In its Eighth Report and Order ("R&O") released on November 22, 2024, the Federal Communications Commission (FCC) adopted rules that, among other things, prohibit the use of third-party STIR/SHAKEN signing services. The new "Third Party Rule" requires voice service providers (VSPs) already subject to STIR/SHAKEN obligations to obtain their own SPC tokens and sign all calls using their own certificates. See our firm's earlier Client Advisory explaining the R&O.
Unfortunately, misinformation has circulated widely, leading to confusion about (1) which VSPs are covered by the new rule and (2) when compliance is actually required.
What the Rule Does and Does Not Require
The rule applies only to VSPs that are currently subject to STIR/SHAKEN compliance requirements. This includes facilities-based providers that have control over their SIP signaling and can technically implement STIR/SHAKEN on their networks.
By contrast, VSPs that are exempt from STIR/SHAKEN—for example, those that lack control over the network infrastructure necessary to sign their own calls—remain exempt from the Third-Party Rule's requirements. These VSPs are not required to sign their own calls and do not need to obtain SPC tokens or certificates.
Despite this, some upstream providers have misled their downstream, exempt VSP partners, insisting that they must implement full STIR/SHAKEN compliance and threatening to withhold A-level attestation unless those demands are met. These upstream providers are misapplying the FCC's rule and attempting to enforce their own internal policies that go beyond what the law requires.
Let us be clear:
- Exempt VSPs are not required to comply with STIR/SHAKEN or the Third-Party Rule.
- Upstream providers are still required to sign calls on behalf of their exempt downstream customers when A-level attestation is appropriate.
If your upstream provider refuses to sign your calls properly—or threatens to downgrade attestation unless you comply with their own internal requirements—you should push back and inform them of your exemption status. Failure on their part to apply A-level attestation when warranted could result in your calls being blocked or labeled as spam, directly harming your business and your customers.
The Compliance Deadline Is Not June 20, 2025
Several trade publications and vendors have incorrectly reported June 20, 2025, as the compliance deadline for the Third-Party Rule. This is not accurate.
While the FCC's R&O references a compliance deadline of 210 days after release, it also clearly states that the rule will not take effect until 30 days after publication in the Federal Register following OMB approval—a step that has not yet occurred due to pending review under the Paperwork Reduction Act.
Bottom line: As of today, the Third-Party Rule is not in effect and no compliance deadline has been set.
We will issue a follow-up Client Advisory once the effective date is formally established.
The CommLaw Group Can Help!
The CommLaw Group advises VSPs nationwide on robocall mitigation, STIR/SHAKEN implementation, and carrier-to-carrier disputes—particularly those involving improper attempts to impose regulatory burdens that are not legally required. Given the pace of change in this space, it's critical to base your compliance strategy on accurate legal interpretations—not vendor assumptions or market rumors.
If your company is facing pressure from upstream providers or you're unsure how these rules apply to your business model, we encourage you to consult with qualified telecom counsel.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
