Comments are due October 9 on proposals that could expand filing obligations, require extensive new disclosures, and accelerate suspension or removal from the RMD
The Federal Communications Commission has formally opened the comment period on a sweeping proposal to strengthen the Robocall Mitigation Database (“RMD”) and transform it into a more active provider-screening, compliance, and enforcement mechanism.
The Further Notice of Proposed Rulemaking, adopted July 22 and released July 23, 2026, was published in the Federal Register on September 9, 2026. Comments are due October 9, 2026, and reply comments are due November 9, 2026.
The published FNPRM carries forward the central proposals discussed in CommLaw Group’s July 2 advisory. The FCC is considering broader filing obligations, more detailed certifications and disclosures, enhanced screening of new and updated filings, expanded grounds for suspension or removal, and stronger safeguards against reentry by prohibited providers.
These are proposals—not final rules—and they do not presently impose new compliance obligations. Publication, however, begins with a short window for affected providers and other voice-ecosystem participants to address how the proposals would affect their businesses.
- The FCC continues to signal a broad view of who must file
The FCC proposes to clarify that its RMD and illegal-call rules apply broadly across the voice ecosystem, regardless of how an entity describes its service, the technology or facilities it uses, or whether it holds a traditional FCC authorization.
The FCC’s analysis could reach not only traditional wireline, wireless, and interconnected VoIP providers, but also VoIP resellers, MVNOs, PBX providers, dialing platforms, cloud communications providers, over-the-top providers, call centers, value-added service providers, and telephone number service providers—to the extent their services furnish or enable voice communications using North American Numbering Plan resources.
An entity would not necessarily fall outside the rules merely because it:
- Does not own network facilities;
- Obtains telephone numbers indirectly;
- Uses an upstream carrier to transmit or authenticate calls;
- Characterizes itself as an information service, software platform, or call center; or
- Does not contract directly with the ultimate end user.
The FCC also proposes to codify that parents, affiliates, and subsidiaries must submit separate RMD filings whenever each entity independently qualifies as a voice service provider. Corporate families operating through multiple subsidiaries, brands, resellers, or platform entities should therefore evaluate filing obligations on an entity-by-entity basis.
- RMD filings could become broader compliance certifications
The FCC proposes several certifications that would make the RMD filing a more comprehensive statement of regulatory compliance.
Among other things, providers could be required to certify that they:
- Have not submitted false, misleading, or inaccurate information to the FCC, the Industry Traceback Group, the North American Numbering Plan Administrator, the STIR/SHAKEN Governance Authority, or other FCC-designated entities;
- Comply with all applicable FCC rules concerning robocalls, illegal calls, caller-ID authentication, call blocking, traceback, and numbering administration;
- Respond fully to qualifying traceback requests within 24 hours and cooperate with investigations into illegal calls; and
- Comply with any STIR/SHAKEN attestation requirements ultimately adopted in the FCC’s related Know Your Upstream Provider proceeding.
These certifications could provide the FCC with more direct grounds to suspend or remove a filing when a provider violates an underlying illegal call rule or supplies inconsistent information elsewhere in the regulatory ecosystem.
Providers would remain responsible for their certifications even when consultants, counsel, authentication vendors, analytics providers, or other third parties prepare filings or perform compliance functions.
- STIR/SHAKEN exemption claims would require greater specificity
Providers certifying to partial or no STIR/SHAKEN implementation would have to identify the specific rule authorizing the claimed exemption and explain, using facts particular to their networks and services, why the exemption applies.
The FCC emphasizes that being a small provider, lacking direct access to numbering resources, relying on an upstream provider, or not currently possessing an SPC token, does not automatically establish a valid exemption.
The FCC also proposes a temporary exemption for a new provider actively pursuing an SPC token. To claim it, the provider would have to supply its Operating Company Number and describe the steps taken to obtain token authorization. The FCC is considering whether such filings should be automatically suspended or removed if the provider does not obtain a token and timely updates its RMD filing.
Providers relying on any implementation exemption should be prepared to substantiate the exemption and confirm that their RMD filing accurately reflects their current technical arrangements.
- Ownership, management, and service disclosures could expand substantially
The FNPRM proposes to require more detailed information about each provider and the parties associated with it.
Proposed disclosures include:
- A human principal’s title, telephone number, email address, physical address, country of residence, and citizenship;
- The identity of all other principals, parents, affiliates, and subsidiaries;
- The RMD identification number of related entities that have RMD filings and the business address of related entities that do not;
- A U.S. registered agent authorized to accept service, with a U.S. mailing address, telephone number, and email address;
- More precise identification of whether the provider is facilities-based or non-facilities-based and the roles it performs in the call path;
- Information concerning prior regulatory or law-enforcement actions or investigations; and
- Identification of third parties used for call analytics, STIR/SHAKEN signing, KYC or KYUP compliance, and potentially RMD filing preparation.
The FCC also seeks comment on requiring government-issued identification for human principals, information about numbering resources and numbering suppliers, and additional operational, ownership, and affiliate information.
Some information would remain available only to Commission staff, while other information could be made publicly available to assist providers in vetting upstream and downstream partners.
- New and updated filings could face screening before publication
Under the proposed framework, submitting an RMD filing would not necessarily mean that the filing immediately “appears” in the Database for call-acceptance purposes.
The FCC proposes to authorize its staff to place a filing into pending status, withhold publication, or reject it when the filing appears deficient, evasive, unauthorized, associated with a previously removed provider, or otherwise requires further review. The Commission is also considering automated validation tools that could compare RMD information against CORES, Form 499 records, STIR/SHAKEN authorization records, numbering information, and other reliable sources.
The FCC additionally seeks comment on more intensive applicant vetting, including supporting documentation and, potentially, a standby letter of credit. These measures could create significant onboarding delays and costs, particularly for new entrants and smaller providers.
Because downstream providers generally may accept traffic only from providers whose filings appear in the RMD and have not been removed, a pending or unpublished filing could have immediate commercial consequences.
- Suspension and removal could become faster—and more consequential
The FCC proposes to codify a broad list of circumstances that could support removal or other enforcement action, including:
- Deficient, incomplete, or internally inconsistent RMD filings;
- Material inconsistencies with information submitted elsewhere;
- Lack of candor;
- Failure to timely update or annually recertify a filing;
- Failure to respond to traceback requests;
- Transmission of illegal calls;
- Inadequate mitigation measures or failure to follow the provider’s own mitigation plan;
- Failure to cooperate with an FCC investigation;
- Impersonation or unauthorized use of another party’s identifying information;
- STIR/SHAKEN implementation or attestation violations;
- National-security or law-enforcement concerns; and
- Repeat violations following reinstatement.
For most serious violations, the FCC proposes an expedited two-step process with only five days to cure or respond before removal. It also seeks comment on a one-step removal process for particularly egregious conduct and on temporary suspension while a filing or provider is under review.
The FCC is separately considering automatic suspension for failure to complete annual recertification or pay the associated fee, time-limited or permanent reinstatement bars, random or targeted compliance audits, and retention of records supporting RMD certifications and mitigation practices.
Removal could also lead to broader consequences involving SPC-token eligibility, access to numbering resources, other FCC licenses or authorizations, and referrals to law-enforcement agencies. The FCC further proposes to clarify that downstream call-refusal obligations apply to all voice traffic received from a removed provider, including calls using non-NANP caller-ID information.
Providers should act before the comment deadline
Companies potentially affected by the proposal should consider whether to participate in the proceeding, particularly if the proposed definitions, disclosures, screening procedures, filing delays, audit requirements, or removal mechanisms would create material operational or competitive burdens.
Comments should include concrete information concerning compliance costs, implementation timelines, technical limitations, effects on new market entrants and small providers, and safeguards needed to protect legitimate providers from erroneous suspension or removal.
Regardless of whether a company files comments, providers should consider reviewing:
- Whether every entity in the corporate structure that independently provides voice service has its own RMD filing;
- Whether each filing accurately identifies the provider’s legal name, prior names, affiliates, principals, roles, and contact information;
- Whether claimed STIR/SHAKEN implementation status and exemptions remain supportable;
- Whether the provider’s OCN, FRN, Form 499, SPC-token, numbering, and RMD information are consistent;
- Whether the robocall mitigation plan describes actual KYC, KYUP, monitoring, blocking, and traceback practices;
- Whether the provider can respond fully to traceback requests within 24 hours;
- Whether arrangements with third-party vendors are documented and appropriately supervised; and
- Whether procedures are in place to update the filing within ten business days after a reportable change and complete annual recertification by the applicable deadline.
Call Out: The RMD is becoming a market-access credential
The FNPRM confirms that the FCC no longer views the RMD as a passive filing repository. The Commission is developing it into a provider-vetting and enforcement system that may determine whether an entity can obtain an SPC token, access numbering resources, establish downstream relationships, and transmit traffic over the U.S. voice network.
A stale or inaccurate filing may therefore create consequences well beyond an ordinary reporting violation.
CALL TO ACTION!
Comments are due October 9, 2026, and reply comments are due November 9, 2026, in WC Docket Nos. 24-213 and 17-97 and CG Docket No. 17-59.
CommLaw Group’s Robocall Mitigation Response Team is available to assist providers with evaluating the FNPRM, preparing comments, reviewing and updating RMD filings, assessing STIR/SHAKEN implementation and exemption claims, strengthening robocall mitigation plans, and developing compliant KYC, KYUP, traceback, and third-party oversight procedures.
Providers that are uncertain whether their current RMD filings accurately reflect their corporate structure, services, call-path roles, numbering arrangements, authentication practices, or mitigation procedures should consider conducting a privileged compliance review before the FCC begins applying more intensive screening and enforcement standards.
ROBOCALL MITIGATION RESPONSE TEAM
Jonathan Marashlian | jsm@commlawgroup.com
Diana James | daj@commlawgroup.com