CPNI Annual Filing: Everything You Need to Know Before March 1

Every covered telecommunications carrier must file an annual Customer Proprietary Network Information (CPNI) certification with the FCC by March 1 each year. Missing this deadline — or filing it incorrectly — can trigger enforcement action even for providers who are otherwise fully compliant. This guide covers exactly what's required and how to prepare.

What Is CPNI?

CPNI is information that telecommunications carriers collect about their customers' calling patterns — including call records, billing information, and service usage. The FCC requires carriers to protect this data and to certify annually that they have systems in place to do so.

Who Must File?

Any company that provides telecommunications services as defined under the Communications Act — including interconnected VoIP providers — must complete the annual CPNI certification. This applies regardless of company size; there is no small-carrier exemption for CPNI certification, unlike some other FCC filing requirements.

What the Certification Requires

The annual CPNI certification must include:

• A statement confirming the carrier has operating procedures in place to ensure compliance with the FCC's CPNI rules
• An explanation of how the carrier's procedures ensure compliance
• A statement on whether the carrier has taken any actions against data brokers
• A summary of any customer complaints received regarding unauthorized access to or disclosure of CPNI in the past year

The March 1 Deadline

The certification must be filed with the FCC by March 1 of each year, covering the previous calendar year's compliance. The filing must be signed by an officer of the company who can certify, based on their own knowledge, that the company has established operating procedures adequate to ensure compliance with CPNI rules.

Building Your CPNI Compliance Program

A solid CPNI compliance program typically includes employee training on what counts as CPNI and how it can and cannot be used, password protection and authentication procedures before disclosing account information, notification procedures for account changes, and a record-keeping system to document compliance efforts and any security breaches.

What Happens If You Miss the Deadline?

Missing the March 1 deadline or filing an inaccurate certification exposes a carrier to FCC enforcement action, including potential fines. The FCC has pursued enforcement actions against carriers for both late and inaccurate CPNI certifications, including failures to properly safeguard customer call detail records.

Preparing for Next Year

The most effective way to avoid a last-minute scramble is to treat CPNI compliance as an ongoing program rather than an annual filing exercise — train new employees as they're hired, audit your safeguards periodically throughout the year, and document everything as you go so the certification itself becomes a formality rather than a fire drill.

Conclusion

CPNI certification is a recurring, non-negotiable obligation for every telecommunications carrier, including interconnected VoIP providers. Building real operating procedures — not just a paper certification — is the difference between sailing through March 1 each year and facing FCC scrutiny.