Equinox Strategies BlogVisit Website →
← Back to blog

STIR/SHAKEN Compliance: What US Businesses Must Do

November 7, 2026
STIR/SHAKEN Compliance: What US Businesses Must Do

If you run an HVAC, plumbing, roofing or restoration company, you most likely do not have to register for STIR/SHAKEN yourself. Your phone or VoIP provider does. The rules apply to companies that carry or originate calls for others, and your job is to make sure your provider is compliant and that your outbound calls are signed at the highest trust level. That is what keeps your calls from being labeled "Spam Likely" and your leads from going unanswered.

This guide covers who is regulated, what the FCC requires, what "registration" really means, and the practical checks a service business should run.

Equinox Strategies LLC
Keep More Service Calls Reachable
Equinox Strategies helps service businesses improve customer outreach with tailored lead generation, AI voice agents, and custom software solutions.
Explore Equinox Strategies

TL;DR

  • STIR/SHAKEN is the FCC-mandated system that lets carriers sign and verify caller ID on IP calls. The obligation sits on voice service providers, gateway providers and intermediate providers.
  • "Registration" means filing in the FCC's Robocall Mitigation Database, with an annual recertification due March 1.
  • An ordinary business with its own phone system for its own staff is not a voice service provider and does not file. If you resell or provide voice service to others, you are one.
  • Since September 2025, a provider may hire a third party to sign calls only if it makes the attestation decisions and the calls carry the provider's own certificate.
  • Your practical task: confirm your provider's status, ask for A-level attestation on your numbers, and monitor how your numbers appear on customers' phones.

Table of Contents

What STIR/SHAKEN is and where the rule comes from

STIR/SHAKEN is a set of technical standards that authenticate and verify caller ID for calls carried over IP networks. The originating carrier signs the call to vouch for the number, and the carrier that delivers it validates that signature before the phone rings. The goal is to cut off caller ID spoofing, where a scammer displays a number that is not theirs.

Congress set the requirement in the TRACED Act of 2019. Under 47 U.S.C. § 227b, the FCC must require voice service providers to implement STIR/SHAKEN in IP networks and take reasonable measures for non-IP networks. The FCC's original deadline for IP networks was June 30, 2021, and some providers received extensions after that.

The framework has grown since. According to the Federal Register's Call Authentication Trust Anchor rule, three categories of provider carry obligations:

  1. Voice service providers that originate calls.
  2. Non-gateway intermediate providers that carry or process calls without originating or terminating them.
  3. Gateway providers that receive calls from foreign originating or intermediate providers at their U.S. facilities and pass them downstream.

Notice who is missing from the list: the plumber, the roofer, the restoration company. You are a customer of these providers, not one of them.

Does your service business need to comply?

For most readers, the answer is no filing, but yes attention.

The line is whether you provide voice service to other people. A business that runs its own PBX for its own employees is not a voice service provider and does not register. A company that resells SIP trunks or offers hosted phone service to customers is a provider and does. TransUnion makes the same point about everyday businesses: they do not need to take action to be STIR/SHAKEN compliant, because their service providers made the certification.

There are a few situations where the question gets less obvious:

  • You built a software product on top of phone lines. If you resell calling or texting to other businesses, you may be acting as a provider. Talk to a telecom attorney before you assume otherwise.
  • You use a call center or lead vendor. Their calls are signed by whichever provider originates them. Ask which provider and which attestation level.
  • You use an AI voice agent. The agent still places and receives calls over a carrier. The carrier's signing and your number setup decide how the call is labeled.

If you want the broader picture of what phone-side issues affect lead response, our guide to spam call filtering for service businesses covers the inbound side.

What covered providers must do

Under 47 CFR 64.6301, a voice service provider must:

  1. Obtain an SPC token and use it to obtain a certificate.
  2. Authenticate and verify caller ID for SIP calls that exclusively transit its network.
  3. Authenticate calls it originates for exchange with another provider.
  4. Verify authenticated calls it receives for termination.

The SPC token comes from the STIR/SHAKEN governance system, and a provider needs it to hold a certificate that is trusted across carriers. This is why registration in the database and having your own certificate are two separate things, both required.

The September 2025 own-certificate rule

Many small providers used to rely on a vendor to sign calls with the vendor's certificate. That changed. Under the rules that took effect September 18, 2025, a provider can hire a third party only to perform the technical act of signing. The provider must make every attestation-level decision, and every call must be signed with the provider's own certificate.

The same notice cites TransNexus's estimate that about 64% of providers in the database that claim STIR/SHAKEN implementation are not registered with the Policy Administrator. For a business owner, the takeaway is simple: a provider saying "we're compliant" is not the same as a provider holding its own certificate.

Exemptions and extensions

The FCC recognizes several situations where the full requirements do not apply. The facilities-based small provider extension lapsed on June 30, 2023, and providers with control over the necessary network infrastructure must implement STIR/SHAKEN unless they cannot obtain an SPC token. An ongoing extension covers network portions that rely on technology unable to handle SIP calls. According to Herman Whiteaker, the Order's requirements also do not reach providers with an entirely non-IP network or those that lack control over the network infrastructure.

Resellers and MVNOs are generally exempt from implementation for that reason. Exempt does not mean invisible, though: they still depend on the upstream carrier's signing.

Exemptions and extensions

What "STIR/SHAKEN registration" means

People searching for registration usually mean the FCC's Robocall Mitigation Database (RMD). Voice service providers, gateway providers and non-gateway intermediate providers must file. The process, in outline:

  1. Create or use a CORES account and a business-type FRN. The FCC's RMD filing instructions walk through account creation and login.
  2. Enter business details and certifying-officer information, and select the provider role.
  3. Report implementation status. Under 47 CFR 64.6305(d), a voice service provider certifies that all calls it originates are covered by a robocall mitigation program, and states whether it has implemented STIR/SHAKEN fully, partially or not at all.
  4. Submit and pay the application fee. The FCC's January 6, 2026 final rule set a $100 processing fee for initial and annual submissions and directs development of two-factor authentication for database access.
  5. Recertify every year. The deadline is March 1, with the first window having opened February 1, 2026.

A filing is not a one-time event. Providers must also keep the data current, and the FCC's enhanced penalties apply to stale or wrong entries.

What happens when a provider doesn't comply

According to Lerman Senter, from February 5, 2026 the FCC may assess a $10,000 base forfeiture per violation for false or inaccurate data and $1,000 for failing to update information within 10 business days of a change, accruing daily until cured. Other carriers are also barred from accepting traffic from providers missing from the database, as SIPSymposium's guide explains.

FCC forfeiture amounts and update deadline

That last point matters to you. If your provider is removed or never filed properly, your calls can be blocked downstream, and you will experience it as customers who never hear your phone ring.

Attestation levels: where compliance meets your lead flow

Every signed call carries one of three attestation levels, as TransUnion describes:

LevelWhat the signing provider knowsPractical effect
A (full)Has a direct authenticated relationship with the customer and has verified the customer's right to use the numberMost trusted by downstream carriers
B (partial)Has verified the customer but not the number's associationLess trust
C (gateway)Has no relationship with the call's initiatorMost likely to be flagged or blocked

VoIPTest notes that A-level calls are least likely to be flagged as spam, while C-level calls are the most likely to be blocked by analytics engines and carrier filters.

A signature is not the whole story. Carrier analytics also weigh call volume, answer rates and complaints, which is the reputation side of the problem. We cover it in caller ID reputation signals.

A practical checklist for service businesses

You do not file, but you can verify. Here is what we would run through with any HVAC, plumbing, roofing or restoration company.

  1. Ask your provider whether it is in the Robocall Mitigation Database and whether it signs with its own certificate.
  2. Ask which attestation level your outbound calls get. If you use several numbers, ask for each. Numbers you own and have verified with the provider are the ones that can earn A-level.
  3. Check every tool that places calls for you. Dialers, call tracking, CRMs and AI voice agents often use separate numbers or separate carriers.
  4. Keep your business identity consistent. Business name, address and number registrations that disagree across systems cause trouble. Text messaging has its own registry, and our guide on fixing A2P 10DLC EIN mismatches explains how identity data gets rejected.
  5. Test on real phones. Call a few staff cell phones on different carriers and note how your caller ID displays.
  6. Document it. Keep a short record of the provider, the numbers and the attestation level you were told. It saves hours the day a number starts getting flagged.

If you place outbound calls with automation, compliance with telemarketing rules is a separate layer. Our AI outbound calling checklist covers TCPA risk, and the call recording laws guide covers consent when calls are recorded.

Perspective

Most of the STIR/SHAKEN content online is written for carriers. Our clients are not carriers. They are owners and office managers who just want the phone to ring and the call to be answered.

We see compliance as part of how a phone system is scoped, not a legal footnote afterward. Every build we do is scoped and documented, with written data maps, least-privilege access, explicit consent flows and rollback plans. Call authentication belongs in that same document: which numbers exist, which provider carries them, who signs the calls and who is accountable when something changes.

When voice agents, follow-up texts and a CRM all touch the same customer record, a gap in one place becomes a missed lead in another. That is why we build workflows end to end, with a single accountable technical lead, so identity, consent and call routing are designed together.

Felix

How we help service businesses keep every call reachable

We build lead response systems for US service businesses: AI voice and messaging agents, lead generation, done-for-you automations and custom software from client briefs. Each project is scoped and documented first, so your phone numbers, providers and consent flows are written down before anything goes live.

Equinox Strategies LLC

If calls are going unanswered or numbers are getting flagged, see how our process works and tell us what your setup looks like. Our guide on secure caller identity verification shows the way we think about trust on the call itself.

FAQ

Do I need to register my small business for STIR/SHAKEN?

Usually not. Businesses that use phone service for their own operations are not voice service providers and do not file in the Robocall Mitigation Database. If you provide or resell voice service to others, you are a provider and must file, so confirm that with a telecom attorney.

How often does STIR/SHAKEN registration have to be renewed?

Providers must recertify their Robocall Mitigation Database filing every year by March 1. They must also update changed information promptly, because the FCC can fine providers for stale data. Check the FCC's current instructions for the filing window.

What is the penalty for not complying?

The FCC can assess base forfeitures of $10,000 per violation for false or inaccurate filings and $1,000 for failing to update information in time, with daily accrual until cured. Other carriers can also refuse traffic from providers missing from the database.

How do I know if my calls are being signed correctly?

Ask your provider for the attestation level on each number you call from. Then place test calls to phones on different carriers and watch how the caller ID displays. Persistent "Spam Likely" labels despite A-level signing point to a reputation issue instead.

Sources