Voice Service Provider Compliance: What the FCC Requires in 2026
Voice service provider compliance is no longer a checklist you finish once and forget. Under current FCC rules, it's an ongoing obligation that touches call authentication, database registration, periodic filings, and — increasingly — how well you know the traffic coming from your upstream partners. If you originate, transport, or terminate voice traffic in the United States, the FCC treats you as accountable for the calls that pass through your network, not just the ones you originate yourself.
This matters more in 2026 than it did a year ago. The Commission has been pushing responsibility for robocall mitigation further upstream, and providers that treat compliance as a one-time registration are getting flagged.
What Counts as a "Voice Service Provider" Under FCC Rules
The FCC's definition is broad by design. It covers:
- Interconnected and non-interconnected VoIP providers
- Wholesale carriers and SIP trunk providers
- CPaaS and UCaaS platforms that originate or terminate calls to the PSTN
- International gateway providers bringing foreign-originated traffic into the U.S. network
- Intermediate providers that simply route calls between other carriers
If your platform touches a call at any point in its path — origination, transit, or termination — you have compliance obligations. This is the foundation of the current FCC approach: no gaps in the chain of custody for a call.
The Core Compliance Stack
1. STIR/SHAKEN Call Authentication
Originating and terminating voice providers implementing IP-based networks must sign and verify calls using STIR/SHAKEN protocols. Providers with non-IP portions of their network are subject to the robocall mitigation requirements even where full STIR/SHAKEN implementation isn't technically feasible. If your network still has gaps here, our STIR/SHAKEN compliance services page covers implementation paths for mixed IP/TDM networks.
2. Robocall Mitigation Database (RMD) Registration
Every voice service provider — regardless of STIR/SHAKEN implementation status — must file a robocall mitigation plan and appear in the FCC's public database. Intermediate and downstream providers are required to check that database before accepting traffic from an upstream partner. If you're not listed correctly, or your plan is outdated, your traffic can legally be blocked by other carriers. See Robocall Mitigation Database registration for what a current filing needs to include.
3. FCC Form 499 Filings
These filings fund USF, TRS, and the numbering administration, and they're also how the FCC keeps track of who's operating in the space. Missing a 499 filing is a fast way to draw regulatory attention even if your call authentication is perfect.
4. CPNI Certification
Annual Customer Proprietary Network Information certifications confirm you have safeguards in place to protect customer call data. This is a separate obligation from robocall mitigation but gets audited on the same enforcement timeline.
The 2026 Shift: Upstream Accountability
Recent FCC activity signals a clear direction: enforcement is moving upstream. The Commission has opened comment proceedings on a "know your upstream provider" framework that would require voice service providers to vet the traffic sources they accept, not just authenticate what they originate. Reporting on this proposal has described it explicitly as an effort to stamp out illegal robocalls by pushing vetting obligations further back in the call chain, rather than relying solely on origination-point controls.
Separately, industry coverage has documented the FCC placing individual voice providers on formal robocall compliance plans, and in at least one reported case, cutting a provider's access to U.S. voice networks entirely. These actions illustrate that the FCC is willing to use network access itself as an enforcement lever, not just fines or certification requirements.
Legal analysis from telecom counsel has characterized this as enforcement "shifting upstream" — meaning transit and wholesale providers who assumed they were insulated because they don't originate the calls are now squarely in scope.
Practical takeaway: if you're a wholesale or intermediate provider, your due diligence process for onboarding downstream customers is now a compliance control, not just a business decision. Confirm the current scope and status of any proposed upstream vetting rule directly with the FCC before treating it as final, since these proceedings can change during the comment period.
2026–2027 Filing Deadlines
| Obligation | Due Date |
|---|---|
| FCC Form 499-Q (Q3 2026) | August 3, 2026 |
| FCC Form 499-Q (Q4 2026) | November 2, 2026 |
| CPNI Certification (annual) | March 1, 2027 |
| FCC Form 499-A (annual) | April 1, 2027 |
Missing any of these dates on its own may not trigger enforcement, but a pattern of late or missing filings is exactly the kind of signal that puts a provider on a compliance plan.
Practical Compliance Checklist
- Confirm your RMD filing reflects your current network architecture (IP, TDM, or mixed)
- Verify STIR/SHAKEN attestation levels match your actual call signing capability
- Check downstream and upstream partners against the RMD before routing traffic
- Calendar all four Form 499 and CPNI deadlines with internal owners assigned
- Document your customer vetting process — who you onboard, and why you trust their traffic
- Review any FCC comment proceedings affecting upstream provider obligations at least quarterly
Where This Leaves Voice Providers
Compliance in 2026 isn't just about having the right paperwork filed — it's about being able to demonstrate that your network makes reasonable, documented decisions about the traffic it carries. That standard applies whether you're a five-person CPaaS startup or a wholesale carrier moving millions of minutes a month. Our telecommunications compliance services are built around that reality: engineering-first assessments that match your actual network, not generic templates.
If you're unsure whether your current STIR/SHAKEN implementation, RMD filing, or upstream vetting process would hold up under FCC scrutiny, STIRSHAKEN.AI can walk through your specific setup and identify the gaps before a regulator does.