New SHAKEN and robocall rules for gateway providers

May 23, 2022

The new STIR/SHAKEN and robocall rules for gateway providers were approved on May 19. Here’s a quick recap of the final version.

Gateway provider definition

The rule defines the gateway provider as a U.S.-based provider that receive a call directly from a foreign provider. The foreign provider can be any intermediate or originating provider.

If you’re a U.S.-based provider and you receive a call with a U.S.-NANP calling number from a foreign provider, then you are subject to these rules. (Note: a foreign affiliate of a U.S.-based provider is not a foreign provider under this definition.)

New rules

Item	Rule	Deadline^*
1.	Register in the Robocall Mitigation Database (RMD)	30 days after Federal Register notice of OMB approval of the relevant information collection obligations
2.	Implement STIR/SHAKEN and authenticate unsigned calls with a U.S. calling number	June 30, 2023
3.	Implement a Robocall Mitigation Program, including:
a.	24-hour traceback response	30 days after publication in the Federal Register
b.	Mandatory blocking of illegal traffic when notified by the Commission and calls with calling numbers that appear on a reasonable DNO (Do Not Originate) list	60 days after publication in the Federal Register
c.	Know Your Upstream Provider—take reasonable and effective steps to ensure that the immediate upstream foreign provider is not using the gateway provider to carry illegal traffic	180 days after publication in the Federal Register
d.	Mitigate illegal robocalls—a “general mitigation standard” that requires gateway providers to mitigate illegal robocalls regardless of whether they have fully implemented STIR/SHAKEN	30 days after publication in the Federal Register
^*

Deadline implications

You may have noticed the variety of deadlines for each requirement: 30 days, 60 days, 180 days, and June 30, 2023. These deadlines allow time the Commission thinks is sufficient to implement each rule.

Commission rules require a provider to update their RMD filing within 10 days after a change in how they do STIR/SHAKEN or robocall mitigation. Therefore, a gateway provider meeting each requirement just before its deadline would have to update its RMD filing four times.

Some providers might prefer to satisfy some requirements early and group them together to reduce the number of filings.

A loophole closed

The Commission also issued an Order on Reconsideration to close a loophole in a previous rule. The rule involved refusing calls from providers not listed in the RMD.

The initial rule said domestic providers could only accept traffic carrying U.S. calling numbers that was received directly from voice service providers, including foreign voice service providers, listed in the RMD.

In the TRACED Act and ensuing FCC rules, a voice service provider is defined as an entity that provides service to an end user. An intermediate provider is not a voice service provider.

Because gateway providers almost never receive calls directly from a foreign voice service provider, this rule was useless.

The Order on Reconsideration fixes it. The revised rule says that domestic providers may only accept calls from foreign originating or intermediate providers that are listed in the RMD.

The full text of the FCC report and order is available online. The document file includes several related items, including a Further Notice of Proposed Rulemaking for potential future rules.

TransNexus solutions

TransNexus is a leader in developing innovative software to manage and protect telecommunications networks. The company has over 20 years’ experience in providing telecom software solutions including toll fraud prevention, robocall mitigation and prevention, TDoS prevention, analytics, routing, billing support, STIR/SHAKEN and SHAKEN certificate services.

This information will only be used to respond to your inquiry. TransNexus will not share your data with any third parties. We will retain your information for as long as needed to retain a record of your inquiry. For more information about how we use personal data, please see our privacy statement.

This article was updated on May 26, 2022 as follows:

The deadline for RMD registration was 30 days after publication in the Federal Register. This was changed to 30 days after Federal Register notice of OMB approval.