The FCC Robocall Mitigation Database (RMD) is becoming much more than a regulatory filing portal.

For U.S. voice providers, interconnected VoIP companies, resellers, MVNOs, wholesale carriers and communications platforms, an RMD filing increasingly functions as part of the provider’s identity within the U.S. voice ecosystem.

In July 2026, the Federal Communications Commission adopted a new Further Notice of Proposed Rulemaking, FCC 26-49, focused on strengthening the accuracy, accountability and enforcement value of the Robocall Mitigation Database. The FCC adopted the proceeding on July 22 and released it on July 23, 2026.

The proposals are not all final rules yet. However, they provide a useful indication of where FCC robocall enforcement and telecom compliance may be heading.

For legitimate providers, the message is increasingly clear:

Know your customers. Know your upstream providers. Maintain accurate RMD information. Understand your STIR/SHAKEN status. And make sure your actual operations match what you certify to regulators.

Why the Robocall Mitigation Database Matters

The RMD was established as part of the FCC’s broader effort to combat illegal robocalls and strengthen implementation of the STIR/SHAKEN caller ID authentication framework.

Today, voice service providers are required to submit information regarding their businesses and robocall mitigation practices to the Database. Importantly, downstream providers generally may only accept voice traffic directly from providers whose required RMD filings appear in the Database and have not been removed through FCC enforcement action.

That makes RMD compliance particularly important.

A filing is not simply a record stored on an FCC website. For many providers, it can directly affect whether other networks are permitted to accept their traffic.

The FCC says the Database currently contains more than 11,000 provider filings.

1. The FCC Is Looking Closely at Who Qualifies as a Voice Service Provider

One of the biggest issues raised in FCC 26-49 is the scope of entities that may have RMD obligations.

The traditional telecom industry is no longer limited to companies that own switches, fiber or physical network infrastructure.

Modern voice services can involve:

• interconnected VoIP providers;
• VoIP resellers;
• MVNOs;
• wholesale voice providers;
• cloud communications platforms;
• PBX and hosted communications providers;
• call centers;
• dialing platforms;
• CPaaS and UCaaS businesses;
• intermediate providers; and
• other businesses participating in the transmission of voice calls.

The FCC’s proceeding asks whether additional clarification is necessary so that companies providing voice functionality understand when the Robocall Mitigation Database rules apply.

This matters particularly for businesses that describe themselves as a software company, communications platform, information service, reseller, or technology provider rather than a telecom carrier.

A business label alone may not determine the regulatory outcome. The company’s actual role in providing, originating, transmitting or enabling voice communications is much more important.

2. VoIP Resellers and MVNOs Should Not Assume Their Upstream Carrier Handles Everything

Non-facilities-based providers deserve particular attention.

The FCC expressly recognizes interconnected VoIP resellers and MVNOs within the provider universe addressed by its robocall mitigation framework. Its July 2026 order also references existing guidance confirming that the RMD filing obligation extends to non-facilities-based providers, including VoIP resellers and MVNOs.

This can create a problem for businesses that assume:

“Our wholesale carrier already handles compliance, so we don’t have to.”

That assumption should be carefully reviewed.

A reseller may have its own responsibilities depending on how it operates, its relationship with customers, its role in the call path, its numbering arrangements and the applicable FCC rules.

For companies launching or expanding a U.S. voice operation, reviewing FCC registration, Robocall Mitigation and STIR/SHAKEN compliance together can help avoid conflicting filings later.

Bizz Core provides an overview of that complete process through our STIR/SHAKEN and U.S. telecom compliance services. (bizzcoreusa.com)

3. Related Companies May Need Their Own RMD Filings

Corporate structure is another area receiving attention.

A parent company, subsidiary or affiliate should not automatically assume that one filing covers an entire corporate group.

The FCC is considering how separate legal entities that independently qualify as voice service providers should be treated and how information regarding related businesses should appear in the RMD.

This is especially important for:

• telecom groups operating multiple subsidiaries;
• businesses using several brands;
• wholesale and retail entities under common ownership;
• companies acquiring existing VoIP providers; and
• organizations using separate legal entities for numbering, wholesale or customer-facing operations.

Providers should maintain a clear inventory of their:

legal entities, DBAs, FRNs, FCC Form 499 Filer IDs, OCNs, RMD filings and STIR/SHAKEN credentials.

A mismatch between those records can become a serious compliance issue.

4. Third-Party RMD Preparers Could Face Greater Scrutiny

Using outside help to prepare a filing is common.

Telecom providers often work with compliance consultants, attorneys or regulatory service providers because the process can involve multiple agencies, databases and industry organizations.

The FCC, however, is considering whether additional information should be required when a third party prepares an RMD filing.

That is important because an RMD submission contains much more than basic company information.

It can include statements concerning:

• the company’s robocall mitigation program;
• STIR/SHAKEN implementation;
• provider type;
• network practices;
• traceback cooperation;
• ownership and business identity; and
• regulatory compliance.

The practical rule for providers is simple:

A consultant can assist with the filing, but the provider must understand and verify what is being submitted on its behalf.

Never treat an RMD certification as routine paperwork.

5. Accuracy of RMD Certifications Is Becoming More Important

The FCC wants the Robocall Mitigation Database to contain reliable information.

FCC 26-49 proposes stronger filing obligations and considers additional tools for identifying and removing bad actors or non-compliant providers.

That means providers should pay particular attention to statements concerning:

STIR/SHAKEN implementation, robocall mitigation practices, company identity, enforcement history, provider role and traceback procedures.

There are already current RMD obligations outside the new proposal. For example, FCC rules adopted before this FNPRM include an annual RMD recertification requirement and requirements to update certain filing information when it changes. (FCC Documents)

A filing that was correct when originally submitted may therefore still create problems if the business later changes and the RMD is not updated accordingly.

6. The FCC Continues to Emphasize 24-Hour Traceback Response

Traceback cooperation is a major part of robocall mitigation.

The FCC’s framework requires providers to take traceback requests seriously, and the July proceeding continues to examine how RMD certifications can reinforce those obligations.

Providers should have an internal process that allows them to quickly identify:

• the customer associated with a call;
• the upstream source of traffic;
• the downstream destination;
• relevant SIP or call records;
• telephone-number information; and
• the person responsible for responding to a traceback request.

A policy that exists only in a PDF is not enough.

Your operational team should know who handles traceback requests and how they will respond within the required timeframe.

7. STIR/SHAKEN Claims Need to Match Reality

STIR/SHAKEN remains closely connected to RMD compliance.

The FCC has expressed concern about providers making unclear or unsupported statements regarding implementation or exemptions.

A company should understand whether it:

• has a STIR/SHAKEN implementation obligation;
• has fully implemented the framework;
• qualifies for an applicable exemption or extension;
• requires an SPC token;
• has its own certificate;
• relies on another provider for technical signing; or
• performs a different role in the call authentication process.

This is especially important after the FCC’s recent changes surrounding provider-specific STIR/SHAKEN certificates.

For providers building their compliance infrastructure, Bizz Core’s STIR/SHAKEN compliance process covers the relationship between FCC/USAC registration, Robocall Mitigation, OCN, STI-PA, SPC Token and STI-CA certification. (bizzcoreusa.com)

8. New Providers May Get a Clearer Path While Obtaining an SPC Token

The FCC also recognizes a practical onboarding problem.

A new provider may need to complete various compliance steps before it can obtain the credentials required for full STIR/SHAKEN implementation.

The July proceeding considers mechanisms around providers that are actively pursuing an SPC token but have not completed that process.

For legitimate new providers, greater clarity could be helpful.

But providers should not interpret a temporary pathway as permission to ignore the process.

If a company relies on a temporary status, it should maintain documentation showing:

• when its application started;
• what steps have been completed;
• its OCN and related provider identifiers;
• communications with relevant organizations; and
• when its RMD information must be updated.

9. Ownership and Business Identity Could Become More Transparent

Another major theme is provider identity.

The FCC is considering whether the Database should collect more detailed information regarding company principals, affiliates, parents, subsidiaries and other identifying information.

The policy goal is understandable: regulators want to make it more difficult for a prohibited provider to disappear and reappear under a different company name.

For legitimate businesses, however, this means corporate records need to be organized.

A provider should be able to reconcile information appearing across:

state formation records → IRS/EIN records → FCC CORES/FRN → FCC Form 499 → RMD → OCN → STI-PA → STIR/SHAKEN certificate records.

Inconsistent names, outdated addresses and unclear ownership information can create unnecessary delays.

10. Numbering Relationships Are Becoming Part of the Bigger Compliance Picture

Telephone numbers are another important piece.

The FCC has been looking more broadly at who receives numbering resources, how numbers move through reseller relationships and how those resources may be connected to illegal calls.

The July RMD proceeding therefore fits within a larger regulatory strategy involving:

KYC — Know Your Customer

KYUP — Know Your Upstream Provider

RMD — Robocall Mitigation Database

STIR/SHAKEN — Caller ID Authentication

Numbering controls

Traceback

These are increasingly interconnected rather than separate compliance exercises.

The FCC’s May 2026 KYUP proceeding, for example, proposed stronger due-diligence and monitoring expectations concerning upstream providers.

For a modern VoIP provider, compliance should therefore be designed as a system, not a collection of individual forms.

What Should VoIP Providers Do Now?

FCC 26-49 is a Further Notice of Proposed Rulemaking. The Commission is seeking public input, and many of the proposals discussed above have not yet become final rules. The FNPRM provides for comments 30 days after Federal Register publication and replies 60 days after publication.

That does not mean providers should ignore it until the rulemaking is complete.

A reasonable compliance review now should include:

• confirming that the company’s RMD filing is current and accurate;
• reviewing the Robocall Mitigation Plan against actual business practices;
• confirming the company’s STIR/SHAKEN implementation status;
• checking whether any claimed exemption remains appropriate;
• testing the company’s 24-hour traceback-response process;
• reviewing KYC procedures for customers;
• reviewing KYUP procedures for upstream providers;
• documenting numbering-resource relationships;
• reconciling FRN, FCC 499, OCN, SPC and entity information;
• identifying every related company that provides voice services; and
• verifying any filing prepared by an outside consultant or vendor.

The Bigger Picture: RMD Is Becoming a Market-Access Tool

The most important takeaway from the FCC’s 2026 activity may be the changing role of the Robocall Mitigation Database.

The RMD is not simply a directory.

It is increasingly part of the mechanism the FCC and industry use to determine who is participating in the U.S. voice ecosystem and whether another provider can continue accepting that company’s traffic.

The FCC itself describes the RMD as a central tool for transparency and accountability, and downstream providers may only accept applicable traffic from providers whose filings appear in the Database and have not been removed through enforcement.

That gives every provider a reason to treat its RMD filing with the same seriousness it would give its FCC registration or STIR/SHAKEN certificate.

Need Help Reviewing Your Telecom Compliance?

If your company provides VoIP services, resells voice services, operates a communications platform or is preparing to launch in the United States, it may be worth reviewing your regulatory structure before a filing problem becomes a network problem.

Bizz Core Solutions can assist with:

• FCC CORES and FRN registration;
• FCC Form 499 and Filer ID;
• Robocall Mitigation Plan preparation;
• Robocall Mitigation Database support;
• OCN/NECA onboarding;
• STI-PA registration;
• SPC Token support; and
• STI-CA / STIR/SHAKEN certificate onboarding.

You can review our complete U.S. VoIP and STIR/SHAKEN compliance services before deciding which registrations your company needs. (bizzcoreusa.com)