A wholesale carrier that passes US voice traffic has regulatory obligations, and so does a buyer that sends traffic through one. Three items come up in almost every wholesale onboarding: the Robocall Mitigation Database (RMD), FCC Form 499, and STIR/SHAKEN attestation. This guide explains what each one requires, who must file it, and what to ask a provider. It is general information, not legal advice. Confirm current requirements with the FCC or a telecom attorney.
The Robocall Mitigation Database
The FCC's robocall rules, codified in 47 CFR 64.6305, require voice service providers and intermediate providers to file a certification in the Robocall Mitigation Database. This applies to gateway providers too. The certification states that the provider has a robocall mitigation program in place, and the filing must be kept current.
The rule also has a practical effect on routing. Since May 28, 2024, intermediate providers and voice service providers have been required to refuse traffic from any provider that is not listed in the database. A provider that is not listed cannot reliably deliver traffic into the US network, so an unlisted route is a problem before it is a price question.
The FCC sets recertification cycles, and those dates change. Check the current deadline on the FCC's RMD pages rather than relying on a date from a summary.
FCC Form 499: filing and contribution
FCC Form 499-A is the annual Telecommunications Reporting Worksheet. Interconnected VoIP providers must file it. Filing is required even for providers that qualify for the de minimis exemption, which exempts them from paying contributions. The exemption does not remove the filing obligation.
Providers that are not de minimis also contribute to the Universal Service Fund each quarter, reported on Form 499-Q. The contribution factor changes each quarter, so budgets built on last year's rate need to be updated. The 2026 Form 499-A was due April 1, 2026, and the next cycle covers 2026 revenues. The FCC's contribution methodology page lists the current forms and instructions.
STIR/SHAKEN attestation
STIR/SHAKEN is the framework that lets carriers sign calls to confirm the caller ID. The signature carries an attestation level, and the FCC's triennial report describes the three levels:
- A (full attestation): the provider confirms the subscriber's identity and that the subscriber is authorized to use the number.
- B (partial attestation): the provider confirms the subscriber's identity, but not that the subscriber owns the number.
- C (gateway attestation): the provider only confirms that it is the point where the call entered the network.
The levels are defined in RFC 8588, and the FCC's triennial report on call authentication describes how they are used. The level is about what the signing provider can verify, not about call quality. A wholesale route that carries traffic from another carrier usually signs at the level its position in the chain allows.
For a buyer, the consequence is simple: do not assume a route is A-attested unless the provider states the level for your traffic and can show how it verifies the subscriber and number. Attestation of this kind is a claim to check, not a default.
Summary of obligations
| Item | What it is | Who must do it |
|---|---|---|
| RMD certification | Robocall mitigation program filing, kept current | Voice service providers, intermediate providers, gateway providers |
| Form 499-A | Annual reporting worksheet | Interconnected VoIP providers, including de minimis providers |
| Form 499-Q | Quarterly USF contribution report | Providers that are not de minimis |
| STIR/SHAKEN | Signed calls with an attestation level | Providers that sign calls, at the level they can verify |
Questions to ask a wholesale provider
- Is your provider listed in the Robocall Mitigation Database, and when was your certification last updated?
- What is your FCC Form 499 filer status, and are you a de minimis provider?
- What attestation level do you apply to traffic from my account, and how do you verify the subscriber and the number?
- What is your process for responding to a traceback request, and who handles it?
- How do you monitor traffic for illegal robocall patterns, and what happens when a customer is flagged?
The answers to the last two questions matter more than a yes or no. A provider that describes a specific process has usually handled a traceback before. Ask for the process in writing, along with the name of the person who runs it.
Related reading
The STIR/SHAKEN guide explains the signing process in more depth. Calls labeled spam can relate to attestation, reputation, and other factors, and the toll fraud prevention guide covers the controls a provider should run on its own routes. The wholesale KYC guide covers the identity checks you should expect during onboarding.