Comprehensive filing requirements for the Robocall Mitigation Database

This article answers in-depth questions related to the filing requirements for the Robocall Mitigation Database (RMD), which is applicable to businesses that are providing PSTN-enabled voice services within the United States. For a simple overview of the RMD registration process, check out our Robocall Mitigation Database guide.

Note: The following is not meant as legal advice. Customers should consult their own legal counsel in making determinations about their legal and regulatory compliance matters.

Terms to know

• Robocall Mitigation Database (RMD) – a database launched by the FCC for voice service providers (VSPs) to register with the FCC, attest to the status of their STIR/SHAKEN deployment, and allow those who aren't fully STIR/SHAKEN capable to formally file their robocall mitigation plans.
• STIR/SHAKEN – industry standards that establish a technology framework for caller identification that was designed to help reduce fraudulent robocalling and illegal phone number spoofing. Provider participation in the framework enables Internet Protocol-based providers to more readily verify the caller ID information transmitted with a call (known as a call signature or attestation).
• Telephone Robocall Abuse Criminal Enforcement and Deterrence (TRACED) Act – legislation passed by the United States Congress with the purpose of fighting unwanted and illegal robocalls. This Act authorized the FCC to establish and enforce sweeping new requirements for VSPs to protect consumers from illegal robocalls.
• Telephone Consumer Protection Act (TCPA) – one of the key laws that prohibit companies from using an automatic telephone dialing system (ATDS) to call consumers without their consent. The fundamental intention of the TCPA is to ban automated or prerecorded calls except when the receiving party consents to receiving the call or when the call is made for emergency purposes. 
• Federal Communications Commission (FCC) – a United States government agency overseen by Congress, responsible for implementing and enforcing US communications laws and regulations.
• Public Switched Telephone Network (PSTN) – the network of the world’s public telecommunications networks. In short, this is what allows for the exchange of communications that rely upon the use of telephone numbers.

RMD requirements

What is the RMD?

The RMD is a publicly accessible database of registered voice service providers (VSPs), which includes certifications concerning a provider’s implementation of the STIR/SHAKEN framework.

In simpler terms, the RMD is the method of creating checks and balances against the FCC’s robocall mitigation directives. VSPs must register and certify that they’re taking the required steps laid out by the FCC to help reduce illegal robocalls.

Who is required to register with the RMD?

Registration is required for all VSPs, according to the FCC’s orders and call-blocking directives. Because the TRACED Act requires that the STIR/SHAKEN framework be supported by all PSTN-interconnected IP-enabled inbound, outbound, and intermediate voice services, a very broad range of service providers are required to register their STIR/SHAKEN status within the RMD.

Who is considered to be a VSP?

For these purposes, the FCC has defined a “voice service provider” as:

A provider of “any service that is interconnected with the public switched telephone network and that furnishes voice communications to an end user using resources from the North American Numbering Plan or any successor to the North American Numbering Plan adopted by the Commission under section 251(e)(1) of the Communications Act of 1934, as amended” 47 C.F.R. 64.1600(r)(1).a.

In essence, this definition can be understood to mean that if your end user customers view you as their service provider and you’re providing outbound PSTN voice calling capabilities to them, you would be expected to register in the RMD.

Why is Bandwidth requiring me to register in the RMD?

As discussed above, the FCC has mandated that all VSPs register in the RMD. The FCC has also mandated that all downstream providers are prohibited from accepting any traffic from unregistered VSPs. 

If Bandwidth has asked you to register, we’ve determined that your use case most likely matches that of a VSP. In these instances, we consider ourselves a downstream provider from you,  which typically means you appear to be reselling Bandwidth’s voice services for consumption by a separate end user placing outbound calls to US destinations in some manner. By reselling, we mean that your business is not directly consuming Bandwidth’s voice services (such as for internal employee communication, in which instance Bandwidth would consider itself the VSP). 

Since you're providing voice services to your customers, FCC rules require that you register in the RMD and Bandwidth must require this as well to uphold its own regulatory obligations to the FCC.

Deciding to file

Why didn’t my previous vendor require me to register with the RMD?

While we can’t speak to your previous vendor’s policy or their legal interpretation of the FCC’s requirements, we can address why this requirement does matter at Bandwidth (in ways that might not apply to your previous vendor):

• We take regulations seriously. Telecom is a highly regulated industry in every country we cover, which is why we have teams dedicated to understanding legal requirements and supporting our customers’ compliance. Cutting corners on regulations would leave you open to the risk of real business and legal impact.
• We care about the integrity of our network because we own it. By taking exhaustive steps to protect and mitigate against fraud on Bandwidth’s own network, we can deliver high-quality, reliable voice coverage. Upholding the FCC’s mitigation efforts is another way we commit to doing so, making sure we can keep delivering a better voice experience than that of a network reseller or aggregator.
• We know voice like the back of our hand. Many providers in this industry provide voice calling services as an afterthought. They may ignore or overlook issues with spam traffic or voice quality, but voice has always been central to Bandwidth’s offering. Our deep industry understanding makes a difference in how we conduct business.

What happens if I don’t register in the RMD?

If Bandwidth determines that you’re a VSP but not validly registered in the FCC’s RMD, Bandwidth may be compelled to suspend your relevant services until you’ve registered in the RMD. 

Beginning September 28, 2021, the FCC has directed downstream carriers like Bandwidth to block traffic from any VSPs utilizing US phone numbers who still haven't registered in the RMD (the initial registration deadline was June 30, 2021). Please see this public notice for more information.

In addition, beginning April 11, 2023, the FCC has directed downstream carriers like Bandwidth to block traffic from any foreign-based voice service providers utilizing US phone numbers who still haven’t registered in the RMD (the initial registration deadline was January 11, 2023). Please see this public notice for more information.

Note: Should you choose to use another vendor for voice services who doesn’t require you to register with the RMD, you may still be considered a VSP by the FCC or other parties.

What legal risk are we taking on by filing?

Please consult your own legal counsel to evaluate the risk for your specific business case.

My legal counsel has advised me that I don’t need to register. How do I ensure Bandwidth doesn't disrupt my traffic? 

Bandwidth can engage in legal discussions between our legal representatives. If Bandwidth believes your service use case constitutes a voice service and you choose not to register in the FCC's RMD accordingly, then without some further satisfactory legal justification for why you have failed to register, Bandwidth may be compelled to block your traffic to ensure its own compliance.

Customers in this position should contact the Bandwidth Support Team with the full details from their legal counsel on why they don't feel they're subject to registration. Bandwidth will review these details and determine at its discretion whether Bandwidth feels the information appropriately addresses the need for registration. It's important to provide this information as soon as possible to ensure adequate time for review.

How will my data be protected?

The FCC makes your certification publicly available on the RMD website in an effort to ensure transparency and accountability for implementing robocall mitigation programs. Prior to submitting your RMD filing, which requires contact information for your designated robocall mitigation point of contact, we encourage you to review the RMD Privacy Act Notice to understand how your information will be handled. See how Bandwidth protects your personal data in our Privacy Notice.

Registration process

How do I register with the RMD? 

Visit the Robocall Mitigation Database website and follow the Robocall Mitigation Database External Filing Instructions. These instructions include directions for establishing a Commission Registration System (CORES) account and FCC Registration Number (FRN), which is a prerequisite for filing with the RMD (see the FCC’s tutorial videos for this step).

If you need help navigating the registration process, there are many consultants and outside counsel who can assist with it. If customers see inaccurate information in the database or need special assistance with the registration process, they should reach out to the FCC directly at RobocallMitigationDatabase@FCC.gov.

How long does it take to file my registration with the RMD?

The filing process can take as little as 15 minutes to complete, especially if you already have an FRN from doing business with the FCC previously. 

What do the RMD registration options regarding STIR/SHAKEN implementation mean?

The TRACED Act and FCC Rules mandate that all IP-based services support the STIR/SHAKEN specifications.

RMD filing instructions require VSPs registering to assert their specific level of STIR/SHAKEN implementation (see Figure 10). You’ll need to discuss the filing selections with your legal counsel to ensure you’re complying with the FCC rules and accurately representing your status to the FCC. It’s possible to update your business’ information later if your filing status needs to be reconsidered.

Which STIR/SHAKEN implementation option should I select?

Although Bandwidth can’t recommend a filing status for your business, you can consult with your legal counsel and consider Bandwidth’s implementation of the STIR/SHAKEN framework as it relates to your services.

Your outbound voice traffic sent over Bandwidth will be signed and sent in compliance with STIR/SHAKEN. To learn more about how Bandwidth implements STIR/SHAKEN, see our support article.

Do I need to include a separate Robocall Mitigation Plan when I register?

If your legal counsel recommends a filing status of Partial or No STIR/SHAKEN implementation because you're unable to certify a complete STIR/SHAKEN deployment, then you most likely need to file a Robocall Mitigation Plan. Please see the filing instructions from the FCC for more information.

Can I use Bandwidth’s Robocall Mitigation Plan as my own? 

No, you can't use Bandwidth’s plan as it's specific to actions Bandwidth is taking. 

Are there specific details that I need to include in my Robocall Mitigation Plan?

The FCC’s rules and guidance specifically ask providers to detail actions they as a provider are taking to mitigate robocalls on their own network/service. Customers will need to consult their own legal counsel regarding what should be included in a Robocall Mitigation Plan. You are, however, welcome and encouraged to review the Robocall Mitigation Plans posted by other providers in the RMD as general examples to inform your own considerations for what items are relevant to include in your plan.

After registration

Will the FCC contact me?

The FCC may contact you if there’s a need to confirm the details of your filing status or to prescribe additional mitigation steps if your implementation doesn’t meet their requirements.

What do I need to provide to Bandwidth?

Bandwidth may use the FRN associated with your filing, or information such as customer names and business details to find your matching filing.

If Bandwidth can’t identify a matching filing, you’ll receive a separate communication prior to any suspension of services, at which time you’ll be given an opportunity to provide your FRN if it was missed. Customers who have registered shouldn't be worried about any disruption to their account.

What should I expect from Bandwidth after registering?

With a valid registration in the RMD, customers will continue to be able to utilize Bandwidth as a chosen downstream service provider. Without a valid RMD registration, however, Bandwidth will be obligated to block traffic it may receive from non-registered VSPs.

Should I be requiring my own customers to be registered in the RMD?

The FCC has stated that all VSPs must register. As a result, Bandwidth expects all of our non-enterprise/retail customers that send phone calls across the Bandwidth network for termination to be registered in the RMD.

In terms of your customers, we encourage them to consult with legal counsel on the interpretation of the FCC rules but again emphasize the FCC’s quite broad and severe directives (i.e., ALL VSPs must register; if they don’t, downstream carriers are being instructed to block their traffic).

Additional questions

I'm registered as an Intermediate Service Provider and therefore the FCC added my information to the RMD by default, but I haven’t done any additional filings. Am I good?

Bandwidth can't be intimately familiar with all of its customers’ use cases or legal positions. Bandwidth believes that the safest course is for all potentially impacted customers to register as completely as possible in the RMD, including their assertion of their STIR/SHAKEN compliance status. Please note additional action may be required with this filing.

Are customers that have 100% of their voice and numbers with Bandwidth fully STIR/SHAKEN compliant?

The first thing to note is that STIR/SHAKEN compliance and RMD filing requirements are related but two separate things. Even if customers are fully STIR/SHAKEN compliant, they're still required to file an entry in the RMD to report their STIR/SHAKEN compliance status.

If your company has all of its phone numbers and voice traffic with Bandwidth then yes, all of your calls sent over Bandwidth are being signed and sent in compliance with STIR/SHAKEN. Regardless, our customers should discuss the filing selections with their legal counsel to ensure they're accurately representing themselves to the FCC. It also means that if you ever choose to send traffic via other providers, your filing status should be reconsidered.

What other resources does Bandwidth have related to STIR/SHAKEN?

Check out our STIR/SHAKEN information hub and STIR/SHAKEN resources for more explanations, videos, and support documentation.