FCC's 2025-2026 STIR/SHAKEN Rule Changes: What Every Carrier Must Know

The regulatory landscape for STIR/SHAKEN continues to evolve rapidly. In 2025 and 2026, the FCC has introduced significant rule changes that affect every voice service provider. This guide covers the most critical updates every carrier must know.

1. The Third-Party Authentication Order (Effective June 20, 2025)

The FCC's Third-Party Authentication Order fundamentally changed how providers can authenticate calls.

Key requirements:

• Providers must use their own certificates — voice service providers with a STIR/SHAKEN implementation obligation must obtain their own certificate(s) and authenticate their own calls.
• Providers must make their own attestation decisions — the provider, not a third party, must determine the attestation level of all calls.
• Calls must be signed using the provider's own certificate, not a third party's.

This rule closes a loophole where providers were relying on third-party vendors to sign calls on their behalf. The FCC wants clear accountability for every call.

2. Know Your Upstream Provider (KYUP) Rules (Adopted May 2026)

In its May 2026 open meeting, the FCC adopted rules requiring voice service providers to Know Their Upstream Providers.

Key requirements:

• Collect business information directly from the upstream provider, verify it, and retain records for four years.
• Monitor the upstream provider using call analytics on an ongoing basis.
• Watch for evidence that the upstream provider is transmitting illegal calls, failing to authenticate calls, or authenticating calls with improper attestation.
• Investigate inconsistent information about that provider.

You are now responsible for verifying the legitimacy of your upstream providers. If they transmit illegal calls, you could be held liable.

3. Closing STIR/SHAKEN Implementation Loopholes

The FCC is moving attestation determination closer to the call source. Proposed rules would require the provider with a direct relationship with the end user (the "initiating provider") to make attestation-level decisions, obtain an SPC token, use it to obtain certificates, and arrange for calls to be signed with their own certificate and attestation level.

This would bring attestation information and accountability closer to the call initiator — a fundamental objective of call authentication.

4. New Definitions Clarify the Rules

The updated rules add nine definitions in §64.6300 of Title 47 CFR to clarify STIR/SHAKEN rules.

5. Proposed End to Implementation Exemptions

The Commission proposed ending STIR/SHAKEN implementation exemptions for satellite providers and providers that cannot obtain an SPC token, and is seeking comment on this proposal.

Key Compliance Dates

Action Items for Carriers

• Obtain your own certificate if you haven't already.
• Implement KYUP procedures — start collecting and verifying upstream provider information.
• Monitor upstream providers with call analytics to detect illegal traffic.
• Review your attestation practices to ensure you're making decisions yourself, not relying on third parties.
• Stay informed on the FCC's further rulemaking on exemptions.

Conclusion

The FCC is tightening the net around fraudulent robocalls and illegal number spoofing. The Third-Party Authentication Order, KYUP rules, and proposed changes represent a significant shift toward greater accountability for all providers.