3 Required STIR/SHAKEN Actions to Keep U.S. Voice Calls ConnectedSTIR/SHAKEN compliance in the United States requires three things: sign IP-originated calls with a certificate tied to your own Service Provider Code, keep an accurate Robocall Mitigation Database filing, and be ready to respond to traceback requests when the FCC or an industry consortium comes asking. Miss any of the three and downstream carriers can legally block your traffic. Check your Robocall Mitigation Database status and confirm your FRN, OCN, and SPC token are current before you do anything else.

TL;DR:

Smaller carriers must ensure their Robocall Mitigation Database filings are current; outdated or incorrect entries lead to call blocking.

Certification expiration and improper signing setup are common compliance pitfalls that can cause calls to be flagged or blocked unexpectedly.

Outsourcing signing operations is allowed but requires the provider to retain control over certificates and decisions, with clear contractual accountability.

Ongoing monitoring, testing, and timely recertification every March are vital to maintain compliance and avoid enforcement actions.

Managed providers can streamline STIR/SHAKEN compliance for multi-site businesses, reducing administrative burdens and preventing connectivity disruptions.

What Is STIR/SHAKEN Compliance and Which Standards Define It
Who Must Comply, and What the FCC's Deadlines Actually Require
The Step-by-Step Path to Signing and Verifying Calls
Robocall Mitigation Database Filings and Why Recertification Trips People Up
Third-Party Signing: What You Can Outsource and What You Can't
Compliance Pitfalls and Your Audit-Ready Checklist
How a Managed Provider Operationalizes This for Multi-Site Businesses
Get STIR/SHAKEN Compliance Handled Without Building It Yourself
Sources

What Is STIR/SHAKEN Compliance and Which Standards Define It

STIR/SHAKEN is two protocols working as one system. STIR (Secure Telephone Identity Revisited) is the technical framework that lets a call carry a cryptographically signed certificate proving where it originated. SHAKEN (Signature-based Handling of Asserted Information Using Tokens) is the governance layer that tells providers how to implement STIR consistently across carrier networks. Together, they let a receiving carrier check whether the number displayed on a call is legitimate or spoofed.

The underlying protocol behavior comes from RFC 8224, which defines how identity information travels inside SIP signaling, along with RFC 8225 and RFC 8226 covering token format and certificate management. ATIS turned those RFCs into carrier-ready implementation rules through ATIS-1000074, ATIS-1000080, and ATIS-1000084, the documents your engineering team or vendor will actually build against.

Every signed call gets an attestation level. A-attestation means the provider knows the caller and confirms they're authorized to use that number. B-attestation means the provider knows the customer but can't verify the number belongs to them. C-attestation applies when the provider only knows where the call entered its network, common with international gateway traffic. Attestation level shapes how a receiving carrier treats the call, and repeated low-attestation traffic is exactly what draws FCC scrutiny.

Diagram of STIR/SHAKEN attestation levels

One limitation trips up a lot of smaller carriers: STIR/SHAKEN only works on IP segments. If any part of your call path still runs over TDM or another legacy non-IP protocol, that segment can't carry the signed identity header. Providers in that position must still file a robocall mitigation plan explaining how they authenticate calls without full IP-based signing.

Who Must Comply, and What the FCC's Deadlines Actually Require

Your obligations depend on where you sit in the call path. Originating providers sign calls at the point they enter the network and carry the heaviest burden. Gateway providers handle calls entering the U.S. from abroad and must authenticate them at the border. Non-gateway intermediate providers pass calls between other carriers and, since the Sixth Report and Order, must authenticate any unauthenticated call they receive directly from an originating provider. Resellers and MVNOs often assume their underlying carrier handles everything, and that assumption is where a lot of compliance gaps start.

The FCC's mandate took effect June 30, 2021 for larger facilities-based voice service providers. Smaller providers and those with extensions got until later dates, but by the end of 2023, nearly all voice service providers, gateway providers, and intermediate providers had an active implementation or mitigation obligation. Annual recertification in the Robocall Mitigation Database is required every March 1 for all providers.

A few points that catch providers off guard:

Non-facilities-based resellers still need their own Robocall Mitigation Database entry, even if they don't sign a single call themselves.
Relying entirely on an upstream carrier's compliance status does not satisfy your own filing obligation.
Filing something inaccurate is treated worse than filing something incomplete on time.
Providers removed from the database in 2025 enforcement sweeps lost connectivity within days because major carriers are required to stop accepting their traffic.

The business consequence is blunt: no filing, wrong filing, or expired certificate means your calls start getting blocked or flagged as spam, and every downstream carrier has regulatory cover to cut you off.

The Step-by-Step Path to Signing and Verifying Calls

Getting from "we know we need this" to actually signing calls follows a fixed administrative sequence. Skip a step and the next one won't work.

Get a Federal Registration Number (FRN) and file FCC Form 499-A. This registers you as a telecom provider in the FCC's CORES system and is the prerequisite for everything downstream.
Apply for an Operating Company Number (OCN) through NECA, the National Exchange Carrier Association. Certificate authorities check your OCN as part of issuing signing credentials.
Register with the Secure Telephone Identity Policy Administrator (STI-PA), operated by iconectiv, and request a Service Provider Code (SPC) token. This token is the credential that proves you're an authorized signer in the SHAKEN ecosystem.
Present your SPC token to an authorized Certificate Authority. A documented registration sequence shows this is where most of the administrative friction lives, not in the cryptography itself. The CA issues the certificate your switches use to sign calls.
Integrate signing into your SIP infrastructure. The signed identity header gets inserted at call origination, and your session border controllers or softswitch need to select the correct attestation level based on how well you can verify the caller.
Configure inbound verification so your network checks signatures on calls received from other carriers, not just signs your own outbound traffic.
Build ongoing testing and monitoring. Run scheduled test calls that assert attestation headers, track certificate expiration dates, and automate renewal well before the deadline.
Retain signing and verification records for audit purposes, since traceback requests can arrive months after a specific call.

Pro Tip: Certificate expiration is the single most common cause of sudden call-blocking incidents. Automate rotation reminders at 60 and 30 days out, not just at expiration, because CA turnaround isn't always instant.

Robocall Mitigation Database Filings and Why Recertification Trips People Up

The Robocall Mitigation Database is the FCC's public record of who's implementing STIR/SHAKEN, who isn't, and what they're doing about it either way. Your entry includes your implementation status, a written robocall mitigation plan if you haven't fully implemented signing, your certifying official's name, and current contact information.

Filing happens through the FCC's CORES portal using your FRN login. You'll select a certification type (full implementation, partial implementation, or a mitigation-plan-only filing under 47 C.F.R. § 64.6305), then upload your plan and confirm contact details. Annual recertification is due every March 1, and it's easy to treat this as a formality when it's actually a full re-review of your compliance posture.

A few practices keep filings defensible:

Write your mitigation plan in specific, checkable terms rather than boilerplate language a reviewer has seen a hundred times.
Update your filing immediately after any change in FRN, OCN, or company structure, not at the next annual cycle.
Assign a real certifying official who can speak to the plan's contents if the FCC follows up.
Keep a dated internal log of every filing and amendment for audit purposes.

The enforcement risk here is not hypothetical. Providers with inaccurate or stale filings have been removed from the database outright, and once that happens, other carriers are obligated to stop carrying their traffic, often within days.

Third-Party Signing: What You Can Outsource and What You Can't

You're allowed to use a vendor to handle the technical work of signing calls, but the FCC's Eighth Report and Order draws a hard line on accountability. The provider that holds the implementation obligation must retain its own SPC token and certificate, and it must be the one making attestation-level decisions, even when a third party executes the signing process. You can't hand off compliance itself, only the operational task.

Hands handling security token in telecom rack

That means a written agreement with any signing vendor needs to spell out who controls the certificate, how attestation decisions get made, and how records get retained for at least two years. If you're using a third party, your Robocall Mitigation Database entry needs to reflect that arrangement explicitly.

For audit readiness, you need the practical ability to pull signed-call logs on demand, confirm certificate custody, and show a regulator exactly how a given call was authenticated. A vendor relationship that leaves you unable to answer those questions during a traceback request is a liability dressed up as convenience.

Compliance Pitfalls and Your Audit-Ready Checklist

Most compliance failures aren't technical. They're administrative gaps that sit unnoticed until a traceback request or an annual recertification exposes them.

An inaccurate or stale Robocall Mitigation Database entry, often from a company that changed ownership or contact info and never updated the filing.
An expired or missing signing certificate, usually caught only after calls start getting flagged.
A missing OCN or SPC token, which halts certificate issuance entirely and is far more common among smaller resellers than larger carriers.
No written third-party signing agreement, leaving a provider unable to demonstrate accountability during an audit.
Ignoring a traceback request, which industry traceback consortiums and the FCC treat as a red flag regardless of the underlying cause.

Run this verification checklist on a recurring schedule, not just once: test both inbound and outbound signed calls quarterly, confirm your upstream partners' Robocall Mitigation Database status hasn't lapsed, and put a calendar reminder on the March 1 recertification date months in advance.

Enforcement is not theoretical. The FCC's 2025 removal actions pulled numerous non-compliant providers from the database, and every downstream carrier receiving their traffic was required by rule to stop. That's not a fine you negotiate around. It's a connectivity cutoff.

How a Managed Provider Operationalizes This for Multi-Site Businesses

For a business running voice service across multiple locations, the administrative load of tracking certificates, filings, and recertification dates across every site adds up fast. Californiatelecom builds STIR/SHAKEN signing directly into the managed voice infrastructure it deploys for multi-location customers, backed by California Telecom's 24/7 U.S.-based network operations center monitoring signing status and certificate health continuously.

The honest answer on whether to outsource or build in-house comes down to scale and staffing. A single-site business with a small IT team rarely has the bandwidth to track SPC token renewals and annual recertification deadlines on top of everything else. A larger organization with a dedicated compliance function might reasonably keep it in-house. Most multi-location businesses land somewhere in between, and that's exactly where a managed partner earns its cost.

— Jim

Get STIR/SHAKEN Compliance Handled Without Building It Yourself

If you've read this far, you know the administrative sequence is longer than most providers expect, and a single missed renewal can cut off your traffic overnight. Californiatelecom handles the entire compliance lifecycle for multi-location voice customers: filing status tracking, certificate issuance and rotation, signing integration into your existing SIP flows, and continuous monitoring backed by a U.S.-based NOC.Instead of one team chasing FRN paperwork and another watching certificate expiration dates, you get one provider, one point of contact, and a 99.999% uptime SLA on voice service built around infrastructure Californiatelecom designs and deploys itself. That matters most for businesses running voice across several sites, where a single overlooked recertification at one location can jeopardize connectivity everywhere else.

Explore nationwide managed network services to see how Californiatelecom folds STIR/SHAKEN signing and Robocall Mitigation Database management into a single managed voice deployment, and request a consultation to get your current compliance status reviewed before your next recertification deadline.

3 Required STIR/SHAKEN Actions to Keep U.S. Voice Calls Connected

Table of Contents