[Federal Register Volume 65, Number 191 (Monday, October 2, 2000)]
[Proposed Rules]
[Pages 58682-58698]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 00-25090]


=======================================================================
-----------------------------------------------------------------------

POSTAL SERVICE

39 CFR Parts 111 and 502


Production, Distribution, and Use of Postal Security Devices and 
Information-Based Indicia

AGENCY: Postal Service.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Postal Service is proposing to add new sections to the 
Domestic Mail Manual (DMM) and to title 39, Code of Federal Regulations 
(CFR), to reflect policies and regulations pertaining to all postage 
evidencing systems that generate information-based indicia (IBI). We 
originally published policies and regulations for public review and 
comment in the March 28, 1997, Federal Register (62 FR 14833). In the 
September 2, 1998, Federal Register (63 FR 46719) we published a 
revision of those proposed policies and regulations which included 
changes made in response to the comments received from the public.
    This publication of proposed policies and regulations includes 
extensive changes. We based the changes since the 1998 publication on 
public comments and on the experience we gained by testing and 
implementing the first postage evidencing systems to generate 
information-based indicia (IBI). One significant proposed change is the 
establishment by the Postal Service of the Electronic Funds Resetting 
System (EFRS) to process resetting data for these systems. We will 
continue to process data for traditional postage meters under the 
Computerized Meter Resetting System (CMRS). Other proposed changes 
include modifying the forms of payment the Postal Service will accept, 
and changing the policy for refunds for unused IBI postage and for the 
balance remaining on a postal security device (PSD) that is withdrawn 
from service.
    We are reissuing the policies and regulations in this proposal for 
public comment because we made extensive changes. We will revise the 
proposed IBI policies and regulations, if required, and publish them as 
a final rule after we review the comments.

DATES: Comments must be received on or before December 1, 2000.

ADDRESSES: Written comments should be mailed or delivered to the 
Manager, Postage Technology Management, USPS Headquarters, 475 L'Enfant 
Plaza SW, Room 8430, Washington, DC 20260-2444. Copies of all written 
comments will be available at this address for inspection and 
photocopying between 9 a.m. and 4 p.m., Monday through Friday.

FOR FURTHER INFORMATION CONTACT: Nicholas S. Stankosky, 202-268-5311.

SUPPLEMENTARY INFORMATION: Postage evidencing systems covered by these 
regulations include all those systems that generate information-based 
indicia (IBI) and use a postal security device (PSD). The 
characteristics of these systems enable the Postal Service to scan 
indicia to detect fraud. Core security functions, such as digital 
signature generation, digital signature verification, and the 
management of postage registers are performed by the PSD. The IBI 
contains a two-dimensional barcode that incorporates a cryptographic 
digital signature. The component of these postage evidencing systems 
that controls the registered user infrastructure for system 
authorization, system audits, remote postage resetting, and production 
of the indicia is called the client system.
    Authorized postage evidencing systems are available from 
authorized, commercial product service providers. The provider's 
infrastructure supports user registration (formerly ``licensing''), PSD 
management and life cycle support, and an interface between the client 
system and the Postal Service infrastructure. The Postal Service 
infrastructure supports the issuance of user registrations, updating 
user registration information, PSD inventory and tracking, resetting, 
account reconciliation, lost and stolen/irregularity monitoring, and 
the assignment of digital certificates.

The Following is a Summary of the Postal Service's Position on Some 
General Interest Policy Issues for Postage Evidencing Systems That 
Generate IBI

    1. Any proposed postage evidencing system that generates IBI must 
be submitted to the Postal Service for approval under the then current 
version of the postage evidencing product submission procedures. These 
procedures include specifics on letters of intent, nondisclosure 
agreements, the product service provider's concept of operations and 
infrastructure, documentation requirements, product submissions, and 
testing activities. Information pertaining to these

[[Page 58683]]

procedures may be accessed through the USPS Web site.
    2. The user must register with the Postal Service before using a 
postage evidencing system that generates IBI.
    3. PSDs remain the property of the USPS-authorized product service 
provider and are available only through a lease agreement with the 
provider. The software component of these postage evidencing systems is 
licensed to the registered user by the provider.
    4. Until the Postal Service has recorded sufficient data on 
reliability and security, the total amount of postage in a descending 
register, which shows the amount of postage available, will be limited 
to an amount established by the Postal Service.
    5. Authorized providers must keep records of the distribution, 
maintenance, replacement, and disposal of all PSDs throughout the 
complete life cycle of the PSD. All PSDs must be tracked, including 
newly produced PSDs; active leased PSDs; and inactive unleased PSDs; 
and lost, stolen, and scrapped PSDs.
    6. Indicia produced by these postage evidencing systems may be used 
to indicate postage for single-piece rate First-Class Mail (including 
Priority Mail), single-piece rate International Mail, Standard Mail 
(B); and Express Mail, Express Mail International Service, Global 
Priority Mail, and Priority Mail Global Guaranteed. Mail bearing the 
indicia is entitled to all privileges and subject to all conditions 
applying to these classes of mail.
    7. Providers are responsible for audit functions. The Postal 
Service will not take over this function, but may at times participate 
in or review the audit process. PSDs must be audited at least once 
every 3 months.
    8. To ensure the quality and readability of the indicia, providers 
must perform an analysis of the mailpieces that registered users submit 
every 6 months for the provider's mailpiece quality assurance program. 
The provider must notify the registered user and the Postal Service of 
any deficiencies and provide guidance to the user to correct any 
deficiencies that are discovered.
    9. All postage downloads or settings will be made under the 
provisions of the Electronic Funds Resetting System (EFRS). The Postal 
Service will conduct periodic audits of the provider's resetting system 
to ensure that the system is operating correctly and that postal 
revenues are protected.
    10. The Postal Service may physically inspect a PSD if it has a 
reason to suspect a security problem.
    11. The Postal Service will provide refunds through the product 
service providers, in accordance with Postal Service procedures, for 
printed but unused postage and for the full postage value balance 
remaining on a PSD that is withdrawn from service.
    12. The provider must supply registered users with modifications 
reflecting rate changes and must implement new rates as of the 
effective date for the new rates established by the Postal Service.
    13. There are provisions in the regulations for the correction of 
postage and dates. For date correction, the facing identification mark 
(FIM) and two-dimensional barcode will be suppressed; for postage 
correction, the FIM will be suppressed.
    14. The provider will make the registered user aware of the 
applicable Postal Service regulations pertaining to use of the 
information-based indicia and of the postage evidencing system that 
generates them through cautionary statements in the system software, 
system documentation, and product labeling, as appropriate.

List of Subjects in 39 CFR Part 111

    Administrative practice and procedure, Postal Service.
    Although exempt from the notice and comment requirements of the 
Administrative Procedure Act (5 U.S.C. 553(b), (c)) regarding proposed 
rulemaking by 39 U.S.C. 410(a), the Postal Service invites public 
comments on the following proposed amendments to the Domestic Mail 
Manual, incorporated by reference in the Code of Federal Regulations. 
See 39 CFR part 111.

PART 111--[AMENDED]

    1. The authority citation for 39 CFR part 111 continues to read as 
follows:

    Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 3001-
3011, 3201-3219, 3403-3406, 3621, 3626, 5001.

    2. Add the following sections to the Domestic Mail Manual as set 
forth below:

P050  Information-Based Indicia (IBI)

1.0  BASIC INFORMATION

1.1  Description of Postage Evidencing Systems that Generate 
Information-Based Indicia (IBI)

    Postage evidencing systems that generate information-based indicia 
(IBI) are secure systems that print USPS-authorized, digitally signed 
indicia to show payment of postage. These systems include as a primary 
component a postal security device (PSD) that performs core security 
functions such as digital signature generation and verification, as 
well as the management of postage registers. The component of these 
postage evidencing systems that controls the registered user 
infrastructure for system authorization, system audits, remote postage 
resetting, and production of the indicia is called the client system. 
The PSD and the client system interact to generate the indicia. Indicia 
consist of a USPS-approved two-dimensional barcode and certain human-
readable information. Authorized postage evidencing systems are 
available from authorized, commercial product service providers. 
Avoiding the payment of postage by misusing a postage evidencing system 
is punishable by law.

1.2  Product Service Provider Responsibilities

    Postal security devices (PSDs) remain the property of the USPS-
authorized product service provider and are available only through a 
lease agreement with the provider. The software component of these 
postage evidencing systems is licensed to the registered user by the 
provider. The Postal Service holds providers responsible for the 
control, operation, distribution, maintenance, and replacement of the 
PSD throughout the entire life cycle of the PSD. The provider is also 
responsible for the secure disposal or destruction of the PSD at the 
end of its useful life.

1.3  Product Service Providers

    Postage evidencing systems that generate IBI are available from 
authorized providers. The following providers have been approved as of 
September 2000:
E-Stamp Corporation, 2051 Stierlin Court, Mountain View, CA 94043-
4655, www.estamp.com
Neopost Online, 3400 Bridge Parkway, Suite 201, Redwood City, CA 
94065-1168, www.neopostonline.com
Pitney Bowes, Inc., 40 Lindeman Drive, Trumbull, CT 06611-4785, 
www.pitneybowes.com/soho/
Stamps.com, 3420 Ocean Park Boulevard, Suite 1040, Santa Monica, CA 
90405-3035, www.stamps.com

1.4  Possession

    No one other than an authorized product service provider may 
possess or use a PSD without a valid USPS-issued postage evidencing 
system user registration and a valid lease agreement with the provider. 
Any person in possession of a PSD without meeting these conditions must 
immediately surrender it to the provider or to the USPS.

[[Page 58684]]

1.5  Classes of Mail

    Information-based indicia (IBI) produced by an authorized postage 
evidencing system may be used to indicate postage for single-piece rate 
First-Class Mail (including Priority Mail), single-piece rate 
International Mail, and single-piece rate Standard Mail (B); also 
Express Mail, Express Mail Military Service, Express Mail International 
Service, Global Priority Mail, and Priority Mail Global Guaranteed. The 
indicia can be used to pay for special services. Mail prepared using 
such a system is entitled to all privileges and subject to all 
conditions that apply to the various mail classes and services.

1.6  Amount of Postage

    The value of the indicia affixed to each mailpiece must equal or 
exceed the exact amount due for the piece when mailed. Refunds for 
overpayment must meet the standards in P014.

1.7  Reply Postage

    A postage evidencing system that generates IBI may be used to 
prepare prepaid reply postage for the following domestic mail classes: 
All single-piece rate First-Class Mail (including Priority Mail), 
Standard Mail (B), and Express Mail. The prepaid reply mail must meet 
the following conditions:
    a. The postage amount in the indicium must be enough to prepay the 
postage in full.
    b. Indicium showing postage evidencing may be printed directly on 
the mailpiece or on a label and must be applied to a mailpiece in 
accordance with the directions in 4.4. An applied label must adhere 
well enough that it cannot be removed in one piece.
    c. The mailpiece must be pre-addressed for return to the registered 
user.
    d. If the postage evidencing system used to prepare the return 
postage indicium has the capability to print destination addresses for 
the given size and class of mailpiece, the address for returning the 
mailpiece to the registered user must be prepared using that system.
    e. For those postage evidencing systems without the capability to 
print an address for the given class or size of mailpiece, the address 
side of reply mail may be prepared by any photographic, mechanical, or 
electronic process or combination of such processes (other than 
handwriting, typewriting, or hand stamping).
    f. The address side of the mailpiece must follow the style and 
content of the example below. Nothing may be added except a return 
address and facing identification mark (FIM).
    g. If the reply mailpiece is letter-sized First-Class Mail, a FIM D 
is required when the indicium for reply postage is printed directly on 
the mailpiece.
    h. Prepaid reply mail is delivered only to the address of the 
registered user. If the address is altered, the mail is held for 
postage.
    i. IBI used to prepay reply postage must show the date the indicium 
was printed by the registered user, and must include the words ``REPLY 
POSTAGE''.
[GRAPHIC] [TIFF OMITTED] TP02OC00.004

2.0  USER REGISTRATION

2.1  Procedures

    The user must register with the Postal Service before using a 
postage evidencing system that generates IBI. An applicant must apply 
for a user registration through the provider and submit to the provider 
all data required for a registration to lease and use postage 
evidencing systems. The application must show the post office where the 
applicant intends to deposit the mail. This is called the registration 
post office. An application for a user registration is processed 
through the Centralized Registration System (CRS), formerly the 
Centralized Meter Licensing System. The provider electronically 
transmits the required information to CRS in the USPS-specified format. 
There is no fee for the application or user registration. After 
approving an application, the Postal Service issues a postage 
evidencing system user registration, and notifies the appropriate 
provider. A single user registration covers all postage evidencing 
systems for the same applicant for the same post office, but a separate 
application must be submitted for each post office where the applicant 
intends to deposit mail. A single PSD can be registered to only one 
post office at any one time; it must be reauthorized by the provider 
for use at a different post office.

2.2  Registered User's Agreement

    By submitting an application for a user registration, the applicant 
agrees that the registration may be revoked immediately and that the 
postage evidencing system may be withdrawn

[[Page 58685]]

from service by the provider or the USPS for the following reasons:
    a. The postage evidencing system is used in any fraudulent or 
unlawful scheme or enterprise.
    b. The postage evidencing system is not used for 12 consecutive 
months.
    c. The registered user fails to exercise sufficient control of the 
postage evidencing system or fails to comply with the standards for 
system care or use.
    d. The postage evidencing system is used outside the United States, 
its territories or its possessions, except as specifically authorized 
by these regulations or by the manager of Postage Technology 
Management, USPS Headquarters.
    e. IBI mail is deposited at other than the registration post office 
(except as permitted under 5.0 or D072).
    f. The registered user fails to forward mailpieces to the provider 
for quality assurance as required in 2.6.h.

2.3  Refusal to Register a User

    The Postal Service notifies both the applicant and the provider 
when an application for user registration is refused. The notification 
is in writing and is sent certified mail, return receipt requested. Any 
applicant refused a user registration may appeal the decision under 
2.5. The Postal Service may refuse to register a user for the following 
reasons:
    a. The applicant submitted false information on the user 
registration application.
    b. The applicant violated any standard for the care or use of a 
PSD, postage evidencing system, information-based indicia, or postage 
meter that resulted in the revocation of that applicant's user 
registration or postage meter license within 5 years preceding 
submission of the application.
    c. There is sufficient reason to believe that the postage 
evidencing system is to be used in violation of Postal Service 
regulations.

2.4  Revocation of a User Registration

    The Postal Service notifies the registered user of any revocation. 
The Postal Service also notifies the registered user's provider of the 
revocation so that the provider can cancel the lease agreement and 
withdraw the postage evidencing system from service. The notification 
is in writing and is sent certified mail, return receipt requested. 
Revocation takes effect 10 calendar days after the registered user 
receives or refuses to receive the revocation notice unless, within 
that time, the registered user appeals the decision under 2.5. A user 
registration is subject to revocation for any of the following reasons:
    a. The postage evidencing system is used for any illegal scheme or 
enterprise or there is probable cause to believe that the system is to 
be used in violation of the applicable standards.
    b. The user registration does not have a postage evidencing system 
applied against it or the registered user's postage evidencing system 
has not been reset within the last 12 months.
    c. Sufficient control of the postage evidencing system is not 
exercised or the standards for its care or use are not followed.
    d. The postage evidencing system is kept or used outside the 
customs territory of the United States or those U.S. territories and 
possessions where the Postal Service operates, except as specified in 
2.11 or 2.12.
    e. IBI mail is deposited at other than the registration post office 
(except as permitted under 5.0 or D072).
    f. The registered user fails to forward mailpieces to the provider 
for quality assurance as required in 2.6.h.

2.5  Appeal Process

    An applicant who is refused a user registration, or a registered 
user whose registration is revoked, may file a written appeal with the 
manager of Postage Technology Management, USPS Headquarters, within 10 
calendar days after receiving or refusing to receive notification of 
the decision.

2.6  Registered User's Responsibilities

    The registered user's responsibilities for the care and use of a 
postage evidencing system that generates IBI include the following:
    a. A PSD that is delivered to a registered user must remain in the 
registered user's custody until it is returned to the authorized 
provider, or to the Postal Service, or is removed by the U.S. Postal 
Inspection Service.
    b. Some postage evidencing systems maintain a log file that 
automatically records all transactions relating to indicia creation, 
funds transfer (including postage value download), and postal security 
device audits which is transmitted automatically to the provider by the 
system with each connection. The registered user may not manipulate 
these log files to reflect an inaccurate record of transactions or 
prevent the transmission of these log files to the provider.
    c. The registered user must, upon request, make immediately 
available for review and audit by the provider or by the Postal Service 
any PSD in the user's custody and the corresponding transaction 
records.
    d. The registered user must reset the PSD at least once every 3 
months to meet provider audit and examination requirements. A zero 
value reset will meet this requirement.
    e. The registered user must update information with the provider 
whenever there is any change in the user's name, address, telephone 
number, location of the PSD, registration post office, or any other 
required user registration information. The Postal Service will issue a 
revised user registration based on the transmission of updated 
information from the provider.
    f. The registered user must report a misregistering or otherwise 
defective PSD to the provider under 2.8, and must ensure that the 
defective PSD is not used. Anyone in possession of a misregistering or 
otherwise defective PSD must return it to the provider within 3 
business days.
    g. For postage evidencing systems that generate IBI and access the 
USPS Address Management System (AMS) CD-ROM, the registered user must 
maintain address quality by ensuring the CD-ROM is updated at least 
once every 6 months.
    h. The registered user must forward a mailpiece with an indicium 
produced by the postage evidencing system to the provider for quality 
assurance when the system is installed and at least once every 6 months 
thereafter, in accordance with provider directions.
    i. The registered user must enter into a signed lease agreement 
with the provider that includes a financial agreement for resetting the 
PSD with postage and the Postage Payment Agreement. The Postal Service 
is not a party to the lease agreement, except to the extent that it may 
enforce the Postage Payment Agreement.
    j. The registered user must ensure that the cautionary information 
placed by the provider in system documentation, on the opening screens 
at system start-up, or on labels attached to the PSD or its housing, is 
not removed or destroyed while the postage evidencing system is in the 
registered user's possession. The cautionary information contains basic 
reminders on ownership and use of the PSD, warnings against system 
tampering or misuse resulting in non-payment of postage owed, and the 
penalties for such system misuse. Postage evidencing systems without 
this cautionary information shall not be authorized for use.

2.7  Custody of Suspect PSDs

    The Postal Service may conduct unannounced, on-site examinations of 
PSDs reasonably suspected of being manipulated or otherwise defective. 
A

[[Page 58686]]

postal inspector also may immediately withdraw a suspect PSD from 
service for physical and/or laboratory examination. The inspector 
withdrawing a suspect PSD issues the registered user a receipt for the 
PSD; forwards a copy to the provider; and, if necessary, assists in 
obtaining a replacement PSD. Where possible, the Inspection Service 
gives advance notice to the provider that a PSD is to be inspected. 
Unless there is reason to believe that the PSD is fraudulently set with 
postage, existing postage in the PSD is refunded to the registered 
user, in accordance with established refund procedures, when it is 
withdrawn from service.

2.8  Defective PSD

    The registered user must immediately report any defective PSD to 
the provider. The provider must retrieve any defective PSD in a user's 
possession within 3 business days of notification by the registered 
user, and must notify the manager of Postage Technology Management, 
USPS Headquarters, immediately. A faulty PSD may not be used under any 
circumstance. The provider supplies the registered user with a 
replacement PSD only if the faulty PSD is in the provider's possession.

2.9  Missing PSD

    The registered user must immediately report to the provider the 
loss or theft of any PSD or the recovery of any missing PSD. Reports 
must include the postal security device identification number of the 
PSD; the date, location, and details of the loss, theft, or recovery; 
and a copy of any police report. The provider will report all details 
of the incident to the manager of Postage Technology Management, USPS 
Headquarters.

2.10  Returning a PSD

    A registered user in possession of a faulty or misregistering PSD, 
or who no longer wants to keep a PSD, must return the PSD to the 
provider to be withdrawn from service. PSDs must be shipped by Priority 
Mail unless the manager of Postage Technology Management, USPS 
Headquarters, gives written permission to ship at another rate or 
special service.

2.11  Approval for Use of Postage Evidencing Systems at Military 
Post Offices

    A person authorized by the Department of Defense to use the 
services of an overseas military post office, such as an APO or FPO, is 
allowed to use a USPS-approved postage evidencing system that generates 
IBI in accordance with the same regulations that apply to domestic 
users. For such users, the APO or FPO will be designated as the 
registration post office on their user registration. These users must 
deposit the mail prepared with their system at the registration post 
office.

2.12  Approval for Use of Postage Evidencing Systems Outside the 
Country

    Under certain conditions, with specific approval from the manager 
of Postage Technology Management, USPS Headquarters, registered users 
(other than those with access to an overseas military post office) may 
use postage evidencing systems that generate IBI outside the customs 
territory of the United States to print evidence of U.S. postage. The 
procedures and conditions are as follows:
    a. The potential users must maintain a permanent, established 
business address in the United States. Any exceptions must be 
specifically approved in writing by the manager of Postage Technology 
Management, USPS Headquarters (see G043).
    b. All registered users who use a USPS-approved postage evidencing 
system outside the customs territory of the United States are subject 
to all Postal Service regulations and U.S. statutes pertaining to mail, 
mail fraud, and misuse of postage evidencing systems.
    c. All postage evidencing systems authorized by the USPS for use in 
foreign locations must have enhanced security features. Only those 
systems specifically approved in writing by the manager of Postage 
Technology Management, USPS Headquarters, may be used outside the 
customs territory of the U.S.
    d. Potential users must submit all data required for the 
application for a registration to lease and use postage evidencing 
systems to the provider. The provider will annotate the application to 
state that it is for the foreign use of a U.S. postage evidencing 
system and show where the system is to be located. The provider must 
submit the application to the manager of Postage Technology Management, 
USPS Headquarters, for review and approval. Once an application is 
approved, Postage Technology Management will designate the registration 
post office and notify the provider and the registered user. Multiple 
foreign postage evidencing systems for the same registered user at the 
same registration post office may be covered by one foreign user 
registration. Mailers who currently have a user registration must apply 
for a separate foreign user registration to participate in this 
program.
    e. The provider selected by the registered user must agree in 
writing to all terms and conditions established by the Postal Service 
pertaining to the distribution of U.S. postage evidencing systems 
outside of the United States.
    Once the postage evidencing system is installed, the provider must 
provide the information required for Form 3601-C, Postage Evidencing 
System Activity Report, and submit it directly to the manager of 
Postage Technology Management, USPS Headquarters (see G043).
    f. Mail to which an IBI is applied as postage evidencing must use 
domestic U.S. postage and must be entered at the registration post 
office.
3.0  SETTING

3.1  Initialization and Authorization of the PSD

    Before the registered user can print evidence of postage, the PSD 
must be initialized and authorized by the provider. The initialization 
process installs PSD-specific information that does not change over the 
life cycle of the PSD. The authorization process is the setting of 
user-specific information. The PSD is reauthorized by the provider when 
certain user-specific information changes. Settings are made in 
accordance with the provisions of the USPS Electronic Funds Resetting 
System (EFRS).

3.2  Relocation of Registered User

    If a registered user changes the post office at which IBI mail is 
to be deposited, the provider must reauthorize the PSD for the new 
registration post office. The user must notify the provider and must be 
registered at the new registration post office before the provider can 
reauthorize the PSD.

3.3  Payment for Postage

    The Postal Service will accept payment only in the following forms: 
Automated Clearinghouse (ACH) debit and credit card.

3.4  Resetting

    To reset a PSD the following conditions must be met:
    a. The registered user shall initiate payment to the Postal Service 
sufficient to cover the desired postage increment before requesting a 
postage value download to reset the PSD.
    b. As part of the resetting procedure, the registered user must 
provide identifying information and PSD audit data as required by the 
Postal Service and in accordance with the provider's

[[Page 58687]]

resetting specifications. Before completing the PSD resetting, the 
provider must verify the identifying data, authenticate the registered 
user, conduct the postage evidencing system audit, and ascertain 
whether payment to the Postal Service sufficient to cover the requested 
postage value download was initiated by the registered user.
    c. The provider will supply the registered user with documentation 
of the reset transaction and the balance on the PSD.

3.5  Postage Refunds

    The Postal Service provides refunds for the entire postage value 
balance remaining on a PSD that is withdrawn from service and is in the 
possession of the provider. Refunds are requested and paid through the 
provider. Refunds for postage already printed onto an envelope or label 
are made in accordance with P014. Postage losses due to malfunctions 
are the responsibility of the provider.

3.6  Postage Adjustment for Faulty or Misregistering PSD

    If the registered user requests a postage adjustment for a faulty 
or misregistering PSD, then the PSD must be withdrawn from service and 
must be in the possession of the provider for examination. The provider 
will examine the PSD in comparison with the data from the registered 
user's log files. After examining a PSD withdrawn from service for 
apparent faulty operation affecting the ascending or descending 
registers, the provider must report the malfunction to the manager of 
Postage Technology Management, USPS Headquarters. The report must 
contain all applicable documentation (including a copy of the 
registered user's log files) and a recommendation for the appropriate 
postage adjustment. At the same time the report is made to the Postal 
Service, the provider must notify the registered user of the proposed 
postage adjustment. A registered user may appeal a postage adjustment 
to the manager of Postage Technology Management, USPS Headquarters, 
within 60 calendar days of the date that the provider submitted the 
postage adjustment recommendation to the Postal Service.

3.7  Periodic Examinations

    The registered user must reset the PSD at least once every 3 
months. A zero-value reset meets this requirement. The Postal Service 
reserves the right to examine PSDs by remote access or otherwise.

3.8  Amount of Postage Available

    The descending register of the PSD, which shows the amount of 
postage remaining, is programmed not to exceed a specified amount 
established by the Postal Service, for a given registered user at any 
time.
4.0  INDICIA

4.1  Designs

    The indicia designs (types, sizes, and styles) must be those that 
the provider specified when the postage evidencing system was approved 
by the Postal Service for production and distribution (see Exhibit 
4.1).
    [Exhibit 4.1, which shows all approved indicia designs, will be 
included when these regulations are published in final form in the 
Domestic Mail Manual.]
* * * * *

4.2  Legibility

    The indicia must be legible. Illegible indicia are not acceptable 
for the payment of postage. Should there be a need to place multiple 
indicia on an envelope (e.g., for redate and/or postage correction) the 
indicia must not overlap each other. The address and POSTNET barcode 
must meet the specifications listed in C840. Reflectance measurements 
of the indicia and the background material must meet the standards in 
C840.5.

4.3  On an Adhesive Label

    A label used to apply information-based indicia to a mailpiece for 
postage evidencing must be approved by the manager of Postage 
Technology Management, USPS Headquarters. Failure to use a USPS-
approved label may result in revocation of the user registration for 
the postage evidencing system. The label must meet the following 
requirements:
    a. The label must be a pressure-sensitive, permanent label. The 
label is subject to the corresponding standards in C810.6.2 for minimum 
peel adhesion. The applied label must adhere well enough that it cannot 
be removed in one piece. A face stock/liner, or ``sandwich,'' label 
must not be used for printing information-based indicia.
    b. The label must meet the reflectance requirements in C840.5.0.
    c. The label must be large enough to contain the entire 
information-based indicia.
    d. Information-based indicia printed on a label must be the same as 
the indicia approved by the manager of Postage Technology Management 
for printing directly on an envelope. The label must not include any 
image or text other than that required by the IBI performance criteria 
or as required or recommended by Postal Service regulation.
    e. For labels applied to standard letter-sized envelopes and 
postcards sent as First-Class Mail, the label must have fluorescent 
striping that meets the following requirements:
    (1) A stripe along the right side (leading edge) of the label that 
is \1/4\ inch wide and extends a minimum of \1/2\ inch and a maximum of 
1\1/2\ inches from the top of the label.
    (2) A stripe along the top edge of the label that is \1/4\ inch 
wide and extends a minimum of \1/2\ inch and a maximum of 1\1/2\ inches 
from the right edge of the label.
    (3) All stripes must have a minimum fluorescent emission intensity 
of at least 20 phosphor meter units (PMU), with a maximum of 70 PMU. 
The visible color of the fluorescent tagging may be any color that 
meets the fluorescence requirements.
    (4) The fluorescent tagging shall exhibit no noticeable change 
(i.e., no more than 10 percent) in its emission when exposed to 
elevated temperature and/or high humidity conditions.
    f. The label must be placed on the envelope such that the position 
of the indicia meets the requirements in 4.4.
    g. If the label is applied to an envelope that already has a FIM, 
then the existing FIM cannot be covered by the label.

4.4  Position

    The indicia must be printed or applied in the upper right corner of 
the envelope. The indicia must be at least \1/4\ inch from the right 
edge of the mailpiece and \1/4\ inch from the top edge of the 
mailpiece. The barcode in the indicia must be horizontally oriented. If 
a FIM is printed with the indicia, the position of the FIM must meet 
the requirements in C100.5.0. The indicia must not infringe on the 
areas reserved for the FIM, POSTNET barcode, or optical character 
reader (OCR) clear zone.

4.5  Content and Format

    The boundaries of the indicium are defined by the right-hand edge 
of the envelope, the top edge of the envelope, the bottom edge of the 
two-dimensional barcode or any indicium element below the barcode, and 
the left-most edge of the two-dimensional barcode or any indicium 
element to the left of the barcode. A \1/2\ inch clear zone, within 
which nothing shall be printed by the postage evidencing system, must 
surround the indicium boundaries to

[[Page 58688]]

the left of and below all elements of the indicium.
    The manager of Postage Technology Management, USPS Headquarters, 
must approve the contents and format of all indicia that will be 
produced by a postage evidencing system. This approval shall include 
all elements in the indicium required by the IBI performance criteria 
and/or Postal Service regulations and applies to the entire area within 
the indicium boundaries. The USPS-approved indicia supplied by the 
provider consist of human-readable information and two-dimensional 
barcoded information. For the contents of indicia used for prepaid 
reply mail, see 1.7; for the contents of redate indicia, see 4.8; and 
for the contents of postage correction indicia, see 4.9. The contents 
of other indicia is as follows:
    a. Unless otherwise approved by the manager of Postage Technology 
Management, USPS Headquarters, the required human-readable information 
must show, at a minimum, the city, state, and 5-digit ZIP Code of the 
registration post office; the postal security device ID; date of 
mailing; endorsement or mail class; the words ``US Postage''; and the 
postage amount. The Arial font must be used for this information. The 
postage amount must use at least 10-point type size. For all other 
required information, the type size must be at least 8 points. The mail 
class or endorsement, the postage amount, and the words ``US Postage'' 
must be in bold type and all letters must be capital letters. The 
remaining required information (city, state and 5-digit ZIP Code, the 
date, and the postal security device ID) need not be capitalized or 
bold. The type size used for all other information printed in the 
indicia must be no greater than 8 points and must not be in bold type.
    b. As an alternative to the city, state, and 5-digit ZIP Code of 
the registration post office, the indicia may show the ZIP Code rather 
than the city and state designation. In this case, the words ``Mailed 
From ZIP Code'' and the ZIP Code of the registration post office may 
appear in place of the city and state, respectively.
    c. When it is necessary to print multiple indicia on a given 
mailpiece, the human-readable information showing the registration post 
office must be included in each.
    d. The requirements for the data elements of the two-dimensional 
barcode are found in the performance criteria for the given postage 
evidencing system.

4.6  Complete Date

    The month, day, and year must be shown in human-readable form in 
the indicia. The year must be represented by four digits.

4.7  Date Accuracy

    The date of mailing in the indicium must be the actual date of 
deposit, except that mail deposited in a collection box after the day's 
last scheduled collection may bear the actual date of deposit or the 
date of the next scheduled collection.
    If the registered user knows the mail will not be tendered to the 
Postal Service on the date of mailing shown in the indicium, the user 
should use a date correction indicium (see 4.8) or have the postage 
evidencing system advance the date and print the intended date of 
deposit in the indicium.

4.8  Date Correction

    If date correction is required, indicia showing only the actual 
date of mailing and the word ``REDATE'' instead of the postage amount 
shall be used. On letter-sized mail, date correction indicia must be 
placed on the nonaddress side at least \3/4\ inch from the bottom edge 
of the mailpiece and not on an envelope flap. On flats or parcels, it 
must be placed next to the original indicium. Date correction indicia 
must not include the FIM or the two-dimensional barcode. The redate 
indicium may be printed on a USPS-approved label instead of directly on 
the mailpiece.

4.9  Postage Correction

    Indicia for additional postage may be placed on a shortpaid 
mailpiece to correct postage. On letter-size mail, correction indicia 
must be printed on the nonaddress side at least \3/4\ inch from the 
bottom edge of the mailpiece and not on an envelope flap. On flats or 
parcels, it must be placed next to the original indicium. The postage 
correction indicium must contain all of the elements required for the 
indicium in 4.5 except for the destination delivery point. The word 
``CORRECTION'' must be added to the human readable information. Postage 
correction indicia must not include the FIM. To meet two-dimensional 
barcode readability requirements, postage correction indicia may be 
printed on a USPS-approved label instead of directly on the mailpiece.

4.10  Use of Indicia

    Valid information-based indicia produced by postage evidencing 
systems shall be used only to show evidence of payment for postage or 
postal services. In any illustration of information-based indicia, or 
for any other non-postal use, the two-dimensional barcode shall be 
rendered unreadable, for example by printing ``VOID'' or similar text 
across the barcode.

4.11  Other Printed Matter

    An approved indicium shall include within its boundaries only 
postal markings and text required or recommended by Postal Service 
regulation, except that the indicium may identify the product service 
provider. Other printed matter may be printed only outside the 
boundaries of the clear zone (see 4.5) surrounding the indicium. Such 
printed matter may not be obscene, defamatory of any person or group, 
or deceptive, and it must not advocate any unlawful action.

4.12  Postal Markings

    Postal markings related to the mail class, subclass, or category of 
mail are required in the indicia.

4.13  Facing Identification Mark (FIM)

    The facing identification mark (FIM) serves to orient and separate 
certain types of First-Class Mail during the facing and canceling 
process. Letter-sized First-Class Mail with the IBI printed directly on 
the envelope must bear a USPS-approved FIM D unless it is courtesy 
reply mail. The FIM must meet the dimensions, print quality, and 
placement specified in the C100.5.
5.0  MAILINGS

5.1  Preparation of IBI Mail

    Mail is subject to the preparation standards that apply to the 
class of mail and rate claimed.

5.2  Where to Deposit

    Single-piece rate First-Class Mail (including Priority Mail), 
Standard Mail (B), and expedited mail may be deposited in any street 
collection box or other place where mail is accepted and that is served 
by the registration post office. International mail weighing less than 
16 ounces may be deposited in any street collection box in accordance 
with the regulations for domestic mail. Limited quantities (i.e., a 
handful) of single-piece rate First-Class Mail including Priority Mail, 
expedited mail, and international mail may be deposited at offices 
other than the registration post office to expedite dispatch, with the 
following exceptions:
    a. Certain Special Postal Services require that the mail be 
presented directly to a Postal Service employee (see S900).
    b. A registered user authorized to use an APO or FPO as the 
registration post

[[Page 58689]]

office shall deposit mail only at the registration APO or FPO.
    c. All other registered users who have Postal Service approval to 
use a postage evidencing system that generates IBI outside the country 
shall deposit mail only at their domestic registration post office.
    d. International mail that requires a customs declaration, or that 
weighs 16 ounces or over, must be given directly to a Postal Service 
employee at the registration post office or other location designated 
by the postmaster. Otherwise, the mail will be returned to the sender 
for proper entry and acceptance. See the International Mail Manual for 
additional information.
6.0 AUTHORIZATION TO PRODUCE AND DISTRIBUTE POSTAGE EVIDENCING SYSTEMS 
THAT GENERATE INFORMATION-BASED INDICIA (IBI)
    Title 39, Code of Federal Regulations, part 502, contains 
information concerning authorization to produce and distribute postage 
evidencing systems that generate information-based indicia (IBI), the 
suspension and revocation of such authorization; performance standards, 
test plans, testing, and approval; required production security 
measures; and standards for distribution and maintenance. Further 
information may be obtained from the manager of Postage Technology 
Management, USPS Headquarters.

List of Subjects in 39 CFR Part 502

    Administrative practice and procedure, Postal Service.
    Although exempt from the notice and comment requirements of the 
Administrative Procedure Act (5 U.S.C. 553(b), (c)) regarding proposed 
rulemaking by 39 U.S.C. 410(a), the Postal Service invites public 
comments on the following proposed amendments to the Code of Federal 
Regulations. For the reasons set out in this document, the Postal 
Service proposes to add 39 CFR part 502 as follows:

PART 502--AUTHORITY TO PRODUCE AND DISTRIBUTE POSTAGE EVIDENCING 
SYSTEMS THAT GENERATE INFORMATION--BASED INDICIA (IBI)

Sec.
502.1   Applicability of regulations.
502.2   Description of postage evidencing systems that generate 
information-based indicia (IBI).
502.3   Definition and use of PC Postage trademark.
502.4   Product service provider qualifications.
502.5   Provider authorization.
502.6   Changes in ownership or control.
502.7   Burden of proof standard.
502.8   Suspension and revocation of authorization.
502.9   Information-based indicia program (IBIP) performance 
criteria.
502.10   Product submission procedures and testing.
502.11   Security testing.
502.12   Postage evidencing system approval.
502.13   Conditions for approval.
502.14   Suspension and revocation of approval.
502.15   Reporting.
502.16   Administrative sanction on reporting.
502.17   Materials and workmanship.
502.18   Destruction of information-based indicia.
502.19   Inspection of new postage evidencing systems.
502.20   Distribution facilities.
502.21   Distribution controls.
502.22   Administrative sanction.
502.23   Postage evidencing system maintenance.
502.24   Access or changes to secure components.
502.25   Inspection of postal security devices (PSDs) in use.
502.26   PSDs not located.
502.27   Electronic Funds Resetting System (EFRS).
502.28   Indicia quality assurance.
502.29   Refunds for postage evidencing systems that generate 
information-based indicia.
502.30   Registered user information.
502.31   Intellectual Property.

    Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 410, 
2601, 2605; Inspector General Act of 1978, as amended (Pub. L. 95-
452, as amended), 5 U.S.C. App 3.


Sec. 502.1  Applicability of regulations.

    The regulations in this section apply to all postage evidencing 
systems that print information-based indicia (IBI) to show payment of 
postage.


Sec. 502.2  Description of postage evidencing systems that generate 
information-based indicia (IBI).

    (a) Postage evidencing systems that generate IBI are secure systems 
that print USPS-authorized, digitally-signed indicia as evidence of 
payment of postage. Indicia consist of a USPS-approved two-dimensional 
barcode and certain human-readable information. Authorized postage 
evidencing systems are available from authorized, commercial product 
service providers.
    (b) These postage evidencing systems include as a primary component 
a postal security device (PSD) that performs core security functions 
such as digital signature generation and verification, as well as the 
management of postage registers. The component of these postage 
evidencing systems that controls the registered user infrastructure for 
system authorization, system audits, remote postage resetting, and 
production of the indicia is called the client system. The PSD and the 
client system interact to generate the indicia. The PSD is remotely set 
with postage value and requires the user to initiate payment to the 
Postal Service sufficient to cover the desired postage increment before 
initial setting or resetting.


Sec. 502.3  Definition and use of PC Postage trademark.

    (a) ``PC Postage'' is the Postal Service trademark for Postal 
Service-approved, secure, postage evidencing systems that generate 
information-based indicia and allow registered users to purchase and 
print postage using their personal computers and the Internet.
    (b) Use of the PC Postage trademark on USPS-approved postage 
evidencing systems and other products must be specifically approved by 
the manager of Postage Technology Management (PTM), USPS Headquarters. 
The provider must sign a trademark licensing agreement with the Postal 
Service for each product the Postal Service authorizes to use the PC 
Postage trademark.


Sec. 502.4  Product service provider qualifications.

    For authorization from the Postal Service to produce and/or lease 
PSDs and postage evidencing systems that generate information-based 
indicia (IBI) for use by registered users under Domestic Mail Manual 
P050, a potential provider must:
    (a) Satisfy the Postal Service of its integrity and fiscal 
responsibility.
    (b) Obtain approval of at least one postage evidencing system 
incorporating all the features and safeguards specified in Sec. 502.9, 
in accordance with the procedures outlined in Sec. 502.10.
    (c) Have, or establish, and keep under its supervision and control 
adequate production facilities suitable to carry out the provisions of 
Secs. 502.17 through 502.19, to the satisfaction of the Postal Service. 
The production facilities must be subject to unannounced inspection by 
representatives of the Postal Service. If the production facilities are 
established by the provider outside the customs territory of the United 
States, the provider shall be responsible for all costs incurred by the 
Postal Service to conduct the inspections.
    (d) Have, or establish, and keep under its supervision and control 
adequate facilities for the control, distribution, and maintenance of 
postage evidencing systems that generate IBI, and their

[[Page 58690]]

replacement or secure disposal or destruction when necessary.


Sec. 502.5  Provider authorization.

    An applicant meeting the qualifications in Sec. 502.4 may be 
authorized in writing by the manager of Postage Technology Management, 
USPS Headquarters, as a provider of postage evidencing systems that 
generate IBI and will be allowed to lease authorized PSDs and systems 
to users registered by the Postal Service. The written authorization 
defines the conditions under which the postage evidencing system may be 
marketed and distributed.


Sec. 502.6  Changes in ownership or control.

    Any person, entity, or concern wanting to acquire ownership or 
control of a provider of an authorized postage evidencing system must 
provide the Postal Service with satisfactory evidence of that person's, 
entity's, or concern's integrity and financial responsibility.


Sec. 502.7  Burden of proof standard.

    The burden of proof is on the Postal Service in adjudications of 
suspensions and revocations under Sec. 502.8 and Sec. 502.14 and 
administrative sanctions under Sec. 502.16 and Sec. 502.22. Except as 
otherwise indicated in those sections, the standard of proof shall be 
the preponderance-of-evidence standard.


Sec. 502.8  Suspension and revocation of authorization.

    (a) The Postal Service may suspend and/or revoke authorization to 
provide and/or distribute any or all of a provider's postage evidencing 
systems if the provider engages in any unlawful scheme or enterprise, 
fails to comply with any provision in this part 502, or fails to 
implement instructions issued in accordance with any final decision 
issued by the Postal Service within its authority over the IBI program.
    (b) The decision to suspend or revoke a provider's authorization 
shall be based on the nature and circumstances of the violation (e.g., 
whether the violation was willful, whether the provider voluntarily 
admitted to the violation, whether the provider cooperated with the 
Postal Service, or whether the provider implemented successful remedial 
measures) and on the provider's performance history. Before determining 
whether a provider's authorization to produce and/or distribute postage 
evidencing systems should be revoked, the procedures in paragraph (c) 
of this section shall be followed.
    (c) Suspension in all cases shall be as follows:
    (1) Upon determination by the Postal Service that a provider is in 
violation of the provisions in this part 502, the Postal Service shall 
issue a written notice of proposed suspension citing deficiencies for 
which suspension of authorization to produce and/or distribute a 
specific postage evidencing system, or a family of system models, may 
be imposed under paragraph (c)(2) of this section. The notification is 
in writing and is sent certified mail, return receipt requested. Except 
in cases of willful violation, the provider shall be given an 
opportunity to correct deficiencies and achieve compliance with all 
requirements within a time limit, determined by the Postal Service, 
corresponding to the potential risk to postal revenue.
    (2) In cases of willful violation, or if the Postal Service 
determines that the provider has failed to correct cited deficiencies 
within the specified time limit, the Postal Service shall issue a 
written notice setting forth the facts and reasons for the decision to 
suspend and the effective date if a written defense is not presented as 
provided in paragraph (d) of this section. The notification is in 
writing and is sent certified mail, return receipt requested.
    (3) If, upon consideration of the defense as provided in paragraph 
(e) of this section, the Postal Service deems that the suspension is 
warranted, the suspension shall remain in effect for up to 90 days 
unless withdrawn by the Postal Service, as provided in paragraph 
(c)(4)(iii) of this section.
    (4) At the end of the 90-day suspension, the Postal Service may:
    (i) Extend the suspension to allow more time for investigation or 
to allow the provider to correct the problem;
    (ii) Make a determination to revoke authorization to provide and/or 
distribute the provider's postage evidencing systems that generate IBI 
in part or in whole; or
    (iii) Withdraw the suspension based on identification and 
implementation of a satisfactory solution to the problem. Provider 
suspensions may be withdrawn before the end of the 90-day period if the 
Postal Service determines that the provider's solution and 
implementation are satisfactory.
    (d) The provider may present the Postal Service with a written 
defense to any suspension or revocation determination within 30 
calendar days after receiving or refusing to receive the written 
notice, unless a shorter period is deemed necessary. The defense must 
include all supporting evidence and specify the reasons for which the 
order should not be imposed.
    (e) After receipt and consideration of the defense, the Postal 
Service shall advise the provider of the decision and the facts and 
reasons for it. The decision shall be effective on receipt unless it 
provides otherwise. The decision shall also advise the provider that it 
may appeal that determination within 30 calendar days after the 
provider receives or refuses to receive written notification of the 
decision, unless a shorter period is deemed necessary, as specified 
therein. The appeal must include all supporting evidence and specify 
the reasons the provider believes that the decision is erroneous.
    (f) An order or final decision under this section does not preclude 
any other criminal or civil statutory, common law, or administrative 
remedy that is available by law to the Postal Service, the United 
States, or any other person or concern.


Sec. 502.9  Information-based indicia program (IBIP) performance 
criteria.

    (a) The performance criteria applicable to the given postage 
evidencing system relate to the data contents and format of the 
indicia, the PSD (which implements digital signature technology for the 
creation and verification of digital signatures), the client system 
(which supports the creation of the indicia and the interface with the 
PSD and the provider), and cryptographic key management.
    (b) The information-based indicia program (IBIP) performance 
criteria describe required system elements that include the provider 
infrastructure and the registered user infrastructure, and their 
interface to the Postal Service infrastructure. The Postal Service 
infrastructure supports user registration, postage evidencing system 
audit, postage resetting, total population management, key management 
support, financial reconciliation, PSD life cycle tracking, lost and 
stolen/irregularity management functions and other reporting. The 
provider infrastructure will support all IBIP functions. The registered 
user infrastructure will consist of the PSD and a client system. The 
Postal Service will evaluate and test postage evidencing systems for 
compliance with this infrastructure. Contact the manager of Postage 
Technology Management, USPS Headquarters for these criteria.


Sec. 502.10  Product submission procedures and testing.

    (a) Each postage evidencing system that generates IBI is submitted 
for Postal Service approval and will be tested and evaluated in 
accordance with the requirements and provisions of the most

[[Page 58691]]

current postage evidencing product submission procedures. Particular 
attention must be given to the requirement to submit identical postage 
evidencing systems simultaneously to the Postal Service and to a 
laboratory accredited under the National Voluntary Laboratory 
Accreditation Program (NVLAP) for FIPS 140-1 certification. Contact the 
manager of Postage Technology Management, USPS Headquarters for these 
requirements. Information pertaining to these procedures may be 
accessed through the USPS website.
    (b) The indicia design must be approved by the manager of Postage 
Technology Management, USPS Headquarters, and must comply with the 
requirements in the Domestic Mail Manual and the applicable IBI 
performance criteria.
    (c) Any change to an approved postage evidencing system must be 
submitted to the Postal Service for evaluation in accordance with the 
most current postage evidencing product submission procedures.
    (d) Where complete evaluation of all security-related components of 
a postage evidencing system requires USPS review of data located 
outside the customs territory of the United States, the provider shall 
be responsible for all costs incurred by the USPS in conducting that 
review.


Sec. 502.11  Security testing.

    The Postal Service reserves the right to require or conduct 
additional examination and testing at any time, without cause, of any 
postage evidencing system submitted to the Postal Service for approval 
or previously approved by the Postal Service for production and 
distribution.


Sec. 502.12  Postage evidencing system approval.

    As provided in Sec. 502.15, the provider has a duty to report 
security weaknesses to the Postal Service to ensure that every postage 
evidencing system in service protects the Postal Service against loss 
of revenue at all times. An approval of a system does not constitute an 
irrevocable determination that the Postal Service is satisfied with its 
revenue-protection capabilities and all other features of the system. 
After approval is granted to produce and distribute a postage 
evidencing system, no change affecting the features or safeguards may 
be made except as authorized or required by the Postal Service in 
writing.


Sec. 502.13  Conditions for approval.

    (a) The Postal Service may require, and reserves future rights to 
require, that production models of approved postage evidencing systems, 
as well as the current design documentation, user manuals, and 
specifications applicable to such systems and any revisions thereof, be 
submitted to the manager of Postage Technology Management, USPS 
Headquarters.
    (b) Upon request by the Postal Service, additional postage 
evidencing systems must be submitted to the Postal Service for testing, 
at the expense of the provider.


Sec. 502.14  Suspension and revocation of approval.

    (a) The Postal Service may suspend approval of a postage evidencing 
system under Sec. 502.12 if the Postal Service has probable cause to 
believe that the postage evidencing system or the family of system 
models poses an unacceptable risk to postal revenue. Suspension of 
approval to produce or distribute a postage evidencing system or a 
family of system models, in whole or in part, shall be based on the 
potential risk to postal revenue. Before determining whether approval 
of a postage evidencing system or a family of system models, should be 
revoked, the procedures in paragraph (b) of this section shall be 
followed.
    (b) Suspension procedures:
    (1) Upon determination by the Postal Service that a postage 
evidencing system poses an unacceptable risk to postal revenue, the 
Postal Service shall issue a written notice of proposed suspension 
citing deficiencies for which suspension may be imposed under paragraph 
(b)(2) of this section. The notification is in writing and is sent 
certified mail, return receipt requested. The provider shall be given 
an opportunity to correct deficiencies and achieve compliance with all 
requirements within a time limit determined by the Postal Service, 
corresponding to the potential risk to postal revenue.
    (2) If the Postal Service determines that the provider has failed 
to correct cited deficiencies within the USPS-specified time limit, the 
Postal Service shall issue a written notice setting forth the facts and 
reasons for the decision to suspend and the effective date if a written 
defense is not presented as provided in paragraph (c) of this section. 
The notification is in writing and is sent certified mail, return 
receipt requested.
    (3) If, upon consideration of the defense as provided in paragraph 
(d) of this section, the Postal Service deems that the suspension is 
warranted, the suspension shall remain in effect for up to 90 days 
unless withdrawn by the Postal Service, as provided in paragraph 
(b)(4)(iii) of this section.
    (4) At the end of the 90-day suspension, the Postal Service may:
    (i) Extend the suspension to allow more time for investigation or 
to allow the provider to correct the problem;
    (ii) Make a determination to revoke the approval of the provider's 
postage evidencing system or family of system models, or
    (iii) Withdraw the suspension based on identification and 
implementation of a satisfactory solution to the problem. Provider 
suspensions may be withdrawn before the end of the 90-day period if the 
Postal Service determines that the provider's solution and 
implementation are satisfactory.
    (c) The provider may present the Postal Service with a written 
defense to any suspension or revocation determination within 30 
calendar days after receiving or refusing to receive notice, unless a 
shorter period is deemed necessary. The defense must include all 
supporting evidence and specify the reasons for which the order should 
not be imposed.
    (d) After receipt and consideration of the written defense, the 
Postal Service shall advise the provider of the decision and the facts 
and reasons for it. The decision shall be effective on receipt unless 
it states otherwise. The decision shall also advise the provider that 
it may appeal that determination within 30 calendar days after the 
provider receives or refuses to receive written notice, unless a 
shorter period is deemed necessary, as specified therein. The appeal 
must include all supporting evidence and specify the reasons that the 
provider believes that the decision is erroneous.
    (e) An order or final decision under this section does not preclude 
any other criminal or civil statutory, common law, or administrative 
remedy that is available by law to the Postal Service, the United 
States, or any other person or concern.


Sec. 502.15  Reporting.

    (a) For purposes of this section, ``provider'' refers to an entity 
authorized under Sec. 502.5 and its foreign or domestic affiliates, 
subsidiaries, assigns, dealers, independent dealers, employees, and 
parent corporations.
    (b) Each provider authorized under Sec. 502.5 must submit a 
preliminary report to notify the Postal Service promptly (in no event 
more than 21 calendar days of discovery) of the following:
    (1) All findings or results of any testing known to the provider 
concerning the security or revenue

[[Page 58692]]

protection features, capabilities, or failings of any postage 
evidencing system or PSD sold, leased, or distributed by the provider 
that has been approved for sale, lease, or distribution by the Postal 
Service or by any foreign postal administration; or have been submitted 
for approval by the provider to the Postal Service or to a foreign 
postal administration.
    (2) All potential security weaknesses or methods of system 
tampering of the postage evidencing systems that the provider 
distributes, of which the provider knows or should know, and the system 
or model subject to each weakness or method. These potential security 
weaknesses include, but are not limited to suspected equipment defects, 
suspected abuse by a registered user or provider employee, suspected 
security breaches of the Electronic Funds Resetting System, 
cryptographic key compromises, occurrences outside normal performance, 
or any repeatable deviation from normal postage evidencing system 
performance (within the same model family and/or by the same registered 
user).
    (c) Within 45 calendar days of the preliminary notification to the 
Postal Service under Sec. 502.15(b), the provider must submit a written 
report to the Postal Service. The report must include the 
circumstances, proposed investigative procedure, and the anticipated 
completion date of the investigation. The provider must also provide 
periodic status reports to the Postal Service during subsequent 
investigation and, on completion, must submit a summary of the 
investigative findings.
    (d) The provider must establish and adhere to timely and efficient 
procedures for internal reporting of potential security weaknesses. The 
provider is required to submit a copy of internal reporting procedures 
and instructions to the Postal Service for review.


Sec. 502.16  Administrative sanction on reporting.

    (a) Notwithstanding any act, admission, or omission by the Postal 
Service, an authorized provider may be subject to an administrative 
sanction for failing to comply with Sec. 502.15.
    (b) The Postal Service shall determine all costs and revenue losses 
measured from the date that the provider knew, or should have known, of 
a potential security weakness, including, but not limited to, 
administrative and investigative costs and documented revenue losses 
that result from any postage evidencing system for which the provider 
failed to comply with any provision in Sec. 502.15. The provider shall 
be responsible to the Postal Service for all such costs and losses (net 
of any amount collected by the Postal Service from the registered 
users) with interest when the Postal service issues a written notice to 
the provider setting forth the facts and reasons on which the 
determination to impose the sanction is based. The notification is in 
writing and is sent certified mail, return receipt requested. The 
notice shall advise the provider of the date that the action takes 
effect if a written defense is not presented within 30 calendar days of 
receipt of the notice.
    (c) The provider may present the Postal Service with a written 
defense to the proposed action within 30 calendar days after receiving 
or refusing to receive notification. The defense must include all 
supporting evidence and specify the reasons for which the sanction 
should not be imposed.
    (d) After receipt and consideration of the defense, the Postal 
Service shall advise the provider of the decision and the facts and 
reasons for it; the decision shall be effective on receipt unless it 
states otherwise. The notification of the decision is in writing and is 
sent certified mail, return receipt requested. The decision shall also 
advise the provider that it may, within 30 calendar days of receiving 
the decision, appeal that determination as specified therein.
    (e) The provider may submit a written appeal to the Postal Service 
within 30 calendar days of receiving or refusing to receive 
notification of the decision. The appeal must include all supporting 
evidence and specify the reasons that the provider believes that the 
administrative sanction was erroneously imposed. The submission of an 
appeal stays the effectiveness of the sanction.
    (f) The imposition of an administrative sanction under this section 
does not preclude any other criminal or civil statutory, common law, or 
administrative remedy that is available by law to the Postal Service, 
the United States, or any other person or concern.


Sec. 502.17  Materials and workmanship.

    All postage evidencing systems that generate IBI must continuously 
maintain the quality in materials and workmanship of the production 
model approved by the Postal Service.


Sec. 502.18  Destruction of information-based indicia.

    All indicia created in the process of testing the postage 
evidencing system by the provider, or its agent, must be collected and 
securely controlled or destroyed by the provider to prevent 
unauthorized use.


Sec. 502.19  Inspection of new postage evidencing systems.

    The provider shall inspect all new postage evidencing systems that 
generate IBI to ensure proper functioning of all operational 
capabilities of each system before distribution.


Sec. 502.20  Distribution facilities.

    (a) An authorized provider must keep adequate facilities for and 
records of the distribution, control, maintenance, replacement, and 
disposal or destruction of all PSDs throughout their entire life cycle. 
Recordkeeping is required for all PSDs, including newly produced PSDs, 
active leased PSDs and inactive, unleased PSDs, as well as lost and 
stolen PSDs. All such facilities and records are subject to inspection 
by Postal Service representatives.
    (b) If the provider uses a third party to control, distribute, 
maintain, replace, repair, or dispose of PSDs or postage evidencing 
systems, all aspects of the arrangement between the parties must be 
specifically authorized in writing by the manager of Postage Technology 
Management, USPS Headquarters.
    (1) The third party relationship shall not compromise any security 
element of the postage evidencing system. The functions of the third 
party with respect to these systems are subject to the same scrutiny as 
the functions of the provider.
    (2) Any authorized third party must keep adequate facilities for 
and records of PSDs and postage evidencing systems in accordance with 
the USPS-authorized arrangement with the provider. All such facilities 
and records are subject to inspection by Postal Service 
representatives, in so far as they are used to control, distribute, 
store, maintain, replace, repair, or dispose of PSDs or postage 
evidencing systems.
    (3) The Postal Service holds the provider fully responsible for any 
deficiencies found in third party facilities, records, or procedures 
and can require termination of the third party arrangement if 
deficiencies are found.


Sec. 502.21  Distribution controls.

    Each authorized provider must do the following:
    (a) Hold title permanently to all PSDs that print U.S. postage, 
except those purchased by the Postal Service.
    (b) On behalf of applicants, electronically transmit information 
required to apply for a user registration to the designated Postal 
Service central registration processing facility.

[[Page 58693]]

    (c) On behalf of users registered to use their postage evidencing 
systems, forward to the Postal Service any changes to user registration 
information when the user submits such changes to the provider. The 
provider must follow authorized USPS procedures for moving the system 
when a registered user changes the registration post office. The 
provider must also notify the Postal Service following any event that 
indicates the need to update registered user information, such as the 
return of an invoice or the inability to communicate with the user.
    (d) Lease PSDs only to parties that have valid user registrations 
issued by the Postal Service to use a postage evidencing system.
    (e) Unless otherwise authorized by the Postal Service, immediately 
withdraw from service any PSD that the registered user no longer wants, 
or that is to be removed from service for any other reason. The 
provider shall retrieve any withdrawn PSD that is in the possession of 
the registered user. All resetting requests for a withdrawn PSD must be 
denied. The provider must keep in its possession for at least 1 year 
from the date of withdrawal a copy of the information on the registered 
user's PS Form 3601-C, Postage Evidencing System Activity Report.
    (f) Retrieve any misregistering, faulty, or defective PSD and 
withdraw it from service within 3 business days of being notified by 
the registered user of the defect. The provider must examine each PSD 
withdrawn from service for apparent faulty operation affecting the 
ascending or the descending register, or for other failure to record 
its operations correctly and accurately. After examining the withdrawn 
PSD, the provider must compile a written report explaining the 
malfunction to the manager of Postage Technology Management, USPS 
Headquarters. The report must include an explanation of the malfunction 
that resulted in the faulty operation or other failure to record 
operations correctly and accurately, all applicable system 
documentation, including log files, and a recommendation for the 
appropriate postage adjustment, if applicable. At the same time the 
report is made to the Postal Service, the provider must notify the 
registered user of the proposed postage adjustment. The provider may 
supply the registered user with a replacement PSD only if the faulty 
PSD is in the provider's possession.
    (g) Report promptly the loss or theft of any PSD, the recovery of 
any PSD previously reported as lost or stolen, or the scrapping of any 
PSD by the provider. The provider must notify the Postal Service by 
completing a standardized Lost and Stolen Postage Evidencing System 
Incident Report and filing it with the Postal Service by the tenth day 
of the month following when a PSD is scrapped or the provider 
determines the loss, theft, or recovery of a PSD. For lost or stolen 
PSDs, the provider must complete all preliminary location activities 
specified in Sec. 502.26 before including a given incident on this 
report.
    (h) Provide to the Postal Service upon request an electronic file 
or database of all postage evidencing systems in service, including the 
PSD identification number, the registered user's name and address, the 
date that the system was placed in service, and the ZIP Code of the 
registration post office. This information is to be provided to the 
Postal Service in USPS-specified format, at times to be determined by 
the Postal Service.
    (i) Keep accurate records and reconcile differences between their 
records and Postal Service databases.
    (j) Keep at provider's headquarters an electronic file or database 
with a complete record of all PSDs produced, showing all movements of 
each from the time that the PSD is produced until it is scrapped. The 
records shall be organized by PSD identification number and shall 
include the reading on the ascending register each time the PSD is 
authorized for a new registered user or is withdrawn from service. 
These records must be available for inspection by Postal Service 
officials at any time during normal business hours. The record for each 
PSD must be maintained for 3 years after the PSD is scrapped.
    (k) Submit other reports as required by the Postal Service.
    (l) Cancel a lease agreement with any lessee whose registration to 
use a postage evidencing system is revoked by the Postal Service.
    (m) Promptly withdraw from service any PSD that the Postal Service 
indicates should be withdrawn from service for revocation of user 
registration or for any other reason, and retrieve the PSD if it is in 
the possession of the registered user. When a user registration is 
revoked, the provider must retrieve all PSDs in the possession of the 
registered user and must withdraw from service all PSDs employed by the 
registered user.
    (n) Take reasonable precautions in the transportation and storage 
of PSDs to prevent use by unauthorized individuals. Providers must ship 
all PSDs by Postal Service Priority Mail unless given written 
permission by the Postal Service to use another method.
    (o) Communicate to all registered users of a postage evidencing 
system the required cautionary statements that provide the registered 
user with basic reminders that the postal security device is leased, 
the actions needed on relocation of the postage evidencing system, and 
warnings against system misuse.
    (1) The cautionary statements must be visually presented to the 
registered user upon each start-up of the postage evidencing system. 
The user must actively acknowledge the statements before proceeding 
with system use. In addition, the statements shall be included 
prominently in the user documentation provided with each system. PSDs 
that are in the possession of a user shall include the cautionary 
statements on a label attached to the PSD, to the housing of the PSD, 
or to the postage evidencing system containing the PSD, if the physical 
dimensions of the equipment will accommodate them. Postage evidencing 
systems provided to registered users without this cautionary 
information shall not be authorized for use.
    (2) In every presentation of the cautionary statements to the 
registered user, the words shown below in capital letters should be 
emphasized. If the cautionary statement can be placed on the PSD or 
other equipment, it shall be placed in a conspicuous and highly visible 
location. The minimum width of the text block containing the statement 
should be 3.25 inches, and the minimum height should be 1.75 inches. 
The statement shall read as follows:

POSTAL SERVICE NOTICE

LEASED POSTAGE EVIDENCING SYSTEM--NOT FOR SALE

PROPERTY OF [NAME OF PROVIDER]

    Use of this system is permissible only under a U.S. Postal 
Service postage evidencing system user registration.
    Call [NAME OF PROVIDER] at phone number ### ###-#### to relocate 
or return this Postage Evidencing System.
    WARNING! POSTAGE EVIDENCING SYSTEM TAMPERING OR MISUSE IS A 
FEDERAL OFFENSE.
    IF YOU SUSPECT POSTAGE EVIDENCING SYSTEM TAMPERING, CALL 
INSPECTOR GENERAL'S HOTLINE AT 1-800-654-8896 OR YOUR LOCAL POSTAL 
INSPECTOR.
    REWARD UP TO $50,000 for information leading to the conviction 
of any person who misuses a postage evidencing system resulting in 
the Postal Service not receiving correct postage payments.
    (3) Exceptions to the formatting of required cautionary labeling 
are determined on a case-by-case basis. The manager of Postage 
Technology Management, USPS Headquarters, must

[[Page 58694]]

approve, in writing, any deviation from the standard labeling 
requirements.


Sec. 502.22  Administrative sanction.

    The Postal Service holds providers responsible for the entire life 
cycle of their postage evidencing systems, including control, 
distribution, operation, maintenance, replacement, and secure disposal.
    (a) ``Postage evidencing system,'' for purposes of this section, 
means any system that is produced by a provider authorized under 
Sec. 502.5 that is not owned or leased by the Postal Service.
    (b) An authorized provider that, without just cause, fails to 
conduct or perform adequately any of the controls required by 
Sec. 502.21, to follow standardized lost and stolen incident reporting 
in Sec. 502.26, or to conduct the inspections required by Sec. 502.25 
in a timely fashion is subject to an administrative sanction based on 
the investigative and administrative costs and documented revenue 
losses (net of any amount collected by the Postal Service from the 
registered user), with interest per occurrence measured from the date 
on which the cost and/or loss occurred, as determined by the Postal 
Service. Sanctions shall be based on the costs and revenue losses that 
result from the provider's failure to comply with these requirements.
    (c) The Postal Service may impose an administrative sanction under 
this section by issuing a written notice to the provider setting forth 
the facts and reasons on which the determination to impose the sanction 
is based. The notification is in writing and is sent certified mail, 
return receipt requested. The Postal Service shall determine all costs 
and losses. The notice shall advise the provider of the date that the 
action shall take effect if a written defense is not presented within 
30 calendar days of receipt of the notice.
    (d) The provider may present to the Postal Service a written 
defense to the proposed action within 30 calendar days of receiving or 
refusing to receive the notice. The defense must include all supporting 
evidence and specify the reasons for which the sanction should not be 
imposed.
    (e) After receipt and consideration of the written defense, the 
Postal Service shall advise the provider of the decision and the facts 
and reasons for it. The decision shall be effective on receipt unless 
it states otherwise.
    (f) The provider may submit a written appeal of the decision within 
30 calendar days of receiving or refusing to receive the decision, 
addressed to the manager of Postage Technology Management, USPS 
Headquarters. The appeal must include all supporting evidence and 
specify the reasons that the provider believes that the administrative 
sanction was erroneously imposed. The submission of an appeal stays the 
effectiveness of the sanction.
    (g) The imposition of an administrative sanction under this section 
does not preclude any other criminal or civil statutory, common law, or 
administrative remedy that is available by law to the Postal Service, 
the United States, or any other person or concern.


Sec. 502.23  Postage evidencing system maintenance.

    (a) The provider must keep its postage evidencing systems that 
generate IBI in proper operating condition by maintaining or replacing 
them when necessary or desirable to prevent electronic failure, 
malfunction, expiration of the life of the battery for the clock or 
timer, or mechanical breakdown.
    (b) The provider must provide the registered users with 
modifications reflecting rate changes and must implement new rates as 
of the effective date for the new rates established by the Postal 
Service.


Sec. 502.24  Access or changes to secure components.

    Postage evidencing system maintenance involving access or changes 
to secure components must be done only within a secure facility under 
the provider's direct control and supervision. PSDs must be withdrawn 
from service before any such maintenance is performed.


Sec. 502.25  Inspection of postal security devices (PSDs) in use.

    (a) The provider must conduct an audit of each PSD at least once 
every 3 months in conjunction with the postage value resetting 
requirements in Sec. 502.27. A zero-value reset will satisfy this 
requirement. The PSD must have a lock-out feature that prevents use of 
the system if an audit is not completed in accordance with this 
regulation.
    (b) Postage evidencing systems that generate IBI, other than PC 
Postage, shall be inspected by the provider every 2 years. Registered 
user mail-in of indicia may substitute for the provider inspection, 
with Postal Service approval. The provider shall inspect or sample PC 
Postage products under special circumstances, as directed by the Postal 
Service. The Postal Service examines postage evidencing systems when 
warranted by special circumstances.


Sec. 502.26  PSDs not located.

    Upon learning that one or more of its PSDs in service cannot be 
located, the provider must undertake reasonable and timely efforts to 
locate the PSD by following a series of Postal Service-specified 
actions designed to locate the PSDs. If these efforts are unsuccessful 
and a PSD is determined to be lost or stolen, the provider must notify 
the Postal Service in accordance with Sec. 502.21.
    (a) If a user registered to use a postage evidencing system cannot 
be located, the provider must, at a minimum, complete the following 
actions:
    (1) Call the registered user's last known telephone number.
    (2) Call directory assistance for the user's new telephone number.
    (3) Contact the registered user's local post office for current 
change of address information.
    (4) Contact Postage Technology Management to verify the location of 
the PSD and the registered user as currently maintained in Postal 
Service records.
    (5) Contact the rental agency responsible for the property where 
the registered user was located, if applicable.
    (6) Visit the registered user's last known address to see whether 
the building superintendent or a neighbor knows the user's new address.
    (7) Mail a certified letter with return receipt to the registered 
user at the last known address with the endorsement ``Forwarding and 
Address Correction Requested''.
    (8) If new address information is obtained during these steps, any 
missed or delinquent scheduled PSD audit must be completed immediately.
    (b) If a PSD is reported to be lost or stolen by the registered 
user, the provider must, at a minimum, complete the following actions:
    (1) Discontinue postage value downloads to the lost or stolen PSD.
    (2) Ensure that the registered user has filed a police report for a 
stolen PSD and that copies have been provided to the appropriate 
Inspection Service Contraband Postage Identification Program (CPIP) 
specialist.
    (3) Withhold issuance of a replacement PSD until the missing PSD 
has been properly reported to the police and to the appropriate 
Inspection Service CPIP specialist.
    (c) If the provider later learns that the PSD has been located and/
or recovered, the provider must take the following actions before 
returning the PSD to service or allowing a postage value download:
    (1) Submit a new Lost and Stolen Postage Evidencing System Incident

[[Page 58695]]

Report that references the initial report and outlines the details of 
how the PSD was recovered, in accordance with Sec. 502.21. The provider 
is responsible for keeping records of these reports as submitted to the 
Postal Service for a minimum of 3 years after submission.
    (2) Retrieve the recovered PSD from the registered user and examine 
it for apparent faulty operation that could affect its ability to 
record its operations correctly and result in a questionable accurate 
registration.
    (3) Recommend a postage adjustment or refund, if appropriate.
    (4) Withdraw the PSD from service if a replacement PSD has been 
supplied to the registered user or if there is an issue of questionable 
accurate registration.
    (d) Any authorized provider that fails to comply with standardized 
lost and stolen reporting procedures and instructions is subject to an 
administrative sanction under Sec. 502.22, as determined by the Postal 
Service.


Sec. 502.27  Electronic Funds Resetting System (EFRS).

    (a) Description. A remote resetting system permits registered users 
to reset their PSDs at places of business and/or homes via modem or 
network interface. The Electronic Funds Resetting System (EFRS) is the 
Postal Service system that processes system resetting data for postage 
value downloads submitted by providers of postage evidencing systems 
that generate IBI. The Postal Service processes the data separately 
from data processed under the Computerized Meter Resetting System 
(CMRS), which is used for traditional postage meters.
    (b) Resetting a PSD. To reset a PSD, the registered user connects 
to the provider and provides specified identifying data and PSD audit 
data for the postage value download. Before proceeding with the 
transaction, the provider must verify all the data, conduct the system 
audit, and ascertain whether payment to the Postal Service sufficient 
to cover the desired postage value download was initiated by the 
registered user. If payment was initiated and the system audit was 
successful, the provider may complete the postage value download.
    (c) Payment to the Postal Service.
    (1) The only acceptable methods used for postage payments for 
postage evidencing systems that generate IBI are credit cards and 
Automated Clearinghouse (ACH) debit. The providers must publicize these 
payment options to all registered IBI users. When publicizing these 
options, the provider must provide a clear and concise description of 
each.
    (i) Credit Cards. The provider must offer the registered user the 
option to use all of the credit cards approved for use by the Postal 
Service for payment for postage. Each provider must receive 
authorization from the Postal Service to offer credit card options to 
registered users and must sign a vendor credit card pilot test 
agreement, a legal agreement with the Postal Service on credit card 
payment, which addresses security requirements, payment of transaction 
costs, reconciliation requirements, and retrieval and chargeback 
requests. The provider must use a certified credit card payment process 
approved for use by the Postal Service's designated card processor. All 
credit card transactions must be sent through the designated Postal 
Service card processor, with each provider working as an agent with the 
Postal Service as the merchant of record.
    (ii) ACH Debit. All ACH debit payments for postage must be 
electronically transferred directly from the registered user's account 
resident in a financial institution that is neither owned, nor 
controlled, nor contracted, nor arranged for by a product service 
provider or its affiliate. The funds must be transferred directly into 
an account at a financial institution designated by the Postal Service.
    (2) A registered user is required to initiate payment to the Postal 
Service sufficient to cover the desired postage value download 
contemporaneously with a download being made. The details of this 
payment requirement are covered in the Postage Payment Agreement.
    (3) Each provider is required to incorporate the Postage Payment 
Agreement into its postage evidencing system lease agreement with each 
registered user, as follows:

POSTAGE PAYMENT AGREEMENT

    By signing this postage evidencing system lease agreement you 
agree to initiate payment for postage using either a USPS-approved 
credit card or ACH debit. If you use ACH debit, you agree to 
transfer funds directly to the Postal Service through a financial 
institution, as specified by the Postal Service, for the purpose of 
prepayment of postage. If you use a credit card, you agree to use 
only those credit cards approved for use for payment for postage by 
the Postal Service.
    You understand that the provider and its affiliates shall not 
hold, or contract with or otherwise arrange for any third party to 
hold, your funds intended for the purchase of postage. You will be 
bound by all terms and conditions of this Postage Payment Agreement 
as it may be amended periodically by the Postal Service.

    (4) The provider must require each registered user who requests a 
postage value download to provide the PSD identification number, the 
registered user account number, and the ascending and descending 
register readings on the PSD at the time of the request. The provider 
must verify that the information entered by the registered user is 
accurate and matches the provider's records. Providers must also verify 
that the registered user has initiated payment to the Postal Service 
sufficient to cover the postage value download requested before 
proceeding with the resetting transaction. Immediately following the 
completion of each transaction, the provider must give the user a 
statement documenting the transaction.
    (d) Revenue protection. The Postal Service shall conduct periodic 
audits and reviews of the EFRS revenue protection safeguards employed 
by each provider and shall reserve the right to revoke a provider's 
authorization if they do not meet all EFRS requirements set forth by 
the Postal Service. In addition, the Postal Service shall reserve the 
right to suspend the operation of the provider, as provided in 
Sec. 502.14, for any serious operational deficiency that may result in 
the loss of funds to the Postal Service.
    (e) Financial operation. The Postal Service shall establish a 
separate account at its designated financial institution to handle the 
funds for payment for postage received from registered users. The 
provider may not establish an account to handle the funds of registered 
users intended for the purchase of postage. Payment Technologies, 
Office of the Treasurer, USPS, will coordinate the implementation of 
the ACH debit process with the provider.
    (f) Reports. The provider must submit a daily financial transaction 
for each postage value download or postage refill according to 
established EFRS procedures. The provider must provide other reports as 
required by the Postal Service.
    (g) Inspection of records and facilities. The provider must make 
its facilities that handle the operation of the EFRS and all records 
about the operation of the system available for inspection by 
representatives of the Postal Service at all reasonable times.


Sec. 502.28  Indicia quality assurance.

    The provider shall implement a mailpiece quality assurance program 
to ensure the quality and readability of the indicia and shall instruct 
the registered user on the submission of the required mailpieces. The 
registered user is required to forward a mailpiece to the provider for 
evaluation when the system is installed and at least once every 6

[[Page 58696]]

months thereafter. If the user fails to comply with this requirement, 
the provider must notify the user that all future postage value 
resettings will be denied. The provider must analyze these mailpieces 
for quality and readability and is required to provide guidance to the 
registered user to correct any deficiencies that are discovered. The 
provider must notify the Postal Service of all noncompliant registered 
users, so that the Postal Service can initiate revocation of the user's 
registration.


Sec. 502.29  Refunds for postage evidencing systems that generate 
information-based indicia (IBI).

    The Postal Service provides refunds for readable, valid, unused 
postage on an unmailed envelope or label, and for any balance remaining 
on a PSD withdrawn from service and in the possession of the provider, 
in accordance with established refund procedures. Postage losses to the 
registered user due to system malfunctions and the refund of any non-
postal fees are the responsibility of the provider. Registered users 
submit refund requests to the provider in accordance with Domestic Mail 
Manual (DMM) P014. The following procedures apply, depending on the 
type of refund requested:
    (a) Refund for unused postage
    (1) The provider shall acknowledge the refund request and confirm 
that the appropriate supporting materials have been received, including 
Postal Service Form 3533-PCP-X, Refund Request for Unused IBI Postage, 
in accordance with the requirements in DMM P014.
    (2) The provider shall scan the two-dimensional barcode in the 
submitted indicium, analyze the data to ensure the indicium is valid, 
and verify the following:
    (i) The PSD used in producing the indicium is the expected PSD.
    (ii) The unused postage is presented by the user to whom the PSD 
that produced the indicium is registered.
    (iii) The date of mailing shown in the indicium is not more than 10 
days before the date on which the registered user mailed the indicium 
for refund. The date is checked by postmark.
    (iv) The human-readable data matches the corresponding data in the 
two-dimensional barcode.
    (v) The PSD certificate has not been revoked.
    (vi) The indicium has not been submitted before.
    (3) The provider shall submit the indicium data electronically to 
the Certificate Authority for verification of the digital signature.
    (4) The provider shall ensure there is no evidence that the 
mailpiece has been processed by the Postal Service.
    (5) The provider shall annotate Postal Service Form 3533-PCP-X, 
Refund Request for Unused IBI Postage, and notify both the registered 
user and the manager of Postage Technology Management, USPS 
Headquarters, of any instances where the refund request for a given, 
unused indicium will be denied.
    (6) Upon successful signature verification and completion of all 
other required checks listed above, the provider shall either:
    (i) Issue an immediate refund to the registered user from the 
provider's own funds, or
    (ii) Issue the refund to the registered user within 5 business days 
of receiving reimbursement from the Postal Service.
    (7) No more frequently than once per week, the provider shall 
submit to the Postal Service a refund request for unused postage, using 
the format in Postal Service Form PCP-X, Provider Refund Request for 
Information-Based Indicia.
    (8) The Postal Service shall remit a check made payable to the 
provider for the total amount of the refund request for unused postage.
    (9) The Postal Service reserves the right to audit the provider's 
refund processing and the unused mailpieces submitted for refund. 
Providers are required to maintain the following records:
    (i) The unused envelopes and labels submitted for refund, and any 
other correspondence related to the refund request, attached to a copy 
of the associated Form 3533 PCP-X, Refund Request for Unused IBI 
Postage, and organized by the date of the provider's refund request. 
The Postal Service will destroy the unused mailpieces after the 
completion of the audit.
    (ii) Electronic copies of the scanned indicia organized by date 
submitted for refund. These are maintained until the Postal Service 
completes its audit.
    (iii) Postal Service Form 3533-PCP-X (printed copy) submitted by 
the registered user to the provider. The printed copy shall be kept for 
1 year. An electronic, scanned version with the registered user's 
signature shall be kept for 3 years after the destruction of the 
printed copy.
    (iv) A copy of each Postal Service Form PCP-X, Provider Refund 
Request for Information-Based Indicia, submitted by the provider to the 
Postal Service. This form shall be maintained by the provider until 
completion of the Postal Service audit.
    (v) A refund count (by number of pieces and postage amount) for 
each PSD. This information shall be maintained until completion of the 
first Postal Service audit following the withdrawal of the PSD from 
service.
    (b) Refund for postage balance remaining on a PSD that is withdrawn 
from service and is in the possession of the provider.
    (1) The registered user informs the provider of the intention to 
withdraw the PSD from service and has the postage evidencing system 
generate a refund request indicium for transmittal to the provider. The 
means by which this is accomplished is at the provider's discretion. 
The transmittal of the refund request indicium is the last activity 
that is permitted for the PSD. If the registered user has physical 
possession of the PSD, the registered user returns the withdrawn PSD to 
the provider, in accordance with regulations for returning PSDs.
    (2) Upon receipt of the refund request indicium and the PSD (where 
applicable), the provider shall scan the two-dimensional barcode in the 
submitted indicium, analyze the data to ensure the indicium is valid, 
and verify the following:
    (i) The descending register value in the refund request indicium is 
$0.00.
    (ii) The PSD used in producing the indicia is the expected PSD.
    (iii) The refund request indicium is presented by the registered 
user of the PSD.
    (iv) The PSD certificate has not been revoked.
    (v) There is no evidence of tampering with the PSD.
    (3) The provider shall submit the refund request indicium data 
electronically to the Certificate Authority for digital signature 
verification.
    (4) Under no circumstances may a provider issue a refund for a 
withdrawn PSD unless the PSD is in the provider's possession.
    (5) The provider shall not issue a refund if there is any question 
as to the remaining postage value on the PSD without first consulting 
with the manager of Postage Technology Management, USPS Headquarters. 
The provider shall notify both the registered user and the manager of 
Postage Technology Management of any instances where the refund request 
will be denied.
    (6) The provider shall generate a form equivalent to Postal Service 
Form 3601-C, Postage Evidencing System Activity Report, for withdrawal 
of the PSD. The form will include the refund request indicium.

[[Page 58697]]

    (7) Upon successful signature verification and completion of all 
other required checks listed above, the provider shall initiate a PSD 
withdrawal as specified by Postal Service procedures and shall revoke 
the PSD certificate. Then the provider shall either:
    (i) Issue an immediate refund to the registered user from the 
provider's own funds; or
    (ii) Issue the refund to the registered user within 5 business days 
of receiving reimbursement from the Postal Service.
    (8) No more frequently than once per week, the provider shall 
submit to the Postal Service a refund request for withdrawn PSDs, 
including a listing of the refund requested by each registered user, 
using the format in Postal Service Form PCP-X, Provider Refund Request 
for Information-Based Indicia.
    (9) The Postal Service shall remit a check made payable to the 
provider for the total amount of the refund request for postage value 
remaining on withdrawn PSDs.
    (10) The Postal Service reserves the right to audit the provider's 
refund processing and the refund request indicia. Providers are 
required to maintain the following records:
    (i) An electronic copy of a form equivalent to Postal Service Form 
3601-C, Postage Evidencing System Activity Report, which includes the 
refund request indicia, organized by the date of the provider's refund 
request, shall be kept for 2 years, or until the completion of the 
Postal Service audit, whichever is longer.
    (ii) Any other correspondence that is related to the refund request 
must be retained by the provider until the Postal Service completes its 
audit.
    (iii) A copy of each Postal Service Form PCP-X, Provider Refund 
Request for Information-Based Indicia, submitted by the provider to the 
Postal Service shall be maintained by the provider until completion of 
the Postal Service audit.


Sec. 502.30  Registered user information.

    (a) Providers are required to collect registration information and 
transaction records from registered users on behalf of the Postal 
Service and to transmit the data to the Postal Service as part of the 
registration process, the postage payment process; and, for IBI open 
systems, the mailpiece generation process. Although the Postal Service 
does not require the provider to retain registered user information, 
the provider may choose to do so for its own purposes, subject to the 
following limitations:
    (1) A provider that retains personal information regarding a 
registered user must issue a privacy policy that informs the registered 
user of the information to be retained and its intended uses.
    (2) The provider is strictly prohibited from disclosing any list of 
applicants or registered users, or any identifying information about 
any given applicant or registered user, to any other entity, for any 
purpose, without prior notification to the customer.
    (3) The provider must offer the applicant or registered user the 
option to not have their personal information disclosed to any other 
entity.
    (b) As stated in Sec. 502.21, providers are required to 
electronically transmit information required to apply for a user 
registration to the designated Postal Service central registration 
processing facility, on behalf of applicants.
    (c) The Postal Service shall use the registered user information in 
accordance with the purposes and routine uses published in the Privacy 
Act system of records USPS 140.020, Postage-Postage Evidencing System 
Records. The Postal Service may use applicant information in the 
administration of postage evidencing systems and mailing activities, 
and to communicate with customers who may no longer be visiting a 
traditional USPS retail outlet. The Postal Service will also use 
applicant information to communicate with USPS customers through any 
new retail channels, and for the following purposes:
    (1) To issue (including reregistration, renewal, transfer, 
revocation, or refusal, as applicable) a user registration to a 
customer and to communicate with respect to the status of such 
registration.
    (2) To disclose to a provider the identity of any PSD and any 
related user registration data for any PSDs required to be removed from 
service by that provider as the result of revocation of a user 
registration, questioned accurate registration or other failure of the 
PSD to record its operations correctly and accurately, or 
decertification by the Postal Service of any particular postage 
evidencing system that generates IBI or family of such models.
    (3) To track the movement of postage evidencing systems between a 
provider and registered users and to communicate to a provider (but not 
to any third party other than the applicant/registered user) concerning 
such movement. The term ``provider'' includes a provider's dealers and 
agents.
    (4) To transmit general information to all registered users 
concerning rate and rate category changes implemented or proposed for 
implementation by the Postal Service.
    (5) To advertise Postal Service services relating to the 
acceptance, processing and delivery of or postage payment for mail 
using information-based indicia.
    (6) To allow the Postal Service to communicate with USPS customers 
on products, services, and other information otherwise available to 
USPS customers through traditional retail outlets.
    (7) To support any internal use by Postal Service personnel, 
including identification and monitoring activities relating to postage 
evidencing systems, provided that such use by the Postal Service does 
not result in the disclosure of applicant information to any third 
party and will not enable any third party to use applicant information 
for its own purposes; except that the applicant information may be 
disclosed to other governmental agencies for law enforcement purposes 
as provided by law.
    (8) To identify authorized product service providers or announce 
de-authorization of an authorized product service provider, or provide 
currently available public information, where an authorized provider is 
identified.
    (9) To promote and encourage the use of information-based indicia 
as a form of postage evidencing, provided that the same information is 
provided to all registered users, and no particular provider will be 
recommended by the Postal Service.
    (10) To contact registered users in cases of revenue fraud or 
revenue security, except that any registered user suspected of fraud 
shall not be identified to other users.
    (11) To disclose to a provider applicant information pertaining to 
that provider's customers that the Postal Service views as necessary to 
enable the Postal Service to carry out its duties and purposes.
    (12) To transmit to a provider all applicant and system information 
pertaining to that provider's customers and systems that may be 
necessary to permit such provider to synchronize its registered user 
and PSD database with information contained in the computer files of 
the Postal Service, including but not limited to computerized data that 
reside in Postal Service postage evidencing system management 
databases.
    (13) Subject to the conditions stated herein, to communicate in 
oral or written form with any or all applicants and registered users 
any information that the Postal Service views as necessary or desirable 
to enable the Postal Service to carry out its duties and purposes under 
this part 502.

[[Page 58698]]

Sec. 502.31  Intellectual Property

    (a) None of the following shall constitute a grant of authorization 
or consent by the Postal Service or the United States to a provider or 
any other person to manufacture or use any patented invention or to 
infringe any copyright, under 28 U.S.C. 1498 or otherwise:
    (1) The publication of performance criteria, or
    (2) The granting of authorization to a provider under part 501 or 
this part 502, or
    (3) The granting of approval to a provider to market or distribute 
a postage evidencing system.
    (b) A provider must reimburse the Postal Service for any 
compensation or other costs or damages (other than the Postal Services' 
own attorneys' fees and other costs of defense) that the Postal Service 
or the U.S. Government is required, by final order of a court of 
competent jurisdiction which is either not subject to appeal or as to 
which the time to appeal has already passed, to pay on a claim of 
infringement or unauthorized use of a U.S. patent or U.S. copyright, 
under any legal theory, based on either:
    (1) The manufacture, use, sale or importation of provider's postage 
evidencing system, whether or not such manufacture, use, sale or 
importation is alleged to be pursuant to authorization or consent 
provided under 28 U.S.C. 1498;
    (2) The use of provider's postage evidencing system by mailers in a 
manner specified or intended by Provider to create postage indicia, 
apply such indicia to mail, and/or deposit such mail with the USPS; or
    (3) The granting by the Postal Service to provider of government 
authorization or consent, under 28 U.S.C. 1498 or otherwise, to make or 
use a patented invention or infringe a copyright in connection with the 
manufacture, use or sale of provider's postage evidencing system, or 
the activities of provider pursuant to such grant of authorization and 
consent.
    (c) The Postal Service may suspend approval of a postage evidencing 
system on 60 days' notice to provider if a court of competent 
jurisdiction determines that the manufacture or use of the postage 
evidencing system, or the creation or validation of the indicia 
produced thereby, infringes, induces or contributes to the infringement 
of, or otherwise violates any person's or entity's rights under a U.S. 
patent or U.S. copyright. The Postal Service shall reinstate approval 
of such postage evidencing system if and so long as:
    (1) Such judicial determination is vacated or reversed; or
    (2) The provider duly licenses or otherwise procures and maintains 
in effect (for the benefit of itself, users and the Postal Service as 
may be necessary) the right to conduct, with respect to provider's 
postage evidencing device and the indicia created thereby, the 
activities that the court has determined to be infringing.
    (d) A determination that the validating of an indicia by the Postal 
Service infringes a patent or copyright shall not be a basis for 
suspending provider's approval if the provider can establish that 
alternative, non-infringing means of performing such validation are 
available to the Postal Service with respect to the indicia created by 
provider's postage evidencing device so long as such means fully comply 
with the performance criteria under which the postage evidencing device 
and indicia have been approved.
    (e) The Postal Service may provide additional requirements relating 
to intellectual property in the product submission procedure, 
performance criteria or both (``IP Requirements'') and may condition 
the granting or maintenance of approval of a postage evidencing system 
on provider's compliance with those IP Requirements. When IP 
Requirements are imposed on a provider, they shall control over any 
conflicting provision in this Sec. 502.31.
    (f) The requirements of this Sec. 502.31 shall apply to all aspects 
of a provider's postage evidencing device and the indicia created 
thereby, including those aspects required or specified under applicable 
performance criteria.
    (g) Notwithstanding Sec. 502.1 to the contrary, this Sec. 502.31 
shall apply to any postage evidencing system approved by the Postal 
Service under part 501, part 502 or otherwise and to any performance 
criteria whether directed to IBI or other forms of postage evidence.
    Appropriate amendments to 39 CFR parts 111 and 502 to reflect these 
changes will be published if the proposal is adopted.

Stanley F. Mires,
Chief Counsel, Legislative.
[FR Doc. 00-25090 Filed 9-29-00; 8:45 am]
BILLING CODE 7710-12-U