# Robocall mitigation and RMD obligations

Canonical: https://warmtransfer.net/knowledge/robocall-mitigation

Last verified: 2026-09-16

# Robocall mitigation and RMD obligations

Every voice service provider must implement an appropriate robocall mitigation program that includes reasonable steps to avoid originating illegal robocall traffic and a commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement and the industry traceback consortium[^52]. Robocall Mitigation Database certifications must be filed in the appropriate portal on the Commission's website, signed by an officer in conformity with 47 CFR 1.16, and certified as true and correct annually on or before March 1[^41][^5].

## Who must run a mitigation program

Voice service providers must run a robocall mitigation program with reasonable steps to avoid originating illegal robocall traffic and a 24-hour traceback commitment[^52]. Gateway providers must run a robocall mitigation program covering calls that use North American Numbering Plan resources pertaining to the United States in the caller ID field, including reasonable steps to avoid carrying or processing illegal robocall traffic[^33]. Non-gateway intermediate providers have the same structure of obligation as gateway providers: an appropriate robocall mitigation program, reasonable steps to avoid carrying or processing illegal robocall traffic, and a 24-hour traceback commitment[^34]. The 24-hour traceback commitment covers requests from the Commission, law enforcement and the industry traceback consortium, and it is coupled with cooperation in investigating and stopping illegal robocallers who use the provider's service[^47].

## What an RMD certification contains

An RMD filer must certify 1 of exactly 3 STIR/SHAKEN states: complete implementation, partial implementation, or no implementation of the framework on any portion of its network[^49]. Each certification must attest that no prior certification has been removed by Commission action and that the provider has not been prohibited from filing in the Robocall Mitigation Database[^43]. The robocall mitigation plan filed with a voice service provider certification must state the specific reasonable steps taken[^42]. Those steps include how the provider complies with its know-your-customer obligation under 47 CFR 64.1200(n)(4), its procedures to know its upstream providers, and the analytics systems it uses to identify and block illegal traffic, with any third-party analytics vendors named[^42].

A certification must disclose whether, in the prior 2 years, the filer was subject to any formal action or investigation with findings about illegal robocalls or spoofing, or to a finding of a deficient Robocall Mitigation Database certification or mitigation program description[^50]. The same disclosure covers any entity with which the filer shares common ownership, management, directors or control[^50]. The required filing data include the provider's obligation category: direct end-user obligation, wholesale originator on behalf of others, or no obligation[^6]. A provider that cannot implement STIR/SHAKEN because it lacks control over the network infrastructure must explain that basis in its filing rather than certify implementation[^40].

## STIR/SHAKEN implementation and third-party authentication

A provider may certify complete or partial implementation in the Robocall Mitigation Database only if it has obtained an SPC token and digital certificate and signs calls with its own certificate[^7]. All providers with a STIR/SHAKEN implementation obligation are explicitly required to obtain an SPC token from the Policy Administrator and to present it to a STIR/SHAKEN Certificate Authority to obtain a digital certificate[^17]. Providers that lack control of the network infrastructure necessary to implement STIR/SHAKEN remain outside the signing obligation and cannot claim partial or complete implementation[^13].

The Commission defines third-party authentication as an arrangement in which a provider with a STIR/SHAKEN implementation obligation contracts with another party to sign calls on the provider's behalf[^18]. The definition expressly includes hosted SHAKEN and carrier SHAKEN solutions and excludes cases in which a provider authenticates its own traffic[^18]. Third-party authentication is authorized only under 2 conditions: the provider with the implementation obligation must make all attestation-level decisions, and all calls must be signed using that provider's certificate[^19]. Using a third party to sign traffic without meeting both conditions is a violation of the Commission's caller ID authentication rules[^20]. Third-party authentication arrangements must be memorialized in written agreements, and providers must maintain records of any such agreement[^14].

When a wholesaler originates on behalf of a reseller that lacks network infrastructure control, the wholesale provider holds the STIR/SHAKEN implementation obligation, and having an upstream customer does not change that obligation[^16]. Reseller and wholesaler arrangements fall outside the adopted definition of third-party authentication unless the wholesaler itself uses a signer[^15]. Compliance with all rules adopted in the Eighth Caller ID Authentication Report and Order was required by September 18, 2025[^12].

See also [STIR SHAKEN attestation framework](https://warmtransfer.net/knowledge/stir-shaken-framework) and [Troubleshooting STIR/SHAKEN attestation levels on outbound calls](https://warmtransfer.net/knowledge/stir-shaken-attestation-troubleshooting).

## Updates, recertification, fees and penalties

A filer must update its Robocall Mitigation Database certification within 10 business days of any change to the required certification and identifying information[^1]. The RMD effectiveness order does not change this 10-business-day mandate in 47 CFR 64.6305(d)(5)[^51]. If the Governance Authority revokes a provider's SPC token, the 10-business-day clock is deferred until the 60-day Commission review window closes, or until 10 business days after a Wireline Competition Bureau final decision on appeal, or until the 30-day formal appeal deadline if no appeal is filed[^48]. CORES registrants must update any information submitted to CORES within 10 business days of any change, and the Commission applies this requirement to all filers, including those with individual FRNs[^8].

The Commission set an annual deadline of March 1 for recertification of existing Robocall Mitigation Database filings[^45]. We infer that recertification of existing filings for the first cycle fell due on March 1, 2026[^44]. Failure to meet the annual recertification requirement results in referral to the Enforcement Bureau[^46]. The rules in the RMD effectiveness order took effect on February 5, 2026, except the amendments to 47 CFR 1.8002(b)(2), 64.6305(h) and 1.1105[^11].

The Commission adopted a $100 application processing fee for initial Robocall Mitigation Database submissions and set a filing fee of $100 per filing for annual recertification, revising 47 CFR 1.1105[^28]. Before the fee can take effect, it requires notice to Congress as well as updates to information technology and internal procedures[^29].

The Commission established a base forfeiture of $10,000 for each violation by filers that submit false or inaccurate information to the Robocall Mitigation Database[^32]. It also established a base forfeiture of $1,000 for failure to update information that has changed[^31]. These RMD forfeitures are assessed daily as continuing violations, up to the statutory maximum[^30].

The Commission directed the Wireline Competition Bureau to establish a dedicated reporting mechanism for deficient Robocall Mitigation Database filings[^10]. It also directed the Wireline Competition Bureau and the Office of Managing Director to develop a two-factor or stronger authentication solution for accessing the Robocall Mitigation Database, and that solution must offer users the option of phishing-resistant authentication[^39]. The Commission declined to adopt a PIN requirement, declined to allow permissive blocking for facially deficient filings, and did not adopt specific data-validation tools[^9]. It left the Bureau authority to implement those measures if their benefits outweigh their costs[^9].

## Call acceptance and enforcement

A provider may accept calls directly from another provider only if that provider's filing appears in the Robocall Mitigation Database and has not been de-listed through an enforcement action[^4]. This acceptance precondition applies to domestic voice service providers[^3]. Since April 11, 2023, it has also applied to foreign voice or intermediate providers that use US-pertinent NANP numbers in the caller ID, to gateway providers, and to non-gateway intermediate providers whose filing was affirmatively submitted[^3]. A provider may not block a call to 911 under any circumstances, and it must make reasonable efforts not to block calls from public safety answering points and government emergency numbers[^2].

In December 2024, the Enforcement Bureau ordered 2,411 non-compliant companies to show cause why their Robocall Mitigation Database filings should not be removed, and removal would bar other providers from accepting their traffic[^21]. On September 2, 2026, the Enforcement Bureau removed the certifications of 14 named companies from the Robocall Mitigation Database under file number EB-TCD-25-00038590[^27]. The stated ground for those removals was that the certifications, including the robocall mitigation plans, lacked required information, and none of the companies updated their certifications in response to the show cause order[^24]. All intermediate providers and voice service providers must stop accepting traffic directly from the 14 removed companies within 2 business days of the release date[^23]. The 14 companies may not re-file in the Robocall Mitigation Database without prior approval from both the Enforcement Bureau and the Wireline Competition Bureau[^26]. The removal order restates that a provider may not block a 911 emergency call and must make all reasonable efforts not to block calls from public safety answering points[^22].

WarmTransfer's reading of the sources is that the Commission's enforcement follows a sequence: first a Wireline Competition Bureau deficiency notice, then an Enforcement Bureau show cause order with a cure period, then removal if the provider neither cures nor responds[^25].

See also [Call blocking and analytics labeling remediation](https://warmtransfer.net/knowledge/call-blocking-labeling).

## Proposed know-your-upstream-provider rules

On May 20, 2026, the Commission adopted FCC 26-32, a Further Notice of Proposed Rulemaking on enhancing know-your-upstream-provider requirements and strengthening STIR/SHAKEN, in WC Docket No. 17-97 and CG Docket No. 17-59[^37]. The Further Notice proposes that providers collect information about their upstream providers, verify it, monitor those providers' traffic and practices, and refuse or discontinue service when the evidence shows an upstream provider is a bad actor[^35]. The Federal Register printing of this item is designated "ACTION: Proposed rule" and uses propose-and-seek-comment framing throughout[^38]. Comments were due August 10, 2026, and reply comments were due September 8, 2026[^38].

## Platform differences: Webex Calling

Cisco documents that Webex Calling reads the STIR/SHAKEN verification result from the verstat parameter in the SIP P-Asserted-Identity header, which takes the values TN-Validation-Passed, TN-Validation-Failed and No-TN-Validation[^59]. According to the same documentation, Webex Calling maps attestation levels A, B and C to Verified Caller, Possible Spam and Potential Fraud[^59]. In Webex Calling Control Hub, the setting that blocks calls that failed caller ID validation is off by default, while the setting that presents calls from unverified callers as normal calls is on by default[^53].

Cisco documents that Webex Calling can query a certified calling reputation provider, which returns an allow, block or challenge action[^54]. Blocked calls are released with cause 603, and challenged callers get 3 attempts with a 15-second timeout[^54]. For on-premises PSTN behind CUBE or a Local Gateway in the United States and Canada, Cisco documents specific SIP profile configuration to pass the verstat parameter through to Webex Calling[^55]. On-net calls between Webex Calling users display as verified[^57]. Calls from on-premises Unified CM users are judged against the enterprise dial plan rather than by the public framework[^57].

## Applicability

Applies to: Federal Communications Commission Robocall Mitigation Database, Federal Communications Commission STIR SHAKEN, Federal Communications Commission CORES registration system, and Cisco Webex Calling. Deployments: multi-tenant, all-us-voice-service-provider-networks, foreign-providers-terminating-to-the-us, gateway-provider-networks, intermediate-provider-networks, on-premises-gateway, and on-premises-ucm-integration. Sources checked 2026-09-16. The regulatory obligations apply in the United States, and the rules in the RMD effectiveness order have been in force since February 5, 2026, apart from the listed exceptions[^11]. Compliance with the Eighth Caller ID Authentication Report and Order rules was required by September 18, 2025[^12]. The Webex Calling call indication and caller ID validation settings apply only to Webex Calling locations in the United States and Canada, and calls elsewhere present normally[^58]. The Webex Calling caller-reputation and call-indication features require Webex App desktop or mobile 42.5 or higher, and 6800, 7800, 8800 or 9800 series MPP devices on firmware 11.3.7 or higher[^56]. The Webex Calling claims also cover on-premises PSTN behind CUBE or a Local Gateway[^55], as well as calls from on-premises Unified CM users[^57].

## What remains uncertain

Cisco Systems' own RMD filing number and certification category are not covered by the sources below. Whether cloud contact centre platforms count as voice service providers for RMD purposes is not covered by the sources below. Any per-call forfeiture amounts for know-your-upstream-provider violations in the primary text of FCC 26-32 are not covered by the sources below. The $100 Robocall Mitigation Database fee provision was carved out of the February 5, 2026 effective date, and its effective date is to be announced in a later Federal Register document[^29]. How the 64.6305(g) acceptance duty applies to bring-your-own-carrier and similar cloud-connected PSTN deployments is not covered by the sources below. The content and status of a separate Commission know-your-customer further notice of proposed rulemaking are not covered by the sources below. The current number of entries in the Robocall Mitigation Database is not covered by the sources below. Providers may accept calls directly only from providers whose filing appears in the Robocall Mitigation Database and has not been de-listed[^4]. This precondition has applied since April 11, 2023 to foreign voice or intermediate providers that use US-pertinent NANP numbers in the caller ID[^3]. Any further effect of de-listing on non-US intermediate providers terminating into the United States is not covered by the sources below.

## Sources

[^1]: A filer must update its Robocall Mitigation Database certification within 10 business days of any change to the required certification and identifying information. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(5). Checked 2026-09-16.
[^2]: A provider may not block a voice call under any circumstances if the call is an emergency call placed to 911, and must make reasonable efforts to ensure it does not block calls from public safety answering points and government emergency numbers. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(g)(5). Checked 2026-09-16.
[^3]: The acceptance precondition applies to domestic voice service providers, and from April 11, 2023 to foreign voice or intermediate providers using US-pertinent NANP numbers in the caller ID and to gateway providers, and to non-gateway intermediate providers whose filing was affirmatively submitted. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(g)(1)-(g)(4). Checked 2026-09-16.
[^4]: A provider may accept calls directly from another provider only if that provider's filing appears in the Robocall Mitigation Database and has not been de-listed pursuant to an enforcement action. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(g). Checked 2026-09-16.
[^5]: All providers must certify annually on or before March 1 that their Robocall Mitigation Database information is true and correct. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(h). Checked 2026-09-16.
[^6]: The required filing data include the provider's obligation category: direct end-user obligation, wholesale originator on behalf of others, or no obligation. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(4). Checked 2026-09-16.
[^7]: A provider may certify complete or partial implementation in the Robocall Mitigation Database only if it has obtained an SPC token and digital certificate and signs calls with its own certificate. Source: [Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)](https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt), FCC 24-120 para 27. Checked 2026-09-16.
[^8]: CORES registrants must update any information submitted to CORES within 10 business days of any change, and the Commission applies this requirement to all filers including those with individual FRNs. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 para 13. Checked 2026-09-16.
[^9]: The Commission declined to adopt a PIN requirement, declined permissive blocking for facially deficient filings, and did not adopt specific data-validation tools, leaving the Bureau authority to implement them if benefits outweigh costs. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 paras 41, 43 and 44. Checked 2026-09-16.
[^10]: The Commission directed the Wireline Competition Bureau to establish a dedicated reporting mechanism for deficient Robocall Mitigation Database filings. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 para 24. Checked 2026-09-16.
[^11]: The rules in the RMD effectiveness order took effect on February 5, 2026, except the amendments to 47 CFR 1.8002(b)(2), 64.6305(h) and 1.1105. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System (FR Doc 2026-00010)](https://www.federalregister.gov/documents/full_text/xml/2026/01/06/2026-00010.xml), FR Doc 2026-00010 DATES field. Checked 2026-09-16.
[^12]: Compliance with all rules adopted in the Eighth Caller ID Authentication Report and Order was required by September 18, 2025. Source: [Wireline Competition Bureau Announces Effective Date for STIR/SHAKEN Rules (DA 25-730)](https://docs.fcc.gov/public/attachments/DA-25-730A1.txt), DA 25-730 body. Checked 2026-09-16.
[^13]: Providers that lack control of the network infrastructure necessary to implement STIR/SHAKEN remain outside the signing obligation, and cannot claim partial or complete implementation. Source: [Wireline Competition Bureau Announces Effective Date for STIR/SHAKEN Rules (DA 25-730)](https://docs.fcc.gov/public/attachments/DA-25-730A1.txt), DA 25-730 background discussion. Checked 2026-09-16.
[^14]: Third-party authentication arrangements must be memorialized in written agreements and providers must memorialize and maintain records of any such agreement. Source: [Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)](https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt), FCC 24-120 paras 26 and 27. Checked 2026-09-16.
[^15]: Reseller and wholesaler arrangements do not fall within the adopted definition of third-party authentication unless the wholesaler itself uses a signer. Source: [Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)](https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt), FCC 24-120 para 19. Checked 2026-09-16.
[^16]: Where a wholesaler originates on behalf of a reseller that lacks network infrastructure control, it is the wholesale provider that holds the STIR/SHAKEN implementation obligation, and that obligation does not change because the provider has an upstream customer. Source: [Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)](https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt), FCC 24-120 para 17. Checked 2026-09-16.
[^17]: All providers with a STIR/SHAKEN implementation obligation are explicitly required to obtain an SPC token from the Policy Administrator and to present it to a STIR/SHAKEN Certificate Authority to obtain a digital certificate. Source: [Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)](https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt), FCC 24-120 para 28. Checked 2026-09-16.
[^18]: The Commission defines third-party authentication as an arrangement in which a provider with a STIR/SHAKEN implementation obligation contracts with another party to perform the technological act of signing calls on the provider's behalf, expressly including hosted SHAKEN and carrier SHAKEN solutions and excluding instances in which a provider authenticates its own traffic. Source: [Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)](https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt), FCC 24-120 para 16. Checked 2026-09-16.
[^19]: Third-party authentication is authorized only subject to two conditions: the provider with the implementation obligation must make all attestation-level decisions, and all calls must be signed using the certificate of the provider with the implementation obligation. Source: [Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)](https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt), FCC 24-120 paras 20 and 23. Checked 2026-09-16.
[^20]: Using a third party to sign traffic without meeting the two conditions constitutes a violation of the Commission's caller ID authentication rules. Source: [Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)](https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt), FCC 24-120 para 14. Checked 2026-09-16.
[^21]: In December 2024 the Enforcement Bureau ordered 2,411 non-compliant companies to show cause why their Robocall Mitigation Database filings should not be removed, and removal would bar other providers from accepting their traffic. Source: [FCC Takes Action Against 2,411 Non-Compliant Companies to Protect Consumers from Illegal Robocalls (news release)](https://docs.fcc.gov/public/attachments/DOC-408083A1.txt), DOC-408083A1 body. Checked 2026-09-16.
[^22]: The removal order restates that a provider may not block a 911 emergency call and must make all reasonable efforts to ensure it does not block calls from public safety answering points. Source: [Enforcement Bureau Removes Fourteen Providers from the Robocall Mitigation Database (DA 26-872)](https://docs.fcc.gov/public/attachments/DA-26-872A1.txt), DA 26-872 body. Checked 2026-09-16.
[^23]: Following the September 2, 2026 removal order, all intermediate providers and voice service providers must cease accepting traffic directly from the fourteen removed companies within two business days of the release date. Source: [Enforcement Bureau Removes Fourteen Providers from the Robocall Mitigation Database (DA 26-872)](https://docs.fcc.gov/public/attachments/DA-26-872A1.txt), DA 26-872 ordering clauses. Checked 2026-09-16.
[^24]: The stated ground for the September 2026 removals was that the certifications, inclusive of the robocall mitigation plan, lacked required information, and none of the companies updated their certifications in response to the March 2026 show cause order. Source: [Enforcement Bureau Removes Fourteen Providers from the Robocall Mitigation Database (DA 26-872)](https://docs.fcc.gov/public/attachments/DA-26-872A1.txt), DA 26-872 body. Checked 2026-09-16.
[^25]: The Commission's enforcement practice runs as a sequence: a Wireline Competition Bureau deficiency notice, then an Enforcement Bureau show cause order with a cure period, then removal if the provider neither cures nor responds (inferred). Source: [Enforcement Bureau Removes Fourteen Providers from the Robocall Mitigation Database (DA 26-872)](https://docs.fcc.gov/public/attachments/DA-26-872A1.txt), DA 26-872 procedural history. Checked 2026-09-16.
[^26]: The fourteen companies may not re-file in the Robocall Mitigation Database without the prior approval of both the Enforcement Bureau and the Wireline Competition Bureau. Source: [Enforcement Bureau Removes Fourteen Providers from the Robocall Mitigation Database (DA 26-872)](https://docs.fcc.gov/public/attachments/DA-26-872A1.txt), DA 26-872 body. Checked 2026-09-16.
[^27]: On September 2, 2026 the Enforcement Bureau removed the certifications of fourteen named companies from the Robocall Mitigation Database under file number EB-TCD-25-00038590. Source: [Enforcement Bureau Removes Fourteen Providers from the Robocall Mitigation Database (DA 26-872)](https://docs.fcc.gov/public/attachments/DA-26-872A1.txt), DA 26-872 body and Appendix A. Checked 2026-09-16.
[^28]: The Commission adopted a $100 application processing fee for initial Robocall Mitigation Database submissions and set the same filing fee of $100 per filing for the annual recertification requirement, revising 47 CFR 1.1105. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 paras 32, 35 and 38. Checked 2026-09-16.
[^29]: The $100 Robocall Mitigation Database fee provision in 47 CFR 1.1105 was carved out of the February 5, 2026 effective date and requires notice to Congress under 47 U.S.C. 159A(b)(2) plus information technology and internal procedure updates, with the effective date to be announced in a later Federal Register document. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System (FR Doc 2026-00010)](https://www.federalregister.gov/documents/full_text/xml/2026/01/06/2026-00010.xml), FR Doc 2026-00010 DATES field and section 9A(b)(2) discussion. Checked 2026-09-16.
[^30]: Forfeitures for these RMD violations are assessed on a daily basis as continuing violations up to the statutory maximum. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 paras 14 and 23. Checked 2026-09-16.
[^31]: The Commission established a base forfeiture of $1,000 for failure to update information that has changed. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 paras 14 and 21. Checked 2026-09-16.
[^32]: The Commission established a base forfeiture of $10,000 for each violation for filers that submit false or inaccurate information to the Robocall Mitigation Database. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 para 14. Checked 2026-09-16.
[^33]: Gateway providers must run a robocall mitigation program covering calls that use North American Numbering Plan resources pertaining to the United States in the caller ID field including reasonable steps to avoid carrying or processing illegal robocall traffic. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(b). Checked 2026-09-16.
[^34]: Non-gateway intermediate providers carry the same structure of obligation as gateway providers: an appropriate robocall mitigation program plus reasonable steps to avoid carrying or processing illegal robocall traffic and a 24-hour traceback commitment. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(c). Checked 2026-09-16.
[^35]: The Further Notice proposes that providers collect information about upstream providers, verify it, monitor their traffic and practices, and refuse or discontinue service when the evidence shows an upstream provider is a bad actor. Source: [FCC Proposes Enhanced Know-Your-Upstream-Provider Requirements to Combat Illegal Robocalls (FCC 26-32 news release)](https://docs.fcc.gov/public/attachments/DOC-421877A1.txt), DOC-421877A1 body. Checked 2026-09-16.
[^36]: Secondary summaries report that the Further Notice proposes per-call base forfeitures of $2,500 for know-your-upstream-provider violations and $1,000 for improper attestations or unauthenticated calls, but this run could not confirm those figures in the primary text (disputed). Source: [Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKEN, Further Notice of Proposed Rulemaking (91 FR 42602)](https://www.govinfo.gov/content/pkg/FR-2026-07-09/html/2026-13874.htm), FR 2026-13874 (figures not located in the portion retrieved). Checked 2026-09-16.
[^37]: The Commission adopted a Further Notice of Proposed Rulemaking on enhancing know-your-upstream-provider requirements and strengthening STIR/SHAKEN as FCC 26-32 on May 20, 2026, in WC Docket No. 17-97 and CG Docket No. 17-59. Source: [FCC Proposes Enhanced Know-Your-Upstream-Provider Requirements to Combat Illegal Robocalls (FCC 26-32 news release)](https://docs.fcc.gov/public/attachments/DOC-421877A1.txt), DOC-421877A1 header. Checked 2026-09-16.
[^38]: The Federal Register printing of the still-pending item is designated ACTION: Proposed rule and repeatedly uses propose-and-seek-comment framing, with comments due August 10, 2026 and reply comments due September 8, 2026. Source: [Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKEN, Further Notice of Proposed Rulemaking (91 FR 42602)](https://www.govinfo.gov/content/pkg/FR-2026-07-09/html/2026-13874.htm), FR 2026-13874 ACTION and DATES fields. Checked 2026-09-16.
[^39]: The Commission directed the Wireline Competition Bureau and the Office of Managing Director to develop a two-factor or stronger authentication solution for accessing the Robocall Mitigation Database, and that solution must offer users the option of phishing-resistant authentication. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 para 39. Checked 2026-09-16.
[^40]: A provider that cannot implement STIR/SHAKEN because it lacks control over the network infrastructure must explain that basis in its filing rather than certify implementation. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(2). Checked 2026-09-16.
[^41]: Robocall Mitigation Database certifications must be filed in the appropriate portal on the Commission's website and signed by an officer in conformity with 47 CFR 1.16. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(3). Checked 2026-09-16.
[^42]: The robocall mitigation plan filed with a voice service provider certification must state the specific reasonable steps taken, including how the provider complies with its know-your-customer obligation under 47 CFR 64.1200(n)(4), its procedures to know its upstream providers, and the analytics systems it uses to identify and block illegal traffic naming any third-party analytics vendors. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(2). Checked 2026-09-16.
[^43]: Each RMD certification must attest that any prior certification has not been removed by Commission action and that the provider has not been prohibited from filing in the Robocall Mitigation Database. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(1). Checked 2026-09-16.
[^44]: Recertification of existing Robocall Mitigation Database filings for the first cycle fell due on March 1, 2026 (inferred). Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 para 38 read with para 37. Checked 2026-09-16.
[^45]: The Commission set an annual deadline of March 1 for recertification of existing Robocall Mitigation Database filings. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 para 38. Checked 2026-09-16.
[^46]: Failure to fulfil the annual recertification requirement will result in referral to the Enforcement Bureau. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System, Report and Order (FCC 24-135)](https://docs.fcc.gov/public/attachments/FCC-24-135A1.txt), FCC 24-135 para 37. Checked 2026-09-16.
[^47]: The 24-hour traceback commitment runs to requests from the Commission, law enforcement and the industry traceback consortium, and is coupled to cooperation in investigating and stopping illegal robocallers using the provider's service. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(a)(2) read with 64.6305(b)(2) and (c)(2). Checked 2026-09-16.
[^48]: Where the Governance Authority revokes a provider's SPC token, the 10-business-day update clock is deferred until the 60-day Commission review window closes, or ten business days after a Wireline Competition Bureau final decision on appeal, or the 30-day formal appeal deadline if no appeal is filed. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(5)(i)-(ii). Checked 2026-09-16.
[^49]: An RMD filer must certify one of exactly three STIR/SHAKEN states: complete implementation, partial implementation, or no implementation of the framework on any portion of its network. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(1). Checked 2026-09-16.
[^50]: A certification must disclose whether in the prior two years the filer, or an entity with which it shares common ownership, management, directors or control, was subject to any formal action or investigation with findings about illegal robocalls or spoofing, or a deficient Robocall Mitigation Database certification or mitigation program description. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(d)(2). Checked 2026-09-16.
[^51]: The order does not change the existing mandate in 47 CFR 64.6305(d)(5) that Robocall Mitigation Database filers update their filings within 10 business days. Source: [Improving the Effectiveness of the Robocall Mitigation Database; Amendment of CORES Registration System (FR Doc 2026-00010)](https://www.federalregister.gov/documents/full_text/xml/2026/01/06/2026-00010.xml), FR Doc 2026-00010 preamble discussing 47 CFR 64.6305(d)(5). Checked 2026-09-16.
[^52]: Every voice service provider must implement an appropriate robocall mitigation program that includes reasonable steps to avoid originating illegal robocall traffic and a commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement and the industry traceback consortium. Source: [47 CFR 64.6305 - Robocall mitigation and certification](https://www.law.cornell.edu/cfr/text/47/64.6305), 47 CFR 64.6305(a). Checked 2026-09-16.
[^53]: In Webex Calling Control Hub the setting to block calls that failed caller ID validation is off by default, while presenting calls from unverified callers as normal calls is on by default. Source: [Secure Calling and Spam mitigation](https://help.webex.com/en-us/article/8j6te9/Secure-Calling-and-Spam-mitigation), Secure calls and spam mitigation - Control Hub settings. Checked 2026-09-16.
[^54]: Webex Calling can query a certified calling reputation provider, returning an allow, block or challenge action; blocked calls are released with cause 603 and challenged callers get three attempts with a 15-second timeout. Source: [Secure Calling and Spam mitigation](https://help.webex.com/en-us/article/8j6te9/Secure-Calling-and-Spam-mitigation), Secure calls and spam mitigation - call reputation section. Checked 2026-09-16.
[^55]: For on-premises PSTN behind CUBE or a Local Gateway in the United States and Canada, Cisco documents specific SIP profile configuration to pass the verstat parameter through to Webex Calling. Source: [Secure Calling and Spam mitigation](https://help.webex.com/en-us/article/8j6te9/Secure-Calling-and-Spam-mitigation), Secure calls and spam mitigation - on-premises PSTN section. Checked 2026-09-16.
[^56]: The Webex Calling caller-reputation and call-indication features require Webex App desktop or mobile 42.5 or higher, and 6800, 7800, 8800 or 9800 series MPP devices on firmware 11.3.7 or higher. Source: [Secure Calling and Spam mitigation](https://help.webex.com/en-us/article/8j6te9/Secure-Calling-and-Spam-mitigation), Secure calls and spam mitigation - endpoint support. Checked 2026-09-16.
[^57]: On-net calls between Webex Calling users display as verified, while calls from on-premises Unified CM users are judged against the enterprise dial plan rather than by the public framework. Source: [Secure Calling and Spam mitigation](https://help.webex.com/en-us/article/8j6te9/Secure-Calling-and-Spam-mitigation), Secure calls and spam mitigation - caller ID validation section. Checked 2026-09-16.
[^58]: Call indication and caller ID validation settings in Webex Calling apply only to Webex Calling locations in the United States and Canada; elsewhere calls present normally. Source: [Secure Calling and Spam mitigation](https://help.webex.com/en-us/article/8j6te9/Secure-Calling-and-Spam-mitigation), Secure calls and spam mitigation - limitations. Checked 2026-09-16.
[^59]: Webex Calling reads the STIR/SHAKEN verification result from the verstat parameter in the SIP P-Asserted-Identity header, with values TN-Validation-Passed, TN-Validation-Failed and No-TN-Validation, and maps attestation levels A, B and C to Verified Caller, Possible Spam and Potential Fraud. Source: [Secure Calling and Spam mitigation](https://help.webex.com/en-us/article/8j6te9/Secure-Calling-and-Spam-mitigation), Secure calls and spam mitigation - caller ID validation section. Checked 2026-09-16.