The FCC Robocall Mitigation Database: who certifies, and what is in it?

The short version

Section 64.6305 is the rule behind the Robocall Mitigation Database, the FCC list of providers that have said, under officer signature, how they try to keep illegal robocalls off their networks. It is a rule for phone carriers and the companies that sit between them, not for individual callers. If you came here because a number or a company shows up in the database, the useful reading is: that entity filed a certification, and every other provider is told not to take its calls directly unless the filing is there.

Three roles, one program requirement

The rule sorts providers into three groups and gives each the same core duty. A voice service provider must implement an appropriate robocall mitigation program that includes reasonable steps to avoid originating illegal robocall traffic. A gateway provider, the first U.S. point of entry for a call coming from abroad, must have a program for calls that use North American Numbering Plan resources pertaining to the United States in the caller ID field, with reasonable steps to avoid carrying or processing illegal traffic. A non-gateway intermediate provider must do the same for the calls it carries or processes. All three programs must include a commitment to respond within 24 hours to traceback requests from the Commission, law enforcement and the industry traceback consortium, and to cooperate in stopping illegal robocallers that use the service. The gateway version adds the word "fully": respond fully and within 24 hours.

What the certification must say

Each provider certifies that all of its covered calls are subject to its program, that any earlier certification has not been removed by Commission action, and that the FCC has not prohibited it from filing. It then picks one of three STIR/SHAKEN statements: fully implemented across the whole network, implemented on a portion (with all calls on that portion compliant), or not implemented on any portion. The widget above shows which paragraph of the rule matches each combination.

The written content has four required parts, in English or with a certified English translation: (1) the extension type received under section 64.6304 and its basis, or an explanation of why the provider cannot implement STIR/SHAKEN for lack of control over the network infrastructure; (2) the specific reasonable steps taken to avoid illegal robocall traffic, including how the provider knows its customers (for voice service providers, with reference to section 64.1200(n)(4)), the procedures for knowing upstream providers, and the analytics systems used to identify and block illegal traffic, including the names of any third-party analytics vendors; (3) the 24-hour traceback commitment; and (4) a statement of whether, in the prior two years, the filer or an affiliated entity under common ownership, management, directors or control was the subject of a formal Commission, law enforcement or regulatory action or investigation with findings of actual or suspected wrongdoing involving illegal robocalls, spoofing, or a deficient database certification or program description, with a description if so.

Filing mechanics

The certification is filed in the appropriate portal on the Commission's website and signed by an officer in conformity with 47 CFR 1.16. The provider also submits identity data: business names (current, other and previous), primary address, whether it is a foreign provider, the name, title, department, address, telephone and email of one person responsible for robocall mitigation issues, which category it falls in with respect to STIR/SHAKEN obligations, and its OCN if it has one. Any change to this information must be updated within 10 business days. There is one carve-out for providers appealing a revoked SPC token: they need not update on that basis until the review periods in the rule run out (60 days to seek Commission review after the Governance Authority's formal review, or 10 business days after a final Wireline Competition Bureau decision if they appeal; 30 days if they elect not to appeal to the Governance Authority Board).

Separately, paragraph (h) requires all providers to certify annually, on or before March 1, that what they submitted to the database is true and correct.

Why other providers care: the acceptance rule

The database has teeth because of paragraph (g). Intermediate providers and voice service providers may accept calls directly from a domestic voice service provider only if its filing appears in the database and has not been de-listed in an enforcement action. The same gate applies to foreign providers that use U.S. numbering resources in caller ID to send traffic to U.S. subscribers (beginning April 11, 2023), to gateway providers (the filing must show the gateway affirmatively submitted it), and to non-gateway intermediate providers. A missing or de-listed filing therefore cuts a provider off from direct traffic.

Two safeguards sit on top: a provider may not block a 911 emergency call under any circumstances, and must make all reasonable efforts not to block calls from public safety answering points and government emergency numbers.

What the rule does not tell you

The rule text does not say what counts as a "reasonable" step beyond the listed topics, does not set penalties for a deficient filing, and does not describe the database's search screen. Whether a particular provider's program is adequate is for the FCC to decide. The rule describes the filing as the provider's own certification. The extension rules sit in section 64.6304 and the STIR/SHAKEN duties in sections 64.6301 and 64.6302, which this page cites only for cross-reference; see the STIR/SHAKEN page for section 64.6301 itself. Providers need an FCC Registration Number for filings; the FRN format checker can catch a typo before you submit.

Sources

• 47 CFR 64.6305, Robocall mitigation and certification (eCFR). Read November 2, 2026.
• 47 CFR 64.6301, Caller ID authentication (eCFR), for the STIR/SHAKEN cross-reference. Read November 2, 2026.

Text read: the eCFR (Electronic Code of Federal Regulations) text of Title 47 as it stood on October 29, 2026, retrieved through the eCFR versioner API on November 2, 2026. The eCFR is an editorial compilation and is not the official legal edition; the Federal Register and the annual CFR are. Rules change, so confirm the current wording on the eCFR before relying on it. This page paraphrases the rule and does not replace it.