The Complete STIR/SHAKEN Implementation Guide for VoIP Providers (2026)

STIR/SHAKEN compliance is no longer optional for any voice service provider operating in the United States. Since the FCC stepped up enforcement after the TRACED Act, the rule is simple: providers must authenticate and verify caller identity to combat spoofing and fraud.

In practice, however, many providers — especially smaller or non-facilities-based operators — face the same questions: How do we build a compliant framework? Where do we obtain authorized certificates? How do we register with the proper authorities?

This guide provides a complete implementation roadmap for VoIP providers, resellers, and carriers seeking STIR/SHAKEN compliance in 2026.

Who Needs STIR/SHAKEN Compliance?

According to the FCC, any voice service provider that originates SIP calls must implement the STIR/SHAKEN framework and sign calls with an authorized STI certificate.

Must obtain their own certificates:

• Tier-1 carriers
• CLECs
• ITSPs controlling their own PSTN numbers
• Non-facilities-based ITSPs or providers with their own softswitch that originate calls

Do NOT need their own certificates but must register in the RMD:

• Resellers or providers that only resell trunk resources — must declare use of upstream certificates and enforce robocall mitigation policies

Critical 2025 update: The FCC's Third-Party Authentication Order requires all voice service providers with a STIR/SHAKEN implementation obligation to obtain their own STIR/SHAKEN certificate(s) and authenticate their own calls. Providers can no longer rely on third parties to sign calls on their behalf.

Step 1: Verify Your Eligibility as a Voice Service Provider

To qualify for signing calls under the STIR/SHAKEN framework, you must first prove your legitimacy as a U.S. voice service provider.

1.1 FCC Registration (FCC Form 499-A)

Register with the FCC and obtain your 499 Filer ID. This registration is free.

1.2 Apply for an Operating Company Number (OCN)

The National Exchange Carrier Association (NECA) is responsible for distributing OCNs.

Required documents typically include an interconnection agreement with an upstream carrier, an invoice copy with one of your customers, a certified copy of Articles of Association, and basic administrative details.

Fees: standard processing is $475; expedited service (3-day turnaround) is $600.

1.3 Verify Your Number Resources (NANP Numbers)

You must have verifiable U.S. number resources, either directly owned or allocated through an upstream ITSP. These credentials are required for STI-PA verification — without a valid OCN and FCC Filer ID, your company cannot be recognized as an authorized voice service provider.

Step 2: Register with the STI Policy Administrator (STI-PA)

The FCC has authorized Iconectiv as the official STI Policy Administrator. You'll need to provide your company name and address, FCC 499 Filer ID, OCN, and billing contact details.

In return you receive your Service Provider Code (SPC) Token — a digital credential proving your authorization to request STIR/SHAKEN certificates. The token is typically valid for one year and must be renewed periodically. Registration typically takes 3 to 5 business days.

Step 3: Obtain Your STIR/SHAKEN Certificate

With your SPC Token in hand, request your certificate from an approved Certification Authority (CA), submitting your SPC Token, a Certificate Signing Request (CSR), and basic company information.

Your STI Certificate is used by your authentication service to sign outbound calls and by the verification service to validate inbound calls. After meeting prerequisites, certificates are typically issued almost immediately. Most CAs charge an annual fee for issuance and maintenance.

Step 4: Register with the FCC Robocall Mitigation Database (RMD)

All voice service providers — regardless of size or call volume — must register in the FCC Robocall Mitigation Database. You'll submit your FCC Filer ID, company and contact information, whether STIR/SHAKEN is fully implemented, your implementation type (Full / Partial / Gateway / Hosted), and robocall mitigation details if not fully compliant.

If your upstream carrier performs the signing on your behalf, you can register as "Hosted" or "Partial Implementation" and indicate your reliance on the upstream's STIR/SHAKEN compliance.

Implementation Checklist

Step	What You Need to Do	Estimated Timeline
Verify Eligibility	Register with FCC (Form 499-A), apply for OCN via NECA, verify NANP number resources	4–8 weeks
Register with STI-PA	Register with Iconectiv, obtain SPC Token	3–5 business days
Obtain Certificate	Request certificate from approved CA	1–3 business days
Register in RMD	Submit FCC RMD registration	Immediate

Common Implementation Pitfalls

• Not obtaining your own certificate — the FCC now requires providers to sign calls using their own digital certificate, not a third party's.
• Skipping the SPC token — all providers with obligations must obtain one.
• Assuming RMD registration is optional — it isn't, regardless of size or call volume.
• Missing USF filing deadlines — late or incorrect 499 filings result in USAC penalties.

Conclusion

STIR/SHAKEN implementation requires navigating multiple regulatory bodies and technical requirements, but the process is straightforward when approached systematically. By verifying eligibility, registering with the STI-PA, obtaining your certificate, and completing RMD registration, you can achieve full compliance and protect your traffic from blocking and spam labeling.