What Every Voice Service Provider Needs to Know

Starting September 18, 2025, the FCC’s new anti-robocall rules make originating providers directly accountable for caller authentication. Loopholes are gone, vendor shields removed, and compliance failures carry real consequences: de-listing, nationwide blocking, and loss of U.S. network access.

Here’s what matters most now.

1. Stop Hiding Behind Your Vendor's Credentials

If your STIR/SHAKEN implementation depends on your vendor's Service Provider Code (SPC) token or certificate, you are already out of compliance.

Requirement: Each provider must obtain its own SPC token from the Policy Administrator and its own certificate from an approved Certificate Authority.
Problem: FCC filings cite TransNexus estimates showing 64% of providers claiming STIR/SHAKEN implementation are actually using their vendor's credentials.
Impact: That shell game ends this September. Without your own token and cert, you will not be considered compliant.

For operations teams: start the SPC token application process now. Waiting until September guarantees disruption.

2. Attestation Decisions Are Now Your Responsibility

Under the new rules, you must decide attestation levels. Vendors can sign calls technically, but the determination of whether a call is "A," "B," or "C" attested belongs to the originating provider.

No outsourcing of trust: Vetting subscribers and their right to use a number is now a non-delegable function.
No excuses: If illegal calls slip through, "my vendor handled it" won't shield you from liability.
Operational shift: Compliance, fraud, and provisioning teams need processes in place to document and defend each attestation decision.

For compliance managers: this is not optional. Build attestation review into your onboarding, monitoring, and auditing workflows.

3. You Need a Signed Contract That Says It Explicitly

If you're working with a third-party authentication vendor, you must have a formal, written agreement on file with very specific language:

The provider (you) makes all attestation-level decisions.
All calls are signed with the provider's own digital certificate.

Retention: These agreements must be preserved for two years after they end. This means audits will not only look at your systems, but also your contracts.

For legal and operations teams: review your vendor contracts today. If the clauses aren't there, you will not pass an FCC audit.

4. Non-Compliance = Traffic Blocking

The biggest hammer in these rules is the Robocall Mitigation Database (RMD) filing. If you cannot comply by September 18, 2025, you must update your RMD certification to reflect non-implementation of STIR/SHAKEN.

Once you do, other carriers are prohibited by law from accepting your traffic.
That means immediate loss of interconnection and no ability to complete calls into the U.S.
For many providers, this is effectively business death.

For executives: this is not a technical nuisance. This is an existential threat. Without compliance, you will be removed from the market overnight.

Act Now or Risk Market Exclusion

The FCC has shifted the ground under every provider. The era of hiding behind a vendor's cert or outsourcing compliance is over. The rules are explicit:

Get your own SPC token and certificate.
Make your own attestation decisions.
Put the right contract clauses in writing.
File an accurate RMD certification---or risk removal.

Telecom professionals who manage regulatory filings, engineering operations, or vendor contracts must treat this as a priority project for Q3 2025. Waiting until the deadline is a gamble few providers will survive.

This is not just about robocalls. It is about whether your traffic will be trusted - or blocked.