numbering identity · published

Robocall mitigation and RMD obligations

Verified 2026-09-16 · 59 sources · tier 1–2

Robocall mitigation and RMD obligations

Every voice service provider must implement an appropriate robocall mitigation program that includes reasonable steps to avoid originating illegal robocall traffic and a commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement and the industry traceback consortium 52. Robocall Mitigation Database certifications must be filed in the appropriate portal on the Commission's website, signed by an officer in conformity with 47 CFR 1.16, and certified as true and correct annually on or before March 1 415.

Who must run a mitigation program

Voice service providers must run a robocall mitigation program with reasonable steps to avoid originating illegal robocall traffic and a 24-hour traceback commitment 52. Gateway providers must run a robocall mitigation program covering calls that use North American Numbering Plan resources pertaining to the United States in the caller ID field, including reasonable steps to avoid carrying or processing illegal robocall traffic 33. Non-gateway intermediate providers have the same structure of obligation as gateway providers: an appropriate robocall mitigation program, reasonable steps to avoid carrying or processing illegal robocall traffic, and a 24-hour traceback commitment 34. The 24-hour traceback commitment covers requests from the Commission, law enforcement and the industry traceback consortium, and it is coupled with cooperation in investigating and stopping illegal robocallers who use the provider's service 47.

What an RMD certification contains

An RMD filer must certify 1 of exactly 3 STIR/SHAKEN states: complete implementation, partial implementation, or no implementation of the framework on any portion of its network 49. Each certification must attest that no prior certification has been removed by Commission action and that the provider has not been prohibited from filing in the Robocall Mitigation Database 43. The robocall mitigation plan filed with a voice service provider certification must state the specific reasonable steps taken 42. Those steps include how the provider complies with its know-your-customer obligation under 47 CFR 64.1200(n)(4), its procedures to know its upstream providers, and the analytics systems it uses to identify and block illegal traffic, with any third-party analytics vendors named 42.

A certification must disclose whether, in the prior 2 years, the filer was subject to any formal action or investigation with findings about illegal robocalls or spoofing, or to a finding of a deficient Robocall Mitigation Database certification or mitigation program description 50. The same disclosure covers any entity with which the filer shares common ownership, management, directors or control 50. The required filing data include the provider's obligation category: direct end-user obligation, wholesale originator on behalf of others, or no obligation 6. A provider that cannot implement STIR/SHAKEN because it lacks control over the network infrastructure must explain that basis in its filing rather than certify implementation 40.

STIR/SHAKEN implementation and third-party authentication

A provider may certify complete or partial implementation in the Robocall Mitigation Database only if it has obtained an SPC token and digital certificate and signs calls with its own certificate 7. All providers with a STIR/SHAKEN implementation obligation are explicitly required to obtain an SPC token from the Policy Administrator and to present it to a STIR/SHAKEN Certificate Authority to obtain a digital certificate 17. Providers that lack control of the network infrastructure necessary to implement STIR/SHAKEN remain outside the signing obligation and cannot claim partial or complete implementation 13.

The Commission defines third-party authentication as an arrangement in which a provider with a STIR/SHAKEN implementation obligation contracts with another party to sign calls on the provider's behalf 18. The definition expressly includes hosted SHAKEN and carrier SHAKEN solutions and excludes cases in which a provider authenticates its own traffic 18. Third-party authentication is authorized only under 2 conditions: the provider with the implementation obligation must make all attestation-level decisions, and all calls must be signed using that provider's certificate 19. Using a third party to sign traffic without meeting both conditions is a violation of the Commission's caller ID authentication rules 20. Third-party authentication arrangements must be memorialized in written agreements, and providers must maintain records of any such agreement 14.

When a wholesaler originates on behalf of a reseller that lacks network infrastructure control, the wholesale provider holds the STIR/SHAKEN implementation obligation, and having an upstream customer does not change that obligation 16. Reseller and wholesaler arrangements fall outside the adopted definition of third-party authentication unless the wholesaler itself uses a signer 15. Compliance with all rules adopted in the Eighth Caller ID Authentication Report and Order was required by September 18, 2025 12.

Updates, recertification, fees and penalties

A filer must update its Robocall Mitigation Database certification within 10 business days of any change to the required certification and identifying information 1. The RMD effectiveness order does not change this 10-business-day mandate in 47 CFR 64.6305(d)(5) 51. If the Governance Authority revokes a provider's SPC token, the 10-business-day clock is deferred until the 60-day Commission review window closes, or until 10 business days after a Wireline Competition Bureau final decision on appeal, or until the 30-day formal appeal deadline if no appeal is filed 48. CORES registrants must update any information submitted to CORES within 10 business days of any change, and the Commission applies this requirement to all filers, including those with individual FRNs 8.

The Commission set an annual deadline of March 1 for recertification of existing Robocall Mitigation Database filings 45. We infer that recertification of existing filings for the first cycle fell due on March 1, 2026 44. Failure to meet the annual recertification requirement results in referral to the Enforcement Bureau 46. The rules in the RMD effectiveness order took effect on February 5, 2026, except the amendments to 47 CFR 1.8002(b)(2), 64.6305(h) and 1.1105 11.

The Commission adopted a $100 application processing fee for initial Robocall Mitigation Database submissions and set a filing fee of $100 per filing for annual recertification, revising 47 CFR 1.1105 28. Before the fee can take effect, it requires notice to Congress as well as updates to information technology and internal procedures 29.

The Commission established a base forfeiture of $10,000 for each violation by filers that submit false or inaccurate information to the Robocall Mitigation Database 32. It also established a base forfeiture of $1,000 for failure to update information that has changed 31. These RMD forfeitures are assessed daily as continuing violations, up to the statutory maximum 30.

The Commission directed the Wireline Competition Bureau to establish a dedicated reporting mechanism for deficient Robocall Mitigation Database filings 10. It also directed the Wireline Competition Bureau and the Office of Managing Director to develop a two-factor or stronger authentication solution for accessing the Robocall Mitigation Database, and that solution must offer users the option of phishing-resistant authentication 39. The Commission declined to adopt a PIN requirement, declined to allow permissive blocking for facially deficient filings, and did not adopt specific data-validation tools 9. It left the Bureau authority to implement those measures if their benefits outweigh their costs 9.

Call acceptance and enforcement

A provider may accept calls directly from another provider only if that provider's filing appears in the Robocall Mitigation Database and has not been de-listed through an enforcement action 4. This acceptance precondition applies to domestic voice service providers 3. Since April 11, 2023, it has also applied to foreign voice or intermediate providers that use US-pertinent NANP numbers in the caller ID, to gateway providers, and to non-gateway intermediate providers whose filing was affirmatively submitted 3. A provider may not block a call to 911 under any circumstances, and it must make reasonable efforts not to block calls from public safety answering points and government emergency numbers 2.

In December 2024, the Enforcement Bureau ordered 2,411 non-compliant companies to show cause why their Robocall Mitigation Database filings should not be removed, and removal would bar other providers from accepting their traffic 21. On September 2, 2026, the Enforcement Bureau removed the certifications of 14 named companies from the Robocall Mitigation Database under file number EB-TCD-25-00038590 27. The stated ground for those removals was that the certifications, including the robocall mitigation plans, lacked required information, and none of the companies updated their certifications in response to the show cause order 24. All intermediate providers and voice service providers must stop accepting traffic directly from the 14 removed companies within 2 business days of the release date 23. The 14 companies may not re-file in the Robocall Mitigation Database without prior approval from both the Enforcement Bureau and the Wireline Competition Bureau 26. The removal order restates that a provider may not block a 911 emergency call and must make all reasonable efforts not to block calls from public safety answering points 22.

WarmTransfer's reading of the sources is that the Commission's enforcement follows a sequence: first a Wireline Competition Bureau deficiency notice, then an Enforcement Bureau show cause order with a cure period, then removal if the provider neither cures nor responds 25.

Proposed know-your-upstream-provider rules

On May 20, 2026, the Commission adopted FCC 26-32, a Further Notice of Proposed Rulemaking on enhancing know-your-upstream-provider requirements and strengthening STIR/SHAKEN, in WC Docket No. 17-97 and CG Docket No. 17-59 37. The Further Notice proposes that providers collect information about their upstream providers, verify it, monitor those providers' traffic and practices, and refuse or discontinue service when the evidence shows an upstream provider is a bad actor 35. The Federal Register printing of this item is designated "ACTION: Proposed rule" and uses propose-and-seek-comment framing throughout 38. Comments were due August 10, 2026, and reply comments were due September 8, 2026 38.

Platform differences: Webex Calling

Cisco documents that Webex Calling reads the STIR/SHAKEN verification result from the verstat parameter in the SIP P-Asserted-Identity header, which takes the values TN-Validation-Passed, TN-Validation-Failed and No-TN-Validation 59. According to the same documentation, Webex Calling maps attestation levels A, B and C to Verified Caller, Possible Spam and Potential Fraud 59. In Webex Calling Control Hub, the setting that blocks calls that failed caller ID validation is off by default, while the setting that presents calls from unverified callers as normal calls is on by default 53.

Cisco documents that Webex Calling can query a certified calling reputation provider, which returns an allow, block or challenge action 54. Blocked calls are released with cause 603, and challenged callers get 3 attempts with a 15-second timeout 54. For on-premises PSTN behind CUBE or a Local Gateway in the United States and Canada, Cisco documents specific SIP profile configuration to pass the verstat parameter through to Webex Calling 55. On-net calls between Webex Calling users display as verified 57. Calls from on-premises Unified CM users are judged against the enterprise dial plan rather than by the public framework 57.

Applicability

Applies to: Federal Communications Commission Robocall Mitigation Database, Federal Communications Commission STIR SHAKEN, Federal Communications Commission CORES registration system, and Cisco Webex Calling. Deployments: multi-tenant, all-us-voice-service-provider-networks, foreign-providers-terminating-to-the-us, gateway-provider-networks, intermediate-provider-networks, on-premises-gateway, and on-premises-ucm-integration. Sources checked 2026-09-16. The regulatory obligations apply in the United States, and the rules in the RMD effectiveness order have been in force since February 5, 2026, apart from the listed exceptions 11. Compliance with the Eighth Caller ID Authentication Report and Order rules was required by September 18, 2025 12. The Webex Calling call indication and caller ID validation settings apply only to Webex Calling locations in the United States and Canada, and calls elsewhere present normally 58. The Webex Calling caller-reputation and call-indication features require Webex App desktop or mobile 42.5 or higher, and 6800, 7800, 8800 or 9800 series MPP devices on firmware 11.3.7 or higher 56. The Webex Calling claims also cover on-premises PSTN behind CUBE or a Local Gateway 55, as well as calls from on-premises Unified CM users 57.

What remains uncertain

Cisco Systems' own RMD filing number and certification category are not covered by the sources below. Whether cloud contact centre platforms count as voice service providers for RMD purposes is not covered by the sources below. Any per-call forfeiture amounts for know-your-upstream-provider violations in the primary text of FCC 26-32 are not covered by the sources below. The $100 Robocall Mitigation Database fee provision was carved out of the February 5, 2026 effective date, and its effective date is to be announced in a later Federal Register document 29. How the 64.6305(g) acceptance duty applies to bring-your-own-carrier and similar cloud-connected PSTN deployments is not covered by the sources below. The content and status of a separate Commission know-your-customer further notice of proposed rulemaking are not covered by the sources below. The current number of entries in the Robocall Mitigation Database is not covered by the sources below. Providers may accept calls directly only from providers whose filing appears in the Robocall Mitigation Database and has not been de-listed 4. This precondition has applied since April 11, 2023 to foreign voice or intermediate providers that use US-pertinent NANP numbers in the caller ID 3. Any further effect of de-listing on non-US intermediate providers terminating into the United States is not covered by the sources below.