US Regulatory Compliance for Wholesale Voice Termination: STIR/SHAKEN, FCC Rules & E911

Serving US-destined voice traffic carries a regulatory burden that international-only routes simply don't have. A carrier that terminates calls only to European or Asian destinations follows a completely different set of rules than one carrying traffic to US phone numbers.

When you evaluate a wholesale voice provider for US traffic, the regulatory question often matters more than the rate card. A provider that cannot show proper FCC registration, STIR/SHAKEN attestation, and 911 compliance is a compliance risk on paper. It can also mean calls get mislabeled as spam. Downstream carriers may block the traffic. Your business may inherit liability it never signed up for.

This guide focuses on the US regulatory and compliance landscape for wholesale voice termination. It covers what STIR/SHAKEN attestation levels mean and what the FCC's Robocall Mitigation Database requires. It also explains how E911 obligations under Kari's Law and RAY BAUM'S Act apply to voice providers. Finally, it lists the documentation you should ask a provider to produce before you commit traffic.

Why Caller ID Authentication Became a Regulatory Requirement

STIR/SHAKEN is the caller ID authentication framework the FCC requires US voice service providers to implement. It was built to combat illegal caller ID spoofing, which fueled the robocall epidemic. Under the framework, the provider that originates a call cryptographically signs it with an attestation level. That signature travels with the call, so the terminating carrier can verify it. Frameworks like this build on core signaling standards such as SIP (RFC 3261). SIP defines how call setup information is carried across IP voice networks.

Full Attestation (A), Partial Attestation (B), and Gateway Attestation (C)

Full Attestation (A) means the originating provider has authenticated the caller and confirmed the caller is authorized to use the calling number. It can vouch for the entire call. Partial Attestation (B) means the provider authenticated the customer originating the call. It cannot confirm the customer is authorized to use that specific number. This is common for calls from a customer the carrier has verified but not fully validated on number ownership. Gateway Attestation (C) applies when a provider receives a call from outside its own network, such as an international gateway. It cannot verify the origin at all. It only knows it accepted the call for further routing.

For wholesale voice traffic terminating to US numbers, attestation level has practical consequences. Calls with lower attestation, or none at all, are increasingly blocked or labeled "Spam Likely" by terminating mobile carriers. This happens even when the call is legitimate business traffic.

Attestation level isn't just a compliance checkbox. It directly shapes whether your calls actually get answered. Terminating mobile carriers use attestation as one of the strongest signals in their spam-filtering models. So a drop from Full to Partial or Gateway attestation can measurably reduce answer rates, even when nothing else about the call has changed.

• Most terminating carriers treat Full Attestation (A) traffic as trusted. It rarely triggers spam-likely labeling on its own.
• Partial Attestation (B) traffic is more likely to get extra scrutiny, especially at high call volumes or with unusual calling patterns.
• Gateway Attestation (C) traffic faces the highest risk of being flagged. It is common on calls entering from international legs. The terminating carrier has the least visibility into true call origin.
• Attestation can drop mid-relationship if a provider's own upstream verification practices change. So confirm the attestation level periodically, not only at onboarding.

Attestation is only one input into deliverability. Evaluate a provider's overall route quality alongside it. ASR, PDD, and CLI data show the other metrics that, with attestation, decide whether your US-bound calls connect.

Registration Requirements Under the TRACED Act

The TRACED Act directed the FCC to set up the rules behind STIR/SHAKEN enforcement. One result is that voice service providers must file information with the FCC's Robocall Mitigation Database (RMD). This filing generally covers whether the provider has put STIR/SHAKEN in place across its network. If not, it covers what other robocall mitigation practices the provider uses instead.

A key enforcement mechanism tied to this database is simple. Intermediate and terminating providers are expected to reject traffic from providers that are not listed in the RMD. In practice, a wholesale voice provider without a current, accurate RMD filing risks having its traffic blocked further down the call path. That risk passes on to any business routing calls through that provider.

Why This Differs From International Wholesale Voice

Carriers that only handle non-US destinations are not subject to FCC registration or the Robocall Mitigation Database at all. Those are US-specific obligations. They sit on top of the general carrier relationships covered in our overview of Wholesale VoIP Carriers. A single provider handling both US and international traffic needs to meet US regulatory requirements on the US-bound portion of that traffic. That is why you should ask providers to clarify which parts of their network are FCC-registered and which are purely international transit.

Kari's Law: Direct 911 Dialing and Notification

Kari's Law requires that multi-line telephone systems let users dial 911 directly, without dialing a prefix first. It also requires the system to notify a designated person or location on-site when a 911 call is placed. This obligation sits mainly with the equipment and system configuration. But any voice provider supporting MLTS deployments for US customers needs to ensure its platform doesn't interfere with direct 911 dialing.

RAY BAUM'S Act: Dispatchable Location

RAY BAUM'S Act extends 911 obligations further. It requires that a dispatchable location be conveyed with 911 calls, including from fixed, nomadic, and interconnected VoIP services. A dispatchable location is specific enough for first responders to find the caller, not just a general service address. This matters for businesses with multiple offices, remote employees, or softphone users who may place calls from varying locations. Their voice platform needs a way to associate and update location information reliably.

These rules apply only to the US market. Most international wholesale voice relationships have no direct equivalent. Emergency-calling systems and the regulations behind them are national in scope.

Dispatchable location isn't a one-time setup step. It needs to stay accurate as employees move between offices, work remotely, or use softphones from changing locations. This matters most for businesses with distributed teams. A stale or default location on file can send first responders to the wrong address entirely.

• Confirm how often location data can be updated for nomadic or softphone users. Ask whether updates apply in real time or on a delay.
• Test that a 911 call from a secondary office or remote location actually reports that location, not the company's primary registered address.
• Ask whether the platform distinguishes between a general service address and a true dispatchable location down to the floor or room level, where required.
• Confirm the on-site notification required under Kari's Law reaches the correct designated person for each physical location. One company-wide contact is not enough.

The FCC's official Kari's Law and RAY BAUM'S Act guidance is the authoritative source for the federal requirements behind these obligations. It lays out the specific dispatchable location and notification requirements that a provider's platform needs to support.

Verbal assurances about compliance aren't enough. Your own business can inherit regulatory risk from an upstream provider that falls short. Before routing US-bound wholesale voice traffic through any carrier, request the following in writing:

• Current FCC registration status and the operating company number (OCN) or equivalent identifier used in FCC filings.
• Robocall Mitigation Database filing confirmation. This should include the attestation practices the provider has declared and the date of the most recent filing.
• The STIR/SHAKEN attestation level the provider typically applies to your traffic profile, and when attestation might drop from A to B or C.
• A description of how the provider handles E911 and dispatchable location for any interconnected VoIP or MLTS traffic it supports.
• Written confirmation of how the provider responds to and fixes issues from traceback requests by the FCC or industry traceback consortiums. Cooperation with traceback investigations is a core expectation of the regulatory framework.

A provider that can produce this documentation quickly and in detail shows that compliance is built into its operations. A provider that only points to general marketing claims about being "fully compliant" treats compliance as an afterthought.

Collecting documentation at onboarding is only the starting point. FCC registration status, attestation practices, and Robocall Mitigation Database filings can all change after a contract is signed. A provider that slips out of compliance won't necessarily announce it.

• Re-verify RMD filing status periodically. Don't assume a provider's initial filing stays current indefinitely.
• Track any unexplained shifts in attestation level or answer rates on US-bound traffic. Both can signal a change in upstream compliance practices.
• Ask providers to notify you proactively if their attestation practices or FCC registration status change. Put that expectation in writing at signing.
• Revisit the same due-diligence questions you asked before signing on a regular schedule. Compliance posture is not a one-time evaluation.

Re-check the same red flags after signing that you watched for before. See our vendor due-diligence checklist for the specific warning signs that a provider's compliance and operational practices are slipping.

US regulatory compliance for wholesale voice termination is not the same evaluation as comparing rates, routing quality, or platform features. It is a distinct set of legal and operational rules. They apply only because the traffic touches the US telephone network. STIR/SHAKEN attestation, FCC Robocall Mitigation Database registration, and E911 requirements under Kari's Law and RAY BAUM'S Act each carry consequences if a provider falls short. Those consequences can land on your business as much as on the provider.

Treat compliance documentation with the same rigor you'd apply to a rate deck. Ask for it in writing. Ask for specifics rather than general assurances. Revisit it periodically, since registration status and attestation practices can change. A provider that handles both US and international traffic should be able to clearly explain which obligations apply to which portion of your traffic. It should back that explanation with documentation rather than a sales pitch.

What is STIR/SHAKEN attestation and why does it have levels?

STIR/SHAKEN is a caller ID authentication framework. It lets an originating provider cryptographically sign a call to indicate how confident it is in the caller's identity. The levels — Full (A), Partial (B), and Gateway (C) — exist because providers have varying degrees of visibility into who is actually placing a call. This is especially true when traffic enters their network from another carrier.

What is the FCC Robocall Mitigation Database and who has to file with it?

The Robocall Mitigation Database is an FCC-maintained registry. Voice service providers file information there about their STIR/SHAKEN implementation and robocall mitigation practices. Providers that are not listed risk having their traffic rejected by other carriers further along the call path. That makes RMD registration a practical requirement for any provider carrying US-bound traffic.

Do international wholesale voice providers need to comply with US STIR/SHAKEN and FCC rules?

Only for the portion of their traffic that touches the US telephone network. A provider that exclusively routes calls between non-US destinations is not subject to FCC registration or STIR/SHAKEN. But once a call is destined for a US number, those requirements apply to whichever provider is responsible for that leg of the call.

What do Kari's Law and RAY BAUM'S Act require of a voice provider?

Kari's Law requires that multi-line telephone systems support direct 911 dialing without a prefix. It also requires them to trigger an on-site notification when a 911 call is made. RAY BAUM'S Act requires that a dispatchable location accurate enough for first responders be conveyed with 911 calls, including from VoIP and nomadic services. Both are US-specific obligations tied to the domestic 911 system.

What documentation should I request from a wholesale voice provider before routing US traffic through them?

At minimum, ask for confirmation of their FCC registration status and their current Robocall Mitigation Database filing. Also ask for the STIR/SHAKEN attestation level they typically apply, and how they handle E911 dispatchable location for any VoIP traffic they support. Treat a provider unable to produce this in writing as a compliance risk, regardless of their advertised rates.