A traceback request asks a voice provider to name the provider that handed it a suspicious call. Every provider in the path answers the same question for its own hop, so the requester can work backward until it reaches the source. Under 47 CFR 64.1200(n)(1), a voice service provider must fully respond to a traceback request within 24 hours of receiving it. That obligation has covered all voice service providers since January 8, 2024. If you buy termination from a wholesale provider, your traffic is one of the hops a traceback can follow.
What a traceback request is
Each provider that passes a call keeps records of where the call came from and where it went. A traceback uses those records. The requester starts with a call that caused a complaint, usually at the far end of the path, and asks the provider that delivered it to name the provider that sent it. That provider checks its own records and answers with the next name back. The requester then asks that provider, and the process repeats until the trail stops or reaches a customer.
A traceback is a question, not a finding. Being named in a response does not mean a provider sent illegal calls. It means the trail continues from that point, and what happens next depends on what the next look shows.
Who sends them and who has to answer
The rule names three kinds of requester: the FCC, civil and criminal law enforcement, and the industry traceback consortium. The consortium is, in practice, the Industry Traceback Group (ITG), a program led by USTelecom. The ITG describes its work as tracing the source of illegal robocalls, and it coordinates with providers at each level of a call's path.
The duty to respond has been extended in steps. The table below lists each date and the source that supports it.
| Date | What happened | Source |
|---|---|---|
| May 19, 2022 | The FCC adopts a 24-hour traceback rule for gateway providers, meaning U.S.-based intermediate providers that receive calls directly from a foreign originating provider. | FCC 22-37 |
| September 23, 2022 | The gateway rule takes effect, according to a law firm summary. | Commlaw Group, September 16, 2022 |
| May 18, 2023 | The FCC adopts the extension of the 24-hour rule to all voice service providers. | FCC 23-37 |
| January 8, 2024 | The extended rule takes effect. | CloudCommunications, July 18, 2023; Commlaw Group, January 4, 2024 |
| March 31, 2026 | An FCC order proposing a penalty against one provider describes the 24-hour requirement as an existing rule and does not propose changing it. | FCC 26-22 |
The 2026 entry is a proposed penalty against one provider, not a final decision. It matters here only because it treats the 24-hour rule as current.
The 24-hour rule in plain terms
The clock is the part that needs the most care. The FCC's 2022 order says the 24-hour clock does not run outside business hours. Business hours are 8:00 a.m. to 5:30 p.m. on a business day, measured in the local time of the office that has to respond. A request that arrives after hours is treated as received at 8:00 a.m. on the next business day. Business days are Monday through Friday, excluding federal holidays. The order's example is a request received at 3:00 p.m. on a Friday, which is due at 3:00 p.m. on the following Monday.
The rule says "fully respond" but does not list the fields a response must contain. The 2022 order, written for gateway providers, said an appropriate response includes the identity of the upstream provider the call came from, and it gave examples such as the country and a complete address. Most responses follow that pattern. A reply that says a call was "forwarded" without naming the provider gives the next hop nothing to act on.
Answering a traceback is separate from blocking. Paragraph (n)(2) of the rule covers a Notice of Suspected Illegal Traffic from the FCC's Enforcement Bureau, which carries its own steps and deadlines. A traceback request on its own does not trigger that paragraph.
How a provider traces a call across carriers
The mechanism is simpler than the paperwork suggests. A provider knows which upstream provider a call arrived from, because the call came in on a specific trunk or interconnect, and that link is recorded in its call detail records and signaling logs. The FCC's 2022 order expects a gateway provider to identify its immediate upstream provider from its records, without further investigation.
The trace moves one hop at a time. Each provider has to answer before the next can be asked, so the total time is the sum of each hop's response. Delays usually come from missing records, slow internal routing of the request, or a provider that does not answer. A single silent provider stops the chain at that point.
A three-hop example
The following is an illustration, not a real case. The providers and times are invented.
A business, Customer A, runs an outbound campaign through its wholesale provider, Provider 1. Provider 1 hands the calls to Provider 2, an intermediate carrier, which delivers them to Provider 3, the carrier that terminates the called number. On a Monday morning, the owner of the called number complains about several hundred calls received in one afternoon. The consortium opens a traceback at Provider 3.
- Provider 3 receives the request. Its records show that the calls arrived from Provider 2. It responds with Provider 2's name before its 24-hour deadline.
- Provider 2 receives the request for the same calls. Its records show Provider 1 as the source. It responds with Provider 1's name.
- Provider 1 receives the request. Its records show the calls came in on Customer A's account, on one trunk, during one campaign. It identifies the account, preserves the records, and asks Customer A for its campaign details.
The trail now reaches a customer, not another carrier. Customer A's answers about its list source, caller ID settings, and dialing schedule determine what Provider 1 can report next. Each hop had its own 24-hour window, but the chain only moved as fast as its slowest answer.
What to do when a traceback arrives
This article is general information, not legal advice. Your own obligations depend on your licenses, contracts, and the rules that apply to your traffic, so speak with a telecom attorney about them. The checklist below covers operational steps that most providers handle in a similar way.
- Record when the request arrived and the time zone of the office that must respond. The deadline depends on the receipt time and on business hours.
- Confirm who sent the request and which case it belongs to.
- Match the numbers, time window, and any call identifiers in the request to your call detail records. Preserve those records before any routine purge.
- Identify the provider the calls came from. That name is the core of your response.
- Check whether the calls came from one of your own customers. If they did, identify the account and request the records you need.
- Send a complete response before the deadline. Say what you confirmed, what you could not confirm, and the name of the upstream provider.
- Keep a copy of the response, its timestamps, and the names of the people who approved it.
- Review the customer and the route. A traceback does not by itself require a block, but a separate FCC notice or your own policy might. Decide that with counsel before you act.
- Check that your Robocall Mitigation Database certification matches your process. The FCC requires that certification to include a commitment to respond fully within 24 hours.
What to put in your contract
A buyer cannot control how a provider answers a traceback, but the contract can set how quickly you hear about one and what you owe. Ask for these points in writing before you send traffic.
- A named traceback contact and a backup, with business hours and time zone.
- How the provider measures its response time, and whether it tells you when a traceback names your traffic.
- The records the provider may request, the format it needs, and how many hours you have to supply them. Agree a number in advance, because a 24-hour limit on the provider's side leaves little room.
- Whether the provider can suspend or restrict routes while a traceback is open, and what triggers that step.
- The reason the provider gives for any suspension, and how you can respond or dispute it.
- How long you must keep dialer logs, calling lists, and caller ID records.
- A copy of the provider's Robocall Mitigation Database certification and a description of its STIR/SHAKEN practice for your traffic.
- The know-your-customer documents you must supply and how often they must be refreshed. Paragraph (n)(4) of the rule requires providers to take affirmative steps to keep new and renewing customers from originating illegal calls.
- What happens to billing, committed volume, and any prepaid balance if traffic is blocked or an account is suspended.
Sources
Rule text is taken from the Legal Information Institute's copy of 47 CFR 64.1200, which lists its latest amendment as 90 FR 42138 (August 29, 2025). Check the eCFR for the current text before relying on any exact wording. The dates below were checked on October 16, 2026.
- 47 CFR 64.1200, Legal Information Institute, paragraphs (n)(1) to (n)(5)
- FCC 22-37, adopted May 19, 2022, paragraphs 65 to 71 on the clock and response content for gateway providers
- FCC 23-37, adopted May 18, 2023, paragraphs 20 to 21 on the extension to all voice service providers, and paragraph 52 on the Robocall Mitigation Database commitment
- FCC 26-22, Notice of Apparent Liability, adopted March 31, 2026, which cites 47 CFR 64.1200(n)(1) as a current requirement
- CloudCommunications, compliance date for the 24-hour traceback response (July 18, 2023), giving January 8, 2024 as the effective date
- Commlaw Group, New Robocall Mitigation Rules Take Effect January 8, 2024 (January 4, 2024)
- Commlaw Group, gateway provider traceback rule effective September 23, 2022 (September 16, 2022)
- USTelecom, Industry Traceback Group announcement (January 28, 2020), describing the ITG's role
Related reading
The filings that commit a provider to this process are covered in RMD, Form 499, and STIR/SHAKEN for wholesale voice. The account checks that come before any traffic are in Wholesale VoIP KYC. Traced traffic often shows fraud patterns, which IRSF vs toll fraud and traffic pumping and access stimulation describe. The caller ID side of the same problem is covered in What Is STIR/SHAKEN?
