Production, Distribution, and Use of Postal Security Devices and Information-Based Indicia

502.1

Applicability of regulations.

502.2

Description of postage evidencing systems that generate information-based indicia (IBI).

502.3

Definition and use of PC Postage trademark.

502.4

Product service provider qualifications.

502.5

Provider authorization.

502.6

Changes in ownership or control.

502.7

Burden of proof standard.

502.8

Suspension and revocation of authorization.

502.9

Information-based indicia program (IBIP) performance criteria.

502.10

Product submission procedures and testing.

502.11

Security testing.

502.12

Postage evidencing system approval.

502.13

Conditions for approval.

502.14

Suspension and revocation of approval.

502.15

Reporting.

502.16

Administrative sanction on reporting.

502.17

Materials and workmanship.

502.18

Destruction of information-based indicia.

502.19

Inspection of new postage evidencing systems.

502.20

Distribution facilities.

502.21

Distribution controls.

502.22

Administrative sanction.

502.23

Postage evidencing system maintenance.

502.24

Access or changes to secure components.

502.25

Inspection of postal security devices (PSDs) in use.

502.26

PSDs not located.

502.27

Electronic Funds Resetting System (EFRS).

502.28

Indicia quality assurance.

502.29

Refunds for postage evidencing systems that generate information-based indicia.

502.30

Registered user information.

502.31

Intellectual Property.

The regulations in this section apply to all postage evidencing systems that print information-based indicia (IBI) to show payment of postage.

(a) Postage evidencing systems that generate IBI are secure systems that print USPS-authorized, digitally-signed indicia as evidence of payment of postage. Indicia consist of a USPS-approved two-dimensional barcode and certain human-readable information. Authorized postage evidencing systems are available from authorized, commercial product service providers.

(b) These postage evidencing systems include as a primary component a postal security device (PSD) that performs core security functions such as digital signature generation and verification, as well as the management of postage registers. The component of these postage evidencing systems that controls the registered user infrastructure for system authorization, system audits, remote postage resetting, and production of the indicia is called the client system. The PSD and the client system interact to generate the indicia. The PSD is remotely set with postage value and requires the user to initiate payment to the Postal Service sufficient to cover the desired postage increment before initial setting or resetting.

(a) “PC Postage” is the Postal Service trademark for Postal Service-approved, secure, postage evidencing systems that generate information-based indicia and allow registered users to purchase and print postage using their personal computers and the Internet.

(b) Use of the PC Postage trademark on USPS-approved postage evidencing systems and other products must be specifically approved by the manager of Postage Technology Management (PTM), USPS Headquarters. The provider must sign a trademark licensing agreement with the Postal Service for each product the Postal Service authorizes to use the PC Postage trademark.

For authorization from the Postal Service to produce and/or lease PSDs and postage evidencing systems that generate information-based indicia (IBI) for use by registered users under Domestic Mail Manual P050, a potential provider must:

(a) Satisfy the Postal Service of its integrity and fiscal responsibility.

(b) Obtain approval of at least one postage evidencing system incorporating all the features and safeguards specified in § 502.9, in accordance with the procedures outlined in § 502.10.

(c) Have, or establish, and keep under its supervision and control adequate production facilities suitable to carry out the provisions of §§ 502.17 through 502.19, to the satisfaction of the Postal Service. The production facilities must be subject to unannounced inspection by representatives of the Postal Service. If the production facilities are established by the provider outside the customs territory of the United States, the provider shall be responsible for all costs incurred by the Postal Service to conduct the inspections.

(d) Have, or establish, and keep under its supervision and control adequate facilities for the control, distribution, and maintenance of postage evidencing systems that generate IBI, and their replacement or secure disposal or destruction when necessary.

An applicant meeting the qualifications in § 502.4 may be authorized in writing by the manager of Postage Technology Management, USPS Headquarters, as a provider of postage evidencing systems that generate IBI and will be allowed to lease authorized PSDs and systems to users registered by the Postal Service. The written authorization defines the conditions under which the postage evidencing system may be marketed and distributed.

Any person, entity, or concern wanting to acquire ownership or control of a provider of an authorized postage evidencing system must provide the Postal Service with satisfactory evidence of that person's, entity's, or concern's integrity and financial responsibility.

The burden of proof is on the Postal Service in adjudications of suspensions and revocations under § 502.8 and § 502.14 and administrative sanctions under § 502.16 and § 502.22. Except as otherwise indicated in those sections, the standard of proof shall be the preponderance-of-evidence standard.

(a) The Postal Service may suspend and/or revoke authorization to provide and/or distribute any or all of a provider's postage evidencing systems if the provider engages in any unlawful scheme or enterprise, fails to comply with any provision in this part 502, or fails to implement instructions issued in accordance with any final decision issued by the Postal Service within its authority over the IBI program.

(b) The decision to suspend or revoke a provider's authorization shall be based on the nature and circumstances of the violation (e.g., whether the violation was willful, whether the provider voluntarily admitted to the violation, whether the provider cooperated with the Postal Service, or whether the provider implemented successful remedial measures) and on the provider's performance history. Before determining whether a provider's authorization to produce and/or distribute postage evidencing systems should be revoked, the procedures in paragraph (c) of this section shall be followed.

(c) Suspension in all cases shall be as follows:

(1) Upon determination by the Postal Service that a provider is in violation of the provisions in this part 502, the Postal Service shall issue a written notice of proposed suspension citing deficiencies for which suspension of authorization to produce and/or distribute a specific postage evidencing system, or a family of system models, may be imposed under paragraph (c)(2) of this section. The notification is in writing and is sent certified mail, return receipt requested. Except in cases of willful violation, the provider shall be given an opportunity to correct deficiencies and achieve compliance with all requirements within a time limit, determined by the Postal Service, corresponding to the potential risk to postal revenue.

(2) In cases of willful violation, or if the Postal Service determines that the provider has failed to correct cited deficiencies within the specified time limit, the Postal Service shall issue a written notice setting forth the facts and reasons for the decision to suspend and the effective date if a written defense is not presented as provided in paragraph (d) of this section. The notification is in writing and is sent certified mail, return receipt requested.

(3) If, upon consideration of the defense as provided in paragraph (e) of this section, the Postal Service deems that the suspension is warranted, the suspension shall remain in effect for up to 90 days unless withdrawn by the Postal Service, as provided in paragraph (c)(4)(iii) of this section.

(4) At the end of the 90-day suspension, the Postal Service may:

(i) Extend the suspension to allow more time for investigation or to allow the provider to correct the problem;

(ii) Make a determination to revoke authorization to provide and/or distribute the provider's postage evidencing systems that generate IBI in part or in whole; or

(iii) Withdraw the suspension based on identification and implementation of a satisfactory solution to the problem. Provider suspensions may be withdrawn before the end of the 90-day period if the Postal Service determines that the provider's solution and implementation are satisfactory.

(d) The provider may present the Postal Service with a written defense to any suspension or revocation determination within 30 calendar days after receiving or refusing to receive the written notice, unless a shorter period is deemed necessary. The defense must include all supporting evidence and specify the reasons for which the order should not be imposed.

(e) After receipt and consideration of the defense, the Postal Service shall advise the provider of the decision and the facts and reasons for it. The decision shall be effective on receipt unless it provides otherwise. The decision shall also advise the provider that it may appeal that determination within 30 calendar days after the provider receives or refuses to receive written notification of the decision, unless a shorter period is deemed necessary, as specified therein. The appeal must include all supporting evidence and specify the reasons the provider believes that the decision is erroneous.

(f) An order or final decision under this section does not preclude any other criminal or civil statutory, common law, or administrative remedy that is available by law to the Postal Service, the United States, or any other person or concern.

(a) The performance criteria applicable to the given postage evidencing system relate to the data contents and format of the indicia, the PSD (which implements digital signature technology for the creation and verification of digital signatures), the client system (which supports the creation of the indicia and the interface with the PSD and the provider), and cryptographic key management.

(b) The information-based indicia program (IBIP) performance criteria describe required system elements that include the provider infrastructure and the registered user infrastructure, and their interface to the Postal Service infrastructure. The Postal Service infrastructure supports user registration, postage evidencing system audit, postage resetting, total population management, key management support, financial reconciliation, PSD life cycle tracking, lost and stolen/irregularity management functions and other reporting. The provider infrastructure will support all IBIP functions. The registered user infrastructure will consist of the PSD and a client system. The Postal Service will evaluate and test postage evidencing systems for compliance with this infrastructure. Contact the manager of Postage Technology Management, USPS Headquarters for these criteria.

(a) Each postage evidencing system that generates IBI is submitted for Postal Service approval and will be tested and evaluated in accordance with the requirements and provisions of the most current postage evidencing product submission procedures. Particular attention must be given to the requirement to submit identical postage evidencing systems simultaneously to the Postal Service and to a laboratory accredited under the National Voluntary Laboratory Accreditation Program (NVLAP) for FIPS 140-1 certification. Contact the manager of Postage Technology Management, USPS Headquarters for these requirements. Information pertaining to these procedures may be accessed through the USPS website.

(b) The indicia design must be approved by the manager of Postage Technology Management, USPS Headquarters, and must comply with the requirements in the Domestic Mail Manual and the applicable IBI performance criteria.

(c) Any change to an approved postage evidencing system must be submitted to the Postal Service for evaluation in accordance with the most current postage evidencing product submission procedures.

(d) Where complete evaluation of all security-related components of a postage evidencing system requires USPS review of data located outside the customs territory of the United States, the provider shall be responsible for all costs incurred by the USPS in conducting that review.

The Postal Service reserves the right to require or conduct additional examination and testing at any time, without cause, of any postage evidencing system submitted to the Postal Service for approval or previously approved by the Postal Service for production and distribution.

As provided in § 502.15, the provider has a duty to report security weaknesses to the Postal Service to ensure that every postage evidencing system in service protects the Postal Service against loss of revenue at all times. An approval of a system does not constitute an irrevocable determination that the Postal Service is satisfied with its revenue-protection capabilities and all other features of the system. After approval is granted to produce and distribute a postage evidencing system, no change affecting the features or safeguards may be made except as authorized or required by the Postal Service in writing.

(a) The Postal Service may require, and reserves future rights to require, that production models of approved postage evidencing systems, as well as the current design documentation, user manuals, and specifications applicable to such systems and any revisions thereof, be submitted to the manager of Postage Technology Management, USPS Headquarters.

(b) Upon request by the Postal Service, additional postage evidencing systems must be submitted to the Postal Service for testing, at the expense of the provider.

(a) The Postal Service may suspend approval of a postage evidencing system under § 502.12 if the Postal Service has probable cause to believe that the postage evidencing system or the family of system models poses an unacceptable risk to postal revenue. Suspension of approval to produce or distribute a postage evidencing system or a family of system models, in whole or in part, shall be based on the potential risk to postal revenue. Before determining whether approval of a postage evidencing system or a family of system models, should be revoked, the procedures in paragraph (b) of this section shall be followed.

(b) Suspension procedures:

(1) Upon determination by the Postal Service that a postage evidencing system poses an unacceptable risk to postal revenue, the Postal Service shall issue a written notice of proposed suspension citing deficiencies for which suspension may be imposed under paragraph (b)(2) of this section. The notification is in writing and is sent certified mail, return receipt requested. The provider shall be given an opportunity to correct deficiencies and achieve compliance with all requirements within a time limit determined by the Postal Service, corresponding to the potential risk to postal revenue.

(2) If the Postal Service determines that the provider has failed to correct cited deficiencies within the USPS-specified time limit, the Postal Service shall issue a written notice setting forth the facts and reasons for the decision to suspend and the effective date if a written defense is not presented as provided in paragraph (c) of this section. The notification is in writing and is sent certified mail, return receipt requested.

(3) If, upon consideration of the defense as provided in paragraph (d) of this section, the Postal Service deems that the suspension is warranted, the suspension shall remain in effect for up to 90 days unless withdrawn by the Postal Service, as provided in paragraph (b)(4)(iii) of this section.

(4) At the end of the 90-day suspension, the Postal Service may:

(i) Extend the suspension to allow more time for investigation or to allow the provider to correct the problem;

(ii) Make a determination to revoke the approval of the provider's postage evidencing system or family of system models, or

(iii) Withdraw the suspension based on identification and implementation of a satisfactory solution to the problem. Provider suspensions may be withdrawn before the end of the 90-day period if the Postal Service determines that the provider's solution and implementation are satisfactory.

(c) The provider may present the Postal Service with a written defense to any suspension or revocation determination within 30 calendar days after receiving or refusing to receive notice, unless a shorter period is deemed necessary. The defense must include all supporting evidence and specify the reasons for which the order should not be imposed.

(d) After receipt and consideration of the written defense, the Postal Service shall advise the provider of the decision and the facts and reasons for it. The decision shall be effective on receipt unless it states otherwise. The decision shall also advise the provider that it may appeal that determination within 30 calendar days after the provider receives or refuses to receive written notice, unless a shorter period is deemed necessary, as specified therein. The appeal must include all supporting evidence and specify the reasons that the provider believes that the decision is erroneous.

(e) An order or final decision under this section does not preclude any other criminal or civil statutory, common law, or administrative remedy that is available by law to the Postal Service, the United States, or any other person or concern.

(a) For purposes of this section, “provider” refers to an entity authorized under § 502.5 and its foreign or domestic affiliates, subsidiaries, assigns, dealers, independent dealers, employees, and parent corporations.

(b) Each provider authorized under § 502.5 must submit a preliminary report to notify the Postal Service promptly (in no event more than 21 calendar days of discovery) of the following:

(1) All findings or results of any testing known to the provider concerning the security or revenue protection features, capabilities, or failings of any postage evidencing system or PSD sold, leased, or distributed by the provider that has been approved for sale, lease, or distribution by the Postal Service or by any foreign postal administration; or have been submitted for approval by the provider to the Postal Service or to a foreign postal administration.

(2) All potential security weaknesses or methods of system tampering of the postage evidencing systems that the provider distributes, of which the provider knows or should know, and the system or model subject to each weakness or method. These potential security weaknesses include, but are not limited to suspected equipment defects, suspected abuse by a registered user or provider employee, suspected security breaches of the Electronic Funds Resetting System, cryptographic key compromises, occurrences outside normal performance, or any repeatable deviation from normal postage evidencing system performance (within the same model family and/or by the same registered user).

(c) Within 45 calendar days of the preliminary notification to the Postal Service under § 502.15(b), the provider must submit a written report to the Postal Service. The report must include the circumstances, proposed investigative procedure, and the anticipated completion date of the investigation. The provider must also provide periodic status reports to the Postal Service during subsequent investigation and, on completion, must submit a summary of the investigative findings.

(d) The provider must establish and adhere to timely and efficient procedures for internal reporting of potential security weaknesses. The provider is required to submit a copy of internal reporting procedures and instructions to the Postal Service for review.

(a) Notwithstanding any act, admission, or omission by the Postal Service, an authorized provider may be subject to an administrative sanction for failing to comply with § 502.15.

(b) The Postal Service shall determine all costs and revenue losses measured from the date that the provider knew, or should have known, of a potential security weakness, including, but not limited to, administrative and investigative costs and documented revenue losses that result from any postage evidencing system for which the provider failed to comply with any provision in § 502.15. The provider shall be responsible to the Postal Service for all such costs and losses (net of any amount collected by the Postal Service from the registered users) with interest when the Postal service issues a written notice to the provider setting forth the facts and reasons on which the determination to impose the sanction is based. The notification is in writing and is sent certified mail, return receipt requested. The notice shall advise the provider of the date that the action takes effect if a written defense is not presented within 30 calendar days of receipt of the notice.

(c) The provider may present the Postal Service with a written defense to the proposed action within 30 calendar days after receiving or refusing to receive notification. The defense must include all supporting evidence and specify the reasons for which the sanction should not be imposed.

(d) After receipt and consideration of the defense, the Postal Service shall advise the provider of the decision and the facts and reasons for it; the decision shall be effective on receipt unless it states otherwise. The notification of the decision is in writing and is sent certified mail, return receipt requested. The decision shall also advise the provider that it may, within 30 calendar days of receiving the decision, appeal that determination as specified therein.

(e) The provider may submit a written appeal to the Postal Service within 30 calendar days of receiving or refusing to receive notification of the decision. The appeal must include all supporting evidence and specify the reasons that the provider believes that the administrative sanction was erroneously imposed. The submission of an appeal stays the effectiveness of the sanction.

(f) The imposition of an administrative sanction under this section does not preclude any other criminal or civil statutory, common law, or administrative remedy that is available by law to the Postal Service, the United States, or any other person or concern.

All postage evidencing systems that generate IBI must continuously maintain the quality in materials and workmanship of the production model approved by the Postal Service.

All indicia created in the process of testing the postage evidencing system by the provider, or its agent, must be collected and securely controlled or destroyed by the provider to prevent unauthorized use.

The provider shall inspect all new postage evidencing systems that generate IBI to ensure proper functioning of all operational capabilities of each system before distribution.

(a) An authorized provider must keep adequate facilities for and records of the distribution, control, maintenance, replacement, and disposal or destruction of all PSDs throughout their entire life cycle. Recordkeeping is required for all PSDs, including newly produced PSDs, active leased PSDs and inactive, unleased PSDs, as well as lost and stolen PSDs. All such facilities and records are subject to inspection by Postal Service representatives.

(b) If the provider uses a third party to control, distribute, maintain, replace, repair, or dispose of PSDs or postage evidencing systems, all aspects of the arrangement between the parties must be specifically authorized in writing by the manager of Postage Technology Management, USPS Headquarters.

(1) The third party relationship shall not compromise any security element of the postage evidencing system. The functions of the third party with respect to these systems are subject to the same scrutiny as the functions of the provider.

(2) Any authorized third party must keep adequate facilities for and records of PSDs and postage evidencing systems in accordance with the USPS-authorized arrangement with the provider. All such facilities and records are subject to inspection by Postal Service representatives, in so far as they are used to control, distribute, store, maintain, replace, repair, or dispose of PSDs or postage evidencing systems.

(3) The Postal Service holds the provider fully responsible for any deficiencies found in third party facilities, records, or procedures and can require termination of the third party arrangement if deficiencies are found.

Each authorized provider must do the following:

(a) Hold title permanently to all PSDs that print U.S. postage, except those purchased by the Postal Service.

(b) On behalf of applicants, electronically transmit information required to apply for a user registration to the designated Postal Service central registration processing facility.

(c) On behalf of users registered to use their postage evidencing systems, forward to the Postal Service any changes to user registration information when the user submits such changes to the provider. The provider must follow authorized USPS procedures for moving the system when a registered user changes the registration post office. The provider must also notify the Postal Service following any event that indicates the need to update registered user information, such as the return of an invoice or the inability to communicate with the user.

(d) Lease PSDs only to parties that have valid user registrations issued by the Postal Service to use a postage evidencing system.

(e) Unless otherwise authorized by the Postal Service, immediately withdraw from service any PSD that the registered user no longer wants, or that is to be removed from service for any other reason. The provider shall retrieve any withdrawn PSD that is in the possession of the registered user. All resetting requests for a withdrawn PSD must be denied. The provider must keep in its possession for at least 1 year from the date of withdrawal a copy of the information on the registered user's PS Form 3601-C, Postage Evidencing System Activity Report.

(f) Retrieve any misregistering, faulty, or defective PSD and withdraw it from service within 3 business days of being notified by the registered user of the defect. The provider must examine each PSD withdrawn from service for apparent faulty operation affecting the ascending or the descending register, or for other failure to record its operations correctly and accurately. After examining the withdrawn PSD, the provider must compile a written report explaining the malfunction to the manager of Postage Technology Management, USPS Headquarters. The report must include an explanation of the malfunction that resulted in the faulty operation or other failure to record operations correctly and accurately, all applicable system documentation, including log files, and a recommendation for the appropriate postage adjustment, if applicable. At the same time the report is made to the Postal Service, the provider must notify the registered user of the proposed postage adjustment. The provider may supply the registered user with a replacement PSD only if the faulty PSD is in the provider's possession.

(g) Report promptly the loss or theft of any PSD, the recovery of any PSD previously reported as lost or stolen, or the scrapping of any PSD by the provider. The provider must notify the Postal Service by completing a standardized Lost and Stolen Postage Evidencing System Incident Report and filing it with the Postal Service by the tenth day of the month following when a PSD is scrapped or the provider determines the loss, theft, or recovery of a PSD. For lost or stolen PSDs, the provider must complete all preliminary location activities specified in § 502.26 before including a given incident on this report.

(h) Provide to the Postal Service upon request an electronic file or database of all postage evidencing systems in service, including the PSD identification number, the registered user's name and address, the date that the system was placed in service, and the ZIP Code of the registration post office. This information is to be provided to the Postal Service in USPS-specified format, at times to be determined by the Postal Service.

(i) Keep accurate records and reconcile differences between their records and Postal Service databases.

(j) Keep at provider's headquarters an electronic file or database with a complete record of all PSDs produced, showing all movements of each from the time that the PSD is produced until it is scrapped. The records shall be organized by PSD identification number and shall include the reading on the ascending register each time the PSD is authorized for a new registered user or is withdrawn from service. These records must be available for inspection by Postal Service officials at any time during normal business hours. The record for each PSD must be maintained for 3 years after the PSD is scrapped.

(k) Submit other reports as required by the Postal Service.

(l) Cancel a lease agreement with any lessee whose registration to use a postage evidencing system is revoked by the Postal Service.

(m) Promptly withdraw from service any PSD that the Postal Service indicates should be withdrawn from service for revocation of user registration or for any other reason, and retrieve the PSD if it is in the possession of the registered user. When a user registration is revoked, the provider must retrieve all PSDs in the possession of the registered user and must withdraw from service all PSDs employed by the registered user.

(n) Take reasonable precautions in the transportation and storage of PSDs to prevent use by unauthorized individuals. Providers must ship all PSDs by Postal Service Priority Mail unless given written permission by the Postal Service to use another method.

(o) Communicate to all registered users of a postage evidencing system the required cautionary statements that provide the registered user with basic reminders that the postal security device is leased, the actions needed on relocation of the postage evidencing system, and warnings against system misuse.

(1) The cautionary statements must be visually presented to the registered user upon each start-up of the postage evidencing system. The user must actively acknowledge the statements before proceeding with system use. In addition, the statements shall be included prominently in the user documentation provided with each system. PSDs that are in the possession of a user shall include the cautionary statements on a label attached to the PSD, to the housing of the PSD, or to the postage evidencing system containing the PSD, if the physical dimensions of the equipment will accommodate them. Postage evidencing systems provided to registered users without this cautionary information shall not be authorized for use.

(2) In every presentation of the cautionary statements to the registered user, the words shown below in capital letters should be emphasized. If the cautionary statement can be placed on the PSD or other equipment, it shall be placed in a conspicuous and highly visible location. The minimum width of the text block containing the statement should be 3.25 inches, and the minimum height should be 1.75 inches. The statement shall read as follows:

POSTAL SERVICE NOTICE

LEASED POSTAGE EVIDENCING SYSTEM—NOT FOR SALE

PROPERTY OF [NAME OF PROVIDER]

Use of this system is permissible only under a U.S. Postal Service postage evidencing system user registration.

Call [NAME OF PROVIDER] at phone number ### ###-#### to relocate or return this Postage Evidencing System.

WARNING! POSTAGE EVIDENCING SYSTEM TAMPERING OR MISUSE IS A FEDERAL OFFENSE.

IF YOU SUSPECT POSTAGE EVIDENCING SYSTEM TAMPERING, CALL INSPECTOR GENERAL'S HOTLINE AT 1-800-654-8896 OR YOUR LOCAL POSTAL INSPECTOR.

REWARD UP TO $50,000 for information leading to the conviction of any person who misuses a postage evidencing system resulting in the Postal Service not receiving correct postage payments.

(3) Exceptions to the formatting of required cautionary labeling are determined on a case-by-case basis. The manager of Postage Technology Management, USPS Headquarters, must approve, in writing, any deviation from the standard labeling requirements.

The Postal Service holds providers responsible for the entire life cycle of their postage evidencing systems, including control, distribution, operation, maintenance, replacement, and secure disposal.

(a) “Postage evidencing system,” for purposes of this section, means any system that is produced by a provider authorized under § 502.5 that is not owned or leased by the Postal Service.

(b) An authorized provider that, without just cause, fails to conduct or perform adequately any of the controls required by § 502.21, to follow standardized lost and stolen incident reporting in § 502.26, or to conduct the inspections required by § 502.25 in a timely fashion is subject to an administrative sanction based on the investigative and administrative costs and documented revenue losses (net of any amount collected by the Postal Service from the registered user), with interest per occurrence measured from the date on which the cost and/or loss occurred, as determined by the Postal Service. Sanctions shall be based on the costs and revenue losses that result from the provider's failure to comply with these requirements.

(c) The Postal Service may impose an administrative sanction under this section by issuing a written notice to the provider setting forth the facts and reasons on which the determination to impose the sanction is based. The notification is in writing and is sent certified mail, return receipt requested. The Postal Service shall determine all costs and losses. The notice shall advise the provider of the date that the action shall take effect if a written defense is not presented within 30 calendar days of receipt of the notice.

(d) The provider may present to the Postal Service a written defense to the proposed action within 30 calendar days of receiving or refusing to receive the notice. The defense must include all supporting evidence and specify the reasons for which the sanction should not be imposed.

(e) After receipt and consideration of the written defense, the Postal Service shall advise the provider of the decision and the facts and reasons for it. The decision shall be effective on receipt unless it states otherwise.

(f) The provider may submit a written appeal of the decision within 30 calendar days of receiving or refusing to receive the decision, addressed to the manager of Postage Technology Management, USPS Headquarters. The appeal must include all supporting evidence and specify the reasons that the provider believes that the administrative sanction was erroneously imposed. The submission of an appeal stays the effectiveness of the sanction.

(g) The imposition of an administrative sanction under this section does not preclude any other criminal or civil statutory, common law, or administrative remedy that is available by law to the Postal Service, the United States, or any other person or concern.

(a) The provider must keep its postage evidencing systems that generate IBI in proper operating condition by maintaining or replacing them when necessary or desirable to prevent electronic failure, malfunction, expiration of the life of the battery for the clock or timer, or mechanical breakdown.

(b) The provider must provide the registered users with modifications reflecting rate changes and must implement new rates as of the effective date for the new rates established by the Postal Service.

Postage evidencing system maintenance involving access or changes to secure components must be done only within a secure facility under the provider's direct control and supervision. PSDs must be withdrawn from service before any such maintenance is performed.

(a) The provider must conduct an audit of each PSD at least once every 3 months in conjunction with the postage value resetting requirements in § 502.27. A zero-value reset will satisfy this requirement. The PSD must have a lock-out feature that prevents use of the system if an audit is not completed in accordance with this regulation.

(b) Postage evidencing systems that generate IBI, other than PC Postage, shall be inspected by the provider every 2 years. Registered user mail-in of indicia may substitute for the provider inspection, with Postal Service approval. The provider shall inspect or sample PC Postage products under special circumstances, as directed by the Postal Service. The Postal Service examines postage evidencing systems when warranted by special circumstances.

Upon learning that one or more of its PSDs in service cannot be located, the provider must undertake reasonable and timely efforts to locate the PSD by following a series of Postal Service-specified actions designed to locate the PSDs. If these efforts are unsuccessful and a PSD is determined to be lost or stolen, the provider must notify the Postal Service in accordance with § 502.21.

(a) If a user registered to use a postage evidencing system cannot be located, the provider must, at a minimum, complete the following actions:

(1) Call the registered user's last known telephone number.

(2) Call directory assistance for the user's new telephone number.

(3) Contact the registered user's local post office for current change of address information.

(4) Contact Postage Technology Management to verify the location of the PSD and the registered user as currently maintained in Postal Service records.

(5) Contact the rental agency responsible for the property where the registered user was located, if applicable.

(6) Visit the registered user's last known address to see whether the building superintendent or a neighbor knows the user's new address.

(7) Mail a certified letter with return receipt to the registered user at the last known address with the endorsement “Forwarding and Address Correction Requested”.

(8) If new address information is obtained during these steps, any missed or delinquent scheduled PSD audit must be completed immediately.

(b) If a PSD is reported to be lost or stolen by the registered user, the provider must, at a minimum, complete the following actions:

(1) Discontinue postage value downloads to the lost or stolen PSD.

(2) Ensure that the registered user has filed a police report for a stolen PSD and that copies have been provided to the appropriate Inspection Service Contraband Postage Identification Program (CPIP) specialist.

(3) Withhold issuance of a replacement PSD until the missing PSD has been properly reported to the police and to the appropriate Inspection Service CPIP specialist.

(c) If the provider later learns that the PSD has been located and/or recovered, the provider must take the following actions before returning the PSD to service or allowing a postage value download:

(1) Submit a new Lost and Stolen Postage Evidencing System Incident Report that references the initial report and outlines the details of how the PSD was recovered, in accordance with § 502.21. The provider is responsible for keeping records of these reports as submitted to the Postal Service for a minimum of 3 years after submission.

(2) Retrieve the recovered PSD from the registered user and examine it for apparent faulty operation that could affect its ability to record its operations correctly and result in a questionable accurate registration.

(3) Recommend a postage adjustment or refund, if appropriate.

(4) Withdraw the PSD from service if a replacement PSD has been supplied to the registered user or if there is an issue of questionable accurate registration.

(d) Any authorized provider that fails to comply with standardized lost and stolen reporting procedures and instructions is subject to an administrative sanction under § 502.22, as determined by the Postal Service.

(a) Description. A remote resetting system permits registered users to reset their PSDs at places of business and/or homes via modem or network interface. The Electronic Funds Resetting System (EFRS) is the Postal Service system that processes system resetting data for postage value downloads submitted by providers of postage evidencing systems that generate IBI. The Postal Service processes the data separately from data processed under the Computerized Meter Resetting System (CMRS), which is used for traditional postage meters.

(b) Resetting a PSD. To reset a PSD, the registered user connects to the provider and provides specified identifying data and PSD audit data for the postage value download. Before proceeding with the transaction, the provider must verify all the data, conduct the system audit, and ascertain whether payment to the Postal Service sufficient to cover the desired postage value download was initiated by the registered user. If payment was initiated and the system audit was successful, the provider may complete the postage value download.

(c) Payment to the Postal Service.

(1) The only acceptable methods used for postage payments for postage evidencing systems that generate IBI are credit cards and Automated Clearinghouse (ACH) debit. The providers must publicize these payment options to all registered IBI users. When publicizing these options, the provider must provide a clear and concise description of each.

(i) Credit Cards. The provider must offer the registered user the option to use all of the credit cards approved for use by the Postal Service for payment for postage. Each provider must receive authorization from the Postal Service to offer credit card options to registered users and must sign a vendor credit card pilot test agreement, a legal agreement with the Postal Service on credit card payment, which addresses security requirements, payment of transaction costs, reconciliation requirements, and retrieval and chargeback requests. The provider must use a certified credit card payment process approved for use by the Postal Service's designated card processor. All credit card transactions must be sent through the designated Postal Service card processor, with each provider working as an agent with the Postal Service as the merchant of record.

(ii) ACH Debit. All ACH debit payments for postage must be electronically transferred directly from the registered user's account resident in a financial institution that is neither owned, nor controlled, nor contracted, nor arranged for by a product service provider or its affiliate. The funds must be transferred directly into an account at a financial institution designated by the Postal Service.

(2) A registered user is required to initiate payment to the Postal Service sufficient to cover the desired postage value download contemporaneously with a download being made. The details of this payment requirement are covered in the Postage Payment Agreement.

(3) Each provider is required to incorporate the Postage Payment Agreement into its postage evidencing system lease agreement with each registered user, as follows:

POSTAGE PAYMENT AGREEMENT

By signing this postage evidencing system lease agreement you agree to initiate payment for postage using either a USPS-approved credit card or ACH debit. If you use ACH debit, you agree to transfer funds directly to the Postal Service through a financial institution, as specified by the Postal Service, for the purpose of prepayment of postage. If you use a credit card, you agree to use only those credit cards approved for use for payment for postage by the Postal Service.

You understand that the provider and its affiliates shall not hold, or contract with or otherwise arrange for any third party to hold, your funds intended for the purchase of postage. You will be bound by all terms and conditions of this Postage Payment Agreement as it may be amended periodically by the Postal Service.

(4) The provider must require each registered user who requests a postage value download to provide the PSD identification number, the registered user account number, and the ascending and descending register readings on the PSD at the time of the request. The provider must verify that the information entered by the registered user is accurate and matches the provider's records. Providers must also verify that the registered user has initiated payment to the Postal Service sufficient to cover the postage value download requested before proceeding with the resetting transaction. Immediately following the completion of each transaction, the provider must give the user a statement documenting the transaction.

(d) Revenue protection. The Postal Service shall conduct periodic audits and reviews of the EFRS revenue protection safeguards employed by each provider and shall reserve the right to revoke a provider's authorization if they do not meet all EFRS requirements set forth by the Postal Service. In addition, the Postal Service shall reserve the right to suspend the operation of the provider, as provided in § 502.14, for any serious operational deficiency that may result in the loss of funds to the Postal Service.

(e) Financial operation. The Postal Service shall establish a separate account at its designated financial institution to handle the funds for payment for postage received from registered users. The provider may not establish an account to handle the funds of registered users intended for the purchase of postage. Payment Technologies, Office of the Treasurer, USPS, will coordinate the implementation of the ACH debit process with the provider.

(f) Reports. The provider must submit a daily financial transaction for each postage value download or postage refill according to established EFRS procedures. The provider must provide other reports as required by the Postal Service.

(g) Inspection of records and facilities. The provider must make its facilities that handle the operation of the EFRS and all records about the operation of the system available for inspection by representatives of the Postal Service at all reasonable times.

The provider shall implement a mailpiece quality assurance program to ensure the quality and readability of the indicia and shall instruct the registered user on the submission of the required mailpieces. The registered user is required to forward a mailpiece to the provider for evaluation when the system is installed and at least once every 6 months thereafter. If the user fails to comply with this requirement, the provider must notify the user that all future postage value resettings will be denied. The provider must analyze these mailpieces for quality and readability and is required to provide guidance to the registered user to correct any deficiencies that are discovered. The provider must notify the Postal Service of all noncompliant registered users, so that the Postal Service can initiate revocation of the user's registration.

The Postal Service provides refunds for readable, valid, unused postage on an unmailed envelope or label, and for any balance remaining on a PSD withdrawn from service and in the possession of the provider, in accordance with established refund procedures. Postage losses to the registered user due to system malfunctions and the refund of any non-postal fees are the responsibility of the provider. Registered users submit refund requests to the provider in accordance with Domestic Mail Manual (DMM) P014. The following procedures apply, depending on the type of refund requested:

(a) Refund for unused postage

(1) The provider shall acknowledge the refund request and confirm that the appropriate supporting materials have been received, including Postal Service Form 3533-PCP-X, Refund Request for Unused IBI Postage, in accordance with the requirements in DMM P014.

(2) The provider shall scan the two-dimensional barcode in the submitted indicium, analyze the data to ensure the indicium is valid, and verify the following:

(i) The PSD used in producing the indicium is the expected PSD.

(ii) The unused postage is presented by the user to whom the PSD that produced the indicium is registered.

(iii) The date of mailing shown in the indicium is not more than 10 days before the date on which the registered user mailed the indicium for refund. The date is checked by postmark.

(iv) The human-readable data matches the corresponding data in the two-dimensional barcode.

(v) The PSD certificate has not been revoked.

(vi) The indicium has not been submitted before.

(3) The provider shall submit the indicium data electronically to the Certificate Authority for verification of the digital signature.

(4) The provider shall ensure there is no evidence that the mailpiece has been processed by the Postal Service.

(5) The provider shall annotate Postal Service Form 3533-PCP-X, Refund Request for Unused IBI Postage, and notify both the registered user and the manager of Postage Technology Management, USPS Headquarters, of any instances where the refund request for a given, unused indicium will be denied.

(6) Upon successful signature verification and completion of all other required checks listed above, the provider shall either:

(i) Issue an immediate refund to the registered user from the provider's own funds, or

(ii) Issue the refund to the registered user within 5 business days of receiving reimbursement from the Postal Service.

(7) No more frequently than once per week, the provider shall submit to the Postal Service a refund request for unused postage, using the format in Postal Service Form PCP-X, Provider Refund Request for Information-Based Indicia.

(8) The Postal Service shall remit a check made payable to the provider for the total amount of the refund request for unused postage.

(9) The Postal Service reserves the right to audit the provider's refund processing and the unused mailpieces submitted for refund. Providers are required to maintain the following records:

(i) The unused envelopes and labels submitted for refund, and any other correspondence related to the refund request, attached to a copy of the associated Form 3533 PCP-X, Refund Request for Unused IBI Postage, and organized by the date of the provider's refund request. The Postal Service will destroy the unused mailpieces after the completion of the audit.

(ii) Electronic copies of the scanned indicia organized by date submitted for refund. These are maintained until the Postal Service completes its audit.

(iii) Postal Service Form 3533-PCP-X (printed copy) submitted by the registered user to the provider. The printed copy shall be kept for 1 year. An electronic, scanned version with the registered user's signature shall be kept for 3 years after the destruction of the printed copy.

(iv) A copy of each Postal Service Form PCP-X, Provider Refund Request for Information-Based Indicia, submitted by the provider to the Postal Service. This form shall be maintained by the provider until completion of the Postal Service audit.

(v) A refund count (by number of pieces and postage amount) for each PSD. This information shall be maintained until completion of the first Postal Service audit following the withdrawal of the PSD from service.

(b) Refund for postage balance remaining on a PSD that is withdrawn from service and is in the possession of the provider.

(1) The registered user informs the provider of the intention to withdraw the PSD from service and has the postage evidencing system generate a refund request indicium for transmittal to the provider. The means by which this is accomplished is at the provider's discretion. The transmittal of the refund request indicium is the last activity that is permitted for the PSD. If the registered user has physical possession of the PSD, the registered user returns the withdrawn PSD to the provider, in accordance with regulations for returning PSDs.

(2) Upon receipt of the refund request indicium and the PSD (where applicable), the provider shall scan the two-dimensional barcode in the submitted indicium, analyze the data to ensure the indicium is valid, and verify the following:

(i) The descending register value in the refund request indicium is $0.00.

(ii) The PSD used in producing the indicia is the expected PSD.

(iii) The refund request indicium is presented by the registered user of the PSD.

(iv) The PSD certificate has not been revoked.

(v) There is no evidence of tampering with the PSD.

(3) The provider shall submit the refund request indicium data electronically to the Certificate Authority for digital signature verification.

(4) Under no circumstances may a provider issue a refund for a withdrawn PSD unless the PSD is in the provider's possession.

(5) The provider shall not issue a refund if there is any question as to the remaining postage value on the PSD without first consulting with the manager of Postage Technology Management, USPS Headquarters. The provider shall notify both the registered user and the manager of Postage Technology Management of any instances where the refund request will be denied.

(6) The provider shall generate a form equivalent to Postal Service Form 3601-C, Postage Evidencing System Activity Report, for withdrawal of the PSD. The form will include the refund request indicium.

(7) Upon successful signature verification and completion of all other required checks listed above, the provider shall initiate a PSD withdrawal as specified by Postal Service procedures and shall revoke the PSD certificate. Then the provider shall either:

(i) Issue an immediate refund to the registered user from the provider's own funds; or

(ii) Issue the refund to the registered user within 5 business days of receiving reimbursement from the Postal Service.

(8) No more frequently than once per week, the provider shall submit to the Postal Service a refund request for withdrawn PSDs, including a listing of the refund requested by each registered user, using the format in Postal Service Form PCP-X, Provider Refund Request for Information-Based Indicia.

(9) The Postal Service shall remit a check made payable to the provider for the total amount of the refund request for postage value remaining on withdrawn PSDs.

(10) The Postal Service reserves the right to audit the provider's refund processing and the refund request indicia. Providers are required to maintain the following records:

(i) An electronic copy of a form equivalent to Postal Service Form 3601-C, Postage Evidencing System Activity Report, which includes the refund request indicia, organized by the date of the provider's refund request, shall be kept for 2 years, or until the completion of the Postal Service audit, whichever is longer.

(ii) Any other correspondence that is related to the refund request must be retained by the provider until the Postal Service completes its audit.

(iii) A copy of each Postal Service Form PCP-X, Provider Refund Request for Information-Based Indicia, submitted by the provider to the Postal Service shall be maintained by the provider until completion of the Postal Service audit.

(a) Providers are required to collect registration information and transaction records from registered users on behalf of the Postal Service and to transmit the data to the Postal Service as part of the registration process, the postage payment process; and, for IBI open systems, the mailpiece generation process. Although the Postal Service does not require the provider to retain registered user information, the provider may choose to do so for its own purposes, subject to the following limitations:

(1) A provider that retains personal information regarding a registered user must issue a privacy policy that informs the registered user of the information to be retained and its intended uses.

(2) The provider is strictly prohibited from disclosing any list of applicants or registered users, or any identifying information about any given applicant or registered user, to any other entity, for any purpose, without prior notification to the customer.

(3) The provider must offer the applicant or registered user the option to not have their personal information disclosed to any other entity.

(b) As stated in § 502.21, providers are required to electronically transmit information required to apply for a user registration to the designated Postal Service central registration processing facility, on behalf of applicants.

(c) The Postal Service shall use the registered user information in accordance with the purposes and routine uses published in the Privacy Act system of records USPS 140.020, Postage-Postage Evidencing System Records. The Postal Service may use applicant information in the administration of postage evidencing systems and mailing activities, and to communicate with customers who may no longer be visiting a traditional USPS retail outlet. The Postal Service will also use applicant information to communicate with USPS customers through any new retail channels, and for the following purposes:

(1) To issue (including reregistration, renewal, transfer, revocation, or refusal, as applicable) a user registration to a customer and to communicate with respect to the status of such registration.

(2) To disclose to a provider the identity of any PSD and any related user registration data for any PSDs required to be removed from service by that provider as the result of revocation of a user registration, questioned accurate registration or other failure of the PSD to record its operations correctly and accurately, or decertification by the Postal Service of any particular postage evidencing system that generates IBI or family of such models.

(3) To track the movement of postage evidencing systems between a provider and registered users and to communicate to a provider (but not to any third party other than the applicant/registered user) concerning such movement. The term “provider” includes a provider's dealers and agents.

(4) To transmit general information to all registered users concerning rate and rate category changes implemented or proposed for implementation by the Postal Service.

(5) To advertise Postal Service services relating to the acceptance, processing and delivery of or postage payment for mail using information-based indicia.

(6) To allow the Postal Service to communicate with USPS customers on products, services, and other information otherwise available to USPS customers through traditional retail outlets.

(7) To support any internal use by Postal Service personnel, including identification and monitoring activities relating to postage evidencing systems, provided that such use by the Postal Service does not result in the disclosure of applicant information to any third party and will not enable any third party to use applicant information for its own purposes; except that the applicant information may be disclosed to other governmental agencies for law enforcement purposes as provided by law.

(8) To identify authorized product service providers or announce de-authorization of an authorized product service provider, or provide currently available public information, where an authorized provider is identified.

(9) To promote and encourage the use of information-based indicia as a form of postage evidencing, provided that the same information is provided to all registered users, and no particular provider will be recommended by the Postal Service.

(10) To contact registered users in cases of revenue fraud or revenue security, except that any registered user suspected of fraud shall not be identified to other users.

(11) To disclose to a provider applicant information pertaining to that provider's customers that the Postal Service views as necessary to enable the Postal Service to carry out its duties and purposes.

(12) To transmit to a provider all applicant and system information pertaining to that provider's customers and systems that may be necessary to permit such provider to synchronize its registered user and PSD database with information contained in the computer files of the Postal Service, including but not limited to computerized data that reside in Postal Service postage evidencing system management databases.

(13) Subject to the conditions stated herein, to communicate in oral or written form with any or all applicants and registered users any information that the Postal Service views as necessary or desirable to enable the Postal Service to carry out its duties and purposes under this part 502.

(a) None of the following shall constitute a grant of authorization or consent by the Postal Service or the United States to a provider or any other person to manufacture or use any patented invention or to infringe any copyright, under 28 U.S.C. 1498 or otherwise:

(1) The publication of performance criteria, or

(2) The granting of authorization to a provider under part 501 or this part 502, or

(3) The granting of approval to a provider to market or distribute a postage evidencing system.

(b) A provider must reimburse the Postal Service for any compensation or other costs or damages (other than the Postal Services' own attorneys' fees and other costs of defense) that the Postal Service or the U.S. Government is required, by final order of a court of competent jurisdiction which is either not subject to appeal or as to which the time to appeal has already passed, to pay on a claim of infringement or unauthorized use of a U.S. patent or U.S. copyright, under any legal theory, based on either:

(1) The manufacture, use, sale or importation of provider's postage evidencing system, whether or not such manufacture, use, sale or importation is alleged to be pursuant to authorization or consent provided under 28 U.S.C. 1498;

(2) The use of provider's postage evidencing system by mailers in a manner specified or intended by Provider to create postage indicia, apply such indicia to mail, and/or deposit such mail with the USPS; or

(3) The granting by the Postal Service to provider of government authorization or consent, under 28 U.S.C. 1498 or otherwise, to make or use a patented invention or infringe a copyright in connection with the manufacture, use or sale of provider's postage evidencing system, or the activities of provider pursuant to such grant of authorization and consent.

(c) The Postal Service may suspend approval of a postage evidencing system on 60 days' notice to provider if a court of competent jurisdiction determines that the manufacture or use of the postage evidencing system, or the creation or validation of the indicia produced thereby, infringes, induces or contributes to the infringement of, or otherwise violates any person's or entity's rights under a U.S. patent or U.S. copyright. The Postal Service shall reinstate approval of such postage evidencing system if and so long as:

(1) Such judicial determination is vacated or reversed; or

(2) The provider duly licenses or otherwise procures and maintains in effect (for the benefit of itself, users and the Postal Service as may be necessary) the right to conduct, with respect to provider's postage evidencing device and the indicia created thereby, the activities that the court has determined to be infringing.

(d) A determination that the validating of an indicia by the Postal Service infringes a patent or copyright shall not be a basis for suspending provider's approval if the provider can establish that alternative, non-infringing means of performing such validation are available to the Postal Service with respect to the indicia created by provider's postage evidencing device so long as such means fully comply with the performance criteria under which the postage evidencing device and indicia have been approved.

(e) The Postal Service may provide additional requirements relating to intellectual property in the product submission procedure, performance criteria or both (“IP Requirements”) and may condition the granting or maintenance of approval of a postage evidencing system on provider's compliance with those IP Requirements. When IP Requirements are imposed on a provider, they shall control over any conflicting provision in this § 502.31.

(f) The requirements of this § 502.31 shall apply to all aspects of a provider's postage evidencing device and the indicia created thereby, including those aspects required or specified under applicable performance criteria.

(g) Notwithstanding § 502.1 to the contrary, this § 502.31 shall apply to any postage evidencing system approved by the Postal Service under part 501, part 502 or otherwise and to any performance criteria whether directed to IBI or other forms of postage evidence.

Appropriate amendments to 39 CFR parts 111 and 502 to reflect these changes will be published if the proposal is adopted.

Stanley F. Mires,

Chief Counsel, Legislative.

[FR Doc. 00-25090 Filed 9-29-00; 8:45 am]

BILLING CODE 7710-12-U