USPS CMRA Requirements: The 2026 Compliance Checklist

What are the USPS CMRA requirements?

USPS CMRA requirements live in one place: Domestic Mail Manual § 508.1.8, which defines a commercial mail receiving agency as “a business that, in whole or in part, accepts the delivery of U.S. Mail on behalf of another person or entity as a business service” — and then attaches six standing duties to that status. Virtual mailbox platforms, mail-forwarding services, office business centers, and reshipping providers all sit inside that definition (the DMM classifies office business centers and reshipping/redelivery providers as CMRAs for postal purposes), so the same checklist applies whether you run one storefront or a national platform. Our explainer on what qualifies as a CMRA covers the definitional line; this guide covers the operator’s obligations on the other side of it.

The six duties, in the order a new operator meets them:

1. Register with the responsible Post Office by submitting PS Form 1583-A before accepting mail for customers.
2. Collect a completed PS Form 1583 — with the signature verified and two IDs checked — from every addressee, before delivering their mail.
3. Upload each record — the 1583 data plus legible copies of each ID document — to the USPS CMRA Customer Registration Database (CRD).
4. Certify the database quarterly (January 15, April 15, July 15, October 15) that every form is current and no ID has expired.
5. Use PMB addressing — every customer address carries the “PMB” designation or the ”#” alternative, and the CMRA represents its delivery address as a private mailbox.
6. Remail a terminated customer’s mail for at least 6 months and retain the endorsed 1583 copies for at least 6 months after termination.

Each duty gets its own section below, quoting the rule it comes from. One framing note before the detail: USPS CMRA requirements were overhauled in 2023 — a Federal Register proposed rule in January, a DMM revision effective July 1 (published July 9), and a new database user guide in October — so any compliance summary written before that wave describes a system that no longer exists. The timeline section maps the change sequence.

The CMRA compliance cycle under DMM 508.1.8 — the five duties that repeat for every operator, compiled from the DMM and Postal Bulletin 22624.

How does a business register as a CMRA with PS Form 1583-A?

Registration happens at the local Post Office, on paper, before anything else. Under DMM 508.1.8, a CMRA must register with its responsible Post Office by submitting PS Form 1583-A, Application to Act as a Commercial Mail Receiving Agency — the current edition is dated January 2023. The owner or manager presents two types of identification (box 10 of the form): one must contain a photograph of the CMRA owner or manager, and one must bear their home address. The form itself lists what counts — acceptable photo IDs include a valid U.S. state/territory/tribal driver’s or non-driver’s ID card, U.S. Access Card, Uniformed Service ID, passport, Matricula Consular, NEXUS card, certificate of naturalization, or U.S. Permanent Resident Card; acceptable address verification includes a current lease, mortgage or deed of trust, voter or vehicle registration card, or a home or vehicle insurance policy listing the address.

The postmaster or designee is an active participant, not a filing clerk: they verify the owner/manager’s residency, witness the signature, write in the identifying information, and file the completed form. Providing false information — or refusing to provide documentation — is grounds for denial, and the form carries an explicit warning that furnishing false or misleading information may result in criminal and civil sanctions under 18 U.S.C. § 1001.

What the operator agrees to by signing

PS Form 1583-A is short, but the agreement block at the top is the closest thing USPS publishes to a CMRA contract. By signing, the agent agrees to five conditions, printed on the form:

1. The CMRA must have on file a PS Form 1583 for the owner/manager and each addressee or firm receiving mail at the agency — the operator files a 1583 too, not just the customers.
2. The CMRA must represent its delivery address as a private mailbox.
3. The CMRA is not authorized to accept Registered Mail from its clients for mailing — the Post Office is the only acceptable mailing point.
4. The CMRA must be in full compliance with DMM 508.1.8 and other applicable postal requirements.
5. When any information on the form changes, the owner or manager must file a new application with the postmaster.

That fifth condition catches operators by surprise: a change of manager, address, or contact details means a fresh 1583-A, not a note in the file. Questions about the program itself go to the USPS CMRA office at CMRAprogram@usps.gov — the contact printed on the form.

What does DMM 508.1.8 require for each customer’s PS Form 1583?

Every addressee completes PS Form 1583 before the CMRA may deliver their mail, and the signature on it must be verified through one of exactly two lanes. The DMM’s own sentence is worth quoting in full, because it is the legal basis for remote onboarding:

“The mail addressee (the applicant) must sign or confirm his or her signature in the physical or virtual (in real-time audio and video) presence of the CMRA owner or manager, or authorized employee, or acknowledge his or her signature in the physical or virtual (in real-time audio and video) presence of a notary public commissioned in a United States state, territory, possession, or the District of Columbia.” — DMM 508.1.8

Both lanes satisfy USPS CMRA requirements; they differ in who does the verifying and who carries the operational load:

	Lane 1: CMRA-witnessed	Lane 2: Notarized
Who verifies the signature	The CMRA owner, manager, or an authorized employee	A notary public commissioned in a U.S. state, territory, possession, or D.C.
Presence permitted	Physical, or virtual in real-time audio and video	Physical, or virtual in real-time audio and video
Who runs the ID check	Your staff, against the DMM’s ID standards	The notary, as part of the notarial act
Where the work lands	On your team — training, live sessions, documentation	On the notary — your team receives the completed form
Typical fit	Walk-in storefront signups	Remote signups at scale, where no staff member meets the customer

The applicant’s identification must meet the DMM’s standard regardless of lane: acceptable primary and secondary forms of identification as specified under DMM 608.10.0, current (not expired), containing sufficient information to confirm the applicant is who they claim to be, and traceable to the bearer. The 2023 DMM revision added two rules operators should build into intake screening: spouses must each complete a separate PS Form 1583 to receive mail at the same private mailbox, and the address information on the form “must match the photo and address verification documents provided with the application, or the application will be rejected” (Postal Bulletin 22624).

That match-or-reject rule is where most preventable failures happen — a customer lists their new apartment while their driver’s license still shows the old one. Our companion guide on why 1583s get rejected maps each rejection cause to the form box that triggers it, and the signer-side walkthrough of USPS Form 1583’s rules and ID list is the page to hand your customers. This article stays on the operator’s side of the counter.

How does the CMRA Customer Registration Database work?

The CRD replaced paper filing at the Post Office. The January 2023 Federal Register proposed rule (FR doc. 2023-00437) set the direction — CMRA owners or managers would enter each PS Form 1583’s data and upload copies of the supporting identification documents into the Postal Service’s electronic CMRA Customer Registration Database. The DMM revision that followed made it a standing duty, in its own words: “The CMRA must enter the information provided on each PS Form 1583 and upload a clear and legible copy of each identification document into the USPS CMRA Customer Registration Database” (Postal Bulletin 22624).

Access runs through the USPS Business Customer Gateway. Per the CMRA User Guide (Rev. October 30, 2023), you must have a BCG account and an authorized 1583-A location to access the CMRA system — the guide notes that no prior approval is needed to create the BCG account itself, but an approved PS Form 1583-A is required before you can create and access a CMRA account and claim your location. Once inside, the workflow mirrors the form: the add-a-customer flow walks through the applicant’s details, business/organization information, additional mail recipients, identification information, and document upload before submission, and a separate function updates existing customers.

Three CRD habits keep the database defensible at inspection time:

• Upload quality matters. The duty is a “clear and legible copy of each identification document” — a cropped, glare-covered phone photo fails the standard the rule sets.
• Termination dates go in promptly. The DMM requires the CMRA to enter the date of termination in the CRD “as soon as practical” — and stale termination dates are one of the three things the quarterly certification attests to.
• The CRD does not replace local records. The CMRA must still maintain, at minimum, a digital copy of each completed PS Form 1583 at the CMRA business location, available for examination by Postal Service representatives.

Technical problems with the system have their own channel — CMRATechSupport@usps.gov, per the User Guide — separate from the CMRA program office.

When are CMRA quarterly certifications due?

Four dates anchor the CMRA compliance calendar: January 15, April 15, July 15, and October 15. The rule, as published in Postal Bulletin 22624: “The CMRA must certify in the USPS CMRA Customer Registration Database each quarter (certification due on January 15, April 15, July 15, and October 15), that every PS Form 1583 it submitted is current, all termination dates have been updated, and no identification documents are expired.”

Read as an operator’s task list, each certification is a three-part sweep of the customer base:

1. Currency sweep — every active PMB has a current PS Form 1583 in the CRD; customers whose details changed need a revised form on file, not a note.
2. Termination sweep — every closed account shows its termination date in the database.
3. ID-expiry sweep — no active customer’s uploaded identification document has passed its expiration date. An ID that was valid at signup and has since expired now fails the certification, which converts ID expiration dates into a recurring re-verification trigger. Our guide to when a Form 1583 must be redone covers what that means for customers mid-lifecycle.

The consequences of falling short are spelled out in two places. PS Form 1583-A warns that failure to comply with DMM 508.1.8 “may subject the agency to withholding of mail until corrective action is taken” — for a mailbox business, an operational stop. And the 2023 DMM revision requires a CMRA to correct all deficiencies the Postal Service identifies in no more than 30 days, or the Postal Service may terminate its authorization to accept mail on behalf of others. A quarterly certification signed without the three sweeps behind it is also a false statement to a federal agency — the same 18 U.S.C. § 1001 warning printed on the 1583-A applies to the information the operator submits.

What are the PMB addressing rules?

Every CMRA customer’s address must carry the private-mailbox designation. Under DMM 508.1.8, customers must use “PMB” or the alternative ”#” sign in their delivery address, and the DMM’s example shows the designator riding on the street line:

JOE DOE 10 MAIN ST STE 11 PMB 234 HERNDON VA 22071-2716

The addressing duty pairs with two of the operator’s 1583-A commitments: the CMRA represents its delivery address as a private mailbox — not a “suite” in a way that disguises the CMRA relationship — and it does not accept Registered Mail from clients for outbound mailing; the Post Office is the only acceptable mailing point. For operators, the practical task is enforcement at signup: publish the exact address format each customer must use, PMB designator included, and reject marketing copy that presents the mailbox as an office suite. Banks, state filing offices, and other institutions routinely check addresses against USPS CMRA flags, so a customer who strips the PMB from their address creates friction that lands back on your support desk.

What must a CMRA do when a customer terminates?

Termination starts a six-month clock, not a clean break. DMM 508.1.8.4 requires the CMRA to remail mail intended for the addressee for at least 6 months after the termination date, and new postage is required for each remailed piece — the forwarding cost sits with the CMRA/customer relationship, not with USPS. After the 6-month period expires, the CMRA may return unopened mail to the Post Office endorsed “Undeliverable, Commercial Mail Receiving Agency, No Authorization to Receive Mail for this Addressee.”

The records side has its own retention rule: the CMRA must retain the endorsed copies of PS Forms 1583 for a minimum of 6 months after the termination date. Add the CRD duty — the termination date entered “as soon as practical” — and a compliant offboarding runs three steps: enter the termination date in the CRD, keep the endorsed 1583 copies for six months, and remail arriving mail with new postage until the window closes. Operators who build this into an offboarding checklist avoid the most common inspection finding a growing mailbox business can generate: active-looking PMBs in the database for customers who left a year ago.

How did the 2023 overhaul change CMRA compliance?

The current USPS CMRA requirements arrived in one coordinated wave across 2023, and the sequence explains why so much older guidance is wrong:

Date	What changed	Source
January 2023	PS Form 1583-A re-issued — the current edition of the operator registration form	PS Form 1583-A (edition date on form)
January 12, 2023	Federal Register proposed rule published: electronic CRD to replace paper filing, digital 1583 submissions, quarterly certification — comments due February 13, 2023; proposed March 1, 2023 implementation	FR doc. 2023-00437
July 1, 2023	DMM 508.1.8 revisions take effect (published in Postal Bulletin 22624 on July 9): CRD entry and ID-upload duty, quarterly certification dates, spouses-file-separately rule, match-or-reject standard	Postal Bulletin 22624
October 30, 2023	CMRA User Guide published (Rev –): BCG-based access, add-customer and quarterly-review workflows documented	CMRA User Guide

Before this wave, a CMRA filed paper 1583 copies with the local Post Office and compliance was largely a filing-cabinet exercise. After it, every customer record is a database entry USPS can query, certification is an affirmative quarterly act with fixed due dates, and ID expiration is a living data point rather than a one-time checkbox. The operational consequence for operators: compliance became continuous. A mailbox business that treats the 1583 as one-and-done onboarding paperwork now fails the certification cycle by design.

Where does the notarized lane fit an operator’s workflow?

The notarized lane is the verification step an operator can take off its own staff. DMM 508.1.8 puts both lanes on equal footing, so the choice is operational: a storefront with trained staff can witness walk-in signatures in-house, while a remote-first platform either builds a real-time audio-video witnessing program — trained employees, live sessions, session documentation — or routes each signup to a commissioned notary and receives the completed, acknowledged form back.

Routing to online notarization through our PS Form 1583 workflows for virtual mailbox operators works business-initiated: your team uploads the customer’s completed 1583 and sends the session invitation, so the customer never hunts for a notary on their own. Sessions run 24/7 and take 15–30 minutes, signers can connect from all 50 states, and identity verification runs credential analysis plus knowledge-based authentication through a third-party identity-verification service before the notary appears. Each session produces a tamper-evident PDF with a complete audit trail, and the audio-video recording and electronic journal entry are retained for 10 years — or longer where state law requires — which gives an operator a verification record it can point to at inspection time, independent of its own files. Pricing is $25 per document, with volume pricing for operators moving steady signup counts.

The two lanes also mix. Many operators witness in-store signups themselves and reserve the notarized lane for remote customers — the DMM does not require one lane across the whole customer base. Whichever split you run, the downstream duties stay identical: upload to the CRD, certify quarterly, retain the copies, remail for six months after termination.

Questions about wiring the notarized lane into your signup flow? Call 804-767-7500 or reach us through the contact page.