Thousands of providers get FCC warnings about Robocalls and STIR/SHAKEN

On December 10th, the FCC published a notice warning 2,411 service providers that their Robocall Mitigation Database (RMD) filings were not compliant. Those service providers are required to fix the issues ASAP or they risk getting removed from the RMD… which in turn would mean that they lose access to the PSTN.

Eek.

For those who haven’t been paying close attention, let’s recap how we got here.

• In 2020 the FCC introduced the Robocall Mitigation Database in response to a new law from Congress that aimed to reduce robocalls.
• The original deadline for compliance was June 30, 2021, but at the time guidance about “compliance” was fairly vague, and many small service providers (with fewer than 100K subscriber lines) could claim an extension.
• In the past 3 years, the FCC has provided more concrete guidance on what is required, and the two year extension has expired. I assume that these 2,411 service providers either filed Robocall Mitigation plans that were inadequate from the start, or that they didn’t update those plans as the guidance was clarified.

In this week’s notice, the FCC lists specifically those items that are required for an acceptable Robocall Mitigation Database certification.

1. You must certify that all calls that originate on your network are subject to a robocall mitigation program, and state to what extent you’ve implemented STIR/SHAKEN for VoIP calls.
2. You must upload a robocall mitigation plan that describes the specific reasonable steps you have taken to prevent illegal robocalls – including (a) a description of the effective measures it is taking to prevent new and renewing customers from originating illegal robocalls (if it is a voice service provider); (b) a description of any call analytic system(s) that it utilizes, including those operated by a third-party vendor; and (c) a description of the procedures it is using to know its upstream providers.
3. You need to provide contact information and various information about your role in the network
4. You need to commit to respond fully to traceback requests within 24 hours

(Note that I’m summarizing the FCC document – if you need to fix your document you should absolutely read the original and base your actions on that.)

I am assuming that the FCC has reviewed everyone’s plans and found that these 2,411 service providers did not meet the above requirements.

Are we one of the 2,411 service providers?

I started reading the list, but I got bored somewhere in the middle of the A’s, so I don’t know. The full list is given in the FCC notice so I’d encourage you to download that and search for all variations of your company name. I would hope that the FCC has also directly contacted you, but I don’t know what would happen if the contact person listed in the database was no longer an employee.

What happens if we don’t fix the problem?

The FCC has given a deadline to comply of “14 days after the order is published in the Federal Register”, [later edit:] and we now know that the deadline is December 31, 2024.

If you don’t respond to the FCC Enforcement Bureau by the deadline then they are threatening to remove you from the Robocall Mitigation Database, which would then require other service providers to block your access to the network. So in theory you would lose the ability to access the PSTN. This would be bad.

How do we fix the problem?

I should perhaps have stated earlier in this article that we are not regulatory consultants, and we’re not best people to write your robocall mitigation plans. I would therefore encourage you to either work with a regulatory consultant or telecoms attorney who is familiar with these issues and have them review your current plan and update it to address the FCC’s concerns, file the updated version, respond to the FCC Enforcement Bureau, and so on (per the order).

What if we need to implement a robocall mitigation solution and/or STIR/SHAKEN in our network?

We can help with that. We have quite a few clients where we implemented STIR/SHAKEN and robocall mitigation in a way that complies with the technical requirements of the regulations. If you have not yet implemented both robocall mitigation and STIR/SHAKEN, and would like to learn more, please don’t hesitate to contact us, and we would be happy to help you out.

Also, if you already have STIR/SHAKEN implemented, but are looking for a more affordable solution, we would be happy to take a look at your network and see if we can save you some money – please contact us for more information.