Skip to content

Guide

RMD annual recertification: what small voice providers need to know

Every provider in the FCC's Robocall Mitigation Database now has to recertify its filing each year. Here is what the rule requires, what a filing must contain, what the FCC has cited when removing filings, and what it proposed in July 2026. Each point links to the FCC document it comes from.

Updated Nov 3, 2026 · Not legal advice: read the sources, and ask counsel about your own filing.

The short version

  • Recertify every year by March 1; the 2027 window opens Feb 1, 2027. The certification is made by an officer.[2][3]
  • Any change to your filing must be made within 10 business days, and so must changes to the CORES registration your filing pulls from.[2][5]
  • Base forfeitures: $10,000 for inaccurate or false information, $1,000 for a late update, both continuing until cured.[6]
  • If a filing is removed, other providers must stop accepting your calls directly; recent orders gave them two business days.[2][10]
  • The FCC says it has removed over 1,400 deficient filings since January 2025.[12]

What the recertification rule says

"All providers shall certify annually, on or before March 1, that any information submitted to the Robocall Mitigation Database is true and correct."

That is 47 CFR § 64.6305(h), adopted in the FCC's December 2024 order and in effect since Feb. 5, 2026.[1][2][4] The order says a missed recertification "will result in referral to the Enforcement Bureau, which may subject the filer to forfeiture or removal from the Database."[1] The first window ran Feb. 1 to March 1, 2026.[3]

The same order adopted a $100 fee for each filing and recertification. As of the FCC's July 2026 notice, the fee was not yet in effect.[3][12]

What your filing has to contain

Recertifying means certifying that all of this is still true and complete. For a voice service provider, 47 CFR § 64.6305(d) requires:[2]

  • Your STIR/SHAKEN status: complete, partial, or none, and that every call you originate is covered by a robocall mitigation program.
  • A mitigation plan describing "the specific reasonable steps" you take to avoid originating illegal robocalls, including how you know your customers, any procedures to know your upstream providers, and the analytics you use, naming any third-party vendor.
  • A commitment to respond to traceback requests within 24 hours.
  • Any formal FCC, law-enforcement or regulatory action in the past two years involving robocalls, spoofing or a deficient filing.
  • Accurate business names, your role in the call path, and a robocall mitigation contact with name, title, address, phone and email.

Resellers without their own STIR/SHAKEN obligation still have to file and explain why they cannot implement it, for example a lack of control over the network equipment.[2][7] The small-provider extensions expired in 2022 and 2023 and can no longer be relied on.[3]

What the FCC has cited when removing filings

  • The August 2025 removals cited plans that were missing or "lack[ed] information required," and certifications missing required information.[8]
  • In March 2026 the Enforcement Bureau ordered 35 companies to cure their filings or show cause; in September it removed 14 of them, saying their certifications and plans still "lack required information" after repeated notices.[9][10]
  • A June 2026 deficiency letter lists the kind of detail the Bureau checks: a STIR/SHAKEN status that didn't match the plan, no description of how the provider knows its upstream providers, no statement about third-party analytics, and an undisclosed prior action.[11]

What the FCC proposed in July 2026

The FCC says "many providers fail to make necessary updates or complete recertifications by the deadlines, thereby requiring us to initiate enforcement activities."[12] Its July 2026 notice proposes to write the grounds for removal into the rules, including failing to recertify or recertifying late, and asks whether the system should "automatically suspend any filing that has not been recertified." It also asks about a grace period after March 1. Reply comments are due Nov. 9, 2026.[12][13]

A checklist before Feb 1, 2027

  1. Open your listing and confirm it shows your current business name, role and contact.
  2. Check your CORES registration: the RMD filing pulls from it.
  3. Read your plan against § 64.6305(d): specific steps, know-your-customer, know your upstream providers, analytics vendors, 24-hour traceback.
  4. Make sure your STIR/SHAKEN status matches what the plan describes.
  5. Disclose any prior action from the last two years.
  6. Refile anything that changed, then recertify between Feb 1 and March 1, 2027.

Want a second pair of eyes first? Get a free one-page check of your public filing, or see what the check looks like.

Sources

  1. [1]FCC 24-135, Improving the Effectiveness of the Robocall Mitigation Database, Report and Order (released Jan. 8, 2025)
  2. [2]47 CFR § 64.6305, Robocall mitigation and certification (eCFR)
  3. [3]DA 26-72, Wireline Competition Bureau Public Notice on the March 1, 2026 annual recertification (Jan. 22, 2026)
  4. [4]91 FR 5242, effective and compliance dates for FCC 24-135 (Feb. 5, 2026)
  5. [5]DA 26-133, Public Notice on CORES information and RMD filings (Feb. 6, 2026)
  6. [6]47 CFR § 1.80, forfeiture proceedings, base forfeiture table (eCFR)
  7. [7]DA 26-174, Enforcement Advisory No. 2026-02 to resellers and MVNOs (Feb. 20, 2026)
  8. [8]DA 25-737, Enforcement Bureau removal order (Aug. 25, 2025)
  9. [9]DA 26-282, Enforcement Bureau order to cure or show cause (Mar. 24, 2026)
  10. [10]DA 26-872, Enforcement Bureau removal order (Sept. 2, 2026)
  11. [11]Enforcement Bureau deficiency letter to an RMD filer (June 11, 2026)
  12. [12]FCC 26-49, Further Notice of Proposed Rulemaking on the Robocall Mitigation Database (released July 23, 2026)
  13. [13]91 FR 57454, comment dates for FCC 26-49 (Sept. 9, 2026)