A September 18 deadline is fast approaching for certain voice service providers to comply with expanded STIR/SHAKEN requirements approved last year by the Federal Communications Commission (FCC).
The FCC's Eighth Report and Order, adopted on November 21, 2024, increased STIR/SHAKEN obligations for voice service providers using third parties to implement their caller ID authentication frameworks. While inititally the Order appears limited to the FCC's STIR/SHAKEN regulatory requirements, impacted voice service providers may also find themselves newly exposed to obligations under the FCC's Universal Service Fund (USF). Depending on a voice service provider's individual circumstances, these USF obligations could have significant financial impacts, as well as potential exposure to FCC enforcement actions.
Overview of the FCC's Third-Party STIR/SHAKEN Authentication Order
The Order permits voice service providers with a STIR/SHAKEN implementation obligation to work with third parties to perform the "technological act" of assigning attestation levels, or "signing" calls, as long as the provider: (1) makes all attestation level decisions, consistent with the STIR/SHAKEN technical standards; and (2) ensures that all calls are signed using its own certificate obtained from a STIR/SHAKEN Certificate Authority – not the certificate of the third party with whom they are working. The Order was published in the Federal Register on August 19, 2025, and, as explained in a recent Public Notice, compliance with the rules adopted in the Order is required by September 18, 2025.
The FCC's rules establish three categories of voice service providers with STIR/SHAKEN caller ID authentication obligations: (1) voice service providers that originate calls; (2) non-gateway intermediate providers that carry or process the calls without originating or terminating them; and (3) gateway providers that receive calls from foreign originating or intermediate providers at their U.S. facilities and transmit them downstream. Under the new rules, such providers must obtain their own certificate from a STIR/SHAKEN Certificate Authority (i.e., a STIR/SHAKEN token) in order to sign calls.
The Secure Telephone Identity Governance Authority (STI-GA) has established several requirements for providers seeking to obtain their own STIR/SHAKEN token. First, providers must have an Operating Company Number (OCN) assigned by the National Exchange Carrier Association. Second, providers must have certified that they have implemented STIR/SHAKEN or comply with the Robocall Mitigation Program requirements and are listed in the FCC's Robocall Mitigation Database. Third, providers must have a current annual FCC Telecommunications Reporting Worksheet (Form 499-A) on file with the FCC. This latter requirement could raise potential exposure for voice service providers that will be filing Form 499-A for the first time to comply with the FCC's September 18, 2025 deadline to obtain their own STIR/SHAKEN token.
The FCC Form 499 Filing Obligation Can Lead to Additional Scrutiny
Form 499-A is used by the FCC and the Universal Service Administrative Company (USAC) for multiple purposes, including to register entities with the FCC, and to report revenues needed to determine annual USF contribution obligations and assess service provider regulatory fees. Telecommunications carriers and certain other providers of telecommunications, including Voice over Internet Protocol (VoIP) providers, are already required to annually submit Form 499-A. Providers subject to the new STIR/SHAKEN caller ID authentication obligations will not only be required to report revenue information on Form 499-A, but must also provide the date they first started providing telecommunications services, including VoIP services.
In instances where a voice service provider has been providing such services beyond one year prior to registering with the FCC and prior to obtaining a 499 Filer ID, it will be required to file Form 499-As with USAC for all prior years of service, and to submit any past due USF contributions unless found to be exempt from contributions. Such providers will also be subject to late fees and penalties from USAC, as well as potential enforcement exposure from the FCC for failure to file timely reports and pay timely contributions.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
