(a) Description. The Computerized Meter Resetting System (CMRS) permits customers to reset their postage meters at their places of business. Authorized providers, who operate CMRS services, are known as resetting companies (RCs).

(b) A customer is required to have funds available on deposit with the Postal Service before resetting a Postage Evidencing System or the provider may opt to provide a funds advance in accordance with paragraph (c) of this section.

(c) If the RC chooses to offer advancement of funds to customers, the RC is required to maintain a deposit with the Postal Service equal to at least one (1) day's average funds advanced. The total amount of funds advanced to customers on any given day shall not exceed the amount the provider has on deposit with the Postal Service. The Postal Service shall not be liable for any payment made by the RC on behalf of a customer that is not reimbursed by the customer, since the RC is solely responsible for the collection of advances made by the RC.

(d) The CMRS customer is permitted to make deposits in one of three ways: check, electronic funds transfer (or wire transfer), or automated clearinghouse (ACH) transfer. These deposits must be remitted to the Postal Service's designated bank account.

(e) The RC must require each CMRS customer that requests a meter resetting to provide the meter serial number, the CMRS account number, and the meter's ascending and descending register readings. The RC must verify that there are sufficient funds in the customer's CMRS account to cover the postage setting requested before proceeding with the setting transaction (unless the RC opts to provide the customer a funds advance).

(f) The Postal Service requires that the RC publicize to all CMRS customers the following payment options (listed in order of preference):

(1) Automated clearinghouse (ACH) debits/credits.

(2) Electronic funds transfers (wire transfers).

(3) Checks.

(g) Financial responsibility for returned payments. The RC is required to reimburse the Postal Service upon request for any returned checks or ACH debits for postage payments. The RC must, upon first becoming aware of a returned check or ACH debit, immediately lock the customer's CMRS account to prevent a meter reset until the RC receives confirmation of payment for the returned item. If a penalty or fine is assessed against the Postal Service for returned checks or ACH debit payments from an RC's customer, the Postal Service may request reimbursement for such penalty or fine from the RC. The RC is required to remit the amount of the returned item to the Postal Service plus the reimbursement request, to the extent applicable, within ten (10) banking days. Invoices will be created monthly for returns and/or applicable penalties or fines incurred for the previous month. The 10 banking days will start once the invoice is mailed. The RC has discretion to decide whether to charge its customer for any such reimbursement costs (of penalties or fines) the RC pays to the Postal Service in connection with the customer's returned check or ACH debit.

(h) Refunds. The Postal Service will issue a refund in the amount remaining in a customer's Computerized Meter Resetting System account, after such time as the customer provides a written request to the provider, as long as the request meets the Postal Service approved minimum and time frame.

(i) Security and revenue protection. To receive Postal Service approval to continue to operate systems in the postage meters environment, the RC must submit to a periodic examination and provide a System and Organization Control (SOC) 1 Type II Report of its meter system and any other applications and technology infrastructure that may have a material impact on Postal Service revenues, as determined by the Postal Service. Additionally, RC must submit to a periodic examination and provide a SOC 2 Type II Report of its meter system data security, accuracy, processing integrity and data integrity for any applications, reports, and technology infrastructure that may have a material impact on the RC's reports, which the Postal Service relies upon. For the initial SOC 2 Type I report, the Postal Service will provide the control objectives by March 18, 2020. The due date for the initial SOC 2 Type I is July 1, 2020, with the SOC 2 Type II due on August 15, 2021. Both the SOC 1 and SOC 2 examinations shall be performed by a qualified, independent audit firm and shall be conducted in accordance with the Statements on Standards for Attestation Engagements (SSAEs) No. 18, Service Organizations, developed by the American Institute of Certified Public Accountants (AICPA), as amended or superseded. Expenses associated with such examination shall be incurred by the RC. The examination shall include testing of the operating effectiveness of relevant RC internal controls (SOC 1 Type II SSAE 18 & SOC 2 Type II SSAE 18 Reports). If the service organization uses another service organization (sub-service provider), the RC should consider the nature and materiality of the transactions and data processed by the sub-service organization and the contribution of the sub-service organization's processes and controls in the achievement of the Postal Service's control objectives. Resetting companies are expected to submit any request for changes to control objectives by December 31 of each year, which will be taken under consideration by the Postal Service for review and approval. The Postal Service will provide common control objectives to be covered by the SOC 1 Type II SSAE 18 by January 31 each year. As a result of the examination, the service auditor shall provide the RC and the Postal Service with an opinion on the design and operating effectiveness of the RC's internal controls related to the meter system and any other applications and technology infrastructure considered material to the services provided to the Postal Service by the RC. SOC 1 and SOC 2 examinations are to be conducted on no less than an annual basis, and are to be as of and for the 12 months ended June 30 of each year (except for new contracts for which the examination period will be no less than the period from the contract date to the following June 30, unless otherwise agreed to by the Postal Service). The SOC 1 and SOC 2 examination reports are to be provided to the Postal Service by August 15 of each year. To the extent that internal control weaknesses are identified in a SOC report, the Postal Service requires prompt communication and remediation of such weaknesses and shall have the right to review working papers and engage in discussions about the work performed with the service auditor. The Postal Service requires that all remediation efforts (if applicable) are completed and reported by the RC prior to the Postal Service's fiscal year end (September 30). In addition, the RC will be responsible for evaluating its internal control environment related to the meter system and any other applications and technology infrastructure considered material to the services provided to the Postal Service by the RC, in particular, disclosing changes to internal controls for the period of July 1 to September 30. This evaluation should be documented and submitted to the Postal Service by October 15 of each year. The RC will be responsible for all costs related to the examinations conducted by the service auditor and the RC.

(j) Inspection of records and facilities. The RC must make its facilities that handle the operation of the computerized resetting system and all records about the operation of the system available for inspection by representatives of the Postal Service at all reasonable times. At its discretion, the Postal Service may continue to fund inspections as it has in the past, provided the costs are not associated with a particular security issue related to the RC's meter systems and supporting infrastructure.

(k) The RC is required to incorporate the following language into its meter rental agreements:

[71 FR 65733, Nov. 9, 2006, as amended at 75 FR 56472, Sept. 16, 2010; 77 FR 56554, Sept. 13, 2012; 79 FR 10994, Feb. 27, 2014; 85 FR 12872, Mar. 5, 2020]