- with readers working within the Insurance industries
On July 23, 2026, the Federal Communications Commission (FCC or Commission) released a Further Notice of Proposed Rulemaking (FNPRM) that seeks to improve the effectiveness of the Robocall Mitigation Database (RMD) by broadening the scope of RMD filing obligations. The FNPRM’s proposals include: (1) expanding the scope of providers required to make RMD filings, (2) requiring providers to submit additional information in their filings, and (3) adopting enhanced screening measures designed to prevent bad actors from entering and abusing the RMD.
The FCC’s FNPRM continues the agency’s aggressive robocall agenda. Since late March, the Commission has launched four other substantive rulemakings proposing reforms to companies’ call center operations, stronger “Know-Your-Customer” (KYC) requirements, expanded know-your-upstream-provider (KYUP) and STIR/SHAKEN obligations, and significant reforms to the Commission’s number resale policies.
We provide a brief overview of the FNPRM below.
The FNPRM Proposes Sweeping Additional Entities into the RMD.
Significant Expansion of the Definition of “Voice Service Provider.” In the FNPRM, the FCC proposes to significantly broaden the scope of the term “voice service provider” by sweeping in a host of services. The FNPRM notes that in addition to traditional wireline, wireless, and voice over internet protocol (VoIP) providers, its proposed term would sweep in private branch exchanges (PBXs), dialing platforms, cloud service providers, over-the-top service providers, call centers, value-added-service providers, and telephone number service providers, in certain instances. The FNPRM states that its approach is supported by the definition of voice service provider in the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act, and the definition in the FCC’s ongoing KYUP FNPRM. The FNPRM also states that under its proposed definition, an entity “need not provide service directly to end users to be a voice service provider.” Rather, the term “voice service provider” would encompass any entity that provides voice service for a given call, including all initiating, originating, intermediate, and terminating providers, as well as facilities-based and non-facilities-based providers, which includes VoIP resellers and mobile virtual network operators (MVNO).
Revised Definitions for Foreign Voice Service Providers and Gateway Providers. The FNPRM seeks comment on whether to revise the definitions of both “foreign voice service provider” and “gateway provider” consistent with those proposed in the FCC’s ongoing KYUP FNPRM proceeding. The FNPRM would define a foreign voice service provider as a voice service provider that was “created, incorporated, or organized outside of the United States, regardless of whether it has an office, operation, or facilities in the United States.” A gateway provider would be defined as a “domestic voice service provider that is an intermediate provider that accepts voice calls directly from a foreign voice service provider before transmitting the call downstream to another domestic voice service provider.” The FNPRM also invites comment on whether the FCC should revise or clarify how foreign providers report their STIR/SHAKEN implementation status in the RMD, particularly considering ongoing efforts to develop Cross-Border Call Authentication.
Expanding Filing Obligations to Related Entities and Third-Party RMD Submissions. The FNPRM proposes codifying the requirement that parent companies, affiliates, and subsidiaries that independently qualify as voice service providers must each file separate RMD certifications. The FNPRM asserts that this requirement is necessary to “increase accountability and prevent filers from obfuscating their relationships with other entities in the RMD, including bad actors and providers that have been removed from the RMD pursuant to a Commission enforcement action.” The FNPRM also seeks comment on “measures to ensure transparency and accountability when providers rely on a third party to submit RMD filings on their behalf.” Under the FCC’s current rules, however, RMD filings must be certified by a company officer under penalty of perjury.
The FNPRM Proposes to Significantly Expand RMD Disclosure Requirements.
Expansion of RMD Filing Certifications. The FNPRM proposes to add four additional certifications providers would make in their RMD filings. Specifically, providers would be required to certify: (1) compliance with any STIR/SHAKEN attestation requirements adopted in the KYUP proceeding; (2) that they have not submitted false, misleading, or inaccurate information to the FCC or certain FCC-designated entities; (3) compliance with all applicable FCC robocall and other illegal call rules; and (4) that they will respond to traceback requests within 24 hours and cooperate with traceback investigations.
Submission of Additional Information Regarding STIR/SHAKEN Exemptions and Enforcement History. The FNPRM asks whether the FCC should strengthen the requirements for claiming a STIR/SHAKEN exemption. This includes proposals to codify the requirement that a provider claiming an exemption (1) cite the specific rule for the exemption; and (2) explain in detail why an exemption applies and expand it to require that the provider include the facts specific to its network and services that are relevant to the scope of the exemption(s) and any steps it has taken to confirm that it cannot implement STIR/SHAKEN, or indicate that it is a foreign voice service provider not subject to STIR/SHAKEN implementation. The FNPRM proposes a temporary exemption for providers awaiting an SPC token, allowing them to submit their OCN in the RMD until they can certify STIR/SHAKEN implementation. The FNPRM also proposes to revise one of the RMD certifications to require that a provider certify that it “is not presently prohibited from filing in the Robocall Mitigation Database by the Commission.” Because providers may be permitted by the Commission to file in the RMD after they have been removed by a Commission action under certain circumstances, the FNPRM explains this revised certification will better capture the goal of deterring providers from refiling when they are not permitted to do so.
Codifying Business Identification Requirements. The FNPRM proposes to codify and expand existing requirements for providers to disclose information regarding their principals, affiliates, subsidiaries, and parent companies, and the Commission seeks comment on proposed definitions for each of those terms.
Provider Type and Service Information. The FNPRM proposes to establish greater granularity to provider type and service information currently submitted to the RMD. In addition to requiring providers to identify their role in the call chain, the FNPRM would require providers to further specify whether they are facilities-based or non-facilities-based providers. Among other things, facilities-based providers would be required to identify whether they are an originating or terminating provider, a wholesale provider, gateway provider, or an intermediate provider. For each category, they would also be required to disclose their relationship to end users in certain instances.
The FNPRM also seeks comment on a host of other changes to the RMD categories. For example, in instances where entities feel compelled to file in the RMD, the FNPRM asks whether they should be able to indicate their belief that they are end users rather than voice service providers. The FNPRM also seeks comment on establishing additional RMD filing requirements covering a range of areas, including additional disclosures for foreign voice service providers and those about access to and use of numbering resources. Additionally, the FNPRM’s proposed framework would seek to collect a broad category of additional information regarding RMD filers’ business, ownership, operational, and service-related information, in line with the KYUP information being considered in the KYUP FNPRM.
Strengthened Robocall Mitigation Plan Requirements. The FNPRM proposes to require voice service providers to implement Robocall Mitigation Plans containing “affirmative, effective measures” rather than merely “reasonable steps” and would expand the requirement to put in place mitigation measures to address all illegal calls, not just illegal robocalls. The proposal would further require providers to submit more detailed descriptions of their mitigation measures, call analytics practices, and robocall-mitigation-related contractual provisions, and the Commission seeks comment on whether providers should disclose additional information regarding KYC and KYUP compliance.
The FNPRM Seeks Comment on Further Expediting the Traceback Process.
In an effort to further expedite tracebacks, the FNPRM seeks comment on whether providers should be required to participate in the Industry Traceback Group’s (ITG) automated traceback response process. Currently, only some providers use the ITG’s secure platform to automate their responses and incident reporting to the traceback consortium, which can expedite the traceback process. Among other things, the FNPRM seeks comment on the feasibility and costs of requiring all providers to participate in the automated traceback response process as a condition of being listed in the RMD. As an alternative, the FNPRM asks whether it should instead require providers to directly participate in the automated traceback process, rather than requiring them to participate as a condition precedent to being listed in the RMD.
The FNPRM Proposes Enhanced Screening Measures for RMD Filers.
Enhanced RMD Screening and Measures for Bad-Actor Detection. The FNPRM proposes delegating authority to the Wireline Competition Bureau to develop measures to prevent noncompliant and fraudulent filings from entering the RMD “in consultation with the Office of Managing Director (OMD), the Office of Economics and Analytics (OEA), and the Enforcement Bureau.” Among other things, the FNPRM seeks comment on mandating additional screening of RMD filings before publication, letter-of-credit and similar financial assurance requirements, and requiring Foreign Adversary Control attestation and disclosures from RMD filers. The FNPRM also seeks comment on whether the vetting of RMD applicants is a task for the North American Numbering Plan Administrator (or a similarly situated entity), subject to an appropriate contract amendment or compensation.
Expanded Removal, Suspension, and Enforcement Authority. The FNPRM proposes codifying numerous causes for removal and other enforcement actions, including deficient filings, traceback violations, STIR/SHAKEN violations, and lack of candor. The FNPRM also seeks comment on codifying detailed RMD removal procedures. The FNPRM also proposes to adopt a “One-Step Removal Process for egregious conduct or circumstances where further pre-removal process would be unnecessary, impracticable, or contrary to the public interest.” This could involve the Enforcement Bureau issuing an order removing a provider’s filing from the RMD after a certain number of days without a pre-removal cure/response period, describing the cause(s) for removal, and allowing the provider to seek reconsideration, review, or reinstatement after removal.
Reinstatement, Debarment, and Call Acceptance Requirements. The FNPRM proposes requirements for providers seeking reinstatement following removal from the RMD, such as submitting a written request to the Enforcement Bureau and demonstrating that all violations have been cured. The FNPRM seeks comment on establishing an RMD-specific debarment process to prevent bad actors from reentering the database. The FNPRM also asks for clarification on providers’ obligations to accept voice calls only from entities listed in the RMD, specifically asking whether to affirmatively prohibit providers from accepting voice calls from a provider that is not published in the RMD, rather than the current wording that requires providers to only accept calls from a provider whose filing appears in the RMD and has not been removed. This also could implicate the proposed temporary exemption for providers seeking an SPC token, and the FNPRM asks whether to specify that providers are not permitted to accept calls from upstream providers unless they appear in the RMD and have obtained an SPC token. The FNPRM further asks about the potential minimum frequency with which providers must check the RMD to ensure compliance with this obligation and how quickly downstream providers must stop accepting calls after a provider’s filing is removed from the RMD, among other questions.
Auditing and Support for RMD Administration. Finally, the FNPRM also invites comment on whether providers should be subject to independent compliance audits and on measures to support administration of the RMD, including potential bond-based funding mechanisms.
***
Consistent with the FCC’s numerous other rulemaking proceedings in the broader robocall space, the agency’s most recent FNPRM is highly detailed and proposes a number of new prescriptive requirements. The FNPRM would significantly expand RMD filing, certification, and compliance obligations for voice service providers while introducing new measures aimed at preventing bad actors from entering and remaining in the database. Wiley’s communications attorneys regularly advise clients on robocall mitigation, STIR/SHAKEN, and related FCC compliance matters. For more information or assistance responding to the new FNPRM, please contact one of the authors listed in this alert.
Tatayana Allen, a Summer Associate at Wiley Rein LLP, contributed to this alert.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
