Mail, and Standard Mail classes.

1.5  Amount of Postage

    The value of the IBIP indicia affixed to each mailpiece must equal 
or exceed the exact amount due for the piece when mailed.

1.6  Additional Postage

    An indicia showing additional postage may be placed on a shortpaid 
mailpiece under 4.9, Postage Correction.
2.0  LICENSE

2.1  Procedures

    The application and the license are processed through the 
Centralized Meter Licensing System (CMLS). An applicant must provide 
all applicable data for Form 3601-A, Application for a License to Lease 
and Use Postage Meters, to the Provider. The application must state the 
post office where the applicant intends to deposit mail produced using 
their IBI system. The Provider electronically transmits the information 
requested on Form 3601-A to CMLS in the USPS-specified format. When a 
Provider transmits the application on behalf of the applicant, the USPS 
notifies the Provider when a license is issued. A single license covers 
all IBI systems to the same applicant by the same post office, but a 
separate application must be submitted for each post office where the 
applicant wants to deposit IBI mail. There is no fee for the 
application and license. After approving an application, the USPS 
issues a Postage Meter License (Form 3601-B). A customer will not have 
to apply for a license to use an IBI system if the customer already 
possesses a valid postage meter license.

2.2  Refusal to Issue License

    The USPS may refuse to issue a license for the following reasons: 
the applicant submitted false or fictitious information on the license 
application; the applicant violated any standard for the care or use of 
an IBI or product/device that resulted in the revocation of that 
applicant's license within 5 years preceding submission of the 
application; or there is sufficient reason to believe that the product/
device is to be used in violation of the applicable standards. The USPS 
sends the licensee written notice when an application for a license is 
refused. The USPS notifies the Provider if the license is refused. Any 
applicant refused a license may appeal the decision under 2.4.

2.3  Revocation of License

    A license is subject to revocation for any of the following 
reasons:
    a. An IBI product/device is used for any illegal scheme or 
enterprise or there is probable cause to believe that the product/
device is to be used in violation of the applicable standards.
    b. The IBI product/device is not reset or audited within a 3-month 
period.
    c. Sufficient control of an IBI product/device is not exercised or 
the standards for its care or use are not followed.
    d. The IBI product/device is kept or used outside the boundaries of 
the United States or those U.S. territories and possessions without 
USPS approval.
    e. IBI mail is deposited at other than the licensing post office 
(except as permitted by 5.0 or D072).
    f. Failure to forward mailpieces to the Provider for quality 
assurance as required by 2.5h.
    The USPS sends written notice to the licensee and the licensee's 
Provider of any revocation.

2.4  Appeals

    An applicant who is refused a license, or a licensee whose license 
is revoked, may file a written appeal with the Manager of Metering 
Technology Management (MTM), USPS Headquarters, within 10 calendar days 
of receipt of the decision.

[[Page 46721]]

2.5  Licensee Responsibilities

    The licensee's responsibilities for the care and use of an IBI 
product/device include the following:
    a. After a PSD supporting a stand-alone system is delivered to a 
licensee, it must remain in the licensee's custody until it is returned 
to the authorized Provider.
    b. The licensee must, upon request, make the PSD in the licensee's 
custody and corresponding records on transactions immediately available 
for review and audit to the Provider or the USPS.
    c. The licensee must remote-set security devices at least once 
every 3 months.
    d. The licensee must immediately notify the Provider of any change 
in the licensee's name, address, telephone number, the location of the 
product/device, or any other information on the Form 3601-A.
    e. The USPS issues a revised license based on the transmission of 
updated information from the Provider. The licensee must verify and 
update license information on a periodic basis. If a licensee changes 
the post office where IBI mail is to be deposited, the PSD or other 
logical security element must be checked out of service by the 
authorized Provider. The customer must be relicensed at the new post 
office before the Provider can issue and reset a replacement PSD or 
other logical security element.
    f. The licensee must report a misregistering or otherwise defective 
IBI product/device to the Provider under 2.7 and must ensure that the 
defective IBI product/device is not used.
    g. The licensee must maintain address quality by updating the USPS 
AMS CD-ROM disk at least once every 6 months.
    h. The licensee must forward a mailpiece produced by the IBI 
product/device to the Provider at least once every 6 months after 
initialization for quality assurance.
    i. The customer must enter into a signed lease agreement with the 
Provider that includes a financial agreement for resetting the IBI 
product/device with postage.

2.6  Custody of Suspect PSDs

    The Postal Service may conduct unannounced, on-site examinations of 
IBI product/devices reasonably suspected of being manipulated or 
otherwise defective. An inspector may also immediately withdraw a 
suspect IBI product/device from service for physical and/or laboratory 
examination. The inspector issues the licensee a receipt for the IBI 
product/device, forwards a copy to the Provider, and, if necessary, 
assists in obtaining a replacement IBI product/device. Where possible, 
the Inspection Service gives advance notice that an IBI product/device 
is to be inspected. Unless there is reason to believe that the IBI 
product/device is fraudulently set with postage, existing postage in 
the IBI product/device to be examined is transferred to the replacement 
PSD.

2.7  Defective PSD or Other Logical Security Element

    The licensee must immediately report any defective PSD or other 
logical security element to the Provider. The Provider must retrieve 
any defective PSD within 3 business days of notification by the 
licensee and notify the USPS. A faulty PSD or other logical security 
element may not be used under any circumstance. Faulty PSDs must be 
returned to the Provider. The Provider will supply the licensee with a 
replacement PSD or will correct the logical security element, as 
applicable.

2.8  Missing PSD

    The licensee must immediately report to the Provider and licensing 
post office the loss or theft of any PSD or the recovery of any missing 
PSD. Reports must include the PSD identification number and/or serial 
number; the date, location, and details of the loss, theft, or 
recovery; and a copy of any police report. The Provider must report all 
details of the incident to the Manager, MTM.

2.9  Returning a PSD

    After a PSD is delivered to a licensee, the PSD must be kept in the 
licensee's custody until returned to the authorized Provider. A 
licensee with a faulty or misregistering PSD or who no longer wants to 
keep a PSD must return the PSD to the Provider to be checked out of 
service. PSDs must be shipped by Priority Mail Returned Receipt for 
Merchandise unless the Manager, MTM, USPS Headquarters, gives written 
permission to ship at another rate or special service.
3.0  SETTING

3.1  Initial Setting of PSD or Other Logical Security Element

    Before the licensee is issued a PSD or is granted access to another 
form of logical security element, the device must be initialized and 
authorized by the Provider. The customer must enter into a lease 
agreement with the Provider that includes a financial agreement for 
resetting the device with postage. Settings are made according to the 
provisions of the USPS Computerized Remote Postage Meter Resetting 
System (CMRS).

3.2  Payment for Postage

    Payment must be made for postage before the IBI product/device is 
set. The customer is permitted to make payment in accordance with 
Treasury Handbook, F-3, section 2-11.

3.3  Postage Transfers and Refunds

    Postage losses due to malfunctions are the responsibility of the 
Provider. The Postal Service will provide refunds for unused postage, 
for any balance remaining on a PSD or other logical security element, 
and for any balance remaining in the licensee's CMRS account.
     For unused postage, refunds will only be granted for 
mailpieces that are 30 days old or less. The mailpieces and a completed 
PS Form 3533, Application and Voucher for Refund of Postage and Fees, 
must be forwarded to the Provider for indicia verification and 
processing. Refunds will be credited to the licensee's CMRS account.
     Upon the return of a PSD, the Provider will verify the 
remaining balance. The refund will be credited to the licensee's CMRS 
account.
     Refunds from other logical security elements will be 
verified by the Provider and credited to the licensee's CMRS account.
     Licensees must notify the Provider in writing to request 
the closing of a CMRS account. After the request has been processed the 
licensee will receive a check for the balance.

3.4  Periodic Examinations

    PSDs or other logical security elements must be reset at least once 
every 3 months. The Provider's update of the watchdog timer/device 
audit satisfies this requirement. The USPS reserves the right to 
examine security devices by remote access or otherwise.

3.5  Resetting

    In addition to the conditions in Part B, Postal Security Device, of 
the ``Performance Criteria for Information-Based Indicia and Security 
Architecture for IBI Postage Metering Systems (PCIBISAIBIPMS),'' the 
following conditions must be met to reset a PSD or other logical 
security element:
    a. The licensee's account must have sufficient funds to cover the 
desired postage increment, or the Provider must agree to advance funds 
to the USPS on behalf of the licensee. The USPS encourages the 
Providers to recommend the use of the following payment forms by order 
of preference:

1. ACH Debit

[[Page 46722]]

2. ACH Credit
3. Wire Transfer
4. Debit Card Optional
5. Credit Card Optional
6. Check

    b. As part of the resetting procedure, the licensee must provide 
identification information according to the Provider's resetting 
specifications.
    c. After a PSD or other logical security element is reset, the 
Provider supplies the licensee with documentation of the transaction 
and the balance remaining in the licensee's account, unless the 
Provider gives a monthly statement to the licensees documenting all 
transactions for the period and the balance after each transaction.

3.6  Amount of Postage

    The descending register of the PSD or other logical security 
element is programmed not to exceed $500 for a given user at any time.
4.0  INDICIA

4.1  Design

    The indicia designs (types, sizes, and styles) must be those the 
Provider specified when the IBI product/device was approved by the USPS 
for manufacture and distribution.

4.2  Legibility

    The indicia must be legible. An illegible indicia is not acceptable 
when determining postage paid. Minimal standards for acceptable 
reflectance measurements of the indicia and the background material are 
in the Uniform Symbology Specifications PDF417 and DMM Section C840.5. 
The facing identification mark (FIM) must meet the dimensions and print 
quality specified in DMM C810. The address and POSTNET barcode must 
meet the specifications listed in the DMM C840.

4.3  On an Adhesive Label

    The USPS-approved label must be used when IBI indicia are to be 
printed on a label. Labels are subject to corresponding standards in 
DMM C810 and must be approved by the Manager, MTM.

4.4  Position

    The indicia must be printed or applied in the upper right corner of 
the envelope, address label, or tag. The indicia must be at least \1/4\ 
inch from the right edge of the mailpiece and \1/4\ inch from the top 
edge of the mailpiece. The indicia barcode must be horizontally 
oriented. The indicia must not infringe on the areas reserved for the 
FIM, POSTNET barcode, or optical character reader (OCR) clear zone. 
These apply to pieces meeting the dimensions specified in DMM C800.

4.5  Content

    In usage, the indicia must consist of human-readable information 
and two-dimensional barcoded information unless specified otherwise. 
The human-readable information must show, as a minimum, the city, 
state, and 5-digit ZIP Code of the licensing post office, the device 
ID, date of mailing, rate category, and the amount of postage. On 
approval of the licensing post office, the indicia may contain the name 
and state designation of its local classified branch. This 
authorization does not apply to classified stations or to contract 
stations or branches. Alternatively, the indicia may show the ZIP Code 
rather than the city and state designation. In this case, the words 
``Mailed From ZIP Code'' and the mailer's delivery address ZIP Code 
must appear in place of the city and state, respectively. When it is 
necessary to print multidenomination IBI product/device indicia on more 
than one tape, the human-readable information showing the post office 
must be on each adhesive label.

4.6  Complete Date

    The month, day, and year must be shown in the indicia on all First-
Class Mail. On Standard Mail the day may be omitted. Mailpieces bearing 
an indicia with only the month and year may be accepted during the 
month shown. They may also be accepted through the third day of the 
following month if the postmaster finds that the mailing was 
unavoidably delayed before deposit with the USPS.

4.7  Date Accuracy

    The date shown in the indicia must be the actual date of deposit. 
Mail deposited after the day's last scheduled collection may bear the 
date of the next scheduled collection.

4.8  Date Correction

    If date correction is required, an indicia showing actual date of 
mail and the word ``REDATE'' instead of the postage amount may be used. 
The indicia must be placed on the nonaddress side at least 20mm from 
the bottom edge of the mailpiece. The indicia impression must not bear 
the FIM or the two-dimensional barcode.

4.9  Postage Correction

    An indicia for additional postage may be placed on a shortpaid 
mailpiece to correct postage. The corrected indicia must be printed on 
the nonaddress side at least 20mm from the bottom edge of the piece and 
not on an envelope flap. The impression on the nonaddress side must 
contain all the indicia elements except for the FIM. To meet two-
dimensional barcode readability requirements, an indicia may be printed 
on a USPS-approved tape/label.

4.10  Other Matter Printed

    Advertising matter, slogans, return addresses, and the postal 
markings specified in 4.11 may be printed with the indicia within space 
limitations. A licensee must obtain the content for printing this 
matter from the authorized Provider. Advertising art messages must 
include the mailer's name or words such as ``Mailer's Message.'' The 
advertising art must not be obscene, defamatory of any person or group, 
or deceptive and it must not advocate any unlawful action. The Provider 
must obtain prior approval for all advertising matter.

4.11  Postal Markings

    Postal markings related to the class or category of mail are 
required. If placed in the advertising art area, only the postal 
marking may be printed, and it must fill the advertising art area as 
much as possible. All words must be in bold capital letters at least 
\1/4\ inch high (18-point type) and legible at 2 feet. Exceptions are 
not made for small advertising art that cannot accommodate a 
permissible marking.

4.12  FIM

    The mailpiece generated by IBI product/device must bear a USPS-
approved FIM D unless the envelope is courtesy reply with a FIM A or 
the piece is not a letter or a flat. The location of the FIM applies to 
pieces meeting the dimensions specified in DMM C800.
5.0  MAILINGS

5.1  Preparation of IBI

    Mail is subject to the preparation standards that apply to the 
class of mail and rate claimed.

5.2  Combination

    IBI mail may be combined in the same mailing with mail paid with 
other methods only if authorized by the USPS.

5.3  Where to Deposit

    Single-piece rate First-Class Mail may be deposited in any street 
collection box or such other place where mail is accepted and that is 
served by the licensing post office. Limited quantities (i.e., a 
handful) of single-piece rate First-Class Mail may be deposited at 
offices other than the licensing post office to expedite dispatch.

[[Page 46723]]

6.0  AUTHORIZATION TO MANUFACTURE AND DISTRIBUTE IBI SYSTEMS
    Title 39, Code of Federal Regulations, part 502, contains 
information about the authorization to manufacture and distribute IBI 
product/devices; the suspension and revocation of such authorization; 
performance standards, test plans, testing, and approval; required 
manufacturing security measures; and standards for distribution and 
maintenance. Further information may be obtained from MTM, USPS 
Headquarters.
    3. Part 502 is added to read as follows:

PART 502--AUTHORITY TO MANUFACTURE AND DISTRIBUTE INFORMATION BASED 
INDICIA SYSTEMS

Sec.
502.1  Provider qualifications.
502.2  Provider authorization.
502.3  Changes in ownership or control.
502.4  Burden of proof standard.
502.5  Suspension and revocation of authorization.
502.6  Description of the IBIP.
502.7  Product/device Provider.
502.8  IBIP performance criteria.
502.9  Test plans.
502.10  Security testing.
502.11  IBI system approval.
502.12  Conditions for approval.
502.13  Suspension and revocation of approval.
502.14  Reporting.
502.15  Administrative sanction on reporting.
502.16  Materials and workmanship.
502.17  Destruction of product/device indicia.
502.18  Inspection of new IBI systems.
502.19  Distribution facilities.
502.20  Distribution controls.
502.21  Administrative sanction.
502.22  IBI system replacement.
502.23  Inspection of PSDs or other logical security elements in 
use.
502.24  PSDs not located.
502.25  Computerized remote resetting.
502.26  Indicia quality assurance.
502.27  IBI system refunds.
502.28  Key management requirements.
502.29  Provider infrastructure.

    Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 410, 
2601, 2605; Inspector General Act of 1978, as amended (Pub. L. 95-
452, as amended), 5 U.S.C. App 3.


Sec. 502.1  Provider qualifications.

    A potential Provider wanting authorization to lease or otherwise 
distribute an Information-Based Indicia (IBI) system, as approved by 
the Postal Service, for use by licensees under Domestic Mail Manual 
P050.1.2 must:
    (a) Satisfy the Postal Service of its integrity and financial 
responsibility;
    (b) Obtain approval of at least one prototype incorporating all the 
features and safeguards specified in Sec. 502.9;
    (c) Have, or establish, and keep under its supervision and control 
adequate manufacturing facilities suitable to carry out the provisions 
of Secs. 502.18 through 502.21 to the satisfaction of the Postal 
Service (such facilities must be subject to unannounced inspection by 
representatives of the Postal Service); and
    (d) Have, or establish, and retain adequate facilities for the 
control, distribution, and maintenance of IBI systems and their 
replacement when necessary.


Sec. 502.2  Provider authorization.

    Upon qualification and approval, the applicant is authorized in 
writing to manufacture IBI products/devices and to lease them to 
persons licensed by the Postal Service.


Sec. 502.3  Changes in ownership or control.

    Any person or concern wanting to acquire ownership or control of an 
authorized Provider must provide the Postal Service with satisfactory 
evidence of that person's or concern's integrity and financial 
responsibility.


Sec. 502.4  Burden of proof standard.

    The burden of proof is on the Postal Service in the adjudication of 
suspensions and revocations under Secs. 502.5 and 502.14 and 
administrative sanctions under Secs. 502.16 and 502.22. Except as 
otherwise indicated in those sections, the standard of proof shall be 
the preponderance of evidence standard.


Sec. 502.5  Suspension and revocation of authorization.

    (a) The Postal Service may suspend and/or revoke authorization to 
provide and/or distribute any or all of a Provider's IBI systems if the 
Provider engages in any unlawful scheme or enterprise, fails to comply 
with any provision in this part 502, or fails to implement instructions 
issued in accordance with any final decision issued by the Postal 
Service within its authority over the IBI product/device programs.
    (b) The decision to suspend or revoke a Provider's authorization 
shall be based on the nature and circumstances of the violation (e.g., 
whether the violation was willful, whether the Provider voluntarily 
admitted to the violation, whether the Provider cooperated with the 
Postal Service, whether the Provider implemented successful remedial 
measures) and on the Provider's performance history. Before determining 
whether a Provider's authorization to manufacture and/or distribute IBI 
systems should be revoked, the procedures in paragraph (c) of this 
section shall be followed.
    (c) Suspension in all cases shall be as follows:
    (1) Upon determination by the Postal Service that a Provider is in 
violation of the provisions in this part 502, the Postal Service shall 
issue a written notice of proposed suspension citing deficiencies for 
which suspension or authorization to provide IBI systems may be imposed 
under paragraph (c) (2) of this section. Except in cases of willful 
violation, the Provider shall be given an opportunity to correct 
deficiencies and achieve compliance with all requirements within a time 
limit corresponding to the potential risk to postal revenue.
    (2) In cases of willful violation, or if the Postal Service 
determines that the Provider has failed to correct cited deficiencies 
within the specified time limit, the Postal Service shall issue a 
written notice setting forth the facts and reasons for the decision to 
suspend and the effective date if a written defense is not presented as 
provided in paragraph (d) of this section.
    (3) If, upon consideration of the defense as provided in paragraph 
(e) of this section, the Postal Service deems that the suspension is 
warranted, the suspension shall remain in effect for up to 90 days 
unless withdrawn by the Postal Service, as provided in paragraph 
(c)(4)(iii) of this section.
    (4) At the end of the 90-day suspension, the Postal Service may:
    (i) Extend the suspension in order to allow more time for 
investigation or to allow the Provider to correct the problem;
    (ii) Make a determination to revoke authorization to provide and/or 
distribute the Provider's products/devices in part or in whole; or
    (iii) Withdraw the suspension based on identification and 
implementation of a satisfactory solution to the problem. Provider 
suspensions may be withdrawn before the end of the 90-day period if the 
Postal Service determines that the Provider's solution and 
implementation are satisfactory.
    (d) The Provider may present the Postal Service with a written 
determination within 30 calendar days of receiving the written notice 
(unless a shorter period is deemed necessary). The defense must include 
all supporting evidence and specify the reasons for which the order 
should not be imposed.
    (e) After receipt and consideration of the defense, the Postal 
Service shall advise the Provider of the decision and the facts and 
reasons for it. The decision

[[Page 46724]]

shall be effective on receipt unless it provides otherwise. The 
decision shall also advise the Provider that it may appeal that 
determination within 30 calendar days of receiving written notice 
(unless a shorter period is deemed necessary), as specified therein. 
The appeal must include all supporting evidence and specify the reasons 
the Provider believes that the decision is erroneous.
    (f) An order or final decision under this section does not preclude 
any other criminal or civil statutory, common law, or administrative 
remedy that is available by law to the Postal Service, the United 
States, or any other person or concern.


Sec. 502.6  Description of the IBIP.

    The IBI product/device prints an authorized USPS Information-Based 
Indicia that shows evidence of postage. The indicia consists of a USPS-
approved two-dimensional barcode and certain human-readable information 
such as city and state, 5-digit ZIP Code of licensing post office, 
Device ID number, date, and amount of postage. The IBI product/device 
includes as a primary component a physical Postal Security Device 
(PSD), or a remote logical security element depending on the installed 
IBI system version, that provides critical functionality for accounting 
postage with a computer-based host system. The security device and host 
system interact to generate the indicia. The PSD or other logical 
security element is remotely set with postage value and requires the 
licensee to have funds on deposit with the Postal Service prior to 
initial setting or resetting. IBIP PC Postage products are classified 
into four major categories.

    1. Stand-alone system products.
    2. Local Area Network (LAN) system products.
    3. Wide Area Network (WAN) system products, and
    4. Hybrid system products.

    Core security functions such as digital signature generation and 
verification and the management of registers are performed on a stand-
alone system by a physical PSD. On all other systems these functions 
are performed remotely through another form of logical security 
element. Customer and Provider requirements may differ according to 
each alternative system.


Sec. 502.7  Product/device Provider.

    The IBI system is available to licensees only through a lease 
agreement from a USPS authorized Provider. The host is envisioned to 
operate on personal computers.


Sec. 502.8  IBIP performance criteria.

    The IBIP performance criteria describe system elements that include 
Postal Service infrastructure, Provider infrastructure, and customer 
infrastructure. The existing Postal Service infrastructure supports 
customer authorization, product audit, postage resetting reporting, 
total population management, key management support, financial 
reconciliation, product lifecycle tracking, and lost and stolen/
irregularity management functions. The Provider infrastructure will 
support all IBIP functions. The customer infrastructure will consist of 
the applicable security device and host system. The Postal Service will 
evaluate and test IBIP systems for compliance with this infrastructure.
    (a) The indicia data content is described in Part A, Indicium, of 
the ``Performance Criteria for Information-Based Indicia and Security 
Architecture for IBI Postage Metering Systems (PCIBISAIBIPMS).'' 
Contact the Manager, MTM, USPS, 475 L'Enfant Plaza SW, Room 8430, 
Washington DC 20260-2444 for these requirements.
    (b) The PSD implements digital signature technology for the 
creation and verification of digital signatures. Postal Security Device 
performance criteria are described in Part B, Postal Security Devices, 
of the PCIBISAIBIPMS. Contact the Manager, MTM, USPS, 475 L'Enfant 
Plaza SW, Room 8430, Washington DC 20260-2444 for these requirements.
    (c) Indicia design must comply with the requirements in Domestic 
Mail Manual (DMM) P050.
    (d) Host System Functional Requirements are contained Part C, Host 
System, of the PCIBISAIBIPMS. Contact the Manager, MTM, USPS, 475 
L'Enfant Plaza SW, Room 8430, Washington DC 20260-2444 for these 
requirements.
    (e) Key Management functional requirements are contained in Part D, 
Key Management Plan, of the PCIBISAIBIPMS. Contact the Manager, MTM, 
USPS, 475 L'Enfant Plaza SW, Room 8430, Washington DC 20260-2444 for 
these requirements.


Sec. 502.9  Test plans.

    Each IBI system that is submitted for USPS approval should be 
submitted in accordance with the provisions contained in the ``Metering 
Technology Management Metering Product Submission Procedures.'' Contact 
the Manager, MTM, USPS, 475 L'Enfant Plaza SW, Room 8430, Washington DC 
20260-2444 for these requirements.


Sec. 502.10  Security testing.

    The Postal Service reserves the right to require or conduct 
additional examination and testing at any time, without cause, of any 
IBI system submitted to the Postal Service for approval or previously 
approved by the Postal Service.


Sec. 502.11  IBI system approval.

    As provided in Sec. 502.14, the Provider has a duty to report 
security weaknesses to the Postal Service to ensure that each IBI 
system protects the Postal Service against loss of revenue at all 
times. An approval of a system does not constitute an irrevocable 
determination that the Postal Service is satisfied with its revenue-
protection capabilities. After approval is granted to an IBI system, no 
change affecting the features or safeguards may be made except as 
authorized or ordered by the Postal Service in writing.


Sec. 502.12  Conditions for approval.

    (a) The Postal Service may require at any time that approved 
production systems of IBI products/devices, as well as the design, user 
manuals, and specifications applicable to such IBI systems and any 
revisions thereof, be submitted to the Manager, MTM, USPS, 475 L'Enfant 
Plaza SW, Room 8430, Washington DC 20260-2444.
    (b) Upon request by the Postal Service, additional IBI systems must 
be submitted to the Postal Service for testing, at the expense of the 
Provider.
    (c) All product/device submissions should adhere to the 
requirements contained in the ``Metering Technology Management Metering 
Product Submission Procedures.'' Particular attention should be given 
to the requirement to simultaneously submit an identical IBI system to 
a laboratory accredited under the National Voluntary Laboratory 
Accreditation Program (NVLAP) for FIPS 140-1 certification.


Sec. 502.13  Suspension and revocation of approval.

    (a) The Postal Service may suspend an IBI system if the Postal 
Service believes that an IBI system poses an unreasonable risk to 
postal revenue.
    (b) Suspension procedures:
    (1) Upon determination by the Postal Service that an IBI system 
poses an unreasonable risk to postal revenue, the Postal Service shall 
issue a written notice of proposed suspension citing deficiencies for 
which suspension may be imposed under paragraph (b)(2) of this section. 
The Provider shall be given an opportunity to correct deficiencies and 
achieve compliance with all requirements within a time limit

[[Page 46725]]

corresponding to the potential risk to postal revenue.
    (2) If the Postal Service determines that the Provider has failed 
to correct cited deficiencies within the specified time limit, the 
Postal Service shall issue a written notice setting forth the facts and 
reasons for the decision to suspend and the effective date if a written 
defense is not presented as provided in paragraph (c) of this section.
    (3) If, upon consideration of the defense as provided in paragraph 
(d) of this section, the Postal Service deems that the suspension is 
warranted, the suspension shall remain in effect for up to 90 days 
unless withdrawn by the Postal Service, as provided in paragraph 
(b)(4)(iii) of this section.
    (4) At the end of the 90-day suspension, the Postal Service may:
    (i) Extend the suspension in order to allow more time for 
investigation or to allow the Provider to correct the problem;
    (ii) Make a determination to revoke the approval of the Provider's 
IBI system or class and/or version, or
    (iii) Withdraw the suspension based on identification and 
implementation of a satisfactory solution to the problem. Provider 
suspensions may be withdrawn before the end of the 90-day period if the 
Postal Service determines that the Provider's solution and 
implementation are satisfactory.
    (c) The Provider may present the Postal Service with a written 
defense to any suspension or revocation determination within 30 
calendar days of receiving the written notice (unless a shorter period 
is deemed necessary). The defense must include all supporting evidence 
and specify the reasons for which the order should not be imposed.
    (d) After receipt and consideration of the written defense, the 
Postal Service shall advise the Provider of the decision and the facts 
and reasons for it. The decision shall be effective on receipt unless 
it states otherwise. The decision shall also advise the Provider that 
it may appeal that determination within 30 calendar days of receiving 
written notice (unless a shorter period is deemed necessary), as 
specified therein. The appeal must include all supporting evidence and 
the reasons that the Provider believes that the decision is erroneous.
    (e) An order or final decision under this section does not preclude 
any other criminal or civil statutory, common law, or administrative 
remedy that is available by law to the Postal Service, the United 
States, or any other person or concern.


Sec. 502.14  Reporting.

    (a) For purposes of this section, ``Provider'' refers to authorized 
Provider in Sec. 502.1 and its foreign or domestic affiliates, 
subsidiaries, assigns, dealers, independent dealers, employees, and 
parent corporations.
    (b) Each authorized Provider in Sec. 502.1 must submit a 
preliminary report to notify the Postal Service promptly (in no event 
more than 21 calendar days of discovery) of the following:
    (1) All findings or results of any testing known to the Provider 
concerning the security or revenue protection features, capabilities, 
or failings of any IBI system distributed by the Provider that has been 
approved for distribution by the Postal Service or any foreign postal 
administration; or have been submitted for approval by the Provider to 
the Postal Service or a foreign postal administration.
    (2) All potential security weaknesses or methods of IBI system 
tampering that the Provider distributes of which the Provider knows or 
should know, and the IBI system or model subject to each method. All 
potential security weaknesses include but are not limited to suspected 
equipment defects, suspected abuse by an IBI licensee or Provider 
employee, suspected security breaches of the Computerized Remote 
Postage Meter Resetting System, cryptographic key compromises, 
occurrences outside normal performance, or any repeatable deviation 
from normal IBI system performance (within the same model family and/or 
by the same licensee).
    (c) Within 45 days of the preliminary notification to the Postal 
Service under Sec. 502.15(b), the Provider must submit a written report 
to the Postal Service. The report must include the circumstances, 
proposed investigative procedure, and the anticipated completion date 
of the investigation. The Provider must also provide periodic status 
reports to the Postal Service during subsequent investigation and, on 
completion, must submit a summary of the investigative findings.
    (d) The Provider must establish and adhere to timely and efficient 
procedures for internal reporting of potential security weaknesses. The 
Provider is required to submit a copy of internal reporting procedures 
and instructions to the Postal Service for review.


Sec. 502.15  Administrative sanction on reporting.

    (a) Notwithstanding any act, admission, or omission by the Postal 
Service, an authorized Provider may be subject to an administrative 
sanction for failing to comply with Sec. 502.14.
    (b) The Postal Service shall determine all costs and revenue losses 
measured from the date that the Provider knew, or should have known, of 
a potential security weakness, including, but not limited to, 
administrative and investigative costs and documented revenue losses 
that result from any IBI System for which the Provider failed to comply 
with any provision in Sec. 502.14. The Postal Service may recover from 
the Provider any and all such costs and losses (net of any amount 
collected by the Postal Service from the licensees or users) with 
interest by issuing a written notice to the Provider setting forth the 
facts and reasons on which the determination to impose the sanction is 
based. The notice shall advise the Provider of the date that the action 
takes effect if a written defense is not presented within 30 calendar 
days of receipt of the notice.
    (c) The Provider may present the Postal Service with a written 
defense to the proposed action within 30 calendar days of receipt. The 
defense must include all supporting evidence and specify the reasons 
for which the sanction should not be imposed.
    (d) After receipt and consideration of the defense, the Postal 
Service shall advise the Provider of the decision and the facts and 
reasons for it; the decision shall be effective on receipt unless it 
states otherwise. The decision shall also advise the Provider that it 
may, within 30 calendar days of receiving written notice, appeal that 
determination as specified therein.
    (e) The Provider may submit a written appeal to the Postal Service 
within 30 calendar days of receipt of the decision. The appeal must 
include all supporting evidence and specify the reasons that the 
Provider believes that the administrative sanction was erroneously 
imposed. The submission of an appeal stays the effectiveness of the 
sanction.
    (f) The imposition of an administrative sanction under this section 
does not preclude any other criminal or civil statutory, common law, or 
administrative remedy that is available by law to the Postal Service, 
the United States, or any other person or concern.


Sec. 502.16  Materials and workmanship.

    All IBI systems must adhere to the quality in materials and 
workmanship of the approved prototype.


Sec. 502.17  Destruction of product/device indicia.

    All IBIP indicia created in the process of testing the IBI system 
by the Provider,

[[Page 46726]]

or its agent, must be collected and destroyed daily.


Sec. 502.18  Inspection of new IBI systems.

    All new IBI systems must be inspected carefully prior to 
distribution.


Sec. 502.19  Distribution facilities.

    An authorized Provider must keep adequate facilities for and 
records of the distribution, control, and maintenance of IBI systems. 
All such facilities and records are subject to inspection by Postal 
Service representatives.


Sec. 502.20  Distribution controls.

    Each authorized Provider must do the following:
    (a) Hold title permanently to all leased systems except those 
purchased by the Postal Service.
    (b) On behalf of applicants, electronically transmit copies of 
completed PS Forms 3601-A, Application for a License to Lease and Use 
Postage Meters, to the designated Postal Service central processing 
facility.
    (c) Lease systems only to parties that have valid licenses issued 
by the Postal Service.
    (d) Supply the host system with slogan or advertising art that 
meets the Postal Service requirements for suitable quality and content. 
The Provider must obtain prior approval for all advertising matter for 
IBI systems.
    (e) Unless otherwise authorized by the Postal Service, the Provider 
must immediately obtain and check out of service PSDs, if the licensee 
no longer wants the PSD or if the PSD is to be removed from service for 
any other reason. If a logical security element resides in the 
Provider's server, it must be immediately disabled. If it resides at 
the Licensee's site, all resetting requests must be denied. The 
Provider must keep in its possession for at least 1 year the licensee's 
PS Form 3601-C, Postage Meter Activity Report.
    (f) Retrieve any misregistering, faulty, or defective PSD to be 
checked out of service within 3 business days of being notified by the 
licensee of the defect. After examining the PSD withdrawn for apparent 
faulty operation affecting registration, the Provider must compile a 
report explaining the malfunction to MTM, USPS Headquarters.
    (g) Report promptly the loss or theft of any IBI system or 
component. The Provider must provide notification to the Postal Service 
by completing a standardized lost and stolen incident report and filing 
it with the Postal Service within 30 days of the Provider's 
determination of a loss, theft, or recovery. The Provider must complete 
all preliminary location activities specified in Sec. 502.24 before 
submitting this report to the Postal Service.
    (h) Cancel a lease agreement with any lessee whose license is 
revoked by the Postal Service, remove the PSD within 15 calendar days, 
and have the PSD checked out of service.
    (i) Promptly remove from service any PSD or other logical security 
element that the Postal Service indicates should be removed from 
service. When a license is canceled, all PSDs or other logical security 
elements in use by the licensee must be removed from service.
    (j) Examine each IBI system withdrawn from service for failure to 
record its operations correctly and accurately, and report to the 
Postal Service the failure or fault that caused the failure.
    (k) Provide MTM monthly with a compatible computer file of lost or 
stolen PSDs. The file is due on the first of each month (for the 
preceding month's activity).
    (l) Take reasonable precautions in the transportation and storage 
of PSDs to prevent use by unauthorized individuals. Providers must ship 
all PSDs by Postal Service Registered Mail unless given written 
permission by the Postal Service to use another carrier. The Provider 
must demonstrate that the alternative delivery carrier employs security 
procedures equivalent to those for Registered mail.
    (m) Submit a daily financial transaction for each postage value 
download or postage refill according to established CMRS procedures.


Sec. 502.21  Administrative sanction.

    The Postal Service holds Providers responsible for the life cycle, 
control, operation, maintenance, and replacement of their products/
devices.
    (a) For purposes of this section, an IBI system is defined as a 
system that is manufactured by an authorized Provider under Sec. 502.1 
that is not owned or leased by the Postal Service.
    (b) An authorized Provider that, without just cause, fails to 
conduct or perform adequately any of the controls in Sec. 502.20, to 
follow standardized lost and stolen incident reporting in Sec. 502.24, 
or to conduct any of the inspections required by Sec. 502.23 in a 
timely fashion is subject to an administrative sanction based on the 
investigative and administrative costs and documented revenue losses 
(net of any amount collected by the Postal Service from the licensee or 
user). Interest per occurrence measured from the date on which the cost 
and/or loss occurred, as determined by the Postal Service. Sanctions 
shall be based on the costs and revenue losses that result from the 
Provider's failure to comply with these requirements.
    (c) The Postal Service may impose an administrative sanction under 
this section by issuing a written notice to the Provider setting forth 
the facts and reasons on which the determination to impose the sanction 
is based. The Postal Service shall determine all costs and losses. The 
notice shall advise the Provider of the date that the action shall take 
effect if a written defense is not presented within 30 calendar days of 
receipt of the notice.
    (d) The Provider may present to the Postal Service a written 
defense to the proposed action within 30 calendar days of receipt of 
the notice. The defense must include all supporting evidence and 
specify the reasons for which the sanction should not be imposed.
    (e) After receipt and consideration of the written defense, the 
Postal Service shall advise the Provider of the decision and the facts 
and reasons for it. The decision shall be effective on receipt unless 
it states otherwise.
    (f) The Provider may submit a written appeal of the decision with 
30 calendar days of receiving the decision, addressed to the Manager of 
MTM, Postal Service Headquarters. The appeal must include all 
supporting evidence and specify the reasons that the Provider believes 
that the administrative sanction was erroneously imposed. The 
submission of an appeal stays the effectiveness of the sanction.
    (g) The imposition of an administrative sanction under this section 
does not preclude any other criminal or civil statutory, common law, or 
administrative remedy that is available by law to the Postal Service, 
the United States, or any other person or concern.


Sec. 502.22  IBI system replacement.

    (a) The Provider must keep its IBI systems in proper operating 
condition for licensees by replacing them when necessary or desirable 
to prevent electronic failure, malfunction, clock/timer/battery life 
expiration, or mechanical breakdown.
    (b) The Provider must provide the licensees with modifications 
reflecting rate changes.


Sec. 502.23  Inspection of PSDs or other logical security elements in 
use.

    The Provider must conduct audits of PSDs or other logical security 
elements at least once every 3 months in conjunction with the postage 
value resetting requirements in Sec. 502.26. In general, the primary 
role of the PSD in

[[Page 46727]]

the device audit function is to create device audit messages and pass 
those messages to the host system for transmission to the Postal 
Service.


Sec. 502.24  PSDs not located.

    Upon learning that one or more of its PSDs in service cannot be 
located, the Provider must undertake reasonable efforts to locate the 
PSD by following a series of Postal Service-specified actions designed 
to locate the PSDs. If these efforts are unsuccessful and a PSD is 
determined to be lost or stolen, the Provider must notify the Postal 
Service within 30 days by submitting a Lost and Stolen PSD Incident 
Report.
    (a) If a licensee cannot be located, the Provider must, at a 
minimum, complete the following actions:
    (1) Call directory assistance for the licensee's new telephone 
number.
    (2) Contact the licensee's local post office for current change of 
address information.
    (3) Contact the CMLS site and the local MATS coordinator to verify 
the location of the PSD or licensee currently maintained in those 
Postal Service records.
    (4) Contact the rental agency responsible for the property where 
the licensee was located, if applicable.
    (5) Visit the licensee's last known address to see whether the 
building superintendent or a neighbor knows the licensee's new address.
    (6) Mail a certified letter with return receipt to the licensee at 
the last known address with the endorsement ``Forwarding and Address 
Correction Requested.''
    (7) If new address information is obtained during these steps, any 
scheduled PSD inspection must be completed promptly.
    (b) If a PSD is reported to be lost or stolen by the licensee, the 
Provider must, at a minimum, complete the following actions:
    (1) Ensure that the licensee has filed a police report and that 
copies have been provided to the appropriate Inspection Service 
Contraband Postage Identification Program (CPIP) specialist.
    (2) Withhold issuance of a replacement PSD until the missing PSD 
has been properly reported to the police and to the appropriate 
Inspection Service CPIP specialist.
    (c) If the Provider later learns that the PSD has been located and/
or recovered, the Provider must update lost and stolen PSD activity 
records, inspect the PSD promptly, initiate a postage adjustment or 
transfer, if appropriate, and check the PSD out of service if a 
replacement PSD has been supplied to the licensee.
    (d) If a PSD reported to the Postal Service as lost or stolen is 
later located, the Provider is responsible for submitting a new Lost 
and Stolen PSD Incident Report that references the initial report and 
outlines the details of how the PSD was recovered. This report must be 
submitted to the Postal Service within 30 days of recovery of the PSD. 
The Provider is also responsible for purging lost and stolen PSD 
reports that are provided on a periodic basis to the Postal Service for 
those PSDs that have been recovered.
    (e) Any authorized Provider that fails to comply with standardized 
lost and stolen reporting procedures and instructions is subject to an 
administrative sanction under Sec. 502.21, as determined by the Postal 
Service.


Sec. 502.25  Computerized remote resetting.

    (a) Description. The Computerized Remote Meter Resetting System 
(CMRS) permits postal licensees to reset PSDs or other logical security 
elements at their places of business and/or homes via modem and/or 
network interface. To reset a PSD, the licensee must connect to the 
Provider and provide identifying data and device audit data. Before 
proceeding with the setting transaction, the Provider must verify all 
the data (including conducting the product audit) and ascertain from 
its own files whether the licensee has sufficient funds on deposit with 
the Postal Service. If the funds are available and the product audit 
was successful, the Provider may complete the setting transaction.
    (b) Revenue protection. The Postal Service shall conduct periodic 
assessments of the revenue protection safeguards of each Provider 
system and shall reserve the right to revoke a Provider's authorization 
if the CMRS system does not meet all requirements set forth by the 
Postal Service. The Provider must make its facilities that handle the 
operation of the computerized resetting system and all records about 
the operation of the system available for inspection by representatives 
of the Postal Service at all reasonable times.
    (c) Deposits with the Postal Service. (1) A CMRS licensee is 
required to have funds available on deposit with the Postal Service 
before resetting a PSD or the Provider may opt to provide a funds 
advance in accordance with The Cash Management Operating Specifications 
for the Computerized Remote Postage Meter Resetting System. Contact the 
Treasurer's Office of the United States Postal Service, 475 L'Enfant 
Plaza SW, Washington DC 20260-5130 for this document. The details of 
this deposit requirement are covered within the Acknowledgment of 
Deposit Requirement document. By signing this document, the licensee 
agrees to transfer funds to the Postal Service through a lockbox bank, 
as specified by the Provider, for the purpose of prepayment of postage. 
The Provider representative must provide all new CMRS licensees with 
this document when a new account is established. The document must be 
completed and signed by the licensee and sent to the Minneapolis 
Accounting Service Center by the Provider.
    (2) The licensee is required to incorporate the following language 
into its IBI rental agreements:

Acknowledgement of Deposit Requirement

    See the Cash Management Operating Specifications for the 
Computerized Remote Postage Meter Resetting System. Contact the 
Treasurer's Office of the United States Postal Service, 475 L'Enfant 
Plaza SW, Washington DC 20260-5130 for this document.


Sec. 502.26  Indicia quality assurance.

    The licensee is required to forward a mailpiece to the Provider at 
least once every 6 months for evaluation. If the licensee fails to 
comply with this requirement, the Provider must notify the licensee 
that, all future postage value resettings will be denied. The Provider 
must notify the Postal Service of all noncomplying licensees, so that 
license revocations can be initiated. The Provider is required to 
provide guidance to the licensee to correct any deficiencies that are 
discovered.


Sec. 502.27  IBI system refunds.

    Postage losses due to malfunctions are the responsibility of the 
Provider. The Postal Service will provide refunds for unused postage, 
for any balance remaining on a PSD or other logical security element, 
and for any balance remaining in the licensee's CMRS account. The 
following procedures must be followed, depending on the type of refund 
requested:
    (a) Unused Postage
    (1) Postage refunds will be granted only for pieces that are 30 
days old or less. The licensee will complete a PS Form 3533, 
Application and Voucher for Refund of Postage and Fees. This form may 
be supplied electronically to the licensee by the Provider. The 
licensee must supply refund details in Part IV of the form which shows 
the number of pieces grouped by postage value, the total postage value 
for each group, and the total postage for all listed groups.
    (2) The unused mailpieces and the completed Form 3533 will be sent 
to the Provider for indicia verification and refund processing.

[[Page 46728]]

    (3) The Provider will scan the indicia to ensure that they are 
valid. Part IV of the Form 3533 must be annotated to show corrections 
for nonqualifying pieces.
    (4) An individual authorized by the Provider must certify the 
amount of the refund by signing Part IV below where the details of the 
mailpieces are shown.
    (5) The Provider will send the Form 3533 to the MATS coordinator at 
the appropriate Postal Service District office for further refund 
processing.
    (6) The District MATS coordinator will arrange for the amount of 
refunded postage to be credited to the licensee's CMRS account.
    (7) The unused envelopes must be retained by the Provider for 45 
days after the Form 3533 has been sent to the District. During this 
period the Postal Service reserves the right to audit the pieces and 
the Providers processing of the refund request.
(b) PSD or Other Logical Security Element Balance
    (1) The Provider must verify the remaining balance in a returned 
PSD or other logical security element. This balance must be reconciled 
with the descending balance as noted by the Provider when the licensee 
notified the Provider that the PSD or other logical security element 
was to be taken out of service.
    (2) The validated refund amount must be noted in section F of the 
completed Form 3601-C and the Providers representative must sign 
Section G.
    (3) The completed Form 3601-C will be sent to the appropriate 
District MATS coordinator.
    (4) The District MATS coordinator will arrange for the amount of 
refunded postage to be credited to the licensee's CMRS account.
(c) CMRS Account
    (1) The licensee must notify the Provider in writing that the 
licensee's CMRS account is to be closed.
    (2) The Provider will notify the Minneapolis Accounting Service 
Center of the closing of the account, according to CMRS procedures as 
administered by USPS Treasury Management.
    (3) The Minneapolis Accounting Service Center will notify the 
lockbox bank to issue a refund check to the licensee.


Sec. 502.28  Key management requirements.

    These requirements are contained in Part D, Key Management Plan, of 
the PCIBISAIBIPMS. Contact the Manager, MTM, USPS, 475 L'Enfant Plaza 
SW, Room 8430, Washington, DC 20260-2444 for these requirements.


Sec. 502.29  Provider infrastructure.

    The Provider must establish and maintain an interface to USPS 
systems as specified in CMRS and CMLS documentation. CMRS documentation 
may be obtained from Corporate Treasury, USPS HQ, 475 L'Enfant Plaza 
SW, Room 8118, Washington, DC 20260-5130. CMLS documentation may be 
obtain from the Manager, MTM, USPS, 475 L'Enfant Plaza SW, Room 8430, 
Washington, DC 20260-2444.
Neva R. Watson,
Acting Chief Counsel, Legislative.
[FR Doc. 98-23559 Filed 8-28-98; 3:59 pm]
BILLING CODE 7710-12-P