# Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKEN (Call Authentication Trust Anchor; Advanced Methods To Target and Eliminate Unlawful Robocalls)

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2026-13874

## Record

- **Collection:** Federal Register
- **Document type:** Proposed Rule
- **Published:** July 9, 2026
- **Citation:** 91 FR 42602

## Text

FEDERAL COMMUNICATIONS COMMISSION
47 CFR Parts 1 and 64
[WC Docket No. 17-97; CG Docket No. 17-59; FCC 26-32; FR ID 355060]
Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKEN (Call Authentication Trust Anchor; Advanced Methods To Target and Eliminate Unlawful Robocalls)

AGENCY:

Federal Communications Commission.

ACTION:

Proposed rule.

SUMMARY:

In this document, the Federal Communications Commission (Commission) proposes steps to strengthen its robocall mitigation framework by enhancing Know-Your-Upstream-Provider (KYUP) requirements, improving oversight of voice service providers by the STIR/SHAKEN Governance Authority, raising caller ID attestation standards, and closing implementation gaps in STIR/SHAKEN implementation. Specifically, the Commission proposes establishing baseline KYUP information-collection, compliance review, verification, monitoring, and responsive-action requirements to ensure providers can identify and cut off bad-actor upstream providers. The Commission also proposes measures to expand the Governance Authority's vetting, enforcement, and reporting responsibilities to prevent misuse of STIR/SHAKEN certificates and to remove noncompliant providers from the authentication ecosystem. The Commission further proposes clarifying and strengthening STIR/SHAKEN attestation rules, including codifying attestation levels, defining improper attestations, and specifying permissible mechanisms for verifying number-to-customer associations. Additionally, the Commission proposes and seeks comment on additional steps to close caller ID authentication gaps, such as refining provider definitions, reconsidering exemptions, requiring providers serving end users to assign STIR/SHAKEN attestations, and ensuring calls maintain authentication information. The Commission also seeks comment on special circumstances, including addressing issues with foreign-originated calls.

DATES:

Comments are due on or before August 10, 2026 and reply comments are due on or before September 8, 2026.

ADDRESSES:

Pursuant to §§ 1.415 and 1.419 of the Commission's rules, 47 CFR 1.415, 1.419, interested parties may file comments and reply comments identified by WC Docket No. 17-97 and CG Docket No. 17-59 by any of the following methods:

•
Electronic Filers:
Comments may be filed electronically using the internet by accessing the Electronic Comment Filing System (ECFS):
https://www.fcc.gov/
ecfs. See
Electronic Filing of Documents in Rulemaking Proceedings,
63 FR 24121 (1998).

•
Paper Filers:
Parties who choose to file by paper must file an original and one copy of each filing.

• Filings can be sent by hand or messenger delivery, by commercial courier, or by the U.S. Postal Service.
All filings must be addressed to the Secretary, Federal Communications Commission.

• Hand-delivered or messenger-delivered paper filings for the Commission's Secretary are accepted between 8:00 a.m. and 4:00 p.m. by the FCC's mailing contractor at 9050 Junction Drive, Annapolis Junction, MD 20701. All hand deliveries must be held together with rubber bands or fasteners. Any envelopes and boxes must be disposed of before entering the building.

• Commercial courier deliveries (any deliveries not by the U.S. Postal Service) must be sent to 9050 Junction Drive, Annapolis Junction, MD 20701.

• Filings sent by U.S. Postal Service First-Class Mail, Priority Mail, and Priority Mail Express must be sent to 45 L Street NE, Washington, DC 20554.

•
Accessible formats.
To request materials in accessible formats for people with disabilities (Braille, large print, electronic files, audio format) or to request reasonable accommodations (
e.g.,
accessible format documents, sign language interpreters, CART), send an email to
fcc504@fcc.gov
or call the Consumer and Governmental Affairs Bureau at (202) 418-0530 (voice).

FOR FURTHER INFORMATION CONTACT:

Chris Laughlin of the Wireline Competition Bureau at (202) 418-2193 or
Chris.Laughlin@fcc.gov.
For additional information concerning the Paperwork Reduction Act proposed information collection requirements contained in this document, email
PRA@fcc.gov
or contact Nicole Ongele at (202) 418-2991.

SUPPLEMENTARY INFORMATION:

This is a summary of the Commission's Further Notice of Proposed Rulemaking (
FNPRM
) in WC Docket No. 17-97 and CG Docket No. 17-59, FCC 26-32, adopted on May 20, 2026 and released on May 21, 2026. The full text of this document is available online at:
https://docs.fcc.gov/public/attachments/FCC-26-32A1.pdf.

Paperwork Reduction Act Analysis:
The
FNPRM
may contain proposed new and revised information collection requirements. The Commission, as part of its continuing effort to reduce paperwork burdens, invites the general public and the Office of Management and Budget (OMB) to comment on the information collection requirements described in this document, as required by the Paper Reduction Act of 1995, Public Law 104-13. In addition, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4), we seek specific comment on how we might further reduce the information collection burden for small business concerns with fewer than 25 employees.

Providing Accountability Through Transparency Act:
Consistent with the Providing Accountability Through Transparency Act, Public Law 118-9, a summary of this document will be available on
https://www.fcc.gov/proposed-rulemakings.

Ex Parte Rules:
The proceeding the
FNPRM
initiates shall be treated as a “permit-but-disclose” proceeding in accordance with the Commission's
ex parte
rules. Persons making
ex parte
presentations must file a copy of any written presentation or a memorandum summarizing any oral presentation within two business days after the presentation (unless a different deadline applicable to the Sunshine period applies). Persons making oral
ex parte
presentations are reminded that memoranda summarizing the presentation must (1) list all persons attending or otherwise participating in the meeting at which the
ex parte
presentation was made, and (2) summarize all data presented and arguments made during the presentation. If the presentation consisted in whole or in part of the presentation of data or arguments already reflected in the presenter's written comments, memoranda or other filings in the proceeding, the presenter may provide citations to such data or arguments in his or her prior comments, memoranda, or other filings (specifying the relevant page and/or paragraph numbers where such data or arguments can be found) in lieu of summarizing them in the memorandum. Documents shown or given to Commission staff during
ex parte
meetings are deemed to be written
ex parte
presentations and must be filed consistent with § 1.1296(b) of the Commission's rules. In proceedings governed by § 1.49(f) of the Commission's rule or for which the Commission has made available a method for electronic filing, written
ex parte
presentations and memoranda

summarizing oral
ex parte presentations,
and all attachments thereto, must, when feasible, be filed through the electronic comments filing system available for that proceeding, and must be filed in their native format (
e.g.,
.doc, .xml, .ppt., searchable .pdf). Participants in this proceeding should familiarize themselves with the Commission's
ex parte
rules.

Synopsis

I. Discussion

Commission measures to stop unlawful and fraudulent calls are only as effective as the voice service providers that implement them. Numbering rules assume providers will use telephone numbers responsibly. The STIR/SHAKEN framework is built on an expectation that providers will authenticate calls and do so with a proper attestation. The value of the Robocall Mitigation Database (RMD) is reliant on providers following their described robocall mitigation programs and only accepting calls from providers with a filing that appears in the RMD. Tracebacks only work if providers respond to traceback requests. Know-your-customer (KYC) requirements are only effective if providers meaningfully vet their customers. The call blocking rules depend on providers actually blocking calls when permitted or required. And the utility of some burgeoning call-branding solutions can be dependent on the effectiveness of STIR/SHAKEN and on the role providers play in verifying the identity of callers. But when voice service providers fail to fulfill these responsibilities, these systems can break down, and illegal calls can find their way to consumers.

We propose a number of actions designed to increase voice service providers' accountability in fulfilling these obligations. First, we propose steps aimed at removing voice service providers that enable illegal calls from the voice ecosystem. Second, we propose to raise the bar for STIR/SHAKEN attestations to ensure that voice service providers are applying the correct attestations to calls. Third, we propose to close certain STIR/SHAKEN implementation loopholes to ensure ubiquitous and consistent deployment of STIR/SHAKEN on IP networks. Fourth, we address special circumstances related to TRS providers, foreign-originated calls, and public safety. We also propose and seek comment on related implementation considerations. We believe these proposed actions will not only enhance the effectiveness of STIR/SHAKEN, but will directly and indirectly improve the efficacy of the Commission's other anti-robocall measures, thereby advancing the Commission's ultimate goal to restore trust in voice communications. As the Commission continues its efforts to combat illegal robocalls through STIR/SHAKEN implementation, the RMD, numbering accountability rules, KYC requirements, and now stronger know-your-upstream-provider (KYUP) standards, we are committed to ensuring that rules designed to protect consumers from illegal calls do not inadvertently create new risks by mandating the collection, retention, and sharing of sensitive business and personal data without corresponding safeguards.

A. Cutting Off Providers That Enable Illegal Calls

Whether they actively collaborate with fraudsters, turn the other way when bad actors use their networks or services to transmit illegal calls or defraud consumers, or simply fail to implement policies and procedures to fulfill their regulatory obligations to stop such nefarious activity, voice service providers that evade or ignore our rules undermine trust in the voice network and the effectiveness of tools designed to combat illegal calls. Providers and other industry stakeholders have been well positioned to identify “bad actor providers” and take rapid action to address them. The Commission established a flexible KYUP requirement that both empowers and obligates providers to identify bad actor providers and keep them from getting illegal calls onto the United States voice network. Similarly, the STIR/SHAKEN Governance Authority was designed to maintain trust in the STIR/SHAKEN framework by setting policies and procedures that govern which providers are authorized to be a part of the STIR/SHAKEN ecosystem. Despite these mechanisms, many bad actor providers remain.

We propose and seek comment on measures designed to improve how providers' KYUP obligation and the STIR/SHAKEN Governance Authority serve to excise bad actor providers from the voice network and deter them from establishing new operations to get back in. Although we are aware that bad actors will continue to look for new ways to commit fraud, we believe these actions will create friction that substantially undercuts the ability of bad actor providers to profit from transmitting illegal calls. Specifically, we believe our proposals will disincentivize bad actor providers from attempting to gain access to the United States voice network by increasing both the costs they must incur to appear legitimate, and the chances that their deceptive schemes will be discovered through ongoing monitoring practices that may result in their expulsion from the United States voice network. We seek comment on this assessment and on the potential impact of the requirements we propose.

1. Establishing Specific KYUP Requirements

The existing KYUP rule gives voice service providers the flexibility to use the best methods to know their upstream providers and prevent them from transmitting illegal calls. But those benefits will only materialize if providers actually take accountability and adopt meaningful measures to know their upstream providers and act on that knowledge. Below we propose to define “upstream” and “downstream” to codify the relationships between providers, particularly as it relates to the application of any existing and future KYUP requirements. Consistent with our description there, a non-facilities-based provider on the origination side of a call path is responsible for conducting KYUP regarding the providers to which it resells service, while a non-facilities-based provider on the termination side of a call path is responsible for conducting KYUP regarding the providers from which it purchases service. Thus far, the Commission has declined to require that providers adopt specific KYUP measures, opting to allow them to determine the best means to fulfill that responsibility. However, we believe that for some providers, the incentive to enter into business with other providers to drive revenue growth deters them from instituting even the most basic practices to evaluate their upstream providers. Other providers may not have implemented baseline practices because they do not take their KYUP obligations seriously. Indeed, record evidence suggests that some providers are failing to take action to cut off bad actor providers even though the universe of bad actor providers appears identifiable and even when the evidence against a particular provider is clear. Although stakeholders disagree on exactly what should be done to address providers' lax KYUP practices, many agree that better practices—and Commission action to achieve them—are needed.

In light of this evidence, we now believe it is necessary to establish certain baseline measures that all voice service providers must follow to help ensure the upstream providers they serve are legitimate and responsible entities that are unlikely to be the

source of illegal calls. Specifically, we propose five categories of baseline measures that providers must follow to fulfill their obligation to know their upstream provider: information collection, compliance review, information verification, monitoring, and responsive action. We developed these categories and the included baseline measures using a variety of Commission and private-sector resources and believe this framework is the logical outgrowth of the types of KYUP practices that responsible voice service providers use today. The resources we relied on include the proposals in the
KYC FNPRM,
91 FR 30596 (May 26, 2026), prior enforcement determinations, the caller ID authentication best practices released by the Wireline Competition Bureau (Bureau) and the associated best practices adopted by the North American Numbering Council (NANC) Call Authentication Trust Anchor (CATA) Working Group, the i3 Forum Know Your Customer/Know Your Traffic Code of Conduct, and best practices identified by stakeholders in the
Call Branding FNPRM,
90 FR 56101 (Dec. 5, 2025) record. We seek comment on these categories and baseline measures. We also propose and seek comment on related issues, including appeals, barriers to performing KYUP responsibilities, use of third parties, compliance and recordkeeping responsibilities, implementation costs and cost recovery, and alternative approaches to various aspects of our proposed KYUP scheme.

We propose triggers for when a voice service provider must perform these KYUP requirements. Specifically, we propose that they must do so: (a) before entering into a service agreement with a new upstream provider; (b) before renewing or renegotiating an agreement with an upstream provider that has an existing service agreement; and (c) at any other time the voice service provider finds, receives, or is made aware of information or evidence concerning an upstream provider, such as through the monitoring practices we propose. We seek comment on these triggers, including whether we should set more specific triggers for performing the KYUP requirements. Below we propose to require that the KYUP rules go into effect the later of 12 months after
Federal Register
publication of a Report and Order adopting the rules or 30 days after approval by the Office of Management and Budget (OMB) for rules that contain new or modified information collections subject to review under the Paperwork Reduction Act (PRA). Accordingly, by the time the rules go into effect, providers would need to have processes and procedures in place to perform the KYUP requirements in accordance with the triggers. Additionally, we propose to require that, within six (6) months
after
the rules go into effect, a provider must perform a one-time information collection, compliance review, and information verification KYUP review for all upstream providers with which it has a service agreement at the time the rules we adopt go into effect if the provider has not already performed the KYUP requirements for an upstream provider under the proposed triggers above.

We acknowledge that the KYUP requirements we propose above may be considered more prescriptive than the approach suggested in our recent
KYC FNPRM,
and we believe this is warranted. As we noted above, voice service providers are the first line of defense with respect to many of the Commission's and private sector's robocall mitigation measures. When bad actor providers are in the ecosystem, those measures often fail, and so we believe it is important to ensure that voice service providers follow robust baseline KYUP practices. We also believe robust KYUP practices are more feasible for providers to follow than more stringent KYC practices for retail, small business, and enterprise end users because there are far fewer providers than there are end users. In May 2025, the Commission's Office of Economics and Analytics reported that as of June 2024, “there were 18 million end-user switched access lines in service, 65 million interconnected VoIP subscriptions, and 388 million mobile subscriptions, for a total of 471 million retail voice telephone service connections in the United States.” Conversely, as of April 21, 2026 there are only 10,872 voice providers with filings in the Commission's Robocall Mitigation Database, and we believe each provider only directly accepts traffic from a relatively small subset of these providers. Additionally, we believe that voice service providers will have a heightened awareness of the importance of responding to KYUP requests to ensure their calls go through than would retail and small businesses end users that may be unfamiliar with KYC and KYUP requirements that apply in the communications industry.

We believe these measures will realign provider incentives and further empower them to be another “cop on the beat” stopping bad actor providers from getting illegal calls onto the voice network. The measures are meant to target upstream providers to which no reasonable voice service provider would provision service and ensure that all voice service providers are held to that same standard. We also believe that specifying KYUP requirements will provide a clearer foundation on which to hold providers accountable; providers that fail to take these obligations seriously may be subject to enforcement action. The measures we propose are not intended to be exhaustive, and if adopted, voice service providers would continue to have both the flexibility and an obligation to implement additional practices to respond to new tactics by bad actor providers in order to satisfy their obligation to prevent their networks and services from being used to transmit illegal calls.

Strengthening the general KYUP requirement.
As the foundation for our proposed KYUP requirements, we propose to revise the baseline KYUP requirement in § 64.1200(n)(5) of our rules to establish an even more stringent obligation on voice service providers to prevent the transmission of illegal calls from upstream providers. Specifically, we propose to require that each voice service provider take affirmative, effective measures to prevent an upstream provider from using its network or services to transmit illegal calls, including knowing its upstream provider. The proposed revised language focuses on the illegality of calls rather than traffic (consistent with how our rules typically apply) and cuts the “high volume of illegal traffic” limitation in the current rule to require that providers prevent all illegal calls. We also believe our proposed changes make clear our intent to apply this rule to all voice service providers, including both facilities-based providers and non-facilities-based providers. We seek comment on this proposal and analysis.

KYUP information collection.
We propose to require that voice service providers collect directly from upstream providers, using mechanisms of their own choosing, the following information or an explanation for why the upstream provider cannot produce this information:

• General business information, including:

○ legal business name and supporting records (
e.g.,
government record, government identification, lease, utility statement, search result from a government website, or report from a legitimate private database that validates company information);

○ any prior business names or trade names (DBAs) the company has used in the last three years;

○ a physical address that is a real place of business for the upstream provider and is not a virtual address, shared office location without a dedicated suite or floor, P.O. Box, mail forwarding service, hosted server location, registered agent, or address shared by multiple unrelated or purportedly unrelated businesses; and

○ contact information, including a business telephone number and email address;

• Financial information, including: billing address, forms of payment, financial institution, and account information;

• Internet commercial presence information, such as website, social media, or apps;

• Ownership and affiliate information, including:

○ information about human principals, owners, and company leadership (including ultimate beneficial owners and authorized business representatives), including their name, title, business telephone number, business email address, work address, country of residence, citizenship, and copies of government issued identification;

○ information about the company's parents, affiliates, and subsidiaries, including their business names, trade names (DBAs), place of incorporation, and principal places of business;

○ names, addresses (including country), email addresses, and ownership stake for all individuals with 10% or more direct or indirect ownership of the company; and

○ whether or not the provider or its parents, affiliates, subsidiaries, principals, owners, or leadership, and other companies where any such persons have served as a principal, owner, or leader, have been the subject of any criminal or regulatory investigations or actions in the past five years and the nature of such investigations or actions;

• Operational information, including:

○ place of formation and corporate formation records, including proof of good standing;

○ location of its principal operations, how long the company has been operating, and whether the company has any foreign ownership or management;

○ business registration number in its jurisdiction (such as federal or state Employer Identification Numbers (EINs) for United States providers and the foreign-equivalents for foreign providers); and

○ registered United States agent (if the provider has one);

• Service information, including:

○ information about the nature of the upstream provider's operations, including the types of services it offers, the types of customers it serves or intends to serve, and whether it relies on non-internet Protocol (IP) technology—the TRACED Act, and the Commission's rules implementing it, use the general term “non-internet protocol” to capture networks that use types of technology other than IP; such technology includes time-division multiplexing (TDM) technology, which often uses the Signaling System No. 7 (SS7) protocol instead of Session Initiation Protocol (SIP) ; and

○ whether another voice service provider has refused or discontinued service to the upstream provider.

We believe that this is the basic amount of information necessary for a provider to be able to know their upstream providers. We also believe this information will help providers determine if an upstream provider is a foreign entity. Are these views correct? Is there additional information we should require providers to obtain? For instance, should we require that providers obtain photos of certain individuals the upstream provider identifies with their government-issued identification? Is there any information listed above that providers should not be required to obtain? If not, why not? We believe it is beneficial to require providers to obtain this information directly from upstream providers because upstream providers are in the best position to supply this information. It may also serve to spur upstream providers to complete necessary steps to establish their business while deterring bad actor providers that may be disincentivized from taking the steps necessary to appear legitimate. Do commenters agree? We seek comment on whether any such information constitutes sensitive business or personal information, and if so, what safeguards we can implement to prevent the misuse of such information. We recognize that some of this information may be duplicative of information voice service providers must submit in the RMD, but to the extent providers would not collect this information directly from new upstream providers anyway, we think requiring providers to obtain this information will allow them to cross-check the information with the RMD to identify any inconsistencies. We are exploring whether some entities are establishing dummy filings in the RMD that bad actors can use to quickly start transmitting unlawful traffic, and which may contain false or unverifiable information and are not properly updated. We intend to evaluate potential improvements to the RMD in a future proceeding.

KYUP compliance review.
We propose to require that voice service providers perform due diligence of upstream providers' compliance with Commission rules related to the provision of service by:

• Confirming the upstream provider has a filing in the RMD (providers can check the RMD in three ways: (1) searching the database by filer or keyword; (2) downloading a .csv file that lists the filings in the database; or (3) accessing the database using the application program interface (API)) and reviewing the filing (including the robocall mitigation plan) to generally assess whether it is complete and compliant with Commission rules—although we do not propose to specify exact requirements for this assessment, we believe providers should check whether a filing includes all required information, such as: principals, parents, affiliates, and subsidiaries, including, at a minimum, at least one natural person principal; operating company number (OCN) if the upstream provider has certified to complete or partial STIR/SHAKEN implementation (as an OCN is required to get a Service Provider Code (SPC) token to implement STIR/SHAKEN); a valid exemption and a detailed basis for claiming the exemption if the upstream provider certifies to less than complete STIR/SHAKEN implementation; and a robocall mitigation plan that describes the upstream provider's robocall mitigation program, including KYC and KYUP measures;

• Confirming the upstream provider has obtained an SPC token if it certified in its RMD filing that it has fully or partially implemented STIR/SHAKEN;

• Determining whether the upstream provider appears on the Foreign Adversary Control System or the Covered List;

• Determining whether the upstream provider has been subject to a Commission action revoking a Commission license; and

• Determining whether the upstream provider has been the subject of any other final or preliminary Commission enforcement actions—this includes Forfeiture Orders, Consent Decrees, Final Determination Orders, Final RMD Removal Orders, Cease-and-Desist Letters, and Notices of Apparent Liability;

In addition to these mechanisms, we believe that providers should evaluate an upstream provider's traceback history, including whether the upstream provider was the source of any tracebacks or failed to respond to any

traceback requests, and we seek comment on how easily providers can obtain this information. Additionally, we believe that providers should try to ascertain, beyond just a general provision in a contract, whether an upstream provider actually has mechanisms in place to ensure its own customers, upstream providers, clients, employees, and contractors comply with federal and state laws and regulations concerning unlawful calls, including any KYC and KYUP requirements established by the Commission, and we seek comment on how and the extent to which providers can do this. We also seek comment on whether and how providers may determine whether a provider has been subject to numbering restrictions by the North American Numbering Plan Administrator (NANPA). By numbering restrictions, we mean that the upstream provider has been prohibited from accessing numbers directly from the NANPA, has had its access to numbers suspended, or has had numbers reclaimed.

We believe this compliance review is a sufficient baseline that providers can use to evaluate whether upstream providers are following Commission regulatory obligations without unnecessarily burdening providers with obligations that are inflexible or require comprehensive compliance reviews. We seek comment on these requirements and this assessment. Should voice service providers be required to perform more or less detailed compliance reviews? Should they confirm that upstream providers have an FCC Form 499 on file with the Commission? Should we require that contracts between voice service providers and upstream providers specifically address that the upstream providers will follow KYUP and KYC requirements established by the Commission, rather than just generic statements that the upstream providers will comply with all laws and regulations?

KYUP information verification.
We propose to require that voice service providers conduct at least a basic level of due diligence to verify the validity and authenticity of an upstream provider, the information voice service providers obtain from or about an upstream provider, and the upstream provider's explanation for any information it could not produce, including:

• Confirming any telephone numbers and email addresses are active;

• Participating in a verbal communication with one or more natural person principals, owners, or company leaders;

• Conducting general research to identify risk factors or contradictory information, such as:

○ whether the physical address provided by the upstream provider represents a real place of business associated with the provider and is not a virtual address, shared office location without a dedicated suite or floor, P.O. Box, mail forwarding service, hosted server location, or an address shared by multiple unrelated or purportedly unrelated businesses;

○ whether there is contradictory information concerning the upstream provider's place of business, such as evidence the company is based outside the United States, including whether the company's IP address is associated with a foreign country or otherwise does not match the location information provided;

○ whether the principals, owners, and leadership of the upstream provider exist as natural persons;

○ whether there is any information that contradicts an upstream provider's claims about prior criminal or regulatory investigations or actions;

○ whether there is other evidence that raises questions about the upstream provider's legitimacy or reputation, such as a lack of digital presence for a purportedly established company; and

○ whether the upstream provider is owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary;

• Reviewing the upstream provider's internet commercial presence information to identify risk factors or contradictory information, such as:

○ excessive spelling and grammatical errors, being created recently, apparent copying of another company's website, apparently fake customer reviews, or use of fake photos for leadership and listed employees (
e.g.,
stock photos, potentially AI-generated photos, or photos of persons with no relationship to the provider); and

○ whether it contains information that contradicts the information supplied to the provider, including, but not limited to, different contact information, different leadership, or an inconsistent description of the nature of the services and types of customers served;

• Conducting a basic comparative analysis of the information to identify inconsistencies in the information or consistencies with information concerning other upstream providers, such as:

○ different business names, addresses, contact information, email addresses or website domains, and individuals involved with the company;

○ similarities with other current or former upstream providers purportedly operating as unrelated entities, which may indicate the upstream provider is replacing a provider whose calls were being scrutinized or blocked; and

• Evaluating an upstream provider's financial information to identify risk factors, such as untraceable forms of payment (
e.g.,
cryptocurrency or prepaid credit cards).

We believe that this level of due diligence sufficiently balances the need for providers to evaluate the information the upstream provider supplied without placing unreasonably burdensome or inflexible baseline requirements for that evaluation. We seek comment on these requirements and this assessment. Should we require providers to conduct more or less due diligence? Should we require providers to take additional steps to verify the identities of natural person principals, owners, and/or leadership, such as checking identity verification or reputation databases? Should we require credit checks?

KYUP monitoring.
To protect against bad actor providers who successfully circumvent initial KYUP vetting, we propose to require that voice service providers implement the following baseline KYUP monitoring obligations:

• Regularly checking the upstream provider's compliance with Commission rules related to the provision of service, consisting of whether the upstream provider no longer has a filing in the RMD, has had its SPC token revoked, has been added to the Foreign Adversary Control System or the Covered List, has had a Commission license revoked, or has become the subject of any other Commission enforcement actions;

• Using call analytics on an ongoing basis to identify illegal or suspect calls or call patterns from each upstream provider, including whether the upstream provider is transmitting calls from a further upstream provider that the voice service provider knows no longer has a filing in the RMD, has had its SPC token revoked, appears on the Foreign Adversary Control System or Covered List, has had a Commission license revoked, or has been subject of a Commission enforcement action that denies its ability to provision voice service;

• Evaluating on a timely basis information or evidence it finds, receives, or is made aware of that an upstream provider is transmitting illegal calls, failing to authenticate calls, or authenticating calls with improper attestations;

• Evaluating on a timely basis whether any information or evidence it

finds, receives, or is made aware of presents inconsistencies with other KYUP information obtained from or about the upstream provider, such as that:

○ the upstream provider or its employees are operating outside the United States, or its calls are originating outside the United States when it claimed it is a domestic provider;

○ the upstream provider's calls are originating in the United States when it claimed it is a foreign provider;

○ the upstream provider is providing different types of service or serving different types of customers than what was described;

○ the upstream provider's calls are sent over non-IP technology when the upstream provider did not specify it uses such technology; and

• Evaluating on a timely basis any other new information or evidence it finds, receives, or is made aware of concerning the upstream provider's reputation, such as a refusal or discontinuance of service by another provider.

We seek comment on each of these proposed requirements and whether we should specify additional KYUP monitoring obligations. For instance, should we specify the type of call analytics information providers must implement and evaluate? For example, the I3 Forum suggests that providers should implement the following call analytics measures: short call duration percentage; average call duration; answer seizure ratio (ASR); the percentage of call attempts blocked due to an improper CLI (invalid, unallocated, on a DNO list etc.); delivery receipt ratio (DLR); ratio of long code Sender IDs relative to short code Sender IDs; and ratio of long code Sender IDs relative to alphanumeric Sender IDs. We note that Commission rules require providers to describe any call analytics they use to identify and block illegal traffic, including whether they use any third-party call analytics providers and the names of those providers. Should we require that providers monitor when certificates have been revoked and not just SPC tokens? Should we direct providers to require, such as through interconnection agreements, that upstream providers update any information the upstream provider supplied within a certain amount of time of any change, such as 10 business days? Should we establish a more specific obligation for providers to proactively monitor upstream providers? Are there any obligations listed above that we should not require providers to follow? We also seek comment on whether we should set specific monitoring timelines, rather than the “regularly,” “ongoing,” and “timely basis” proposed requirements.

KYUP responsive action.
We propose to require that voice service providers perform a holistic, totality-of-the-circumstances evaluation of each upstream provider based on the information collection, information verification, compliance review, and monitoring measures described above and implement measures to refuse or discontinue service:

• When the results do not form an objectively reasonable basis for concluding that the upstream provider is a valid and authentic entity;

• When the results form an objectively reasonable basis for concluding that an upstream provider is likely to use or is using the network or services of the provider with the KYUP obligation to transmit illegal calls or enable the transmission of illegal calls;

• When the upstream provider does not have a filing in the RMD, transmits calls in IP but does not have an SPC token, appears on the Foreign Adversary Control System or Covered List, has had a Commission license revoked, or has been the subject of any other Commission enforcement actions that deny its ability to provision voice service—we believe that providers are already obligated to refuse or discontinue services to upstream providers who have not fulfilled compliance obligations necessary to provision service or whose authority to provide service by Commission action has been revoked, but we believe that establishing a rule will more clearly put providers on notice of this obligation; and

• When the provider finds, receives, or is made aware that an upstream provider does not have mechanisms in place to ensure its customers, upstream providers, clients, employees, and contractors comply with federal and state laws and regulations concerning unlawful calls, including any KYC and KYUP requirements established by the Commission.

We propose an objectively reasonable standard to prevent subjective applications where a provider refuses or discontinues service for anticompetitive purposes and where a provider fails to refuse or discontinue service when a reasonable provider would do so. To support providers taking responsive action, we propose that providers will receive a safe harbor from liability under the Act or Commission rules for objectively reasonable decisions to refuse or discontinue service, and seek comment on whether we should and have the authority to expand the safe harbor to better spur providers to take action. We seek comment on our proposal and whether it would serve our goal to remove bad actor providers from the voice network. What is the risk that providers would abuse their KYUP obligations for anticompetitive purposes? Are there other reasons we should require providers to refuse or discontinue service? Should we permit targeted call blocking based on providers' evaluations in certain circumstances, and if so, what circumstances? We also seek comment on potential economic or operational costs that could result if a provider refuses or discontinues service to valid and authentic upstream providers that are not in fact an actual or likely source of illegal calls due to a misapplication of the KYUP requirements.

We seek comment on whether our proposed approach will deter upstream providers from evading these requirements. Should we set a specific standard for when an upstream provider is using or likely to use the network or services of the provider with the KYUP obligation to transmit illegal calls or enable the transmission of illegal calls? Will these requirements successfully deter situations where bad actor providers create multiple shell providers, sometimes in multi-level arrangements, to try to avoid scrutiny by downstream providers? Will it address upstream providers that use traffic management techniques, such as mixing legal calls with illegal calls or transmitting illegal calls for short periods of time on a repeated but occasional basis? Should we set a requirement to discontinue service based on percentages of calls within certain timeframes that are presumptively illegal based on call analytics? If so, what should those percentages and timeframes be? Are there other standards we should set to address traffic management practices to evade our proposed requirements?

As part of this requirement, we propose to require that voice service providers document their decisions to refuse or discontinue service—including their findings, supporting documents, and conclusions—and provide this information, or a summary thereof, in a notice to the upstream provider. We propose to require that providers deliver the notice to an upstream provider five (5) business days prior to discontinuing service. We do not believe a timeline is necessary for when a provider declines to provide service so long as a notice is delivered. We do not propose to prohibit providers from accepting new information or explanations from upstream providers and reconsidering

their decisions. We seek comment on these proposals and views. Should we prohibit providers from counseling upstream providers on how to resolve issues? Should we require upstream providers that receive this notice to notify their customers of the forthcoming service discontinuance?

We seek comment on how quickly a voice service provider must complete evaluations and take responsive action when it finds, receives, or is made aware of information or evidence concerning an upstream provider, such as through monitoring practices. Should we require that providers complete evaluations and take responsive action as soon as feasible and no later than 30 days after finding, receiving, or being made aware of information or evidence? Does that time period adequately balance the need to stop illegal calls quickly with giving providers sufficient time to conduct evaluations and take responsive action? How much time should providers permit upstream providers to respond to any concerns?

Remedies.
We believe that to the extent providers dispute whether a decision to refuse or discontinue service based on KYUP information is erroneous that they are positioned to remedy the disputes themselves. We seek comment on this belief. We nevertheless also seek comment on whether we should establish specific avenues for providers to remedy such disputes. We also seek comment on the costs associated with dispute resolution.

Barriers to performing KYUP responsibilities.
We do not believe there are meaningful barriers to voice service providers performing the proposed KYUP requirements and we seek comment on this view. Because providers would obtain the required information directly from upstream providers, we do not believe there are barriers to obtaining that information. We believe providers have the means to conduct compliance reviews and monitoring using information from readily available public sources and will find, receive, or be made aware of information or evidence for monitoring purposes from its own call analytics tools and monitoring practices, the ITG, the Governance Authority, the Commission and other federal agencies, state entities (
e.g.,
state Attorneys General), and other voice service providers. The proposed verification process would require fairly basic due diligence and we do not believe it would pose an unmanageable responsibility. Is there certain compliance information that providers would be unable to easily obtain, such as an upstream provider's traceback history? Are all voice service providers in the call path able to obtain information about an upstream provider's attestation practices? What about number access, license, and SPC token revocation information? Should we take steps to facilitate any necessary information sharing? Do we need to revise our rules implementing Section 222's privacy protections to allow certain information sharing? Are there any privacy or competitive concerns with facilitating sharing of the information described above, such as potential sharing of sensitive personal or business information, and how might any such concerns be mitigated? Should we find that sharing of aggregated data be explicitly permitted? Would there be particular challenges for small providers in complying with our proposed KYUP obligations, and if so, how should we reduce the burden for such providers? Are there alternatives to the proposed information collection, compliance review, information verification, and monitoring obligations that would allow small providers flexibility to identify bad actors?

We also seek comment on any barriers to voice service providers refusing or discontinuing service. Are providers prevented from refusing service under federal or state laws or regulations in certain circumstances? We believe that most contracts between voice service providers include broad service discontinuance provisions that may be triggered by violation of applicable laws, and thus we believe that the discontinuance reasons we propose would be consistent with industry practice. Is this belief correct?

Use of third-party KYUP services.
We propose to allow voice service providers to use third-party services to conduct some or all of their KYUP obligations. We believe that allowing providers to use third-party KYUP services may help reduce any costs that result from the KYUP requirements we propose, including for small providers, and we seek comment on the costs of these services relative to providers performing KYUP obligations themselves. We also believe that third-party services will be able to develop into information clearinghouses as they collect information about a wide number of voice service providers in the ecosystem and use that information to inform their KYUP determinations for all the providers they work with. We seek comment on whether we should designate one or more specific entities to be an information clearinghouse and require providers to use that entity for some or all the information they must obtain, and if so, which third parties we should select. Should we require providers to use the Global Legal Entity Identifier System (GLEIS) to obtain certain information? While we propose to allow the use of third parties, we believe that the obligation to properly fulfill KYUP obligations should remain with providers. This, we believe, will ensure that providers only work with legitimate third parties that have adopted KYUP practices that meet the baseline standards we establish.

Compliance and recordkeeping responsibilities.
We believe that for voice service providers to fulfill their KYUP obligations, they will need to have adequate policies and procedures in place, and we seek comment on whether we should require providers to establish any specific policies and procedures. We note that the I3Forum Know Your Customer/Know Your Traffic Code of Conduct suggests that providers should “identify at least one person who will have particular responsibility for upholding the policy” and it suggests and describes the duties of that compliance leader. The duties of the KYC compliance leader and their team include: “[p]erforming pre-agreement reviews of all prospective customers to determine whether they meet the corporate KYC and KYT policy requirements, keeping documentation of all information considered, decisions reached, and all the individuals involved in the review[;] [p]erforming escalated enhanced due diligence reviews and making KYC decisions for higher-risk clients identified through the standard review process[;] [e]nsuring corporate policy is sufficient to meet changes in legal and regulatory obligations and consulting with internal teams on legal questions that arise as part of KYC processes[;] [s]upporting the development or implementation of the tools, systems, or other resources needed to perform and document KYC and KYT in a timely manner[; and] [w]orking with line management and human resources management to ensure the adequacy of the KYC and KYT training that is given to staff.” Should we adopt such a requirement for the KYUP obligations? Should we require that providers implement close coordination between sales teams and compliance teams to ensure that the KYUP steps occur before a provider agrees to provide service to an upstream provider?

We propose that voice service providers retain the KYUP information they collect for each upstream provider for the entirety of any potential statute of limitations relating to the use of its network or services to transmit illegal calls—
i.e.,
for a minimum of four years.

We seek comment on this proposal. Should we consider a longer or shorter retention timeframe? What are the industry standard retention periods for business customer information? Would such information retention implicate the security of sensitive business or personal information, and if so, what safeguards can we implement to address this? In the event we allow providers to use third parties to complete their KYUP obligations, we believe the provider should maintain the obligation to supply the information in the event of an investigation under our proposals, and would therefore need to ensure it can obtain the information from the third party in a timely manner upon request.

We also seek comment on whether voice service providers should undergo any compliance reviews related to their KYUP obligations. For instance, should we require providers to obtain independent verification of their compliance, such as through an independent auditor using generally accepted auditing practices? How often should such reviews be conducted? Should they be randomized? Should reviews generally evaluate all provider KYUP practices or be targeted toward specific practices, such as those where there appear to be the greatest weaknesses by providers at the time? What role, if any, should the Commission play in such compliance reviews? Should we require providers to report the findings of such reviews to the Commission?

Implementation costs and cost recovery.
We seek comment on the costs of the KYUP obligations for voice service providers. As an initial matter, we believe that many legitimate providers already perform many of the baseline KYUP steps we propose above to fulfill their existing obligation to know their upstream providers, and therefore their costs will be minimal. We believe the greatest cost would be incurred by providers that have not implemented the most basic KYUP practices to comply with that existing obligation, and we believe that cost would be warranted. We seek comment on what share of providers would need to adopt new processes and what share would only need to make minor adjustments. What costs would providers who only require minor changes to their current procedures incur? We believe that providers that seek to enter into business with a number of upstream providers will also incur greater costs but that those costs are warranted as they will ensure that wholesale providers are employing proper measures to deter bad actor providers. Upstream providers that only have a direct relationship with end users will not incur these costs. We also believe our proposed baseline KYUP requirements minimize the costs incurred by obligated providers by enabling them to rely on upstream providers to supply most of the information they must obtain and only prescribing basic due diligence. Additionally, we believe that responsible providers already collect most of this information as part of their normal onboarding process with new upstream providers. We seek comment on this assessment and on the specific costs providers, including small providers, may face for each of the requirements we propose above.

We also think that the costs associated with being subject to a downstream provider's KYUP obligations will be reasonable for legitimate and responsible upstream providers. Nearly all voice service providers may bear some costs in compiling the requested KYUP information and providing it to downstream providers, but we believe many upstream providers will have this information readily available. Upstream providers will also be able to share the same information with all downstream providers with which they do business. In any event, the fact that they will have to provide information will, we believe, spur all voice service providers in the ecosystem to be more responsible actors, ensuring that they have completed necessary registrations and can provide information showing they are a legitimate business. We seek comment on these views.

We seek comment on whether we should put guardrails on how voice service providers will recover these costs. Will providers treat this as a cost of doing business and recover such costs from their customers? Will they attempt to charge upstream providers for the costs of performing their KYUP obligations? Should we explicitly permit or prohibit any specific cost recovery approaches?

Safe harbor for accepting calls from upstream providers who obtain SPC tokens.
Below we propose to require that the Governance Authority strengthen its SPC token access policy, including certain steps to know voice service providers that are modeled on the KYUP requirements above, and increase its enforcement of the policy. In the event we adopt those requirements, we seek comment on whether we should create a safe harbor from Commission enforcement of KYUP requirements if a provider provides service to an upstream provider that has and maintains an SPC token with specific regard to the KYUP requirements that would duplicate the token access policy requirements. We believe such a safe harbor could reduce providers' costs of performing KYUP requirements. However, we are concerned it could undermine the ability of providers to perform KYUP monitoring obligations because they would not have obtained certain information about upstream providers to compare against. Should we require the Governance Authority to share information with providers that they can use to support their monitoring activities? Should this safe harbor only apply to small providers?

Best practices.
We seek comment on whether, instead of requiring voice service providers to follow the specific baseline KYUP obligations we propose above, we should establish those proposed requirements as best practices or advise providers to use existing resources as best practices. Should we delegate authority to the Wireline Competition Bureau (Bureau) to establish and maintain best practices, as needed, in coordination with the Consumer and Governmental Affairs Bureau and the Enforcement Bureau? Are there specific existing best practices resources we should advise providers to use? Should we establish a safe harbor from Commission enforcement of the general KYUP requirement for providers that do adopt the best practices? How would such a safe harbor work? Alternatively, should we adopt a rule requiring providers to use a specific best practices resource?

Liability standard for Commission enforcement.
We seek comment on whether we should establish a liability standard the Commission could use to hold voice service providers accountable for complying with their KYUP obligations. We remain concerned that certain providers may seek to circumvent these obligations. Should we establish that the Commission can hold a provider accountable if it knew or should have known that an upstream provider is using its network or services to transmit illegal calls? Should we establish a different liability standard? If so, what liability standard would best spur providers to take their KYUP obligations seriously without placing an unreasonable threat of enforcement on those providers that make legitimate efforts to fulfill those obligations? Should we establish a liability standard as an alternative to establishing the baseline KYUP obligations we propose? Should we establish a liability standard for providers who abuse their KYUP obligations, such as using them to

advance anticompetitive goals? If so, should the standard be whether a decision to refuse or discontinue service was objectively reasonable?

2. Enhancing Oversight of Voice Service Providers by the STIR/SHAKEN Governance Authority

The STIR/SHAKEN framework is predicated on trust. The STIR/SHAKEN Governance Authority establishes and enforces the policies and procedures that determine which voice service providers can participate in the STIR/SHAKEN ecosystem so that authentication information is applied by trusted entities. When we refer to the Governance Authority, we include the Policy Administrator and the Certification Authorities even though each entity may perform specific functions, unless otherwise specified. The technical requirements establish a secure mechanism to transmit authentication information so that it remains trustworthy. As originally contemplated, this framework would allow for originating providers to develop a reputation based on the calls they sign and for terminating providers to treat calls differently based on that reputation, which might deter originating providers from transmitting illegal calls. However, trust in the STIR/SHAKEN framework can break down when there are bad actor providers in the ecosystem that are not implementing the framework consistently or correctly, including originating providers that fail to authenticate calls or do not apply the proper attestations, downstream providers that accept those calls, and terminating providers that fail to verify authentication information.

We do not believe that the Governance Authority's current policies and practices are sufficiently preventing bad actor providers from entering the STIR/SHAKEN ecosystem. Because this can undermine the trust on which STIR/SHAKEN is built, we propose and seek comment on steps we should take to enhance the Governance Authority's role in serving as a gatekeeper to the ecosystem. Specifically, we propose to require that the Governance Authority adopt improved policies that include affirmative, effective measures to prevent voice service providers that are issued SPC tokens from transmitting calls that are not in compliance with the STIR/SHAKEN authentication framework, the Commission's STIR/SHAKEN rules, or the Governance Authority's policies and to prevent Certification Authorities from failing to comply with the STIR/SHAKEN authentication framework, the Commission's STIR/SHAKEN rules, or the Governance Authority's policies. We propose that such policies include enhancements for the issuance and revocation of SPC tokens and the selection and removal of Certification Authorities, including taking greater action to enforce those policies. We also propose that the Governance Authority apply those policies to existing SPC token holders and Certification Authorities within six (6) months after any rules we adopt go into effect. We believe these enhancements will not only help restore trust in the STIR/SHAKEN framework, but will help keep bad actor providers off the voice network, particularly if we adopt our proposal to prohibit voice service providers from accepting unauthenticated SIP calls.

In advancing these proposals, we acknowledge that we would be applying a more directed oversight approach with the Governance Authority, but we believe Commission intervention now is necessary to restore trust in the STIR/SHAKEN framework, and that we have authority to do so. Although the Commission found that intervention in the independent STIR/SHAKEN governance structure was not appropriate when it first mandated that voice service providers implement STIR/SHAKEN given that the Commission “[did] not know the nature and scope of the problems that may arise,” it has consistently contemplated—since before the Governance Authority was established—that it could play a greater oversight role if necessary. With greater experience, we now believe that we have identified problems that the Commission can address by requiring updated policies and requirements. We seek comment on these views.

Policies for the issuance of SPC tokens and selection of Certification Authorities.
We propose to direct the Governance Authority to revise its SPC token access policy to include baseline vetting requirements prior to the issuance of SPC tokens that are modeled off the KYUP requirements we propose above, and that these requirements should also be applied to existing SPC token holders. We do not believe that the Governance Authority's current SPC token access policy is sufficient to prevent bad actor providers from obtaining a token, which in turn authorizes them to access the certificates needed to authenticate calls, and then use those certificates to sign calls that are not in compliance with the STIR/SHAKEN authentication framework and the Commission's STIR/SHAKEN rules. Under the existing SPC token access policy, providers must: (1) have a current form 499-A on file with the Commission, (2) have been assigned an Operating Company Number (OCN), and (3) have certified with the Commission that they have implemented STIR/SHAKEN or comply with the Commission's robocall mitigation program requirements and are listed in the RMD. Although the existing policy subjects voice service providers seeking SPC tokens to some level of scrutiny, it does not include an evaluation of whether a provider is a legitimate entity or provide the gatekeeping necessary to keep potential bad actor providers out of the STIR/SHAKEN ecosystem. Accordingly, we propose to require the Governance Authority to modify its policy to include all of the KYUP information collection, compliance review, and verification requirements we propose above. We also propose to require that the Governance Authority adopt a policy to review this information and deny an SPC token when there is a reasonable basis for believing the SPC token holder is unlikely to comply with the STIR/SHAKEN authentication framework, the Commission's STIR/SHAKEN rules, and/or the Governance Authority's policies. We seek comment on our proposals and associated analysis. Are there any such KYUP requirements we should not require the Governance Authority to follow? How do these relate to the information collection requirements of, and due diligence performed by, the National Exchange Carrier Association (NECA) when providers request OCNs? Should we require other changes to the Governance Authority's SPC token access policy to deter bad actors?

We likewise propose to require the Governance Authority to follow certain KYUP requirements to vet entities seeking to become Certification Authorities prior to their selection, and that these requirements should be applied to existing Certification Authorities. The Governance Authority has not published a written policy governing the selection of Certification Authorities. Rather, the Governance Authority has established a policy for governing the issuance of certificates that is consistent with the STIR/SHAKEN standards, which Certification Authorities must follow in order to be considered a “trusted” Certification Authority. We are concerned that some Certification Authorities may not be following the certificate issuance policy or otherwise may be enabling illegal calls. While a robust Certification Authority removal process could address such concerns, we believe the

Governance Authority should take steps to identify bad actors before they are selected as Certification Authorities. Accordingly, we propose to require the Governance Authority to establish a policy for the selection of Certification Authorities and that such policy should include following all of the KYUP information collection and information verification requirements we propose above. We also propose to require that the Governance Authority policy include reviewing this information and denying selection of an entity as a Certification Authority when there is a reasonable basis for believing the entity is unlikely to comply with the STIR/SHAKEN authentication framework, the Commission's STIR/SHAKEN rules, and/or the Governance Authority's policies. We seek comment on our proposals and associated analysis, including whether we should require greater or lesser due diligence obligations. Should we also require the Governance Authority to adjust the certificate issuance policy, such as by reducing the maximum permissible expiration timeline for a certificate?

We also seek comment on whether we should require the Governance Authority to establish a conflict of interest policy governing Certification Authorities' relationships with voice service providers, including when they are also acting as voice service providers, and what that policy should entail. Although the Governance Authority has established a policy concerning conflicts as to a Certification Authority also serving as the Policy Administrator, it has not established a conflict-of-interest policy as to a Certification Authority also acting as a provider or having common ownership with providers for which the Certification Authority issues certificates. We are concerned about such relationships because a Certification Authority may have incentive to issue certificates to providers to which they are related without following the certificate issuance policy or in a way that otherwise enables illegal calls. We seek comment on this assessment. Should we also require the Governance Authority to revise its certificate issuance policy so that Certification Authorities have a responsibility to not issue certificates to entities that are likely to use certificates to sign illegal calls?

Policies for the revocation of SPC tokens and removal of Certification Authorities.
We propose to require that the Governance Authority play an active role in obtaining information about providers misusing their SPC tokens and take appropriate action on any information it receives or obtains. Under the Governance Authority's existing SPC Token revocation policy, providers must sign an agreement that contains the terms for which tokens may be used, such as in compliance with the STIR/SHAKEN standards governing proper attestations. The policy further states that the Governance Authority may revoke SPC tokens upon indication that a provider is in breach of the agreement, and lays out other specified reasons for revocation. Additionally, the policy imposes a standardized process stakeholders must use to report potential SPC token misuse. The stakeholders identified by the policy include the Policy Administrator, Certification Authorities, voice service providers, members of the Governance Authority board, Alliance for Telecommunications Industry Solutions (ATIS) staff, regulatory authorities (
e.g.,
the FCC and FTC), consumers, and third parties. Despite well-known reports that providers are applying improper attestations to calls or otherwise failing to follow the STIR/SHAKEN standards, the Governance Authority has reported to Commission staff that it has not permanently revoked SPC tokens of its own accord except for providers that have failed to pay required fees or failed to supply annual FCC Form 499 revenue data, which the Governance Authority uses to calculate fees. The Governance Authority has revoked SPC tokens in response to Commission enforcement actions against certain providers, and it reports that it has engaged with some providers who were subject to complaints about improper attestations, but that the providers cured their violations prior to SPC token revocation or after revocation, resulting in reinstatement. We believe the Governance Authority may be hindered in enforcing the SPC token policy by relying on an overly formal reporting process to obtain information and that it may be too forgiving in enforcing the policy. To address these issues, we first propose to require that the Governance Authority establish formal information sharing arrangements with the Industry Traceback Group and call analytics providers to receive information about specific providers' practices. We also propose to require the Governance Authority to review and evaluate information it receives from any sources, even in the absence of formal reports. We further propose to require that the Governance Authority enhance its procedures for acting on suspected violations, and we seek comment on how its procedures should be enhanced so providers that violate the STIR/SHAKEN authentication framework, the Commission's STIR/SHAKEN rules, and/or the Governance Authority's policies are permanently removed from the STIR/SHAKEN ecosystem. We seek comment on our proposals and any aspects of our analysis. Should we require the Governance Authority to seek additional information about providers? Should we require it to relax its reporting policy so that stakeholders can submit information informally or anonymously?

We propose to require that the Governance Authority also play a more active role in seeking information, and taking action on information it receives, about Certification Authorities failing to follow the STIR/SHAKEN authentication framework, the Commission's STIR/SHAKEN rules, and/or the Governance Authority's policies. As noted, the Governance Authority has established a policy governing the issuance of certificates by Certification Authorities. It has also established a policy for the suspension or removal of Certification Authorities that violate the policy, violate their agreement with the Governance Authority, or have been involved in a cybersecurity incident. Commission staff is concerned about anecdotal evidence that certain Certification Authorities issue a disproportionate number of certificates that are being used by voice service providers applying improper attestations to their calls, and we seek record evidence demonstrating this concern. We believe this indicates that the Governance Authority policies do not sufficiently guard against misuse of certificates and the role Certification Authorities may play in such misuse. To our knowledge, the Governance Authority has not suspended or removed any Certification Authorities. Commission staff has observed changes in the number of Certification Authorities, but believes those have been due to voluntary decisions by Certification Authorities. We propose to require that the Governance Authority establish a process to accept information about Certification Authority practices from stakeholders, including a process to regularly obtain information from call analytics providers. We further propose to require that the Governance Authority initiate investigations into Certification Authorities with suspect practices, such as granting certificates to providers responsible for a high volume of illegal calls associated, and remove Certification Authorities who are found to be violating the STIR/SHAKEN authentication framework, the

Commission's STIR/SHAKEN rules, and/or the Governance Authority's policies. We seek comment on whether we should require the Governance Authority to obtain other information about Certification Authority practices that would inform their oversight. We further seek comment on whether we should require the Governance Authority to update its policies to better address the misuse of certificates and the role that Certification Authorities may play in such misuse, and if so, how. We also seek comment whether the Governance Authority has established adequate steps providers must take when they were issued certificates from a Certification Authority that was subsequently removed.

We seek comment on whether we should require that the Governance Authority review and act on any information it receives or obtains about voice service providers or Certification Authorities within a specific time. We note that bad actor providers can transmit a significant number of non-compliant calls in a short period of time. Is 10 business days a sufficient time period in which the Governance Authority can reasonably review evidence of wrongdoing and take action? Should it be longer or shorter? Should we require the Governance Authority to adopt a policy to immediately suspend an SPC token or Certification Authority when presented with evidence of egregious activity, after which it can conduct a more thorough review and final determination?

Implementation barriers.
We seek comment on any barriers to the Governance Authority following any of the requirements we proposed above. Are there steps the Commission or the Governance Authority can take to facilitate information sharing? Are there specific reasons the Governance Authority may be deterred from obtaining information or enforcing the policies, such as resource or liability concerns? Can any costs associated with obtaining any such information be incorporated into other Governance Authority operational expenses that are paid for by fees from providers obtaining SPC tokens? Is there a safe harbor we can grant to the Governance Authority for denials and revocations that would support it taking action, and if so, how would the safe harbor be applied? Should we permit the Governance Authority to use third parties to perform some or all of the required vetting?

Appeals.
We propose to allow parties to appeal Governance Authority decisions to the Commission. The Commission has already established a process for voice service providers to appeal token revocation decisions to the Commission. Should we establish a similar process for entities removed as Certification Authorities, as well as for when providers are denied SPC tokens and entities denied as Certification Authorities in the first instance? How, if at all, should the appeals process be different? Should aggrieved entities be required to appeal to the Governance Authority before it would be allowed to file such appeals with the Commission? Should we also allow stakeholders to appeal decisions by the Governance Authority declining to revoke an SPC token, remove a Certification Authority, or initiate an investigation? How might this appeal process work or might there be a better process for entities to alert the Commission to the Governance Authority's decisions they perceive to be erroneous? Should we require the Governance Authority to respond to stakeholders that submit complaints if it declines to take any of those actions?

Reporting.
We propose to require that the Governance Authority report to the Commission on a quarterly basis information about its enforcement activity, including complaints it has received, investigations it has initiated or concluded, and decisions concerning SPC token revocations and Certification Authority removals, including any reports documenting the Governance Authority's final determinations. We believe that such reporting will aid the Commission in its efforts to identify and take action against bad actor providers. We seek comment on this proposal.

B. Raising STIR/SHAKEN Attestation Standards

An attestation is a voice service provider's assertion about the knowledge it has of its customer and the customer's right to use a telephone number. A provider may assert A-level (or “full”) attestation when it (1) is responsible for the origination of the call onto the IP network, (2) has a direct authenticated relationship with its customer and can identify the customer, and (3) has established a verified association between its customer and the telephone number used for the call. It may assert B-level (or “partial”) attestation when it can satisfy elements (1) and (2), but not (3). It must assert C-level (or “gateway”) attestation when the provider has no relationship with the originator of a call, such as when a provider is acting as an international gateway. The ATIS standards also permit a C-level attestation when a provider is unable to satisfy the criteria of A- or B-level attestations. By asserting full (A-level) attestation, the provider is claiming that is has knowledge that the number has not been spoofed. While calls receiving partial (B-level) or gateway (C-level) attestations are not necessarily spoofed, they indicate that the voice service provider lacks sufficient knowledge to conclusively determine that fact.

Many calls are being authenticated by originating providers with improper attestations, according to a 2024 report from the STIR/SHAKEN Governance Authority. The
Call Branding FNPRM
record is replete with comments making the same case. The Commission has acknowledged the problem too, and has taken some steps to address it. The
Lingo Order
represents the most high-profile example, in which the Commission found that Lingo Telecom applied A-level attestations to 3,978 spoofed robocalls carrying a deepfake generative AI voice message purporting to be from then-President Joe Biden. Recent data show that “93.4% of robocall traffic from the most prolific robocall signers now carry A-level attestations” and “48 percent of illegal calls are A-attested.” In an analysis done by the American Bankers Association “of 12,900 calls that illegally spoofed telephone numbers belonging to 47 large banks, retailers, and healthcare providers, more than half of the calls received an A-level or B-level attestation.” Improper signing practices are not limited to bad actor providers. Transaction Network Services reports that, based on internal data covering the first half of 2025, “certain top tier carriers had marked around 8% of their invalid number calls with A-level attestation, and non-top tier carriers had marked 57% of their invalid number calls with A-level attestation.”

These findings call for enhancements to the Commission's STIR/SHAKEN implementation rules. Improper attestations undermine the trust in and integrity of the STIR/SHAKEN framework, and its value in supporting efforts to combat illegal robocalls. When attestations are improper, terminating providers do not have trustworthy information concerning whether the number used for the call was illegally spoofed. Because voice service providers also use attestations to inform call analytics engines, improper attestations can undermine their effectiveness, contributing to inaccurate blocking and labeling determinations. And because the Commission has proposed in the
Call Branding FNPRM
to prohibit terminating providers from delivering indications of A-level attestations to consumers' devices

unless they also deliver verified caller identity information, improper attestations may subvert the validity of caller identity information rather than serve to enhance it. Ultimately, improper attestations may lend false legitimacy to bad actors and may undermine the credibility of good actors.

Given these stated harms, stakeholders have called on the Commission to take a stronger role in overseeing and enforcing voice service providers' compliance with the ATIS attestation standards. We believe the primary cause for improper attestations is a lack of specificity on what practices are permissible for satisfying each of the attestation-level criteria. We also believe improper attestations result from disagreement about what mechanisms are permitted to close the attestation “knowledge gap.” As we understand it, this knowledge gap generally occurs in the following general scenarios:

Scenario 1
—When the originating provider that is authenticating the call is a separate entity from the telephone number service provider (TNSP) that provisioned the telephone numbers to the customer initiating the call, such as when a TNSP assigns direct inward dialing (DID) numbers to a customer that initiates the call with another voice service provider.

Scenario 2
—When the originating provider does not have a direct relationship with the end user because the end user obtained voice service from an intermediary provider, such as a reseller that may be several steps removed from the originating provider if the service is resold multiple times. This scenario is a direct result of the STIR/SHAKEN implementation exemption for non-facilities-based providers that is inherent in the STIR/SHAKEN framework and which we propose to codify below. We also propose to close this knowledge gap by requiring all voice service providers serving end users directly to make attestation-level decisions regarding those end users' calls.

We do not believe these scenarios are mutually exclusive, and therefore both could exist with respect to a single call. We seek comment on this assessment. Are there other scenarios that cause a knowledge gap? We believe that bad actors may take advantage of the “knowledge gap” to obscure their identity to the originating provider and use that obscurity to generate spoofed or unlawful calls. As we raised in the
Call Branding FNPRM,
the knowledge gap can also undermine the ability for providers to verify caller identity verification information. We seek comment on these views. As a technical matter, we believe there is also a knowledge gap when a gateway provider is authenticating a call that it received from a foreign voice service provider and when an intermediate provider is authenticating an unauthenticated call it receives, but these circumstances are outside the scope of the problem we seek to address here.

We propose specific requirements and guardrails to govern STIR/SHAKEN attestation-level decisions to ensure that voice service providers base such decisions on sufficient knowledge about their customer and the customer's right to use a number, and not on factors that may be unrelated to caller ID information. Although we believe the main driver of improper attestations is the presence of bad actor providers in the ecosystem, which we believe will be addressed by the KYUP and Governance Authority proposals above, we also want to ensure that all providers in the ecosystem are applying attestations consistently and correctly. We also seek to provide a clearer foundation for enforcement when providers misapply attestations. Accordingly, we propose to: (1) codify the attestation levels established in the ATIS standards and the criteria that apply to them, (2) set out requirements to satisfy the attestation-level criteria including closing the attestation knowledge gap in Scenario 1, and (3) codify the definition for and prohibitions on improper attestations that are implicit in providers' obligation to implement the STIR/SHAKEN standards. We believe the proposals will serve to enhance the STIR/SHAKEN standards and better achieve the intended outcomes of the TRACED Act without superseding the requirement that providers implement the STIR/SHAKEN standards, as required by the TRACED Act. We seek comment on this analysis, including the extent to which our proposals will address all causes of improper attestations and our authority to take these actions. We also seek comment on whether we should require providers to implement the most current version of the STIR/SHAKEN standards, rather than the version that was in effect at the time they were first required to implement STIR/SHAKEN. In the
First Caller ID Authentication Report Order,
85 FR 22029 (April 21, 2020) and in subsequent orders, the Commission required providers to comply with the versions of those standards that were in effect at the time of their respective compliance deadlines, including any errata as of those dates or earlier. The Commission delegated to the Bureau authority: (1) to determine whether to seek comment on requiring compliance with revised versions of the three ATIS standards associated with the STIR/SHAKEN authentication framework, and all documents referenced therein; (2) to require providers subject to a STIR/SHAKEN authentication requirement to comply with those revised standards; and (3) to set appropriate compliance deadlines regarding such revised standards. In doing so, the Commission noted that providers will only be required to implement new standards if the benefits to the STIR/SHAKEN ecosystem outweigh any compliance burdens. Notwithstanding our delegation of authority to the Bureau, we seek to address the question here.

1. Codifying the Attestation Levels

We propose to codify the three attestation levels—A, B, and C—and the criteria that apply to each level. We believe that this step goes hand-in-hand with establishing steps voice service providers must take to satisfy the attestation-level criteria, as we propose to do below. We also think it will clarify any perceived ambiguity about the attestation levels by providers and provide a stronger foundation for oversight and enforcement of attestation-level decisions. We seek comment on this proposal. In particular, are there meaningful concerns with codifying the attestation levels when the Commission has acknowledged that ATIS standards may change over time? Are ATIS and/or the Governance Authority continuing to study the problem of improper attestations and planning to issue more particularized guidance? Is ATIS in the process of changing the attestation levels or their criteria, particularly in light of the issues with improper attestations? We note ATIS's view in the context of non-IP caller ID authentication standards that “[s]tandards are not a proxy for regulations” and that “standards should not be used as the primary basis for regulation without significant independent legal and factual analysis to evaluate whether the standard is viable or appropriate for a regulatory mandate to implement solution(s) based on that standard.” Given the widespread support for and investment in STIR/SHAKEN, we believe that the attestation portion of the standard is viable and appropriate for codification. We seek comment on these views and any other legal or factual analysis that we should consider in our assessment.

2. Requirements To Satisfy the Attestation Level Criteria

We propose and seek comment on specifying how voice service providers may satisfy the criteria used for applying the STIR/SHAKEN attestation levels to dispel any perceived ambiguity about how the criteria apply and ensure providers are making proper attestation decisions. We believe doing so is necessary, given the evidence of improper attestations by providers of all types and stakeholders' requests that the Commission provide greater oversight of attestation practices. We seek comment on this proposal. Do commenters agree it is necessary to specify how attestation-level criteria are satisfied to address improper attestations? Are providers using the absence of such specificity to skirt their attestation responsibilities? Are there other reasons, beyond differences in interpretation or implementation of the ATIS standards, as to why many providers are improperly attesting to calls? Rather than adopting requirements, should we establish best practices, and should we delegate authority to establish those best practices to the Bureau? If we do establish requirements for satisfying attestation-level decisions, would this instill enough trust in attestations that we should prohibit blocking or spam labeling of calls with A-level attestations? What about B-level attestations? What incentives would that provide to originating providers?

Responsibility for call origination.
We propose that for a voice service provider to satisfy the requirement that it is responsible for the origination of the call onto the IP network, it must qualify for the definition of “origination” that we propose to adopt below. We seek comment on this proposal. If we adopt our proposal to define “origination” as the technological act of placing a customer's outgoing call onto the network using the provider's own facilities, does this offer enough clarity about which provider is responsible for originating a call onto the IP network? If not, how can we provide greater clarity? We believe that, under our definition of “origination,” neither intermediate providers, including gateway providers, nor initiating providers, as we propose to define that term below, can be responsible for the origination of a call. In our discussion surrounding our proposals to define “origination” and “originating provider” and “facilities-based provider” and “non-facilities-based provider,” we seek comment on whether under our proposed definition of “origination,” only facilities-based providers can be originating providers, meaning non-facilities-based providers cannot be responsible for the origination of a call. Is this understanding correct?

Direct authenticated relationship with the customer and ability to identify the customer.
We propose that for an originating provider to satisfy the requirement that it have a direct, authenticated relationship with the customer associated with the call and be able to identify the customer, it must satisfy any KYC or KYUP requirements established by the Commission. We seek comment on this proposal. The KYC requirement would apply when the originating provider is authenticating a call for an end user customer. Section 64.1200(n)(4) of the Commission's rules establishes the current KYC requirement, and in the
KYC FNPRM,
the Commission seeks comment on specific requirements originating providers must follow to fulfill this requirement. The KYUP requirement would apply when the originating provider is authenticating a call from a customer that is a direct upstream provider, such as when the originating provider's customer is a reseller. As discussed above, Section 64.1200(n)(5) of the Commission's rules establishes a KYUP requirement, and all voice service providers must describe their KYUP practices in the robocall mitigation plans they file in the RMD. We also propose above to establish specific requirements providers must follow to fulfill the KYUP requirement. We believe that tying KYC and KYUP requirements to attestation-level decisions will help ensure originating providers actually know their customer before assigning A- or B-level attestations to calls, making such attestations more accurate and thereby better deterring impermissible spoofing. Do commenters agree? Are there other benefits? Are there any drawbacks? Should we only require originating providers to rely on specific KYC or KYUP practices to fulfill this criterion? If so, which practices? We also seek comment on how this proposal relates to the
Call Branding FNPRM,
which seeks comment on requiring originating providers to verify customer identity information as a condition of A-level attestation.

Establishing a verified association between the customer and the telephone number used for the call.
We propose to specify permissible and impermissible mechanisms an originating provider may use to establish a verified association between its customer and the telephone number used for a call. We do not believe all originating providers are meaningfully verifying a customer's association with a telephone number, leading to improper attestations. This stems, we believe, from ATIS-1000074, which states that “[u]ltimately it is up to service provider policy to decide what constitutes [a] `legitimate right to assert a [telephone number]' but the service provider's reputation may be directly dependent on how rigorous they have been in making this assertion.” We believe that some originating providers are interpreting this direction too broadly.

To resolve these practices, we propose two mechanisms that providers may use to establish a customer's association with a number. First, we propose to find that an originating provider may establish a verified association between its customer and the telephone number used when the originating provider is the TNSP (
i.e.,
it assigned the telephone number to the customer either as an individual number or as part of a range of numbers). Second, we propose to partially close the knowledge gap in Scenario 1 by finding that delegate certificates are a viable method for originating providers to establish a verified association between a customer that is an initiating provider and the number being used to initiate the call, and we seek comment on this view. Delegate certificates, which are described in ATIS-1000092 (a separate ATIS standard than those required for STIR/SHAKEN implementation), allow an entity to obtain a certificate from the TNSP that demonstrates the entity's authority to use the number and present that certificate to the originating provider. We believe this process would enable initiating providers to satisfy this criterion whenever its end user customer uses a telephone number that the initiating provider assigned to the end user. To what extent are providers already using delegate certificates for this purpose? What measures, if any, are needed to ensure that delegate certificates are accepted as a valid form of showing an initiating provider has a relationship with a number? Must we require that originating providers accept delegate certificates from initiating providers as evidence they have a verified association with a number, and if so, should we place any guardrails on this requirement? In the
Eighth Caller ID Authentication Order,
90 FR 40241 (Aug. 19, 2025)), the Commission declined to mandate acceptance of delegate certificates, concluding that such a mandate was beyond the scope of the third-party authentication rules adopted in that
Order
and that the record in that proceeding was

insufficient to weigh the benefits and burdens of imposing such a requirement. Given our aim to close the knowledge gap, we seek to develop a more robust record on the issue. What are the benefits and drawbacks of the delegate certificate approach? Because the delegate certificate would be associated with the TNSP, would it enable the TNSP to be held accountable for the illegal calls transmitted by entities to which they assigned numbers? We also seek comment on whether we should make a determination as to whether delegate certificates are a permissible method for originating providers to establish a verified association between an end user customer, such as a non-voice service provider enterprise, and the number being used to initiate the call. ATIS-1000092 contemplates that end users that are non-provider enterprises could also obtain delegate certificates from a TNSP and present them to voice service providers to establish their association with the telephone number they are using. To what extent are delegate certificates already being used for this purpose? What are the risks and benefits of allowing non-provider entities to participate in the STIR/SHAKEN ecosystem in this fashion? We seek comment on any additional provider and customer arrangements for which delegate certificates could be used to establish a customer's association with a number.

Conversely, we believe there are two mechanisms a voice service provider cannot use to establish a verified association between its customer and the telephone number used. First, we do not believe this association can be established by a business agreement or certification that includes only a general statement that the customer will only use numbers with which it has a verified association. This is essentially the mechanism that Lingo Telecom used when it misassigned A-level attestations for spoofed calls. Second, we do not believe an association can be established when a number qualifies as a Do-Not-Originate (DNO) number by default. We seek comment on these beliefs.

We seek comment on whether we should specify other mechanisms an originating provider can use to establish a customer's association with a telephone number. Should we require that providers obtain reasonable evidence of a customer's association with a number? Should we allow business agreements or certifications that specify the active telephone numbers the customer will use? In the
Robocall Numbering Policies NPRM
(91 FR 25312), we sought comment on “better means of tracking the chain of custody of numbering resources,” such a numbering database, and we seek comment on whether any such solution we establish could be used by providers to verify customer associations with telephone numbers. Do commenters believe the still-in-development VESPER standard, which is described as an extension of delegate certificates that establishes an entity or individual's verified right-to-use a number after the entity is vetted, could be used for this purpose?

3. Attestation Prohibitions

We propose to define improper attestation and establish an affirmative prohibition on voice service providers engaging in improper attestation practices, including willfully assigning improper attestations and using other criteria to make attestation-level decisions. Although we believe the existing requirement that providers implement STIR/SHAKEN using the STIR/SHAKEN standards necessarily requires that they apply attestations based on the criteria described above, we believe that codifying these prohibitions will establish a clear floor and ceiling for each attestation level and a firmer foundation for enforcement of improper attestations. We seek comment on these views.

Defining “improper attestation.”
We propose to define improper attestation as any attestation level that does not conform to ATIS-1000074 and the Commission's rules, including any attestation that is inconsistent with the information the voice service provider has, or is required to have, about the call. This proposed definition largely mirrors the definition established by the Governance Authority in guidance concerning improper authentication and attestations, and we believe it properly captures what constitutes an improper attestation. We seek comment on this proposal. We do not, at this time, propose to establish requirements related to improper authentication, but we note that the guidance defined improper authentication as the use of a certificate “to authenticate any information contained within an STI-GA recognized SHAKEN extension that is known to be false, or information that is outside the scope of the U.S. STIR/SHAKEN framework.”

Prohibiting voice service providers from willfully making improper attestations.
We propose to prohibit voice service providers from willfully assigning attestations that are higher or lower than permissible under the STIR/SHAKEN standards and any rules we establish. ZipDX provides evidence that voice service providers may improperly apply higher-than-permissible attestations if they want their calls to be viewed as more trustworthy and lower-than-permissible attestations if they want their calls to be transmitted with less scrutiny. Is there other evidence that providers are or have the incentive to willfully apply improper attestations? Should we find that specific practices constitute improper attestation, such as a C-level attestation by a provider that originates a call or an A- or B-level attestation when the provider authenticating the call is a gateway provider or non-gateway intermediate provider?

Prohibiting providers from using other criteria in making attestation-level decisions.
We propose to prohibit voice service providers from using other information or standards for setting attestation levels. We are concerned, in particular, about actual or
de facto
pay-for-attestation or attestation retribution or reward practices. This might occur, for example, if a provider tells a customer (whether an end user or upstream provider) that the customer may or must buy a particular product or service to receive a higher-level attestation or that the customer's attestations will be lowered if it does not take a specific action, notwithstanding what attestation would be proper for the call under the STIR/SHAKEN standards and the Commission's rules. We seek comment on this proposal. We do not intend to intervene in legitimate third-party-signer or similar arrangements. We seek comment on what legitimate arrangements may be implicated by this rule, and how to ensure our rule is cabined to exclude them. Would such a prohibition risk preventing providers from using advanced tools or strategies to help inform their attestation-level decisions? Do providers have evidence of such pay-for-attestation arrangements or retribution/reward schemes, and if so, are they a widespread problem? Are there other criteria on which providers rely in making attestation-level decisions that may or may not be useful to consider in this analysis?

C. Closing STIR/SHAKEN Implementation Loopholes

The STIR/SHAKEN framework enables an end-to-end system for authenticating caller ID. For this system to work, the Identity header must travel the entire length of the call path, from originating provider to terminating provider, which can include networks of various types of voice service providers. The Commission has

recognized that the existence of non-IP networks is among the most significant hinderances to full STIR/SHAKEN implementation and continues to explore avenues to advance the IP transition as well as its proposals for non-IP caller ID authentication solutions. The Commission's caller ID authentication rules apply to all voice service providers in a call path—namely voice service providers that perform the origination of calls, non-gateway intermediate providers that carry or process the calls without performing the origination or termination of them, gateway providers that receive calls from foreign originating or intermediate providers at their United States facilities and transmit them downstream, and voice service providers that perform the termination of calls. But we believe that certain providers do not consider themselves subject to the caller ID authentication rules based on perceived ambiguity in the definitions for these types of providers in the Commission's rules. We also believe at least one of the undue hardship implementation exemptions may no longer be needed. Additionally, providers that lack control of the network infrastructure necessary to implement STIR/SHAKEN currently do not have an obligation to participate in the STIR/SHAKEN ecosystem. Beyond these issues, we are concerned about other loopholes that may contribute to the number of calls that terminate without authentication information, including providers intentionally choosing to initiate or route authenticated calls over non-IP networks that cannot carry STIR/SHAKEN authentication information, providers accepting unauthenticated SIP calls, and our rule requiring only the first intermediate provider in a call path to authenticate an unauthenticated call. We propose to close these loopholes below and seek comment on any other steps we should take to enhance STIR/SHAKEN.

1. Clarifying Definitions for Providers That Must Implement STIR/SHAKEN

In this section, we examine a variety of terms and definitions found in our caller ID authentication rules and seek comment on a variety of proposals to amend or adopt definitions to ensure that our rules are precise, clear, administrable, and do not enable bad actor providers to skirt their obligations. Specifically, we seek to define important terms that describe all aspects of the transmission of a call, from the point it is initiated by a calling party to the point it is received by the call recipient, and all voice service provider types that play a role in this transmission. We believe that doing so will strengthen the caller ID authentication regulatory framework by putting all voice service providers on notice as to their precise obligations. We also anticipate this will strengthen our RMD regulatory framework, which requires, among other things, that providers identify their role in the call path and certify to their STIR/SHAKEN implementation for the type of provider they are and whether any exemptions apply. We intend for the definitions we adopt to apply on a call-by-call basis, and we seek comment on this approach. In connection with this task, we seek to know the universe of entities that participate in the voice ecosystem, the types of arrangements between these entities related to the provision of voice service, and whether the definitions we discuss below will indeed clarify the roles and obligations of each entity.

a. Voice Service and Voice Service Provider

We propose to change our interpretations of the definitions of “voice service” in the RAY BAUM'S Act and the TRACED Act to encompass the same scope of providers, and propose to define “voice service provider” in reference to the “voice service” definition in the TRACED Act. We believe the harmonized interpretations represent the best reading of the definitions and will remove ambiguity concerning the applicability of the Commission's rules concerning illegal calls to providers.

Statutory definitions of “voice service.”
Congress has adopted two definitions of “voice service” that apply to the Commission's rules concerning illegal calls. The 2018 RAY BAUM'S Act defines “voice service” as “any service that is interconnected with the public switched telephone network and that furnishes voice communications to an end user using resources from the North American Numbering Plan or any successor to the North American Numbering Plan adopted by the Commission under Section 251(e)(1) of the Communications Act of 1934, as amended; and . . . [i]ncludes transmissions from a telephone facsimile machine, computer, or other device to a telephone facsimile machine.” The 2020 TRACED Act adopted an identical definition of “voice service,” except that it includes the language “[w]ithout limitation, any service that enables real-time, two-way voice communications, including any service that requires internet Protocol-compatible customer premises equipment and permits out-bound calling, whether or not the service is one-way or two-way voice over internet Protocol.” The Commission defines “interconnected VoIP service” in § 9.3 of its rules.

Inconsistent interpretations of the statutory definitions.
Despite the nearly identical statutory language, the Commission's interpretation of each definition has differed, causing providers to be considered voice service providers for some of our rules pertaining to illegal calls and not for others. The Commission codified the earlier definition of “voice service” in the RAY BAUM'S Act in § 64.1600(r) of its rules and interpreted it broadly to encompasses all entities that originate, carry, or terminate voice calls through TDM, VoIP, or commercial mobile radio service. It has applied that definition to the Commission's telemarketing, Truth in Caller ID, call blocking, and ring signaling integrity rules. The Commission codified the later TRACED Act definition in § 64.6300(o), and interpreted it more narrowly to exclude intermediate providers. It has applied that definition to its caller ID authentication rules. In interpreting the TRACED Act's definition, the Commission did not discuss its prior interpretation of the RAY BAUM'S Act's definition, and only later acknowledged the divergence in interpretation.

Harmonizing the interpretations of “voice service.”
We propose to conclude that the two “voice service” definitions cover the same scope of providers, and that the best reading of both definitions is to include intermediate providers. We believe the definitions cover the same scope of providers notwithstanding the added language in the TRACED Act's definition, because we believe that language merely provides more specificity as to what is included within the scope of “voice service” without expanding or narrowing the scope. We also believe that both definitions apply to the furnishing of voice communications to an end user directly or indirectly, such that all providers involved with an end user's voice communications, including intermediate providers, provide voice service to that end user. Both definitions require that voice communications be furnished to an end user, but we do not believe that the RAY BAUM'S Act or the TRACED Act expressly require the voice communications to be furnished
directly
or foreclose a reading that such voice communications may be furnished to an end user
indirectly.
Indeed, in one provision, the TRACED Act uses the term “voice service provider” to refer to providers that “originate
or
transmit” calls, suggesting that Congress intended the definition to include intermediate

providers. We also maintain our understanding that “voice service” includes termination. We seek comment on this proposal and analysis.

We do not believe that harmonizing the interpretation of these rules will change the scope of providers that are subject to any of our rules concerning illegal calls, and we seek comment on this view. While the proposed interpretation of the RAY BAUM's Act definition codified in § 64.1600(r) would effectively include within its scope, under our proposed interpretation, “any service that enables real-time, two-way voice communications, including any service that requires internet Protocol-compatible customer premises equipment and permits out-bound calling, whether or not the service is one-way or two-way voice over internet Protocol,” we believe those providers already fall within the scope of that definition and that our proposed interpretation will not subject any new providers to our telemarketing, Truth in Caller ID, call blocking, and ring signaling integrity rules. The proposed interpretation of the TRACED Act's definition codified in 64.6300(o) also will not change the scope of providers subject to our caller ID authentication rules because our rules already require intermediate providers to implement STIR/SHAKEN in their IP networks.

Defining “voice service provider.”
We also propose to adopt a definition of “voice service provider” as any entity that provides voice service for a given call. This will establish a consistent approach by having definitions for each category of provider, including the umbrella category for all voice service providers. It also would make clear that whether an entity is a voice service provider is determined on a call-by-call basis. We also reiterate that the term “voice service provider” includes all initiating, originating, intermediate, and terminating providers, including facilities-based providers and non-facilities-based providers, which includes VoIP resellers and MVNOs, and irrespective of whether the provider is claiming an exemption from the STIR/SHAKEN implementation obligation.

Conforming amendments to caller ID authentication rules.
In connection with our proposal to streamline the Commission's caller ID authentication rules, we propose to rely on our proposed new interpretation of “voice service,” inclusive of intermediate providers and initiating providers (as we propose to define those below), for our caller ID authentication rules. Specifically, we propose to use the term “voice service provider” when a requirement applies to all categories of providers and to refer to specific categories of voice service providers when a requirement applies only to that category. We believe this specificity will facilitate our streamlining and add clarity to voice service providers' regulatory obligations depending on their position in a call path. We seek comment on this proposal and assessment.

Foreign voice service provider and domestic voice service provider.
We propose to amend the definition of “foreign voice service provider” and establish a definition of “domestic voice service provider” to ensure that our proposed understanding of “voice service” does not lead to unintended confusion as to whether a provider is foreign or domestic and to deter bad actor foreign voice service providers from attempting to nominally establish themselves as domestic voice service providers to avoid scrutiny. Specifically, we propose to define “foreign voice service provider” as a voice service provider that was created, incorporated, or organized outside of the United States, regardless of whether it has an office, operation, or facilities in the United States. We also propose to define “domestic voice service provider” as a voice service provider that is not a foreign voice service provider. We believe that these changes are necessary because the current definition of “foreign voice service provider” is a provider that provides voice service “outside the United States.” Under our proposed understanding of voice service as furnishing voice communications to an end user both directly and indirectly, this means that any provider in the United States may be a “foreign voice service provider” so long as it terminates calls outside of the United States. We thus instead seek to tie the definition of “foreign voice service provider” to the business's location—where it was created, incorporated, or organized—rather than the nature of the service that it provides. We believe our proposed definition of “domestic voice service provider” as not a foreign voice service provider adequately covers the scope of providers that are created, incorporated, or organized within the United States. We also believe that these definitions will enable us to provide a clearer definition of “gateway provider,” as we propose to do below. We seek comment on these proposals.

b. Initiation and Initiating Provider

We propose to establish definitions of “initiation” and “initiating provider” for the purposes of our caller ID authentication rules to clarify the relationship of a customer to a voice service provider and to remove ambiguity as to which entity is responsible for each phase in the lifecycle of a call. Specifically, we propose to define “initiation” as “the action performed by a voice service customer in commencing a call, and does not include origination” and “initiating provider” as “a voice service provider that performs initiation for its end users' calls.”

We believe that adopting such definitions of “initiation” and “initiating provider” is likely necessary to enable us to better describe the action performed by a customer—such as an end user or a provider that serves end users—in placing a call, as distinct from the technological processes performed by the originating provider to enable that customer's call to traverse the voice network. In particular, under this definition, a non-facilities-based resale provider (as a customer of a facilities-based wholesale provider) that has a direct relationship with an end user would perform the “initiation” of a call on behalf of that end user, but the facilities-based wholesale provider would perform the “origination” of that call. When the facilities-based provider serves an end user directly (meaning the end user is the customer of the facilities-based provider), it would perform the “origination” of the end user's calls, while the end user would perform the “initiation.” We also believe that, according to this proposed definition, only the non-facilities-based provider that directly serves end users can be considered an initiating provider. Non-facilities-based providers in the middle of a chain of resellers would not fall within the definition, which we believe is appropriate given our understanding that they are not technologically in the path of a call. These providers would still be subject to the requirement to ensure the services they resell are not used to transmit illegal calls under § 64.1200(n)(5) of our rules, including the KYUP requirements we propose above.

We also believe that the existence of ambiguity as to how the term “initiation” is used in the ATIS standards and in our orders suggests that adopting a definition is appropriate. For example, in the
Eighth Caller ID Authentication Order,
the Commission used the term “initiate” in one instance to differentiate the action that a voice service customer does from a voice service provider. The Commission described a complex call path in which an originating provider's customer is not

the ultimate end user of a voice service, “such as where an originating service provider authenticates calls
initiated
by a reseller that itself maintains a direct relationship with the calling party.” However, given the lack of a codified definition in the Commission's rules or ATIS's standards, the Commission in the same
Order
also used the word as a synonym for origination. The ATIS standards appear to use the term in a similar way to our proposed definition, but limits its usage to customers that have a direct relationship with an originating provider. For example, ATIS-1000088 describes an “initiating [user agent]” that “signals the call to the originating [service provider]” and which is “typically in the possession of or under the control of a `customer,' which is typically an entity that has a direct commercial relationship with the originating [service provider] and may or may not be the ultimate source of the call (the end-user entity).” ATIS-1000088 at 9. This “SIP [User Agent]” is “authenticated by the originating service provider . . . network” and, “[w]hen the SIP [User Agent] is under direct management control of the [originating service provider], the [originating service provider's] network can assert the calling party identity in originating SIP INVITE requests initiated by the SIP [User Agent].”

Do commenters agree that a definition of “initiation” and “initiating provider”

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2026-13874. Public record. Not legal advice.