[Federal Register: October 2, 2000 (Volume 65, Number 191)]
[Proposed Rules]
[Page 58682-58698]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr02oc00-23]

=======================================================================
-----------------------------------------------------------------------

POSTAL SERVICE

39 CFR Parts 111 and 502

Production, Distribution, and Use of Postal Security Devices and
Information-Based Indicia

AGENCY: Postal Service.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Postal Service is proposing to add new sections to the
Domestic Mail Manual (DMM) and to title 39, Code of Federal Regulations
(CFR), to reflect policies and regulations pertaining to all postage
evidencing systems that generate information-based indicia (IBI). We
originally published policies and regulations for public review and
comment in the March 28, 1997, Federal Register (62 FR 14833). In the
September 2, 1998, Federal Register (63 FR 46719) we published a
revision of those proposed policies and regulations which included
changes made in response to the comments received from the public.
    This publication of proposed policies and regulations includes
extensive changes. We based the changes since the 1998 publication on
public comments and on the experience we gained by testing and
implementing the first postage evidencing systems to generate
information-based indicia (IBI). One significant proposed change is the
establishment by the Postal Service of the Electronic Funds Resetting
System (EFRS) to process resetting data for these systems. We will
continue to process data for traditional postage meters under the
Computerized Meter Resetting System (CMRS). Other proposed changes
include modifying the forms of payment the Postal Service will accept,
and changing the policy for refunds for unused IBI postage and for the
balance remaining on a postal security device (PSD) that is withdrawn
from service.
    We are reissuing the policies and regulations in this proposal for
public comment because we made extensive changes. We will revise the
proposed IBI policies and regulations, if required, and publish them as
a final rule after we review the comments.

DATES: Comments must be received on or before December 1, 2000.

ADDRESSES: Written comments should be mailed or delivered to the
Manager, Postage Technology Management, USPS Headquarters, 475 L'Enfant
Plaza SW, Room 8430, Washington, DC 20260-2444. Copies of all written
comments will be available at this address for inspection and
photocopying between 9 a.m. and 4 p.m., Monday through Friday.

FOR FURTHER INFORMATION CONTACT: Nicholas S. Stankosky, 202-268-5311.

SUPPLEMENTARY INFORMATION: Postage evidencing systems covered by these
regulations include all those systems that generate information-based
indicia (IBI) and use a postal security device (PSD). The
characteristics of these systems enable the Postal Service to scan
indicia to detect fraud. Core security functions, such as digital
signature generation, digital signature verification, and the
management of postage registers are performed by the PSD. The IBI
contains a two-dimensional barcode that incorporates a cryptographic
digital signature. The component of these postage evidencing systems
that controls the registered user infrastructure for system
authorization, system audits, remote postage resetting, and production
of the indicia is called the client system.
    Authorized postage evidencing systems are available from
authorized, commercial product service providers. The provider's
infrastructure supports user registration (formerly ``licensing''), PSD
management and life cycle support, and an interface between the client
system and the Postal Service infrastructure. The Postal Service
infrastructure supports the issuance of user registrations, updating
user registration information, PSD inventory and tracking, resetting,
account reconciliation, lost and stolen/irregularity monitoring, and
the assignment of digital certificates.

The Following is a Summary of the Postal Service's Position on Some
General Interest Policy Issues for Postage Evidencing Systems That
Generate IBI

    1. Any proposed postage evidencing system that generates IBI must
be submitted to the Postal Service for approval under the then current
version of the postage evidencing product submission procedures. These
procedures include specifics on letters of intent, nondisclosure
agreements, the product service provider's concept of operations and
infrastructure, documentation requirements, product submissions, and
testing activities. Information pertaining to these

[[Page 58683]]

procedures may be accessed through the USPS Web site.
    2. The user must register with the Postal Service before using a
postage evidencing system that generates IBI.
    3. PSDs remain the property of the USPS-authorized product service
provider and are available only through a lease agreement with the
provider. The software component of these postage evidencing systems is
licensed to the registered user by the provider.
    4. Until the Postal Service has recorded sufficient data on
reliability and security, the total amount of postage in a descending
register, which shows the amount of postage available, will be limited
to an amount established by the Postal Service.
    5. Authorized providers must keep records of the distribution,
maintenance, replacement, and disposal of all PSDs throughout the
complete life cycle of the PSD. All PSDs must be tracked, including
newly produced PSDs; active leased PSDs; and inactive unleased PSDs;
and lost, stolen, and scrapped PSDs.
    6. Indicia produced by these postage evidencing systems may be used
to indicate postage for single-piece rate First-Class Mail (including
Priority Mail), single-piece rate International Mail, Standard Mail
(B); and Express Mail, Express Mail International Service, Global
Priority Mail, and Priority Mail Global Guaranteed. Mail bearing the
indicia is entitled to all privileges and subject to all conditions
applying to these classes of mail.
    7. Providers are responsible for audit functions. The Postal
Service will not take over this function, but may at times participate
in or review the audit process. PSDs must be audited at least once
every 3 months.
    8. To ensure the quality and readability of the indicia, providers
must perform an analysis of the mailpieces that registered users submit
every 6 months for the provider's mailpiece quality assurance program.
The provider must notify the registered user and the Postal Service of
any deficiencies and provide guidance to the user to correct any
deficiencies that are discovered.
    9. All postage downloads or settings will be made under the
provisions of the Electronic Funds Resetting System (EFRS). The Postal
Service will conduct periodic audits of the provider's resetting system
to ensure that the system is operating correctly and that postal
revenues are protected.
    10. The Postal Service may physically inspect a PSD if it has a
reason to suspect a security problem.
    11. The Postal Service will provide refunds through the product
service providers, in accordance with Postal Service procedures, for
printed but unused postage and for the full postage value balance
remaining on a PSD that is withdrawn from service.
    12. The provider must supply registered users with modifications
reflecting rate changes and must implement new rates as of the
effective date for the new rates established by the Postal Service.
    13. There are provisions in the regulations for the correction of
postage and dates. For date correction, the facing identification mark
(FIM) and two-dimensional barcode will be suppressed; for postage
correction, the FIM will be suppressed.
    14. The provider will make the registered user aware of the
applicable Postal Service regulations pertaining to use of the
information-based indicia and of the postage evidencing system that
generates them through cautionary statements in the system software,
system documentation, and product labeling, as appropriate.

List of Subjects in 39 CFR Part 111

    Administrative practice and procedure, Postal Service.
    Although exempt from the notice and comment requirements of the
Administrative Procedure Act (5 U.S.C. 553(b), (c)) regarding proposed
rulemaking by 39 U.S.C. 410(a), the Postal Service invites public
comments on the following proposed amendments to the Domestic Mail
Manual, incorporated by reference in the Code of Federal Regulations.
See 39 CFR part 111.

PART 111--[AMENDED]

    1. The authority citation for 39 CFR part 111 continues to read as
follows:

    Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 3001-
3011, 3201-3219, 3403-3406, 3621, 3626, 5001.

    2. Add the following sections to the Domestic Mail Manual as set
forth below:

P050  Information-Based Indicia (IBI)

1.0  BASIC INFORMATION

1.1  Description of Postage Evidencing Systems that Generate
Information-Based Indicia (IBI)

    Postage evidencing systems that generate information-based indicia
(IBI) are secure systems that print USPS-authorized, digitally signed
indicia to show payment of postage. These systems include as a primary
component a postal security device (PSD) that performs core security
functions such as digital signature generation and verification, as
well as the management of postage registers. The component of these
postage evidencing systems that controls the registered user
infrastructure for system authorization, system audits, remote postage
resetting, and production of the indicia is called the client system.
The PSD and the client system interact to generate the indicia. Indicia
consist of a USPS-approved two-dimensional barcode and certain human-
readable information. Authorized postage evidencing systems are
available from authorized, commercial product service providers.
Avoiding the payment of postage by misusing a postage evidencing system
is punishable by law.

1.2  Product Service Provider Responsibilities

    Postal security devices (PSDs) remain the property of the USPS-
authorized product service provider and are available only through a
lease agreement with the provider. The software component of these
postage evidencing systems is licensed to the registered user by the
provider. The Postal Service holds providers responsible for the
control, operation, distribution, maintenance, and replacement of the
PSD throughout the entire life cycle of the PSD. The provider is also
responsible for the secure disposal or destruction of the PSD at the
end of its useful life.

1.3  Product Service Providers

    Postage evidencing systems that generate IBI are available from
authorized providers. The following providers have been approved as of
September 2000:
E-Stamp Corporation, 2051 Stierlin Court, Mountain View, CA 94043-
4655, www.estamp.com
Neopost Online, 3400 Bridge Parkway, Suite 201, Redwood City, CA
94065-1168, www.neopostonline.com
Pitney Bowes, Inc., 40 Lindeman Drive, Trumbull, CT 06611-4785,
www.pitneybowes.com/soho/
Stamps.com, 3420 Ocean Park Boulevard, Suite 1040, Santa Monica, CA
90405-3035, www.stamps.com

1.4  Possession

    No one other than an authorized product service provider may
possess or use a PSD without a valid USPS-issued postage evidencing
system user registration and a valid lease agreement with the provider.
Any person in possession of a PSD without meeting these conditions must
immediately surrender it to the provider or to the USPS.

[[Page 58684]]

1.5  Classes of Mail

    Information-based indicia (IBI) produced by an authorized postage
evidencing system may be used to indicate postage for single-piece rate
First-Class Mail (including Priority Mail), single-piece rate
International Mail, and single-piece rate Standard Mail (B); also
Express Mail, Express Mail Military Service, Express Mail International
Service, Global Priority Mail, and Priority Mail Global Guaranteed. The
indicia can be used to pay for special services. Mail prepared using
such a system is entitled to all privileges and subject to all
conditions that apply to the various mail classes and services.

1.6  Amount of Postage

    The value of the indicia affixed to each mailpiece must equal or
exceed the exact amount due for the piece when mailed. Refunds for
overpayment must meet the standards in P014.

1.7  Reply Postage

    A postage evidencing system that generates IBI may be used to
prepare prepaid reply postage for the following domestic mail classes:
All single-piece rate First-Class Mail (including Priority Mail),
Standard Mail (B), and Express Mail. The prepaid reply mail must meet
the following conditions:
    a. The postage amount in the indicium must be enough to prepay the
postage in full.
    b. Indicium showing postage evidencing may be printed directly on
the mailpiece or on a label and must be applied to a mailpiece in
accordance with the directions in 4.4. An applied label must adhere
well enough that it cannot be removed in one piece.
    c. The mailpiece must be pre-addressed for return to the registered
user.
    d. If the postage evidencing system used to prepare the return
postage indicium has the capability to print destination addresses for
the given size and class of mailpiece, the address for returning the
mailpiece to the registered user must be prepared using that system.
    e. For those postage evidencing systems without the capability to
print an address for the given class or size of mailpiece, the address
side of reply mail may be prepared by any photographic, mechanical, or
electronic process or combination of such processes (other than
handwriting, typewriting, or hand stamping).
    f. The address side of the mailpiece must follow the style and
content of the example below. Nothing may be added except a return
address and facing identification mark (FIM).
    g. If the reply mailpiece is letter-sized First-Class Mail, a FIM D
is required when the indicium for reply postage is printed directly on
the mailpiece.
    h. Prepaid reply mail is delivered only to the address of the
registered user. If the address is altered, the mail is held for
postage.
    i. IBI used to prepay reply postage must show the date the indicium
was printed by the registered user, and must include the words ``REPLY
POSTAGE''.
[GRAPHIC] [TIFF OMITTED] TP02OC00.004

2.0  USER REGISTRATION

2.1  Procedures

    The user must register with the Postal Service before using a
postage evidencing system that generates IBI. An applicant must apply
for a user registration through the provider and submit to the provider
all data required for a registration to lease and use postage
evidencing systems. The application must show the post office where the
applicant intends to deposit the mail. This is called the registration
post office. An application for a user registration is processed
through the Centralized Registration System (CRS), formerly the
Centralized Meter Licensing System. The provider electronically
transmits the required information to CRS in the USPS-specified format.
There is no fee for the application or user registration. After
approving an application, the Postal Service issues a postage
evidencing system user registration, and notifies the appropriate
provider. A single user registration covers all postage evidencing
systems for the same applicant for the same post office, but a separate
application must be submitted for each post office where the applicant
intends to deposit mail. A single PSD can be registered to only one
post office at any one time; it must be reauthorized by the provider
for use at a different post office.

2.2  Registered User's Agreement

    By submitting an application for a user registration, the applicant
agrees that the registration may be revoked immediately and that the
postage evidencing system may be withdrawn

[[Page 58685]]

from service by the provider or the USPS for the following reasons:
    a. The postage evidencing system is used in any fraudulent or
unlawful scheme or enterprise.
    b. The postage evidencing system is not used for 12 consecutive
months.
    c. The registered user fails to exercise sufficient control of the
postage evidencing system or fails to comply with the standards for
system care or use.
    d. The postage evidencing system is used outside the United States,
its territories or its possessions, except as specifically authorized
by these regulations or by the manager of Postage Technology
Management, USPS Headquarters.
    e. IBI mail is deposited at other than the registration post office
(except as permitted under 5.0 or D072).
    f. The registered user fails to forward mailpieces to the provider
for quality assurance as required in 2.6.h.

2.3  Refusal to Register a User

    The Postal Service notifies both the applicant and the provider
when an application for user registration is refused. The notification
is in writing and is sent certified mail, return receipt requested. Any
applicant refused a user registration may appeal the decision under
2.5. The Postal Service may refuse to register a user for the following
reasons:
    a. The applicant submitted false information on the user
registration application.
    b. The applicant violated any standard for the care or use of a
PSD, postage evidencing system, information-based indicia, or postage
meter that resulted in the revocation of that applicant's user
registration or postage meter license within 5 years preceding
submission of the application.
    c. There is sufficient reason to believe that the postage
evidencing system is to be used in violation of Postal Service
regulations.

2.4  Revocation of a User Registration

    The Postal Service notifies the registered user of any revocation.
The Postal Service also notifies the registered user's provider of the
revocation so that the provider can cancel the lease agreement and
withdraw the postage evidencing system from service. The notification
is in writing and is sent certified mail, return receipt requested.
Revocation takes effect 10 calendar days after the registered user
receives or refuses to receive the revocation notice unless, within
that time, the registered user appeals the decision under 2.5. A user
registration is subject to revocation for any of the following reasons:
    a. The postage evidencing system is used for any illegal scheme or
enterprise or there is probable cause to believe that the system is to
be used in violation of the applicable standards.
    b. The user registration does not have a postage evidencing system
applied against it or the registered user's postage evidencing system
has not been reset within the last 12 months.
    c. Sufficient control of the postage evidencing system is not
exercised or the standards for its care or use are not followed.
    d. The postage evidencing system is kept or used outside the
customs territory of the United States or those U.S. territories and
possessions where the Postal Service operates, except as specified in
2.11 or 2.12.
    e. IBI mail is deposited at other than the registration post office
(except as permitted under 5.0 or D072).
    f. The registered user fails to forward mailpieces to the provider
for quality assurance as required in 2.6.h.

2.5  Appeal Process

    An applicant who is refused a user registration, or a registered
user whose registration is revoked, may file a written appeal with the
manager of Postage Technology Management, USPS Headquarters, within 10
calendar days after receiving or refusing to receive notification of
the decision.

2.6  Registered User's Responsibilities

    The registered user's responsibilities for the care and use of a
postage evidencing system that generates IBI include the following:
    a. A PSD that is delivered to a registered user must remain in the
registered user's custody until it is returned to the authorized
provider, or to the Postal Service, or is removed by the U.S. Postal
Inspection Service.
    b. Some postage evidencing systems maintain a log file that
automatically records all transactions relating to indicia creation,
funds transfer (including postage value download), and postal security
device audits which is transmitted automatically to the provider by the
system with each connection. The registered user may not manipulate
these log files to reflect an inaccurate record of transactions or
prevent the transmission of these log files to the provider.
    c. The registered user must, upon request, make immediately
available for review and audit by the provider or by the Postal Service
any PSD in the user's custody and the corresponding transaction
records.
    d. The registered user must reset the PSD at least once every 3
months to meet provider audit and examination requirements. A zero
value reset will meet this requirement.
    e. The registered user must update information with the provider
whenever there is any change in the user's name, address, telephone
number, location of the PSD, registration post office, or any other
required user registration information. The Postal Service will issue a
revised user registration based on the transmission of updated
information from the provider.
    f. The registered user must report a misregistering or otherwise
defective PSD to the provider under 2.8, and must ensure that the
defective PSD is not used. Anyone in possession of a misregistering or
otherwise defective PSD must return it to the provider within 3
business days.
    g. For postage evidencing systems that generate IBI and access the
USPS Address Management System (AMS) CD-ROM, the registered user must
maintain address quality by ensuring the CD-ROM is updated at least
once every 6 months.
    h. The registered user must forward a mailpiece with an indicium
produced by the postage evidencing system to the provider for quality
assurance when the system is installed and at least once every 6 months
thereafter, in accordance with provider directions.
    i. The registered user must enter into a signed lease agreement
with the provider that includes a financial agreement for resetting the
PSD with postage and the Postage Payment Agreement. The Postal Service
is not a party to the lease agreement, except to the extent that it may
enforce the Postage Payment Agreement.
    j. The registered user must ensure that the cautionary information
placed by the provider in system documentation, on the opening screens
at system start-up, or on labels attached to the PSD or its housing, is
not removed or destroyed while the postage evidencing system is in the
registered user's possession. The cautionary information contains basic
reminders on ownership and use of the PSD, warnings against system
tampering or misuse resulting in non-payment of postage owed, and the
penalties for such system misuse. Postage evidencing systems without
this cautionary information shall not be authorized for use.

2.7  Custody of Suspect PSDs

    The Postal Service may conduct unannounced, on-site examinations of
PSDs reasonably suspected of being manipulated or otherwise defective.
A

[[Page 58686]]

postal inspector also may immediately withdraw a suspect PSD from
service for physical and/or laboratory examination. The inspector
withdrawing a suspect PSD issues the registered user a receipt for the
PSD; forwards a copy to the provider; and, if necessary, assists in
obtaining a replacement PSD. Where possible, the Inspection Service
gives advance notice to the provider that a PSD is to be inspected.
Unless there is reason to believe that the PSD is fraudulently set with
postage, existing postage in the PSD is refunded to the registered
user, in accordance with established refund procedures, when it is
withdrawn from service.

2.8  Defective PSD

    The registered user must immediately report any defective PSD to
the provider. The provider must retrieve any defective PSD in a user's
possession within 3 business days of notification by the registered
user, and must notify the manager of Postage Technology Management,
USPS Headquarters, immediately. A faulty PSD may not be used under any
circumstance. The provider supplies the registered user with a
replacement PSD only if the faulty PSD is in the provider's possession.

2.9  Missing PSD

    The registered user must immediately report to the provider the
loss or theft of any PSD or the recovery of any missing PSD. Reports
must include the postal security device identification number of the
PSD; the date, location, and details of the loss, theft, or recovery;
and a copy of any police report. The provider will report all details
of the incident to the manager of Postage Technology Management, USPS
Headquarters.

2.10  Returning a PSD

    A registered user in possession of a faulty or misregistering PSD,
or who no longer wants to keep a PSD, must return the PSD to the
provider to be withdrawn from service. PSDs must be shipped by Priority
Mail unless the manager of Postage Technology Management, USPS
Headquarters, gives written permission to ship at another rate or
special service.

2.11  Approval for Use of Postage Evidencing Systems at Military
Post Offices

    A person authorized by the Department of Defense to use the
services of an overseas military post office, such as an APO or FPO, is
allowed to use a USPS-approved postage evidencing system that generates
IBI in accordance with the same regulations that apply to domestic
users. For such users, the APO or FPO will be designated as the
registration post office on their user registration. These users must
deposit the mail prepared with their system at the registration post
office.

2.12  Approval for Use of Postage Evidencing Systems Outside the
Country

    Under certain conditions, with specific approval from the manager
of Postage Technology Management, USPS Headquarters, registered users
(other than those with access to an overseas military post office) may
use postage evidencing systems that generate IBI outside the customs
territory of the United States to print evidence of U.S. postage. The
procedures and conditions are as follows:
    a. The potential users must maintain a permanent, established
business address in the United States. Any exceptions must be
specifically approved in writing by the manager of Postage Technology
Management, USPS Headquarters (see G043).
    b. All registered users who use a USPS-approved postage evidencing
system outside the customs territory of the United States are subject
to all Postal Service regulations and U.S. statutes pertaining to mail,
mail fraud, and misuse of postage evidencing systems.
    c. All postage evidencing systems authorized by the USPS for use in
foreign locations must have enhanced security features. Only those
systems specifically approved in writing by the manager of Postage
Technology Management, USPS Headquarters, may be used outside the
customs territory of the U.S.
    d. Potential users must submit all data required for the
application for a registration to lease and use postage evidencing
systems to the provider. The provider will annotate the application to
state that it is for the foreign use of a U.S. postage evidencing
system and show where the system is to be located. The provider must
submit the application to the manager of Postage Technology Management,
USPS Headquarters, for review and approval. Once an application is
approved, Postage Technology Management will designate the registration
post office and notify the provider and the registered user. Multiple
foreign postage evidencing systems for the same registered user at the
same registration post office may be covered by one foreign user
registration. Mailers who currently have a user registration must apply
for a separate foreign user registration to participate in this
program.
    e. The provider selected by the registered user must agree in
writing to all terms and conditions established by the Postal Service
pertaining to the distribution of U.S. postage evidencing systems
outside of the United States.
    Once the postage evidencing system is installed, the provider must
provide the information required for Form 3601-C, Postage Evidencing
System Activity Report, and submit it directly to the manager of
Postage Technology Management, USPS Headquarters (see G043).
    f. Mail to which an IBI is applied as postage evidencing must use
domestic U.S. postage and must be entered at the registration post
office.
3.0  SETTING

3.1  Initialization and Authorization of the PSD

    Before the registered user can print evidence of postage, the PSD
must be initialized and authorized by the provider. The initialization
process installs PSD-specific information that does not change over the
life cycle of the PSD. The authorization process is the setting of
user-specific information. The PSD is reauthorized by the provider when
certain user-specific information changes. Settings are made in
accordance with the provisions of the USPS Electronic Funds Resetting
System (EFRS).

3.2  Relocation of Registered User

    If a registered user changes the post office at which IBI mail is
to be deposited, the provider must reauthorize the PSD for the new
registration post office. The user must notify the provider and must be
registered at the new registration post office before the provider can
reauthorize the PSD.

3.3  Payment for Postage

    The Postal Service will accept payment only in the following forms:
Automated Clearinghouse (ACH) debit and credit card.

3.4  Resetting

    To reset a PSD the following conditions must be met:
    a. The registered user shall initiate payment to the Postal Service
sufficient to cover the desired postage increment before requesting a
postage value download to reset the PSD.
    b. As part of the resetting procedure, the registered user must
provide identifying information and PSD audit data as required by the
Postal Service and in accordance with the provider's

[[Page 58687]]

resetting specifications. Before completing the PSD resetting, the
provider must verify the identifying data, authenticate the registered
user, conduct the postage evidencing system audit, and ascertain
whether payment to the Postal Service sufficient to cover the requested
postage value download was initiated by the registered user.
    c. The provider will supply the registered user with documentation
of the reset transaction and the balance on the PSD.

3.5  Postage Refunds

    The Postal Service provides refunds for the entire postage value
balance remaining on a PSD that is withdrawn from service and is in the
possession of the provider. Refunds are requested and paid through the
provider. Refunds for postage already printed onto an envelope or label
are made in accordance with P014. Postage losses due to malfunctions
are the responsibility of the provider.

3.6  Postage Adjustment for Faulty or Misregistering PSD

    If the registered user requests a postage adjustment for a faulty
or misregistering PSD, then the PSD must be withdrawn from service and
must be in the possession of the provider for examination. The provider
will examine the PSD in comparison with the data from the registered
user's log files. After examining a PSD withdrawn from service for
apparent faulty operation affecting the ascending or descending
registers, the provider must report the malfunction to the manager of
Postage Technology Management, USPS Headquarters. The report must
contain all applicable documentation (including a copy of the
registered user's log files) and a recommendation for the appropriate
postage adjustment. At the same time the report is made to the Postal
Service, the provider must notify the registered user of the proposed
postage adjustment. A registered user may appeal a postage adjustment
to the manager of Postage Technology Management, USPS Headquarters,
within 60 calendar days of the date that the provider submitted the
postage adjustment recommendation to the Postal Service.

3.7  Periodic Examinations

    The registered user must reset the PSD at least once every 3
months. A zero-value reset meets this requirement. The Postal Service
reserves the right to examine PSDs by remote access or otherwise.

3.8  Amount of Postage Available

    The descending register of the PSD, which shows the amount of
postage remaining, is programmed not to exceed a specified amount
established by the Postal Service, for a given registered user at any
time.
4.0  INDICIA

4.1  Designs

    The indicia designs (types, sizes, and styles) must be those that
the provider specified when the postage evidencing system was approved
by the Postal Service for production and distribution (see Exhibit
4.1).
    [Exhibit 4.1, which shows all approved indicia designs, will be
included when these regulations are published in final form in the
Domestic Mail Manual.]
* * * * *

4.2  Legibility

    The indicia must be legible. Illegible indicia are not acceptable
for the payment of postage. Should there be a need to place multiple
indicia on an envelope (e.g., for redate and/or postage correction) the
indicia must not overlap each other. The address and POSTNET barcode
must meet the specifications listed in C840. Reflectance measurements
of the indicia and the background material must meet the standards in
C840.5.

4.3  On an Adhesive Label

    A label used to apply information-based indicia to a mailpiece for
postage evidencing must be approved by the manager of Postage
Technology Management, USPS Headquarters. Failure to use a USPS-
approved label may result in revocation of the user registration for
the postage evidencing system. The label must meet the following
requirements:
    a. The label must be a pressure-sensitive, permanent label. The
label is subject to the corresponding standards in C810.6.2 for minimum
peel adhesion. The applied label must adhere well enough that it cannot
be removed in one piece. A face stock/liner, or ``sandwich,'' label
must not be used for printing information-based indicia.
    b. The label must meet the reflectance requirements in C840.5.0.
    c. The label must be large enough to contain the entire
information-based indicia.
    d. Information-based indicia printed on a label must be the same as
the indicia approved by the manager of Postage Technology Management
for printing directly on an envelope. The label must not include any
image or text other than that required by the IBI performance criteria
or as required or recommended by Postal Service regulation.
    e. For labels applied to standard letter-sized envelopes and
postcards sent as First-Class Mail, the label must have fluorescent
striping that meets the following requirements:
    (1) A stripe along the right side (leading edge) of the label that
is \1/4\ inch wide and extends a minimum of \1/2\ inch and a maximum of
1\1/2\ inches from the top of the label.
    (2) A stripe along the top edge of the label that is \1/4\ inch
wide and extends a minimum of \1/2\ inch and a maximum of 1\1/2\ inches
from the right edge of the label.
    (3) All stripes must have a minimum fluorescent emission intensity
of at least 20 phosphor meter units (PMU), with a maximum of 70 PMU.
The visible color of the fluorescent tagging may be any color that
meets the fluorescence requirements.
    (4) The fluorescent tagging shall exhibit no noticeable change
(i.e., no more than 10 percent) in its emission when exposed to
elevated temperature and/or high humidity conditions.
    f. The label must be placed on the envelope such that the position
of the indicia meets the requirements in 4.4.
    g. If the label is applied to an envelope that already has a FIM,
then the existing FIM cannot be covered by the label.

4.4  Position

    The indicia must be printed or applied in the upper right corner of
the envelope. The indicia must be at least \1/4\ inch from the right
edge of the mailpiece and \1/4\ inch from the top edge of the
mailpiece. The barcode in the indicia must be horizontally oriented. If
a FIM is printed with the indicia, the position of the FIM must meet
the requirements in C100.5.0. The indicia must not infringe on the
areas reserved for the FIM, POSTNET barcode, or optical character
reader (OCR) clear zone.

4.5  Content and Format

    The boundaries of the indicium are defined by the right-hand edge
of the envelope, the top edge of the envelope, the bottom edge of the
two-dimensional barcode or any indicium element below the barcode, and
the left-most edge of the two-dimensional barcode or any indicium
element to the left of the barcode. A \1/2\ inch clear zone, within
which nothing shall be printed by the postage evidencing system, must
surround the indicium boundaries to

[[Page 58688]]

the left of and below all elements of the indicium.
    The manager of Postage Technology Management, USPS Headquarters,
must approve the contents and format of all indicia that will be
produced by a postage evidencing system. This approval shall include
all elements in the indicium required by the IBI performance criteria
and/or Postal Service regulations and applies to the entire area within
the indicium boundaries. The USPS-approved indicia supplied by the
provider consist of human-readable information and two-dimensional
barcoded information. For the contents of indicia used for prepaid
reply mail, see 1.7; for the contents of redate indicia, see 4.8; and
for the contents of postage correction indicia, see 4.9. The contents
of other indicia is as follows:
    a. Unless otherwise approved by the manager of Postage Technology
Management, USPS Headquarters, the required human-readable information
must show, at a minimum, the city, state, and 5-digit ZIP Code of the
registration post office; the postal security device ID; date of
mailing; endorsement or mail class; the words ``US Postage''; and the
postage amount. The Arial font must be used for this information. The
postage amount must use at least 10-point type size. For all other
required information, the type size must be at least 8 points. The mail
class or endorsement, the postage amount, and the words ``US Postage''
must be in bold type and all letters must be capital letters. The
remaining required information (city, state and 5-digit ZIP Code, the
date, and the postal security device ID) need not be capitalized or
bold. The type size used for all other information printed in the
indicia must be no greater than 8 points and must not be in bold type.
    b. As an alternative to the city, state, and 5-digit ZIP Code of
the registration post office, the indicia may show the ZIP Code rather
than the city and state designation. In this case, the words ``Mailed
From ZIP Code'' and the ZIP Code of the registration post office may
appear in place of the city and state, respectively.
    c. When it is necessary to print multiple indicia on a given
mailpiece, the human-readable information showing the registration post
office must be included in each.
    d. The requirements for the data elements of the two-dimensional
barcode are found in the performance criteria for the given postage
evidencing system.

4.6  Complete Date

    The month, day, and year must be shown in human-readable form in
the indicia. The year must be represented by four digits.

4.7  Date Accuracy

    The date of mailing in the indicium must be the actual date of
deposit, except that mail deposited in a collection box after the day's
last scheduled collection may bear the actual date of deposit or the
date of the next scheduled collection.
    If the registered user knows the mail will not be tendered to the
Postal Service on the date of mailing shown in the indicium, the user
should use a date correction indicium (see 4.8) or have the postage
evidencing system advance the date and print the intended date of
deposit in the indicium.

4.8  Date Correction

    If date correction is required, indicia showing only the actual
date of mailing and the word ``REDATE'' instead of the postage amount
shall be used. On letter-sized mail, date correction indicia must be
placed on the nonaddress side at least \3/4\ inch from the bottom edge
of the mailpiece and not on an envelope flap. On flats or parcels, it
must be placed next to the original indicium. Date correction indicia
must not include the FIM or the two-dimensional barcode. The redate
indicium may be printed on a USPS-approved label instead of directly on
the mailpiece.

4.9  Postage Correction

    Indicia for additional postage may be placed on a shortpaid
mailpiece to correct postage. On letter-size mail, correction indicia
must be printed on the nonaddress side at least \3/4\ inch from the
bottom edge of the mailpiece and not on an envelope flap. On flats or
parcels, it must be placed next to the original indicium. The postage
correction indicium must contain all of the elements required for the
indicium in 4.5 except for the destination delivery point. The word
``CORRECTION'' must be added to the human readable information. Postage
correction indicia must not include the FIM. To meet two-dimensional
barcode readability requirements, postage correction indicia may be
printed on a USPS-approved label instead of directly on the mailpiece.

4.10  Use of Indicia

    Valid information-based indicia produced by postage evidencing
systems shall be used only to show evidence of payment for postage or
postal services. In any illustration of information-based indicia, or
for any other non-postal use, the two-dimensional barcode shall be
rendered unreadable, for example by printing ``VOID'' or similar text
across the barcode.

4.11  Other Printed Matter

    An approved indicium shall include within its boundaries only
postal markings and text required or recommended by Postal Service
regulation, except that the indicium may identify the product service
provider. Other printed matter may be printed only outside the
boundaries of the clear zone (see 4.5) surrounding the indicium. Such
printed matter may not be obscene, defamatory of any person or group,
or deceptive, and it must not advocate any unlawful action.

4.12  Postal Markings

    Postal markings related to the mail class, subclass, or category of
mail are required in the indicia.

4.13  Facing Identification Mark (FIM)

    The facing identification mark (FIM) serves to orient and separate
certain types of First-Class Mail during the facing and canceling
process. Letter-sized First-Class Mail with the IBI printed directly on
the envelope must bear a USPS-approved FIM D unless it is courtesy
reply mail. The FIM must meet the dimensions, print quality, and
placement specified in the C100.5.
5.0  MAILINGS

5.1  Preparation of IBI Mail

    Mail is subject to the preparation standards that apply to the
class of mail and rate claimed.

5.2  Where to Deposit

    Single-piece rate First-Class Mail (including Priority Mail),
Standard Mail (B), and expedited mail may be deposited in any street
collection box or other place where mail is accepted and that is served
by the registration post office. International mail weighing less than
16 ounces may be deposited in any street collection box in accordance
with the regulations for domestic mail. Limited quantities (i.e., a
handful) of single-piece rate First-Class Mail including Priority Mail,
expedited mail, and international mail may be deposited at offices
other than the registration post office to expedite dispatch, with the
following exceptions:
    a. Certain Special Postal Services require that the mail be
presented directly to a Postal Service employee (see S900).
    b. A registered user authorized to use an APO or FPO as the
registration post

[[Page 58689]]

office shall deposit mail only at the registration APO or FPO.
    c. All other registered users who have Postal Service approval to
use a postage evidencing system that generates IBI outside the country
shall deposit mail only at their domestic registration post office.
    d. International mail that requires a customs declaration, or that
weighs 16 ounces or over, must be given directly to a Postal Service
employee at the registration post office or other location designated
by the postmaster. Otherwise, the mail will be returned to the sender
for proper entry and acceptance. See the International Mail Manual for
additional information.
6.0 AUTHORIZATION TO PRODUCE AND DISTRIBUTE POSTAGE EVIDENCING SYSTEMS
THAT GENERATE INFORMATION-BASED INDICIA (IBI)
    Title 39, Code of Federal Regulations, part 502, contains
information concerning authorization to produce and distribute postage
evidencing systems that generate information-based indicia (IBI), the
suspension and revocation of such authorization; performance standards,
test plans, testing, and approval; required production security
measures; and standards for distribution and maintenance. Further
information may be obtained from the manager of Postage Technology
Management, USPS Headquarters.

List of Subjects in 39 CFR Part 502

    Administrative practice and procedure, Postal Service.
    Although exempt from the notice and comment requirements of the
Administrative Procedure Act (5 U.S.C. 553(b), (c)) regarding proposed
rulemaking by 39 U.S.C. 410(a), the Postal Service invites public
comments on the following proposed amendments to the Code of Federal
Regulations. For the reasons set out in this document, the Postal
Service proposes to add 39 CFR part 502 as follows:

PART 502--AUTHORITY TO PRODUCE AND DISTRIBUTE POSTAGE EVIDENCING
SYSTEMS THAT GENERATE INFORMATION--BASED INDICIA (IBI)

Sec.
502.1   Applicability of regulations.
502.2   Description of postage evidencing systems that generate
information-based indicia (IBI).
502.3   Definition and use of PC Postage trademark.
502.4   Product service provider qualifications.
502.5   Provider authorization.
502.6   Changes in ownership or control.
502.7   Burden of proof standard.
502.8   Suspension and revocation of authorization.
502.9   Information-based indicia program (IBIP) performance
criteria.
502.10   Product submission procedures and testing.
502.11   Security testing.
502.12   Postage evidencing system approval.
502.13   Conditions for approval.
502.14   Suspension and revocation of approval.
502.15   Reporting.
502.16   Administrative sanction on reporting.
502.17   Materials and workmanship.
502.18   Destruction of information-based indicia.
502.19   Inspection of new postage evidencing systems.
502.20   Distribution facilities.
502.21   Distribution controls.
502.22   Administrative sanction.
502.23   Postage evidencing system maintenance.
502.24   Access or changes to secure components.
502.25   Inspection of postal security devices (PSDs) in use.
502.26   PSDs not located.
502.27   Electronic Funds Resetting System (EFRS).
502.28   Indicia quality assurance.
502.29   Refunds for postage evidencing systems that generate
information-based indicia.
502.30   Registered user information.
502.31   Intellectual Property.

    Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 410,
2601, 2605; Inspector General Act of 1978, as amended (Pub. L. 95-
452, as amended), 5 U.S.C. App 3.

Sec. 502.1  Applicability of regulations.

    The regulations in this section apply to all postage evidencing
systems that print information-based indicia (IBI) to show payment of
postage.

Sec. 502.2  Description of postage evidencing systems that generate
information-based indicia (IBI).

    (a) Postage evidencing systems that generate IBI are secure systems
that print USPS-authorized, digitally-signed indicia as evidence of
payment of postage. Indicia consist of a USPS-approved two-dimensional
barcode and certain human-readable information. Authorized postage
evidencing systems are available from authorized, commercial product
service providers.
    (b) These postage evidencing systems include as a primary component
a postal security device (PSD) that performs core security functions
such as digital signature generation and verification, as well as the
management of postage registers. The component of these postage
evidencing systems that controls the registered user infrastructure for
system authorization, system audits, remote postage resetting, and
production of the indicia is called the client system. The PSD and the
client system interact to generate the indicia. The PSD is remotely set
with postage value and requires the user to initiate payment to the
Postal Service sufficient to cover the desired postage increment before
initial setting or resetting.

Sec. 502.3  Definition and use of PC Postage trademark.

    (a) ``PC Postage'' is the Postal Service trademark for Postal
Service-approved, secure, postage evidencing systems that generate
information-based indicia and allow registered users to purchase and
print postage using their personal computers and the Internet.
    (b) Use of the PC Postage trademark on USPS-approved postage
evidencing systems and other products must be specifically approved by
the manager of Postage Technology Management (PTM), USPS Headquarters.
The provider must sign a trademark licensing agreement with the Postal
Service for each product the Postal Service authorizes to use the PC
Postage trademark.

Sec. 502.4  Product service provider qualifications.

    For authorization from the Postal Service to produce and/or lease
PSDs and postage evidencing systems that generate information-based
indicia (IBI) for use by registered users under Domestic Mail Manual
P050, a potential provider must:
    (a) Satisfy the Postal Service of its integrity and fiscal
responsibility.
    (b) Obtain approval of at least one postage evidencing system
incorporating all the features and safeguards specified in Sec. 502.9,
in accordance with the procedures outlined in Sec. 502.10.
    (c) Have, or establish, and keep under its supervision and control
adequate production facilities suitable to carry out the provisions of
Secs. 502.17 through 502.19, to the satisfaction of the Postal Service.
The production facilities must be subject to unannounced inspection by
representatives of the Postal Service. If the production facilities are
established by the provider outside the customs territory of the United
States, the provider shall be responsible for all costs incurred by the
Postal Service to conduct the inspections.
    (d) Have, or establish, and keep under its supervision and control
adequate facilities for the control, distribution, and maintenance of
postage evidencing systems that generate IBI, and their

[[Page 58690]]

replacement or secure disposal or destruction when necessary.

Sec. 502.5  Provider authorization.

    An applicant meeting the qualifications in Sec. 502.4 may be
authorized in writing by the manager of Postage Technology Management,
USPS Headquarters, as a provider of postage evidencing systems that
generate IBI and will be allowed to lease authorized PSDs and systems
to users registered by the Postal Service. The written authorization
defines the conditions under which the postage evidencing system may be
marketed and distributed.

Sec. 502.6  Changes in ownership or control.

    Any person, entity, or concern wanting to acquire ownership or
control of a provider of an authorized postage evidencing system must
provide the Postal Service with satisfactory evidence of that person's,
entity's, or concern's integrity and financial responsibility.

Sec. 502.7  Burden of proof standard.

    The burden of proof is on the Postal Service in adjudications of
suspensions and revocations under Sec. 502.8 and Sec. 502.14 and
administrative sanctions under Sec. 502.16 and Sec. 502.22. Except as
otherwise indicated in those sections, the standard of proof shall be
the preponderance-of-evidence standard.

Sec. 502.8  Suspension and revocation of authorization.

    (a) The Postal Service may suspend and/or revoke authorization to
provide and/or distribute any or all of a provider's postage evidencing
systems if the provider engages in any unlawful scheme or enterprise,
fails to comply with any provision in this part 502, or fails to
implement instructions issued in accordance with any final decision
issued by the Postal Service within its authority over the IBI program.
    (b) The decision to suspend or revoke a provider's authorization
shall be based on the nature and circumstances of the violation (e.g.,
whether the violation was willful, whether the provider voluntarily
admitted to the violation, whether the provider cooperated with the
Postal Service, or whether the provider implemented successful remedial
measures) and on the provider's performance history. Before determining
whether a provider's authorization to produce and/or distribute postage
evidencing systems should be revoked, the procedures in paragraph (c)
of this section shall be followed.
    (c) Suspension in all cases shall be as follows:
    (1) Upon determination by the Postal Service that a provider is in
violation of the provisions in this part 502, the Postal Service shall
issue a written notice of proposed suspension citing deficiencies for
which suspension of authorization to produce and/or distribute a
specific postage evidencing system, or a family of system models, may
be imposed under paragraph (c)(2) of this section. The notification is
in writing and is sent certified mail, return receipt requested. Except
in cases of willful violation, the provider shall be given an
opportunity to correct deficiencies and achieve compliance with all
requirements within a time limit, determined by the Postal Service,
corresponding to the potential risk to postal revenue.
    (2) In cases of willful violation, or if the Postal Service
determines that the provider has failed to correct cited deficiencies
within the specified time limit, the Postal Service shall issue a
written notice setting forth the facts and reasons for the decision to
suspend and the effective date if a written defense is not presented as
provided in paragraph (d) of this section. The notification is in
writing and is sent certified mail, return receipt requested.
    (3) If, upon consideration of the defense as provided in paragraph
(e) of this section, the Postal Service deems that the suspension is
warranted, the suspension shall remain in effect for up to 90 days
unless withdrawn by the Postal Service, as provided in paragraph
(c)(4)(iii) of this section.
    (4) At the end of the 90-day suspension, the Postal Service may:
    (i) Extend the suspension to allow more time for investigation or
to allow the provider to correct the problem;
    (ii) Make a determination to revoke authorization to provide and/or
distribute the provider's postage evidencing systems that generate IBI
in part or in whole; or
    (iii) Withdraw the suspension based on identification and
implementation of a satisfactory solution to the problem. Provider
suspensions may be withdrawn before the end of the 90-day period if the
Postal Service determines that the provider's solution and
implementation are satisfactory.
    (d) The provider may present the Postal Service with a written
defense to any suspension or revocation determination within 30
calendar days after receiving or refusing to receive the written
notice, unless a shorter period is deemed necessary. The defense must
include all supporting evidence and specify the reasons for which the
order should not be imposed.
    (e) After receipt and consideration of the defense, the Postal
Service shall advise the provider of the decision and the facts and
reasons for it. The decision shall be effective on receipt unless it
provides otherwise. The decision shall also advise the provider that it
may appeal that determination within 30 calendar days after the
provider receives or refuses to receive written notification of the
decision, unless a shorter period is deemed necessary, as specified
therein. The appeal must include all supporting evidence and specify
the reasons the provider believes that the decision is erroneous.
    (f) An order or final decision under this section does not preclude
any other criminal or civil statutory, common law, or administrative
remedy that is available by law to the Postal Service, the United
States, or any other person or concern.

Sec. 502.9  Information-based indicia program (IBIP) performance
criteria.

    (a) The performance criteria applicable to the given postage
evidencing system relate to the data contents and format of the
indicia, the PSD (which implements digital signature technology for the
creation and verification of digital signatures), the client system
(which supports the creation of the indicia and the interface with the
PSD and the provider), and cryptographic key management.
    (b) The information-based indicia program (IBIP) performance
criteria describe required system elements that include the provider
infrastructure and the registered user infrastructure, and their
interface to the Postal Service infrastructure. The Postal Service
infrastructure supports user registration, postage evidencing system
audit, postage resetting, total population management, key management
support, financial reconciliation, PSD life cycle tracking, lost and
stolen/irregularity management functions and other reporting. The
provider infrastructure will support all IBIP functions. The registered
user infrastructure will consist of the PSD and a client system. The
Postal Service will evaluate and test postage evidencing systems for
compliance with this infrastructure. Contact the manager of Postage
Technology Management, USPS Headquarters for these criteria.

Sec. 502.10  Product submission procedures and testing.

    (a) Each postage evidencing system that generates IBI is submitted
for Postal Service approval and will be tested and evaluated in
accordance with the requirements and provisions of the most

[[Page 58691]]

current postage evidencing product submission procedures. Particular
attention must be given to the requirement to submit identical postage
evidencing systems simultaneously to the Postal Service and to a
laboratory accredited under the National Voluntary Laboratory
Accreditation Program (NVLAP) for FIPS 140-1 certification. Contact the
manager of Postage Technology Management, USPS Headquarters for these
requirements. Information pertaining to these procedures may be
accessed through the USPS website.
    (b) The indicia design must be approved by the manager of Postage
Technology Management, USPS Headquarters, and must comply with the
requirements in the Domestic Mail Manual and the applicable IBI
performance criteria.
    (c) Any change to an approved postage evidencing system must be
submitted to the Postal Service for evaluation in accordance with the
most current postage evidencing product submission procedures.
    (d) Where complete evaluation of all security-related components of
a postage evidencing system requires USPS review of data located
outside the customs territory of the United States, the provider shall
be responsible for all costs incurred by the USPS in conducting that
review.

Sec. 502.11  Security testing.

    The Postal Service reserves the right to require or conduct
additional examination and testing at any time, without cause, of any
postage evidencing system submitted to the Postal Service for approval
or previously approved by the Postal Service for production and
distribution.

Sec. 502.12  Postage evidencing system approval.

    As provided in Sec. 502.15, the provider has a duty to report
security weaknesses to the Postal Service to ensure that every postage
evidencing system in service protects the Postal Service against loss
of revenue at all times. An approval of a system does not constitute an
irrevocable determination that the Postal Service is satisfied with its
revenue-protection capabilities and all other features of the system.
After approval is granted to produce and distribute a postage
evidencing system, no change affecting the features or safeguards may
be made except as authorized or required by the Postal Service in
writing.

Sec. 502.13  Conditions for approval.

    (a) The Postal Service may require, and reserves future rights to
require, that production models of approved postage evidencing systems,
as well as the current design documentation, user manuals, and
specifications applicable to such systems and any revisions thereof, be
submitted to the manager of Postage Technology Management, USPS
Headquarters.
    (b) Upon request by the Postal Service, additional postage
evidencing systems must be submitted to the Postal Service for testing,
at the expense of the provider.

Sec. 502.14  Suspension and revocation of approval.

    (a) The Postal Service may suspend approval of a postage evidencing
system under Sec. 502.12 if the Postal Service has probable cause to
believe that the postage evidencing system or the family of system
models poses an unacceptable risk to postal revenue. Suspension of
approval to produce or distribute a postage evidencing system or a
family of system models, in whole or in part, shall be based on the
potential risk to postal revenue. Before determining whether approval
of a postage evidencing system or a family of system models, should be
revoked, the procedures in paragraph (b) of this section shall be
followed.
    (b) Suspension procedures:
    (1) Upon determination by the Postal Service that a postage
evidencing system poses an unacceptable risk to postal revenue, the
Postal Service shall issue a written notice of proposed suspension
citing deficiencies for which suspension may be imposed under paragraph
(b)(2) of this section. The notification is in writing and is sent
certified mail, return receipt requested. The provider shall be given
an opportunity to correct deficiencies and achieve compliance with all
requirements within a time limit determined by the Postal Service,
corresponding to the potential risk to postal revenue.
    (2) If the Postal Service determines that the provider has failed
to correct cited deficiencies within the USPS-specified time limit, the
Postal Service shall issue a written notice setting forth the facts and
reasons for the decision to suspend and the effective date if a written
defense is not presented as provided in paragraph (c) of this section.
The notification is in writing and is sent certified mail, return
receipt requested.
    (3) If, upon consideration of the defense as provided in paragraph
(d) of this section, the Postal Service deems that the suspension is
warranted, the suspension shall remain in effect for up to 90 days
unless withdrawn by the Postal Service, as provided in paragraph
(b)(4)(iii) of this section.
    (4) At the end of the 90-day suspension, the Postal Service may:
    (i) Extend the suspension to allow more time for investigation or
to allow the provider to correct the problem;
    (ii) Make a determination to revoke the approval of the provider's
postage evidencing system or family of system models, or
    (iii) Withdraw the suspension based on identification and
implementation of a satisfactory solution to the problem. Provider
suspensions may be withdrawn before the end of the 90-day period if the
Postal Service determines that the provider's solution and
implementation are satisfactory.
    (c) The provider may present the Postal Service with a written
defense to any suspension or revocation determination within 30
calendar days after receiving or refusing to receive notice, unless a
shorter period is deemed necessary. The defense must include all
supporting evidence and specify the reasons for which the order should
not be imposed.
    (d) After receipt and consideration of the written defense, the
Postal Service shall advise the provider of the decision and the facts
and reasons for it. The decision shall be effective on receipt unless
it states otherwise. The decision shall also advise the provider that
it may appeal that determination within 30 calendar days after the
provider receives or refuses to receive written notice, unless a
shorter period is deemed necessary, as specified therein. The appeal
must include all supporting evidence and specify the reasons that the
provider believes that the decision is erroneous.
    (e) An order or final decision under this section does not preclude
any other criminal or civil statutory, common law, or administrative
remedy that is available by law to the Postal Service, the United
States, or any other person or concern.

Sec. 502.15  Reporting.

    (a) For purposes of this section, ``provider'' refers to an entity
authorized under Sec. 502.5 and its foreign or domestic affiliates,
subsidiaries, assigns, dealers, independent dealers, employees, and
parent corporations.
    (b) Each provider authorized under Sec. 502.5 must submit a
preliminary report to notify the Postal Service promptly (in no event
more than 21 calendar days of discovery) of the following:
    (1) All findings or results of any testing known to the provider
concerning the security or revenue

[[Page 58692]]

protection features, capabilities, or failings of any postage
evidencing system or PSD sold, leased, or distributed by the provider
that has been approved for sale, lease, or distribution by the Postal
Service or by any foreign postal administration; or have been submitted
for approval by the provider to the Postal Service or to a foreign
postal administration.
    (2) All potential security weaknesses or methods of system
tampering of the postage evidencing systems that the provider
distributes, of which the provider knows or should know, and the system
or model subject to each weakness or method. These potential security
weaknesses include, but are not limited to suspected equipment defects,
suspected abuse by a registered user or provider employee, suspected
security breaches of the Electronic Funds Resetting System,
cryptographic key compromises, occurrences outside normal performance,
or any repeatable deviation from normal postage evidencing system
performance (within the same model family and/or by the same registered
user).
    (c) Within 45 calendar days of the preliminary notification to the
Postal Service under Sec. 502.15(b), the provider must submit a written
report to the Postal Service. The report must include the
circumstances, proposed investigative procedure, and the anticipated
completion date of the investigation. The provider must also provide
periodic status reports to the Postal Service during subsequent
investigation and, on completion, must submit a summary of the
investigative findings.
    (d) The provider must establish and adhere to timely and efficient
procedures for internal reporting of potential security weaknesses. The
provider is required to submit a copy of internal reporting procedures
and instructions to the Postal Service for review.

Sec. 502.16  Administrative sanction on reporting.

    (a) Notwithstanding any act, admission, or omission by the Postal
Service, an authorized provider may be subject to an administrative
sanction for failing to comply with Sec. 502.15.
    (b) The Postal Service shall determine all costs and revenue losses
measured from the date that the provider knew, or should have known, of
a potential security weakness, including, but not limited to,
administrative and investigative costs and documented revenue losses
that result from any postage evidencing system for which the provider
failed to comply with any provision in Sec. 502.15. The provider shall
be responsible to the Postal Service for all such costs and losses (net
of any amount collected by the Postal Service from the registered
users) with interest when the Postal service issues a written notice to
the provider setting forth the facts and reasons on which the
determination to impose the sanction is based. The notification is in
writing and is sent certified mail, return receipt requested. The
notice shall advise the provider of the date that the action takes
effect if a written defense is not presented within 30 calendar days of
receipt of the notice.
    (c) The provider may present the Postal Service with a written
defense to the proposed action within 30 calendar days after receiving
or refusing to receive notification. The defense must include all
supporting evidence and specify the reasons for which the sanction
should not be imposed.
    (d) After receipt and consideration of the defense, the Postal
Service shall advise the provider of the decision and the facts and
reasons for it; the decision shall be effective on receipt unless it
states otherwise. The notification of the decision is in writing and is
sent certified mail, return receipt requested. The decision shall also
advise the provider that it may, within 30 calendar days of receiving
the decision, appeal that determination as specified therein.
    (e) The provider may submit a written appeal to the Postal Service
within 30 calendar days of receiving or refusing to receive
notification of the decision. The appeal must include all supporting
evidence and specify the reasons that the provider believes that the
administrative sanction was erroneously imposed. The submission of an
appeal stays the effectiveness of the sanction.
    (f) The imposition of an administrative sanction under this section
does not preclude any other criminal or civil statutory, common law, or
administrative remedy that is available by law to the Postal Service,
the United States, or any other person or concern.

Sec. 502.17  Materials and workmanship.

    All postage evidencing systems that generate IBI must continuously
maintain the quality in materials and workmanship of the production
model approved by the Postal Service.

Sec. 502.18  Destruction of information-based indicia.

    All indicia created in the process of testing the postage
evidencing system by the provider, or its agent, must be collected and
securely controlled or destroyed by the provider to prevent
unauthorized use.

Sec. 502.19  Inspection of new postage evidencing systems.

    The provider shall inspect all new postage evidencing systems that
generate IBI to ensure proper functioning of all operational
capabilities of each system before distribution.

Sec. 502.20  Distribution facilities.

    (a) An authorized provider must keep adequate facilities for and
records of the distribution, control, maintenance, replacement, and
disposal or destruction of all PSDs throughout their entire life cycle.
Recordkeeping is required for all PSDs, including newly produced PSDs,
active leased PSDs and inactive, unleased PSDs, as well as lost and
stolen PSDs. All such facilities and records are subject to inspection
by Postal Service representatives.
    (b) If the provider uses a third party to control, distribute,
maintain, replace, repair, or dispose of PSDs or postage evidencing
systems, all aspects of the arrangement between the parties must be
specifically authorized in writing by the manager of Postage Technology
Management, USPS Headquarters.
    (1) The third party relationship shall not compromise any security
element of the postage evidencing system. The functions of the third
party with respect to these systems are subject to the same scrutiny as
the functions of the provider.
    (2) Any authorized third party must keep adequate facilities for
and records of PSDs and postage evidencing systems in accordance with
the USPS-authorized arrangement with the provider. All such facilities
and records are subject to inspection by Postal Service
representatives, in so far as they are used to control, distribute,
store, maintain, replace, repair, or dispose of PSDs or postage
evidencing systems.
    (3) The Postal Service holds the provider fully responsible for any
deficiencies found in third party facilities, records, or procedures
and can require termination of the third party arrangement if
deficiencies are found.

Sec. 502.21  Distribution controls.

    Each authorized provider must do the following:
    (a) Hold title permanently to all PSDs that print U.S. postage,
except those purchased by the Postal Service.
    (b) On behalf of applicants, electronically transmit information
required to apply for a user registration to the designated Postal
Service central registration processing facility.

[[Page 58693]]

    (c) On behalf of users registered to use their postage evidencing
systems, forward to the Postal Service any changes to user registration
information when the user submits such changes to the provider. The
provider must follow authorized USPS procedures for moving the system
when a registered user changes the registration post office. The
provider must also notify the Postal Service following any event that
indicates the need to update registered user information, such as the
return of an invoice or the inability to communicate with the user.
    (d) Lease PSDs only to parties that have valid user registrations
issued by the Postal Service to use a postage evidencing system.
    (e) Unless otherwise authorized by the Postal Service, immediately
withdraw from service any PSD that the registered user no longer wants,
or that is to be removed from service for any other reason. The
provider shall retrieve any withdrawn PSD that is in the possession of
the registered user. All resetting requests for a withdrawn PSD must be
denied. The provider must keep in its possession for at least 1 year
from the date of withdrawal a copy of the information on the registered
user's PS Form 3601-C, Postage Evidencing System Activity Report.
    (f) Retrieve any misregistering, faulty, or defective PSD and
withdraw it from service within 3 business days of being notified by
the registered user of the defect. The provider must examine each PSD
withdrawn from service for apparent faulty operation affecting the
ascending or the descending register, or for other failure to record
its operations correctly and accurately. After examining the withdrawn
PSD, the provider must compile a written report explaining the
malfunction to the manager of Postage Technology Management, USPS
Headquarters. The report must include an explanation of the malfunction
that resulted in the faulty operation or other failure to record
operations correctly and accurately, all applicable system
documentation, including log files, and a recommendation for the
appropriate postage adjustment, if applicable. At the same time the
report is made to the Postal Service, the provider must notify the
registered user of the proposed postage adjustment. The provider may
supply the registered user with a replacement PSD only if the faulty
PSD is in the provider's possession.
    (g) Report promptly the loss or theft of any PSD, the recovery of
any PSD previously reported as lost or stolen, or the scrapping of any
PSD by the provider. The provider must notify the Postal Service by
completing a standardized Lost and Stolen Postage Evidencing System
Incident Report and filing it with the Postal Service by the tenth day
of the month following when a PSD is scrapped or the provider
determines the loss, theft, or recovery of a PSD. For lost or stolen
PSDs, the provider must complete all preliminary location activities
specified in Sec. 502.26 before including a given incident on this
report.
    (h) Provide to the Postal Service upon request an electronic file
or database of all postage evidencing systems in service, including the
PSD identification number, the registered user's name and address, the
date that the system was placed in service, and the ZIP Code of the
registration post office. This information is to be provided to the
Postal Service in USPS-specified format, at times to be determined by
the Postal Service.
    (i) Keep accurate records and reconcile differences between their
records and Postal Service databases.
    (j) Keep at provider's headquarters an electronic file or database
with a complete record of all PSDs produced, showing all movements of
each from the time that the PSD is produced until it is scrapped. The
records shall be organized by PSD identification number and shall
include the reading on the ascending register each time the PSD is
authorized for a new registered user or is withdrawn from service.
These records must be available for inspection by Postal Service
officials at any time during normal business hours. The record for each
PSD must be maintained for 3 years after the PSD is scrapped.
    (k) Submit other reports as required by the Postal Service.
    (l) Cancel a lease agreement with any lessee whose registration to
use a postage evidencing system is revoked by the Postal Service.
    (m) Promptly withdraw from service any PSD that the Postal Service
indicates should be withdrawn from service for revocation of user
registration or for any other reason, and retrieve the PSD if it is in
the possession of the registered user. When a user registration is
revoked, the provider must retrieve all PSDs in the possession of the
registered user and must withdraw from service all PSDs employed by the
registered user.
    (n) Take reasonable precautions in the transportation and storage
of PSDs to prevent use by unauthorized individuals. Providers must ship
all PSDs by Postal Service Priority Mail unless given written
permission by the Postal Service to use another method.
    (o) Communicate to all registered users of a postage evidencing
system the required cautionary statements that provide the registered
user with basic reminders that the postal security device is leased,
the actions needed on relocation of the postage evidencing system, and
warnings against system misuse.
    (1) The cautionary statements must be visually presented to the
registered user upon each start-up of the postage evidencing system.
The user must actively acknowledge the statements before proceeding
with system use. In addition, the statements shall be included
prominently in the user documentation provided with each system. PSDs
that are in the possession of a user shall include the cautionary
statements on a label attached to the PSD, to the housing of the PSD,
or to the postage evidencing system containing the PSD, if the physical
dimensions of the equipment will accommodate them. Postage evidencing
systems provided to registered users without this cautionary
information shall not be authorized for use.
    (2) In every presentation of the cautionary statements to the
registered user, the words shown below in capital letters should be
emphasized. If the cautionary statement can be placed on the PSD or
other equipment, it shall be placed in a conspicuous and highly visible
location. The minimum width of the text block containing the statement
should be 3.25 inches, and the minimum height should be 1.75 inches.
The statement shall read as follows:

POSTAL SERVICE NOTICE

LEASED POSTAGE EVIDENCING SYSTEM--NOT FOR SALE

PROPERTY OF [NAME OF PROVIDER]

    Use of this system is permissible only under a U.S. Postal
Service postage evidencing system user registration.
    Call [NAME OF PROVIDER] at phone number ### ###-#### to relocate
or return this Postage Evidencing System.
    WARNING! POSTAGE EVIDENCING SYSTEM TAMPERING OR MISUSE IS A
FEDERAL OFFENSE.
    IF YOU SUSPECT POSTAGE EVIDENCING SYSTEM TAMPERING, CALL
INSPECTOR GENERAL'S HOTLINE AT 1-800-654-8896 OR YOUR LOCAL POSTAL
INSPECTOR.
    REWARD UP TO $50,000 for information leading to the conviction
of any person who misuses a postage evidencing system resulting in
the Postal Service not receiving correct postage payments.
    (3) Exceptions to the formatting of required cautionary labeling
are determined on a case-by-case basis. The manager of Postage
Technology Management, USPS Headquarters, must

[[Page 58694]]

approve, in writing, any deviation from the standard labeling
requirements.

Sec. 502.22  Administrative sanction.

    The Postal Service holds providers responsible for the entire life
cycle of their postage evidencing systems, including control,
distribution, operation, maintenance, replacement, and secure disposal.
    (a) ``Postage evidencing system,'' for purposes of this section,
means any system that is produced by a provider authorized under
Sec. 502.5 that is not owned or leased by the Postal Service.
    (b) An authorized provider that, without just cause, fails to
conduct or perform adequately any of the controls required by
Sec. 502.21, to follow standardized lost and stolen incident reporting
in Sec. 502.26, or to conduct the inspections required by Sec. 502.25
in a timely fashion is subject to an administrative sanction based on
the investigative and administrative costs and documented revenue
losses (net of any amount collected by the Postal Service from the
registered user), with interest per occurrence measured from the date
on which the cost and/or loss occurred, as determined by the Postal
Service. Sanctions shall be based on the costs and revenue losses that
result from the provider's failure to comply with these requirements.
    (c) The Postal Service may impose an administrative sanction under
this section by issuing a written notice to the provider setting forth
the facts and reasons on which the determination to impose the sanction
is based. The notification is in writing and is sent certified mail,
return receipt requested. The Postal Service shall determine all costs
and losses. The notice shall advise the provider of the date that the
action shall take effect if a written defense is not presented within
30 calendar days of receipt of the notice.
    (d) The provider may present to the Postal Service a written
defense to the proposed action within 30 calendar days of receiving or
refusing to receive the notice. The defense must include all supporting
evidence and specify the reasons for which the sanction should not be
imposed.
    (e) After receipt and consideration of the written defense, the
Postal Service shall advise the provider of the decision and the facts
and reasons for it. The decision shall be effective on receipt unless
it states otherwise.
    (f) The provider may submit a written appeal of the decision within
30 calendar days of receiving or refusing to receive the decision,
addressed to the manager of Postage Technology Management, USPS
Headquarters. The appeal must include all supporting evidence and
specify the reasons that the provider believes that the administrative
sanction was erroneously imposed. The submission of an appeal stays the
effectiveness of the sanction.
    (g) The imposition of an administrative sanction under this section
does not preclude any other criminal or civil statutory, common law, or
administrative remedy that is available by law to the Postal Service,
the United States, or any other person or concern.

Sec. 502.23  Postage evidencing system maintenance.

    (a) The provider must keep its postage evidencing systems that
generate IBI in proper operating condition by maintaining or replacing
them when necessary or desirable to prevent electronic failure,
malfunction, expiration of the life of the battery for the clock or
timer, or mechanical breakdown.
    (b) The provider must provide the registered users with
modifications reflecting rate changes and must implement new rates as
of the effective date for the new rates established by the Postal
Service.

Sec. 502.24  Access or changes to secure components.

    Postage evidencing system maintenance involving access or changes
to secure components must be done only within a secure facility under
the provider's direct control and supervision. PSDs must be withdrawn
from service before any such maintenance is performed.

Sec. 502.25  Inspection of postal security devices (PSDs) in use.

    (a) The provider must conduct an audit of each PSD at least once
every 3 months in conjunction with the postage value resetting
requirements in Sec. 502.27. A zero-value reset will satisfy this
requirement. The PSD must have a lock-out feature that prevents use of
the system if an audit is not completed in accordance with this
regulation.
    (b) Postage evidencing systems that generate IBI, other than PC
Postage, shall be inspected by the provider every 2 years. Registered
user mail-in of indicia may substitute for the provider inspection,
with Postal Service approval. The provider shall inspect or sample PC
Postage products under special circumstances, as directed by the Postal
Service. The Postal Service examines postage evidencing systems when
warranted by special circumstances.

Sec. 502.26  PSDs not located.

    Upon learning that one or more of its PSDs in service cannot be
located, the provider must undertake reasonable and timely efforts to
locate the PSD by following a series of Postal Service-specified
actions designed to locate the PSDs. If these efforts are unsuccessful
and a PSD is determined to be lost or stolen, the provider must notify
the Postal Service in accordance with Sec. 502.21.
    (a) If a user registered to use a postage evidencing system cannot
be located, the provider must, at a minimum, complete the following
actions:
    (1) Call the registered user's last known telephone number.
    (2) Call directory assistance for the user's new telephone number.
    (3) Contact the registered user's local post office for current
change of address information.
    (4) Contact Postage Technology Management to verify the location of
the PSD and the registered user as currently maintained in Postal
Service records.
    (5) Contact the rental agency responsible for the property where
the registered user was located, if applicable.
    (6) Visit the registered user's last known address to see whether
the building superintendent or a neighbor knows the user's new address.
    (7) Mail a certified letter with return receipt to the registered
user at the last known address with the endorsement ``Forwarding and
Address Correction Requested''.
    (8) If new address information is obtained during these steps, any
missed or delinquent scheduled PSD audit must be completed immediately.
    (b) If a PSD is reported to be lost or stolen by the registered
user, the provider must, at a minimum, complete the following actions:
    (1) Discontinue postage value downloads to the lost or stolen PSD.
    (2) Ensure that the registered user has filed a police report for a
stolen PSD and that copies have been provided to the appropriate
Inspection Service Contraband Postage Identification Program (CPIP)
specialist.
    (3) Withhold issuance of a replacement PSD until the missing PSD
has been properly reported to the police and to the appropriate
Inspection Service CPIP specialist.
    (c) If the provider later learns that the PSD has been located and/
or recovered, the provider must take the following actions before
returning the PSD to service or allowing a postage value download:
    (1) Submit a new Lost and Stolen Postage Evidencing System Incident

[[Page 58695]]

Report that references the initial report and outlines the details of
how the PSD was recovered, in accordance with Sec. 502.21. The provider
is responsible for keeping records of these reports as submitted to the
Postal Service for a minimum of 3 years after submission.
    (2) Retrieve the recovered PSD from the registered user and examine
it for apparent faulty operation that could affect its ability to
record its operations correctly and result in a questionable accurate
registration.
    (3) Recommend a postage adjustment or refund, if appropriate.
    (4) Withdraw the PSD from service if a replacement PSD has been
supplied to the registered user or if there is an issue of questionable
accurate registration.
    (d) Any authorized provider that fails to comply with standardized
lost and stolen reporting procedures and instructions is subject to an
administrative sanction under Sec. 502.22, as determined by the Postal
Service.

Sec. 502.27  Electronic Funds Resetting System (EFRS).

    (a) Description. A remote resetting system permits registered users
to reset their PSDs at places of business and/or homes via modem or
network interface. The Electronic Funds Resetting System (EFRS) is the
Postal Service system that processes system resetting data for postage
value downloads submitted by providers of postage evidencing systems
that generate IBI. The Postal Service processes the data separately
from data processed under the Computerized Meter Resetting System
(CMRS), which is used for traditional postage meters.
    (b) Resetting a PSD. To reset a PSD, the registered user connects
to the provider and provides specified identifying data and PSD audit
data for the postage value download. Before proceeding with the
transaction, the provider must verify all the data, conduct the system
audit, and ascertain whether payment to the Postal Service sufficient
to cover the desired postage value download was initiated by the
registered user. If payment was initiated and the system audit was
successful, the provider may complete the postage value download.
    (c) Payment to the Postal Service.
    (1) The only acceptable methods used for postage payments for
postage evidencing systems that generate IBI are credit cards and
Automated Clearinghouse (ACH) debit. The providers must publicize these
payment options to all registered IBI users. When publicizing these
options, the provider must provide a clear and concise description of
each.
    (i) Credit Cards. The provider must offer the registered user the
option to use all of the credit cards approved for use by the Postal
Service for payment for postage. Each provider must receive
authorization from the Postal Service to offer credit card options to
registered users and must sign a vendor credit card pilot test
agreement, a legal agreement with the Postal Service on credit card
payment, which addresses security requirements, payment of transaction
costs, reconciliation requirements, and retrieval and chargeback
requests. The provider must use a certified credit card payment process
approved for use by the Postal Service's designated card processor. All
credit card transactions must be sent through the designated Postal
Service card processor, with each provider working as an agent with the
Postal Service as the merchant of record.
    (ii) ACH Debit. All ACH debit payments for postage must be
electronically transferred directly from the registered user's account
resident in a financial institution that is neither owned, nor
controlled, nor contracted, nor arranged for by a product service
provider or its affiliate. The funds must be transferred directly into
an account at a financial institution designated by the Postal Service.
    (2) A registered user is required to initiate payment to the Postal
Service sufficient to cover the desired postage value download
contemporaneously with a download being made. The details of this
payment requirement are covered in the Postage Payment Agreement.
    (3) Each provider is required to incorporate the Postage Payment
Agreement into its postage evidencing system lease agreement with each
registered user, as follows:

POSTAGE PAYMENT AGREEMENT

    By signing this postage evidencing system lease agreement you
agree to initiate payment for postage using either a USPS-approved
credit card or ACH debit. If you use ACH debit, you agree to
transfer funds directly to the Postal Service through a financial
institution, as specified by the Postal Service, for the purpose of
prepayment of postage. If you use a credit card, you agree to use
only those credit cards approved for use for payment for postage by
the Postal Service.
    You understand that the provider and its affiliates shall not
hold, or contract with or otherwise arrange for any third party to
hold, your funds intended for the purchase of postage. You will be
bound by all terms and conditions of this Postage Payment Agreement
as it may be amended periodically by the Postal Service.

    (4) The provider must require each registered user who requests a
postage value download to provide the PSD identification number, the
registered user account number, and the ascending and descending
register readings on the PSD at the time of the request. The provider
must verify that the information entered by the registered user is
accurate and matches the provider's records. Providers must also verify
that the registered user has initiated payment to the Postal Service
sufficient to cover the postage value download requested before
proceeding with the resetting transaction. Immediately following the
completion of each transaction, the provider must give the user a
statement documenting the transaction.
    (d) Revenue protection. The Postal Service shall conduct periodic
audits and reviews of the EFRS revenue protection safeguards employed
by each provider and shall reserve the right to revoke a provider's
authorization if they do not meet all EFRS requirements set forth by
the Postal Service. In addition, the Postal Service shall reserve the
right to suspend the operation of the provider, as provided in
Sec. 502.14, for any serious operational deficiency that may result in
the loss of funds to the Postal Service.
    (e) Financial operation. The Postal Service shall establish a
separate account at its designated financial institution to handle the
funds for payment for postage received from registered users. The
provider may not establish an account to handle the funds of registered
users intended for the purchase of postage. Payment Technologies,
Office of the Treasurer, USPS, will coordinate the implementation of
the ACH debit process with the provider.
    (f) Reports. The provider must submit a daily financial transaction
for each postage value download or postage refill according to
established EFRS procedures. The provider must provide other reports as
required by the Postal Service.
    (g) Inspection of records and facilities. The provider must make
its facilities that handle the operation of the EFRS and all records
about the operation of the system available for inspection by
representatives of the Postal Service at all reasonable times.

Sec. 502.28  Indicia quality assurance.

    The provider shall implement a mailpiece quality assurance program
to ensure the quality and readability of the indicia and shall instruct
the registered user on the submission of the required mailpieces. The
registered user is required to forward a mailpiece to the provider for
evaluation when the system is installed and at least once every 6

[[Page 58696]]

months thereafter. If the user fails to comply with this requirement,
the provider must notify the user that all future postage value
resettings will be denied. The provider must analyze these mailpieces
for quality and readability and is required to provide guidance to the
registered user to correct any deficiencies that are discovered. The
provider must notify the Postal Service of all noncompliant registered
users, so that the Postal Service can initiate revocation of the user's
registration.

Sec. 502.29  Refunds for postage evidencing systems that generate
information-based indicia (IBI).

    The Postal Service provides refunds for readable, valid, unused
postage on an unmailed envelope or label, and for any balance remaining
on a PSD withdrawn from service and in the possession of the provider,
in accordance with established refund procedures. Postage losses to the
registered user due to system malfunctions and the refund of any non-
postal fees are the responsibility of the provider. Registered users
submit refund requests to the provider in accordance with Domestic Mail
Manual (DMM) P014. The following procedures apply, depending on the
type of refund requested:
    (a) Refund for unused postage
    (1) The provider shall acknowledge the refund request and confirm
that the appropriate supporting materials have been received, including
Postal Service Form 3533-PCP-X, Refund Request for Unused IBI Postage,
in accordance with the requirements in DMM P014.
    (2) The provider shall scan the two-dimensional barcode in the
submitted indicium, analyze the data to ensure the indicium is valid,
and verify the following:
    (i) The PSD used in producing the indicium is the expected PSD.
    (ii) The unused postage is presented by the user to whom the PSD
that produced the indicium is registered.
    (iii) The date of mailing shown in the indicium is not more than 10
days before the date on which the registered user mailed the indicium
for refund. The date is checked by postmark.
    (iv) The human-readable data matches the corresponding data in the
two-dimensional barcode.
    (v) The PSD certificate has not been revoked.
    (vi) The indicium has not been submitted before.
    (3) The provider shall submit the indicium data electronically to
the Certificate Authority for verification of the digital signature.
    (4) The provider shall ensure there is no evidence that the
mailpiece has been processed by the Postal Service.
    (5) The provider shall annotate Postal Service Form 3533-PCP-X,
Refund Request for Unused IBI Postage, and notify both the registered
user and the manager of Postage Technology Management, USPS
Headquarters, of any instances where the refund request for a given,
unused indicium will be denied.
    (6) Upon successful signature verification and completion of all
other required checks listed above, the provider shall either:
    (i) Issue an immediate refund to the registered user from the
provider's own funds, or
    (ii) Issue the refund to the registered user within 5 business days
of receiving reimbursement from the Postal Service.
    (7) No more frequently than once per week, the provider shall
submit to the Postal Service a refund request for unused postage, using
the format in Postal Service Form PCP-X, Provider Refund Request for
Information-Based Indicia.
    (8) The Postal Service shall remit a check made payable to the
provider for the total amount of the refund request for unused postage.
    (9) The Postal Service reserves the right to audit the provider's
refund processing and the unused mailpieces submitted for refund.
Providers are required to maintain the following records:
    (i) The unused envelopes and labels submitted for refund, and any
other correspondence related to the refund request, attached to a copy
of the associated Form 3533 PCP-X, Refund Request for Unused IBI
Postage, and organized by the date of the provider's refund request.
The Postal Service will destroy the unused mailpieces after the
completion of the audit.
    (ii) Electronic copies of the scanned indicia organized by date
submitted for refund. These are maintained until the Postal Service
completes its audit.
    (iii) Postal Service Form 3533-PCP-X (printed copy) submitted by
the registered user to the provider. The printed copy shall be kept for
1 year. An electronic, scanned version with the registered user's
signature shall be kept for 3 years after the destruction of the
printed copy.
    (iv) A copy of each Postal Service Form PCP-X, Provider Refund
Request for Information-Based Indicia, submitted by the provider to the
Postal Service. This form shall be maintained by the provider until
completion of the Postal Service audit.
    (v) A refund count (by number of pieces and postage amount) for
each PSD. This information shall be maintained until completion of the
first Postal Service audit following the withdrawal of the PSD from
service.
    (b) Refund for postage balance remaining on a PSD that is withdrawn
from service and is in the possession of the provider.
    (1) The registered user informs the provider of the intention to
withdraw the PSD from service and has the postage evidencing system
generate a refund request indicium for transmittal to the provider. The
means by which this is accomplished is at the provider's discretion.
The transmittal of the refund request indicium is the last activity
that is permitted for the PSD. If the registered user has physical
possession of the PSD, the registered user returns the withdrawn PSD to
the provider, in accordance with regulations for returning PSDs.
    (2) Upon receipt of the refund request indicium and the PSD (where
applicable), the provider shall scan the two-dimensional barcode in the
submitted indicium, analyze the data to ensure the indicium is valid,
and verify the following:
    (i) The descending register value in the refund request indicium is
$0.00.
    (ii) The PSD used in producing the indicia is the expected PSD.
    (iii) The refund request indicium is presented by the registered
user of the PSD.
    (iv) The PSD certificate has not been revoked.
    (v) There is no evidence of tampering with the PSD.
    (3) The provider shall submit the refund request indicium data
electronically to the Certificate Authority for digital signature
verification.
    (4) Under no circumstances may a provider issue a refund for a
withdrawn PSD unless the PSD is in the provider's possession.
    (5) The provider shall not issue a refund if there is any question
as to the remaining postage value on the PSD without first consulting
with the manager of Postage Technology Management, USPS Headquarters.
The provider shall notify both the registered user and the manager of
Postage Technology Management of any instances where the refund request
will be denied.
    (6) The provider shall generate a form equivalent to Postal Service
Form 3601-C, Postage Evidencing System Activity Report, for withdrawal
of the PSD. The form will include the refund request indicium.

[[Page 58697]]

    (7) Upon successful signature verification and completion of all
other required checks listed above, the provider shall initiate a PSD
withdrawal as specified by Postal Service procedures and shall revoke
the PSD certificate. Then the provider shall either:
    (i) Issue an immediate refund to the registered user from the
provider's own funds; or
    (ii) Issue the refund to the registered user within 5 business days
of receiving reimbursement from the Postal Service.
    (8) No more frequently than once per week, the provider shall
submit to the Postal Service a refund request for withdrawn PSDs,
including a listing of the refund requested by each registered user,
using the format in Postal Service Form PCP-X, Provider Refund Request
for Information-Based Indicia.
    (9) The Postal Service shall remit a check made payable to the
provider for the total amount of the refund request for postage value
remaining on withdrawn PSDs.
    (10) The Postal Service reserves the right to audit the provider's
refund processing and the refund request indicia. Providers are
required to maintain the following records:
    (i) An electronic copy of a form equivalent to Postal Service Form
3601-C, Postage Evidencing System Activity Report, which includes the
refund request indicia, organized by the date of the provider's refund
request, shall be kept for 2 years, or until the completion of the
Postal Service audit, whichever is longer.
    (ii) Any other correspondence that is related to the refund request
must be retained by the provider until the Postal Service completes its
audit.
    (iii) A copy of each Postal Service Form PCP-X, Provider Refund
Request for Information-Based Indicia, submitted by the provider to the
Postal Service shall be maintained by the provider until completion of
the Postal Service audit.

Sec. 502.30  Registered user information.

    (a) Providers are required to collect registration information and
transaction records from registered users on behalf of the Postal
Service and to transmit the data to the Postal Service as part of the
registration process, the postage payment process; and, for IBI open
systems, the mailpiece generation process. Although the Postal Service
does not require the provider to retain registered user information,
the provider may choose to do so for its own purposes, subject to the
following limitations:
    (1) A provider that retains personal information regarding a
registered user must issue a privacy policy that informs the registered
user of the information to be retained and its intended uses.
    (2) The provider is strictly prohibited from disclosing any list of
applicants or registered users, or any identifying information about
any given applicant or registered user, to any other entity, for any
purpose, without prior notification to the customer.
    (3) The provider must offer the applicant or registered user the
option to not have their personal information disclosed to any other
entity.
    (b) As stated in Sec. 502.21, providers are required to
electronically transmit information required to apply for a user
registration to the designated Postal Service central registration
processing facility, on behalf of applicants.
    (c) The Postal Service shall use the registered user information in
accordance with the purposes and routine uses published in the Privacy
Act system of records USPS 140.020, Postage-Postage Evidencing System
Records. The Postal Service may use applicant information in the
administration of postage evidencing systems and mailing activities,
and to communicate with customers who may no longer be visiting a
traditional USPS retail outlet. The Postal Service will also use
applicant information to communicate with USPS customers through any
new retail channels, and for the following purposes:
    (1) To issue (including reregistration, renewal, transfer,
revocation, or refusal, as applicable) a user registration to a
customer and to communicate with respect to the status of such
registration.
    (2) To disclose to a provider the identity of any PSD and any
related user registration data for any PSDs required to be removed from
service by that provider as the result of revocation of a user
registration, questioned accurate registration or other failure of the
PSD to record its operations correctly and accurately, or
decertification by the Postal Service of any particular postage
evidencing system that generates IBI or family of such models.
    (3) To track the movement of postage evidencing systems between a
provider and registered users and to communicate to a provider (but not
to any third party other than the applicant/registered user) concerning
such movement. The term ``provider'' includes a provider's dealers and
agents.
    (4) To transmit general information to all registered users
concerning rate and rate category changes implemented or proposed for
implementation by the Postal Service.
    (5) To advertise Postal Service services relating to the
acceptance, processing and delivery of or postage payment for mail
using information-based indicia.
    (6) To allow the Postal Service to communicate with USPS customers
on products, services, and other information otherwise available to
USPS customers through traditional retail outlets.
    (7) To support any internal use by Postal Service personnel,
including identification and monitoring activities relating to postage
evidencing systems, provided that such use by the Postal Service does
not result in the disclosure of applicant information to any third
party and will not enable any third party to use applicant information
for its own purposes; except that the applicant information may be
disclosed to other governmental agencies for law enforcement purposes
as provided by law.
    (8) To identify authorized product service providers or announce
de-authorization of an authorized product service provider, or provide
currently available public information, where an authorized provider is
identified.
    (9) To promote and encourage the use of information-based indicia
as a form of postage evidencing, provided that the same information is
provided to all registered users, and no particular provider will be
recommended by the Postal Service.
    (10) To contact registered users in cases of revenue fraud or
revenue security, except that any registered user suspected of fraud
shall not be identified to other users.
    (11) To disclose to a provider applicant information pertaining to
that provider's customers that the Postal Service views as necessary to
enable the Postal Service to carry out its duties and purposes.
    (12) To transmit to a provider all applicant and system information
pertaining to that provider's customers and systems that may be
necessary to permit such provider to synchronize its registered user
and PSD database with information contained in the computer files of
the Postal Service, including but not limited to computerized data that
reside in Postal Service postage evidencing system management
databases.
    (13) Subject to the conditions stated herein, to communicate in
oral or written form with any or all applicants and registered users
any information that the Postal Service views as necessary or desirable
to enable the Postal Service to carry out its duties and purposes under
this part 502.

[[Page 58698]]

Sec. 502.31  Intellectual Property

    (a) None of the following shall constitute a grant of authorization
or consent by the Postal Service or the United States to a provider or
any other person to manufacture or use any patented invention or to
infringe any copyright, under 28 U.S.C. 1498 or otherwise:
    (1) The publication of performance criteria, or
    (2) The granting of authorization to a provider under part 501 or
this part 502, or
    (3) The granting of approval to a provider to market or distribute
a postage evidencing system.
    (b) A provider must reimburse the Postal Service for any
compensation or other costs or damages (other than the Postal Services'
own attorneys' fees and other costs of defense) that the Postal Service
or the U.S. Government is required, by final order of a court of
competent jurisdiction which is either not subject to appeal or as to
which the time to appeal has already passed, to pay on a claim of
infringement or unauthorized use of a U.S. patent or U.S. copyright,
under any legal theory, based on either:
    (1) The manufacture, use, sale or importation of provider's postage
evidencing system, whether or not such manufacture, use, sale or
importation is alleged to be pursuant to authorization or consent
provided under 28 U.S.C. 1498;
    (2) The use of provider's postage evidencing system by mailers in a
manner specified or intended by Provider to create postage indicia,
apply such indicia to mail, and/or deposit such mail with the USPS; or
    (3) The granting by the Postal Service to provider of government
authorization or consent, under 28 U.S.C. 1498 or otherwise, to make or
use a patented invention or infringe a copyright in connection with the
manufacture, use or sale of provider's postage evidencing system, or
the activities of provider pursuant to such grant of authorization and
consent.
    (c) The Postal Service may suspend approval of a postage evidencing
system on 60 days' notice to provider if a court of competent
jurisdiction determines that the manufacture or use of the postage
evidencing system, or the creation or validation of the indicia
produced thereby, infringes, induces or contributes to the infringement
of, or otherwise violates any person's or entity's rights under a U.S.
patent or U.S. copyright. The Postal Service shall reinstate approval
of such postage evidencing system if and so long as:
    (1) Such judicial determination is vacated or reversed; or
    (2) The provider duly licenses or otherwise procures and maintains
in effect (for the benefit of itself, users and the Postal Service as
may be necessary) the right to conduct, with respect to provider's
postage evidencing device and the indicia created thereby, the
activities that the court has determined to be infringing.
    (d) A determination that the validating of an indicia by the Postal
Service infringes a patent or copyright shall not be a basis for
suspending provider's approval if the provider can establish that
alternative, non-infringing means of performing such validation are
available to the Postal Service with respect to the indicia created by
provider's postage evidencing device so long as such means fully comply
with the performance criteria under which the postage evidencing device
and indicia have been approved.
    (e) The Postal Service may provide additional requirements relating
to intellectual property in the product submission procedure,
performance criteria or both (``IP Requirements'') and may condition
the granting or maintenance of approval of a postage evidencing system
on provider's compliance with those IP Requirements. When IP
Requirements are imposed on a provider, they shall control over any
conflicting provision in this Sec. 502.31.
    (f) The requirements of this Sec. 502.31 shall apply to all aspects
of a provider's postage evidencing device and the indicia created
thereby, including those aspects required or specified under applicable
performance criteria.
    (g) Notwithstanding Sec. 502.1 to the contrary, this Sec. 502.31
shall apply to any postage evidencing system approved by the Postal
Service under part 501, part 502 or otherwise and to any performance
criteria whether directed to IBI or other forms of postage evidence.
    Appropriate amendments to 39 CFR parts 111 and 502 to reflect these
changes will be published if the proposal is adopted.

Stanley F. Mires,
Chief Counsel, Legislative.
[FR Doc. 00-25090 Filed 9-29-00; 8:45 am]
BILLING CODE 7710-12-U