FCC Proposes Major Expansion of the Robocall Mitigation Database

In one of the Federal Communications Commission’s (FCC or “Commission”) most aggressive moves to eliminate unlawful robocalling from US voice networks, it has released a Further Notice of Proposed Rulemaking (FNPRM) seeking comment on several proposals aimed at improving the effectiveness of the Robocall Mitigation Database (RMD).

The RMD is the FCC’s centralized database through which voice service providers that originate, carry, or terminate calls register and certify their robocall mitigation practices. The RMD serves as the Commission’s principal gatekeeping mechanism for ensuring compliance with its robocall mitigation, caller ID authentication, and related enforcement requirements. All voice providers generally must have an RMD entry on file, and downstream providers may only accept calls directly from providers in the RMD.

The FNPRM represents one of the FCC’s most significant robocall-related proposals since implementation of STIR/SHAKEN. Indeed, in keeping with the FCC’s recent approach of purging bad actors from the RMD and relying on carriers to block unregistered traffic, the proposed rules, if adopted, would turn the RMD into a comprehensive compliance regime requiring more detailed ownership disclosures, enhanced know-your-customer (KYC) and know-your-upstream-provider (KYUP) requirements, strengthen traceback commitments, and expand the Commission’s authority to suspend, remove, or bar providers from US telecommunications networks.

Here are the key takeaways from the FCC’s proposals:

• Broader scope of covered entities. The FCC proposes to clarify that a wide range of entities may qualify as “voice service providers” subject to RMD obligations, including certain VoIP resellers, MVNOs, dialing platforms, cloud providers, call centers, and other voice-related service providers. The FCC makes clear that if a service provides voice communications of any sort, it may be covered and required to file in the RMD. This could sweep additional entities subject to traditional TCPA requirements into direct FCC compliance obligations.
• Substantially expanded RMD filing requirements. Providers would be required to submit significantly more information regarding ownership, affiliates, principals, use of third-party vendors, enforcement history, service offerings, and robocall mitigation practices. The FCC also proposes requiring a US-registered agent for service of process to facilitate enforcement actions, the submission of more detailed robocall mitigation plans, and the submission of additional certifications regarding compliance.
• Stronger focus on KYC and KYUP compliance. The proposal would further integrate the FCC’s recent Know Your Customer and Know Your Upstream Provider initiatives into the RMD framework. The proposal would require providers to disclose and document how they vet customers and upstream voice providers.
• More detailed robocall mitigation plans. The FCC finds that current standards for robocall mitigation plans fall short. The Commission “proposes to require providers to take ‘affirmative, effective measures’ rather than just ‘reasonable steps’” to mitigate illegal robocalls and to require providers to disclose more information such as call analytics programs, KYC procedures, KYUP procedures, contractual protections, and call blocking practices.
• Modernizing filing procedures and requirements. The FCC seeks comment on changes to filing procedures, including requiring machine-readable robocall mitigation plans, adjusting annual recertification requirements, modifying update obligations, and determining what information should remain public versus nonpublic.
• Keeping bad actors out of the database. In an attempt to prevent “bad actors” from entering the RMD, the FCC proposes enhanced screening measures before filings become active, including using expanded technical validation tools, a more rigorous review process, and more. The FCC is also considering requiring some providers to obtain letters of credit or similar financial assurances as a means of deterring shell entities and repeat bad actors. In addition, the FCC proposes a comprehensive framework for removing providers from the RMD for deficiencies, traceback failures, false statements, inadequate mitigation practices, STIR/SHAKEN violations, facilitating illegal traffic, or national security concerns. Because downstream providers generally cannot accept traffic from entities that do not appear in the RMD, removal can effectively cut off a provider’s ability to exchange traffic with the US.
• Potential new compliance risks and causes for removal. The FCC seeks comment on enhanced traceback obligations, audits, expanded reporting requirements, customer notification obligations following removals, and possible restrictions on providers attempting to re-enter the market after removal from the RMD. It also seeks comment on how to keep removed bad actors out of the RMD.
• Foreign adversary and national security measures. The Commission proposes requiring domestic RMD filers to submit Foreign Adversary Control attestations and is considering additional screening mechanisms tied to national security concerns that may require more disclosures and heighten requirements for foreign-based providers.

Next Steps

Comments and reply comments on the FNPRM are due 30 days and 60 days after publication in the Federal Register.

Subscribe To Viewpoints