FCC Robocall Mitigation Database Explained

The FCC’s Robocall Mitigation Database is one of the least understood but most impactful compliance mechanisms in the US telephone network. If your carrier is not listed in the RMD, downstream providers may not accept its calls directly — not because your calls are illegal, but because your carrier has not certified compliance with the FCC’s robocall mitigation framework. Calls on affected routes fail before they reach the terminating carrier. And you may have little visibility into why, because the refusal happens at a layer between your carrier and the recipient’s carrier that you cannot see.

This guide explains what the RMD is, what carriers must file, and what it means for your operation. SIPNEX is an FCC-licensed carrier registered in the Robocall Mitigation Database, with a robocall mitigation plan on file and outbound calls signed under our own STIR/SHAKEN certificate.

What the Robocall Mitigation Database is

The RMD is a public database maintained by the FCC where voice service providers (carriers) must file certifications regarding their implementation of STIR/SHAKEN caller ID authentication and/or a robocall mitigation program. The database was established under the TRACED Act (Telephone Robocall Abuse Criminal Enforcement and Deterrence Act) of 2019 and the FCC’s subsequent implementation orders.

Every provider in the US call path — originating, gateway, intermediate, and terminating — must now file in the RMD. Voice service providers filed first, gateway providers were added in 2022, and the FCC’s Sixth Report and Order (FCC 23-18, adopted March 16, 2023) extended the duty to all remaining providers, including non-gateway intermediate providers. Those rules took effect February 26, 2024. A voice service provider’s filing certifies one of three things:

Complete STIR/SHAKEN implementation. The carrier has fully implemented STIR/SHAKEN caller ID authentication on all IP-based calls it originates. This means the carrier holds an SP-KI certificate and signs outbound calls with attestation levels. This is the highest level of compliance.

Partial STIR/SHAKEN implementation with robocall mitigation. The carrier has implemented STIR/SHAKEN on some but not all of its traffic (common for carriers that still have TDM/PRI infrastructure alongside SIP), and has a robocall mitigation program in place for the traffic that is not covered by STIR/SHAKEN.

Robocall mitigation program only. The carrier has not implemented STIR/SHAKEN but has a documented program to prevent illegal robocall traffic from originating on its network. Today this lane belongs to providers with non-IP (TDM) portions of their networks, providers that cannot obtain a Service Provider Code token, and small satellite providers — the general small-carrier extension expired June 30, 2023.

SIPNEX is registered in the RMD. We hold our own SP-KI certificate and sign our outbound calls with STIR/SHAKEN attestation. RMD filings are public: search for SIPNEX in the FCC’s Robocall Mitigation Database.

Why the RMD matters for your operation

The FCC’s enforcement mechanism gives the RMD real teeth: under 47 CFR 64.6305(g), intermediate providers and voice service providers may accept calls directly from another provider only if that provider’s filing appears in the RMD and has not been de-listed in an enforcement action. This is not a suggestion — it is a rule with enforcement consequences.

In practice, this means that if your carrier is not in the RMD, carriers downstream in the call path (the carriers that deliver your calls to the recipient) may refuse its traffic. The call never reaches the terminating carrier. The recipient’s phone never rings. What your dialer sees varies by carrier: a SIP error response such as 503 Service Unavailable, or, worse, a false ring-no-answer that looks like the recipient simply did not pick up.

Don’t confuse this with analytics-based blocking. Since March 25, 2026, the FCC’s order FCC 25-15 requires providers that block calls based on reasonable analytics to return SIP 603+ with the reason phrase “Network Blocked.” That is a separate mechanism from the RMD rule.

How consistently the RMD rule is enforced depends on each downstream provider’s compliance practices. But it binds every provider that accepts traffic directly from your carrier, so a carrier missing from the RMD is exposed at every hand-off to another network.

How to check your carrier’s RMD status. The RMD is publicly searchable at the FCC’s Service Now portal (fccprod.servicenowservices.com/rmd). Search for your carrier’s name and verify that they have an active filing. If your carrier is not in the RMD, or if their filing has lapsed (filings must be recertified annually by March 1 and updated within 10 business days of any change), your traffic is at risk of downstream blocking.

What a robocall mitigation program includes

Every filer now describes a robocall mitigation program. For a voice service provider, 47 CFR 64.6305(d) spells out what the filing must cover: the specific reasonable steps it takes to avoid originating illegal robocalls (including how it knows its customers, how it knows its upstream providers, and which analytics it uses to identify and block illegal traffic), plus a commitment to answer traceback requests within 24 hours and to cooperate in stopping illegal robocallers. In practice, those programs cover four areas:

Know Your Customer (KYC) practices. The carrier must take reasonable steps to verify the identity of its customers and to evaluate whether a customer’s traffic patterns are consistent with legitimate use. This includes collecting and verifying business information, monitoring traffic volumes and patterns, and investigating anomalies.

Traffic monitoring. The carrier must monitor originating traffic for patterns associated with illegal robocalling — high-volume short-duration calls, rapid caller ID rotation, calls to numbers on the DNC registry, and other indicators. When suspicious patterns are detected, the carrier must investigate and take action.

Enforcement mechanisms. The carrier must have contractual provisions and operational processes to address customers that originate illegal robocall traffic. This includes the ability to suspend service, block specific traffic patterns, and terminate customer relationships. The carrier’s Acceptable Use Policy (like SIPNEX’s AUP) is a key component of this enforcement framework.

Cooperation with industry traceback. The carrier must participate in traceback efforts coordinated by the Industry Traceback Group (ITG) when illegal robocall campaigns are traced to the carrier’s network. Traceback is the process by which industry participants identify the source carrier of illegal robocall traffic by tracing the call path from the recipient back to the originator.

How to file in the RMD (from a carrier that has)

For providers facing their own filing, the process runs through the FCC’s RMD portal (the same public system linked above). What you are actually assembling, from our own filing experience:

1. Your certification category. Decide honestly which of the three certifications describes your network — complete STIR/SHAKEN, partial with mitigation, or mitigation-only. The category dictates what documentation follows, and misstating it is worse than filing the humbler truth.
2. The mitigation plan description. Every filer submits one — since the FCC’s Sixth Report and Order (filings due February 26, 2024), certifying complete STIR/SHAKEN implementation no longer exempts you from describing your robocall mitigation program. Write the KYC, monitoring, and enforcement elements above specifically enough that the FCC (and any downstream carrier reading your filing) can tell it’s operational rather than aspirational.
3. Contact information that answers. The filing requires a point of contact for traceback and enforcement inquiries. Treat it as an SLA: your filing commits you to answering traceback requests within 24 hours, and an unresponsive contact is itself a compliance failure.
4. Keep it current. Filings are not fire-and-forget. Changes must be reflected in your filing within 10 business days. The FCC’s December 2024 RMD order (FCC 24-135, in force since February 5, 2026) added an annual recertification due by March 1, plus base forfeitures of $10,000 for false or inaccurate information and $1,000 for failing to update. The same order adopted a $100 filing fee that takes effect only once the FCC publishes its effective date, so check the current filing instructions before you file. If the FCC removes a deficient filing from the database, the practical consequence is the same as never filing: downstream providers may no longer accept your traffic directly.

None of this is legal advice — it’s the operator’s map of the terrain. If you’re a reseller or ITSP building on SIPNEX wholesale services, your filing obligations are your own, but the upstream attestation and mitigation posture you inherit from us makes the story you certify considerably easier to tell.

STIR/SHAKEN and the RMD: how they interact

STIR/SHAKEN and the RMD are complementary components of the FCC’s robocall framework.

STIR/SHAKEN is the technical mechanism — it provides a way for carriers to cryptographically sign calls with attestation levels, allowing terminating carriers to evaluate the trustworthiness of the caller ID claim. It operates on a per-call basis: each call gets signed, each signature gets validated.

The RMD is the accountability mechanism — it ensures that every carrier participating in the US telephone network has either implemented STIR/SHAKEN or has a documented robocall mitigation program. It operates at the carrier level: the carrier files once (recertified annually), and downstream carriers check the filing status before accepting traffic.

For your calls to have the best chance of reaching recipients:

1. Your carrier must be registered in the RMD (network-level access)
2. Your carrier must implement STIR/SHAKEN and sign your calls (per-call trust)
3. Your carrier must sign at A-level attestation for maximum trust
4. Your calling practices must be clean (reputation layer)

Each layer builds on the one below it. Downstream providers may not accept calls directly from a carrier missing from the RMD. A carrier in the RMD but without STIR/SHAKEN cannot provide call-level trust signals. A carrier with STIR/SHAKEN but only B-level attestation provides a weaker trust signal than A-level. And even A-level attestation cannot save numbers with destroyed reputation from flagging.

SIPNEX covers the first three: RMD registration, STIR/SHAKEN signing with our own SP-KI certificate, and A-level attestation on all verified DIDs. The fourth is shared: we monitor traffic on our network, but your consent records and dialing patterns decide your numbers’ reputation.

Frequently asked questions

SIPNEX is registered in the FCC Robocall Mitigation Database and signs outbound calls under its own STIR/SHAKEN certificate. To check how that fits your traffic, talk to the SIPNEX team.