Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)

Publisher

Federal Communications Commission

URL

https://docs.fcc.gov/public/attachments/FCC-24-120A1.txt

Published

2024-11-22

Updated

unknown

Accessed

2026-09-16

HTTP status

200

License

US Government work; not subject to copyright in the United States (17 USC 105); public-domain; short excerpts and locators only

Source notes citing this source

• A provider may certify complete or partial implementation in the Robocall Mitigation Database only if it has obtained an SPC token and digital certificate and signs calls with its own certificate. in context
• Third-party authentication arrangements must be memorialized in written agreements and providers must memorialize and maintain records of any such agreement. in context
• Reseller and wholesaler arrangements do not fall within the adopted definition of third-party authentication unless the wholesaler itself uses a signer. in context
• Where a wholesaler originates on behalf of a reseller that lacks network infrastructure control, it is the wholesale provider that holds the STIR/SHAKEN implementation obligation, and that obligation does not change because the provider has an upstream customer. in context
• All providers with a STIR/SHAKEN implementation obligation are explicitly required to obtain an SPC token from the Policy Administrator and to present it to a STIR/SHAKEN Certificate Authority to obtain a digital certificate. in context
• The Commission defines third-party authentication as an arrangement in which a provider with a STIR/SHAKEN implementation obligation contracts with another party to perform the technological act of signing calls on the provider's behalf, expressly including hosted SHAKEN and carrier SHAKEN solutions and excluding instances in which a provider authenticates its own traffic. in context
• Third-party authentication is authorized only subject to two conditions: the provider with the implementation obligation must make all attestation-level decisions, and all calls must be signed using the certificate of the provider with the implementation obligation. in context
• Using a third party to sign traffic without meeting the two conditions constitutes a violation of the Commission's caller ID authentication rules. in context

Cite this source record

APA

WarmTransfer. (2024, November 22). Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120). WarmTransfer. https://warmtransfer.net/knowledge/sources/fcc-24-120-eighth-caller-id-order

BibTeX

@misc{warmtransfer-fcc-24-120-eighth-caller-id-order,
  title  = {Call Authentication Trust Anchor, Eighth Report and Order (FCC 24-120)},
  author = {{WarmTransfer}},
  year   = {2024},
  url    = {https://warmtransfer.net/knowledge/sources/fcc-24-120-eighth-caller-id-order},
  note   = {Federal Communications Commission, accessed 2026-09-16}
}