Robocall Mitigation Database filing requirements

Follow

Sarah

Updated

Note: The following is not meant as legal advice. Customers should consult their own legal counsel in making determinations about their STIR/SHAKEN compliance, Robocall Mitigation Database filing requirements, and how to provide an accurate description of your business to the FCC.

What's happening?

STIR/SHAKEN is a framework used to mitigate phone number spoofing for fraud or illegal robocalling. The FCC launched the Robocall Mitigation Database (RMD) for service providers to attest to their STIR/SHAKEN deployment and allow those who are not fully STIR/SHAKEN capable to formally file their robocall mitigation plans. All voice service providers were required to register in the RMD by June 30, 2021. The FCC has directed downstream carriers like Bandwidth to begin blocking traffic from any voice service providers who still haven't registered in the RMD on September 28, 2021. Please see this public notice for more information.

Who is required to register?

The FCC has used the term “voice service provider” in its orders that require registration and in its call blocking directives. It's also important to understand that the TRACED Act and FCC rules and orders require all IP-enabled voice services that are inbound, outbound, and intermediate to appropriately support STIR/SHAKEN. Therefore, a very broad range of providers are required by the FCC to register. While Bandwidth’s underlying services may support customers’ needs in certain respects, such underlying support doesn't remove a customer’s need to register.

Bandwidth expects all existing and future termination customers that haven't specifically purchased Enterprise and/or Retail services to register. Customers who are unsure about whether they are contracted on an Enterprise and/or Retail services should open a support ticket to confirm.

Please recognize that registration is a relatively simple process, while not registering may place your business at significant risk. When in doubt - register.

What happens if I don’t register?

If Voice Service Provider customers don't register, Bandwidth may be compelled to suspend the customer’s termination services until they register in the RMD.

Registration FAQ

Where do I go to file with the Robocall Mitigation Database?

Please visit this page. For more information, see the Robocall Mitigation Database website.

Should I be requiring my own customers to be registered in the RMD?

The FCC has stated that all voice service providers must register. As a result, Bandwidth expects all of our non-enterprise/retail customers that send phone calls across the Bandwidth network for termination should be registered in the database.

In terms of our customers’ customers, we would encourage our customers to consult with their legal counsel on the interpretation of the FCC rules but again emphasize the FCC’s quite broad and severe directives (i.e. ALL voice service providers must register; if they don’t, downstream carriers are being instructed to block their traffic).

How is Bandwidth determining whether customers are registered in the RMD?

Bandwidth will be using its customer information, including customer names and business details to determine a matching FCC Registration Number (FRN) and entry in the Robocall Mitigation Database. Customers without a found filing will receive a separate communication prior to any suspension of services, at which time they'll be given an opportunity to provide their FRN if it was missed. Customers that have registered shouldn't be worried about any disruption to their account.

I’m registered in the database but I received a communication from Bandwidth about registration. What should I do?

Prior communications went to all potentially impacted customers regardless of RMD filing status to remind them of the need to register. No further action is required of customers that have already registered.

I'm registered as an Intermediate Service Provider and therefore the FCC added my information to the RMD by default, but I haven’t done any additional filings. Am I good?

Bandwidth can't be intimately familiar with all of its customers’ use cases or legal positions. Bandwidth believes that the safest course is for all potentially impacted customers to register as completely as possible in the RMD, including their assertion of their STIR/SHAKEN compliance status.

Are customers that have 100% of their voice and numbers with Bandwidth fully STIR/SHAKEN compliant?

First thing to note is that STIR/SHAKEN compliance and RMD filing requirements are related but two separate things. Even if customers are fully STIR/SHAKEN compliant, they're still required to file an entry in the RMD to report their STIR/SHAKEN compliance status.

If your company has all of their phone numbers and voice traffic with Bandwidth then yes, all of your calls sent over Bandwidth are being signed and sent in compliance with STIR/SHAKEN. Regardless, our customers should discuss filing selections with their legal counsel to ensure they're accurately representing themselves to the FCC. It also means that if you ever choose to send traffic via other providers, your filing status should be reconsidered.

Note: STIR/SHAKEN isn't deployed on legacy network devices such as inbound/outbound gateways "Bandwidth 7", "Bandwidth 9", and "Bandwidth Edge" devices. Calls traversing these routes won't be signed. If you'd like to migrate to STIR/SHAKEN devices, please reach out to your Bandwidth Support Team.

Do I need to include a separate Robocall Mitigation Plan when I register?

If you're unable to certify a complete STIR/SHAKEN deployment, then you most likely need to file a Robocall Mitigation Plan. Please see the filing instructions from the FCC for more information.

Can I use Bandwidth’s Robocall Mitigation Plan as my own? Does Bandwidth have any advice on what I need to include in my Robocall Mitigation Plan?

No, you can't use Bandwidth’s plan as it's specific to actions Bandwidth is taking. The Robocall Mitigation Plan specifically asks providers to detail actions they as a provider are taking to mitigate robocalls on their own network/service.

You shouldn't put anything in a Robocall Mitigation Plan that you aren't doing directly. Customers will need to consult their own legal counsel regarding what should be included in a Robocall Mitigation Plan. You are, however, welcome and encouraged to review Robocall Mitigation Plans posted by other providers in the database as general examples to inform your own considerations for what items are relevant to include in your plan.

I received the communication from Bandwidth but my attorney has advised me that I don’t need to register. How do I ensure Bandwidth doesn't disrupt my traffic?

If customers choose not to register in the FCC's RMD according to the FCC's requirements, then without some further satisfactory legal justification for why that customer has failed to register, Bandwidth may well feel compelled to block its traffic to ensure its own compliance.

Customers in this position should contact the Bandwidth Support Team with the full details from their legal counsel on why they don't feel they're subject to registration. Bandwidth will review these details and determine at its discretion whether Bandwidth feels the information appropriately addresses the need for registration. It's important to provide this information as soon as possible to ensure adequate time for review.

I'm having difficulty registering or navigating the FCC system. Who can help me?

There are many consultants and outside lawyers who can assist with these procedures if you need help. If customers see inaccurate information in the database or need special assistance with the registration process, they should reach out to the FCC directly at RobocallMitigationDatabase@FCC.gov.

Article is closed for comments.