The Clock Is Ticking: Why Every U.S. Carrier Must Master STIR/SHAKEN

If you are a voice service provider routing calls across U.S. networks, you have likely heard of STIR/SHAKEN. But knowing the acronym and understanding your compliance obligations are two very different things.

STIR/SHAKEN—which stands for Secure Telephony Identity Revisited (STIR) and Signature-based Handling of Asserted Information using toKENs (SHAKEN)—is the FCC’s flagship framework for combating illegal caller ID spoofing. It requires voice service providers to digitally sign and verify calls, ensuring that the caller ID information displayed to consumers is trustworthy.

For carriers, this is not optional. It is the law. And the rules have just gotten significantly stricter.

The Three Attestation Levels: A, B, and C

Under the STIR/SHAKEN framework, carriers assign one of three attestation levels to every outbound call they authenticate:

A-Level (Full Attestation): The carrier knows the caller, has verified the caller’s identity, and confirms that the caller is authorized to use the phone number displayed. This is the highest level of trust and the gold standard for call verification.

B-Level (Partial Attestation): The carrier knows the caller but cannot verify that the caller is authorized to use the specific phone number being displayed. This often occurs when calls traverse multiple networks.

C-Level (Gateway Attestation): The carrier has received the call from an upstream provider and is passing it through the network. The carrier cannot attest to the caller’s identity or authorization.

For U.S. consumers, A-level attestation provides the highest confidence that a call is legitimate. B-level and C-level calls are more likely to be flagged as potential spam or fraud.

The Third-Party Rule: A Game-Changer for Carriers

Before September 2025, many carriers contracted with third-party signing services to authenticate their calls. These vendors would sign calls using their own certificates on behalf of the carrier.

That is no longer compliant.

Under the FCC’s Third-Party Authentication Order, all voice service providers with a STIR/SHAKEN implementation obligation must obtain their own STIR/SHAKEN certificate(s) and authenticate (sign and attest) their own calls. The deadline for compliance was September 18, 2025.

What this means in practice:

– Carriers must obtain their own Service Provider Code (SPC) token and STIR/SHAKEN certificate

– Carriers must sign their own outbound calls using their own certificate

– Carriers must assign appropriate attestation levels (A, B, or C) to each call

If a carrier cannot comply by the deadline, they must update their RMD certification to reflect non-implementation of STIR/SHAKEN. Once they do, other carriers are legally prohibited from accepting their traffic. In other words, non-compliance means your calls stop going through.

What’s Coming Next: Verified Caller Information

The FCC is not stopping with basic authentication. In October 2025, the Commission proposed new rules requiring originating service providers to put verified caller information into the SHAKEN PASSporT for calls authenticated with full A-level attestation.

This verified caller name would be the minimum requirement. Other information—such as brand logos and call reasons—could also be included. The goal is to give consumers more confidence in the calls they answer and to help legitimate businesses stand out from scammers.

Why This Matters for Your Carrier Business

For carriers, STIR/SHAKEN compliance is about more than avoiding fines. It is about:

Protecting Your Network Reputation: Carriers that consistently deliver verified, trustworthy calls build stronger relationships with downstream providers and consumers.

Ensuring Call Delivery: If your calls carry low attestation levels or if you fail to comply with the Third-Party Rule, other carriers may block or filter your traffic.

Staying Competitive: As consumers become more aware of STIR/SHAKEN, they will increasingly prefer to do business with carriers and brands that provide verified caller information.

The Bottom Line

STIR/SHAKEN is no longer a future consideration—it is a present reality. The Third-Party Rule is in effect, and the FCC is actively enforcing it. Carriers that fail to obtain their own certificates and sign their own calls face being cut off from the U.S. telecommunications network.

At Microtalk, we understand the complexities of carrier compliance. Our Cloud Contact Service Solution is built to help voice service providers navigate STIR/SHAKEN requirements, maintain strong attestation levels, and ensure uninterrupted call delivery across U.S. networks.

The clock is ticking. Is your carrier business STIR/SHAKEN compliant?