2023-13035. Advanced Methods To Target and Eliminate Unlawful Robocalls, Call Authentication Trust Anchor

AGENCY:

Federal Communications Commission.

ACTION:

Final rule.

SUMMARY:

In this document, the Federal Communications Commission (Commission) expands several rules previously adopted for gateway providers to other categories of voice service providers and modifies or removes existing rules consistent with these changes. Specifically, the Commission requires all domestic voice service providers to respond to traceback requests from the Commission, civil and criminal law enforcement, and the industry traceback consortium within 24 hours of the receipt of the request. Second, it requires originating providers to block substantially similar traffic when the Commission notifies the provider of illegal traffic or risk the Commission requiring all providers immediately downstream to block all of that provider's traffic. This rule is consistent with the rule for gateway providers, and requires non-gateway intermediate or terminating providers that receive such a notice to promptly inform the Commission that it is not the originating or gateway provider for the identified traffic, identify the upstream provider(s) from which it received the traffic, and, if possible, take lawful step to mitigate the traffic. Third it requires all voice service providers to take reasonable and effective steps to ensure that the immediate upstream provider is not using it to carry or process a high volume of illegal traffic. Finally, it updates the Commission's Robocall Mitigation Database certification requirements to reflect the 24-hour traceback requirement.

DATES:

Effective January 8, 2024, except for the amendments to 47 CFR 64.6305(d)(2)(ii) and (iii), (e)(2)(ii), and (f)(2)(iii) (amendatory instruction 5), which are delayed indefinitely. The amendments to 47 CFR 64.6305(d)(2)(ii) and (iii), (e)(2)(ii), and (f)(2)(iii) will become effective following publication of a document in the Federal Register announcing approval of the information collection and the relevant effective date.

FOR FURTHER INFORMATION CONTACT:

Jerusha Burnett, Consumer Policy Division, Consumer and Governmental Affairs Bureau, email at [e-mail] or by phone at (202) 418–0526.

SUPPLEMENTARY INFORMATION:

This is a summary of the Commission's Report and Order, in CG Docket No. 17–59 and WC Docket 17–97, FCC 23–37, adopted on May 18, 2023, and released on May 19, 2023. The Further Notice of Proposed Rulemaking and Notice of Inquiry that was adopted concurrently with the Report and Order is published elsewhere in this issue of the Federal Register . The document is available for download at https://docs.fcc.gov/​public/​attachments/​FCC-23-37A1.pdf.

To request this document in accessible formats for people with disabilities ( e.g., Braille, large print, electronic files, audio format) or to request reasonable accommodations ( e.g., accessible format documents, sign language interpreters, CART), send an email to [e-mail] or call the FCC's Consumer and Governmental Affairs Bureau at (202) 418–0530. The amendments to 47 CFR 64.6305(d)(2)(ii) and (e)(2)(ii) do not themselves contain information collection requirements subject to approval. However, substantive changes made to those rules in the 2023 Caller ID Authentication Order,88 FR 40096 (June 21, 2023), and that are delayed indefinitely, pending approval of information collection requirements associated with that order, must become effective at the same time as or before the changes to 47 CFR 64.6305(d)(2)(ii) and (e)(2)(ii) adopted herein. Therefore, the changes in 47 CFR 64.6305(d)(2) and (e)(2) are delayed indefinitely pending the effective date of the changes to those rules from the 2023 Caller ID Authentication Order.

Final Paperwork Reduction Act of 1995 Analysis

This document may contain new or modified information collection requirements subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104–13. This document will be submitted to the Office of Management and Budget (OMB) for review under section 3507(d) of the PRA. OMB, the general public, and other Federal agencies will be invited to comment on the new or modified information collection requirements contained in this proceeding.

Congressional Review Act

The Commission sent a copy of the Report and Order to Congress and the Government Accountability Office pursuant to the Congressional Review Act, see5 U.S.C. 801(a)(1)(A).

Synopsis

1. In this item, the Commission extends some of the requirements it adopted in the Gateway Provider Order,87 FR 42916 (July 18, 2022), to other voice service providers in the call path. First, the Commission requires all voice service providers, rather than only gateway providers, to respond to traceback requests within 24 hours. Second, the Commission extends the requirements to block calls following Commission notification. Finally, the Commission expands the know-your-upstream-provider requirement to cover all voice service providers. The Commission also makes other changes to voice service providers' Robocall Mitigation Database filing and mitigation obligations to be consistent with these new rules. Taken together, the expansion of these rules protects consumers from illegal calls, holds voice service providers responsible for the calls they carry, and aids in the identification of bad actors.

24-Hour Traceback Requirement

2. The Commission requires all voice service providers, regardless of their position in the call path, to fully respond to traceback requests from the Commission, civil and criminal law enforcement, and the industry traceback consortium within 24 hours of receipt of such a request. This extends the rule the Commission previously adopted for gateway providers to all voice service providers and replaces the existing requirement to respond “fully and in a timely manner.” While some commenters opposed the 24-hour requirement in general, none argued that non-gateway providers are less capable of complying with such a requirement.

3. Rapid traceback is essential to identifying both callers placing illegal calls and the voice service providers that facilitate them. Time is of the essence in all traceback requests, including domestic-only tracebacks. While gateway providers play a critical role, they are not the only voice service providers with an important role to play. As one commenter noted, voice service providers do not retain call detail records for a consistent period of time, so the traceback process must finish before any voice service providers in the call path seeking to shield bad actors dispose of their records. The Commission therefore agrees with commenters that argue a general 24-hour traceback requirement is a prudent measure, with benefits that outweigh the burdens. In particular, the Commission finds that the benefits of having a single, clear, equitable rule for all traceback requests outweigh the burdens of requiring a response within 24 hours. Further, the Commission made clear in adopting the existing requirement to respond “fully and in a timely manner” that it expected responses “within a few hours, and certainly not more than 24 hours absent extenuating circumstances.” As a result, this modification is primarily a matter of codifying the Commission's existing expectation, rather than significantly modifying the standard.

4. Out of an abundance of caution, the Commission initially limited the strict 24-hour requirement to gateway providers, based on their particular position in the call path and the need for especially rapid responses in the case of foreign-originated calls. Many calls, however, transit multiple U.S.-based intermediate providers' networks after passing through a gateway provider's network, and delay by any of the intermediate providers in responding to traceback requests has the same impact as delay by the gateway provider. When an intermediate provider receives a traceback request, it may not know if the call originated from outside the United States, making it impossible to apply different standards to foreign-originated calls versus domestic calls through the entire call path.

5. The Commission disagrees with commenters that argue against a strict 24-hour requirement. While the Commission understands that some smaller voice service providers that have not received previous traceback requests may be unfamiliar with the process, they will have ample time to become familiar before the requirements take effect. Additionally, the Commission adopted rules that require a response from all voice service providers “fully and in a timely manner” in December 2020, more than two years ago. In adopting that rule, the Commission made clear its expectation that responses would be made “within a few hours, and certainly in less than 24 hours absent extenuating circumstances.” Voice service providers have therefore had a significant amount of time to improve their processes so that they can respond within 24 hours in the vast majority of cases. Similarly, voice service providers can identify a clear point of contact for traceback requests and provide it to the entities authorized to make traceback requests. The Commission will consider limited waivers where a voice service provider that normally responds within the 24-hour time frame has a truly unexpected or unpredictable issue that leads to a delayed response in a particular case or for a short period of time. This may, in some instances, include problems with the point of contact or other delays caused by the request not being properly received. Voice service providers for which this requirement poses a unique and significant burden may apply for a waiver of this rule under the “good cause” standard of § 1.3 of the Commission's rules. Under that standard, for example, waivers may be available in the event of sudden unforeseen circumstances that prevent compliance for a limited period or for a limited number of calls. By doing so, voice service providers can significantly reduce the risk that traceback requests will be missed or delayed. For those voice service providers for which requests outside of business hours pose a problem, the Commission adopts the same restrictions on the 24-hour clock that it imposed for gateway providers. The 24-hour clock, consistent with the Commission's proposal to adopt the clock as adopted for gateway providers, does not start outside of business hours of the local time for the responding office. Requests received outside of business hours as defined in the Commission's rules are deemed received at 8 a.m. on the next business day. Similarly, if the 24-hour response period would end on a non-business day, either a weekend or a Federal legal holiday, the 24-hour clock does not run for the weekend or the holiday in question, and restarts at 12:01 a.m. on the next business day following when the request would otherwise be due. “Business day” for these purposes is Monday through Friday, excluding Federal legal holidays, and “business hours” are 8 a.m. to 5:30 p.m. on a business day, consistent with the definition of office hours in the Commission's rules.

6. Consistent with that finding, the Commission declines INCOMPAS' request that the Commission double the response time to 48 hours or allow voice service providers to submit a response indicating that responding requires additional time along with assurances that it will complete the traceback request “in a timely manner.” INCOMPAS offers little in the way of support for this proposed doubling of the traceback response time and the Commission is not persuaded that the narrow reasons it does offer cannot be adequately addressed through the Commission's waiver process. Additionally, allowing for a “request received” response to obtain further time could allow bad-actor providers to simply delay traceback responses. The Commission is also unpersuaded by other commenters opposing the 24-hour requirement whose arguments were vague. Other objections to the requirement were vague and unsupported, e.g., the requirement “will likely result in increased enforcement activity and expenses for good actors who for legitimate reasons (and on an infrequent basis) may not respond in a timely manner” or is “unnecessary and unwarranted.”

7. The Commission further declines to adopt the tiered approach that it sought comment on in the Gateway Provider Further Notice of Proposed Rulemaking (FNPRM),87 FR 42670 (July 18, 2022). The Commission finds that the tiered approach is too complicated; voice service providers and other entities would not easily know when each response is due with a tiered approach. A uniform rule for all types of voice service providers is significantly easier to follow and enforce. While a tiered approach might benefit some smaller voice service providers that receive few requests, the benefits do not outweigh the overall burdens of administering such a complex system. This 24-hour requirement is a clear standard that the Commission believes all voice service providers will be able to implement because for several years they have already complied with the “timely manner” requirement.

8. The Commission is similarly unpersuaded by arguments that the current efficiency of the traceback system, where many voice service providers do respond rapidly, indicates that a strict rule is inappropriate. The Commission applauds the industry for its work at improving traceback and recognizes that many, if not most, voice service providers already respond in under 24 hours. There are, however, a large number of voice service providers, and experience indicates that some may not be incentivized to respond without delay. The failure of any one voice service provider to do so presents a potential bottleneck. For those voice service providers that already respond within 24 hours, this requirement presents no new burden; those voice service providers can simply continue what they have been doing. It is voice service providers that do not respond within that timeframe that present a problem, and this requirement puts them clearly on notice that any delaying tactics will not be tolerated in a way that a “timely” requirement does not.

9. Finally, the Commission declines INCOMPAS' request to remove the Commission and civil and criminal law enforcement from the list of entities authorized to make a traceback request under the Commission's rules. The Commission has included these entities on the list since it adopted the initial rule in 2020, and voice service providers have not provided evidence that requests from these entities present problems. The mere fact that “many companies have established processes” to respond to these entities does not justify excluding them in the rule.

Mandatory Blocking Following Commission Notification

10. The Commission next extends two of the mandatory blocking requirements adopted in the Gateway Provider Order to a wider range of voice service providers. First, the Commission modifies the existing requirement for voice service providers to effectively mitigate illegal traffic; the Commission now requires all originating providers to block such traffic when notified by the Commission, consistent with the existing requirement for gateway providers. Second, the Commission makes it clear that, while terminating and non-gateway intermediate providers are not generally required to block, they are required to respond and provide accurate information regarding the source from which they received the traffic. Finally, the Commission requires voice service providers immediately downstream from a bad-actor voice service provider that has failed to meet these obligations to block all traffic from the identified provider when notified by the Commission that the upstream provider failed to meet its obligation to block illegal traffic or inform the Commission as to the source of the traffic.

11. Consistent with the rules the Commission adopted in the Gateway Provider Order, the Commission ensures that all voice service providers are afforded due process; the rule the Commission adopts here includes a clear process that allows ample time for a notified voice service provider to remedy the problem and demonstrate that it can be a good actor in the calling ecosystem before the Commission directs downstream providers to begin blocking. This process, adopted for gateway providers in the Gateway Provider Order, includes the following steps: (1) the Enforcement Bureau shall provide the voice service provider with an initial Notification of Suspected Illegal Traffic; (2) the provider shall be granted time to investigate and act upon that notice; (3) if the provider fails to respond or its response is deemed insufficient, the Enforcement Bureau shall issue an Initial Determination Order, providing a final opportunity for the provider to respond; and (4) if the provider fails to respond or that response is deemed insufficient, the Enforcement Bureau shall issue a Final Determination Order, directing downstream voice service providers to block all traffic from the identified provider. In the Gateway Provider FNPRM, the Commission sought comment on extending this process to all voice service providers.

12. Blocking Following Commission Notification of Suspected Illegal Traffic. The Commission first extends the requirement to block and cease carrying or transmitting illegal traffic when notified of such traffic by the Commission through the Enforcement Bureau; in extending the rule, the Commission applies it to originating providers as well as gateway providers. To comply with this requirement, originating providers must block or cease accepting traffic that is substantially similar to the identified traffic on an ongoing basis. Any voice service provider that is not an originating or gateway provider and is notified by the Commission of illegal traffic must still identify the upstream voice service provider(s) from which it received the identified traffic and, if possible, take lawful steps to mitigate this traffic. The Commission finds that, in most instances, blocking is the most effective means of mitigating illegal traffic and nothing in the record contradicts this conclusion. Further, this modification eliminates potential ambiguity and provides certainty to voice service providers that may otherwise be unsure how to comply.

13. In expanding this requirement, the Commission makes clear that nothing in this rule precludes the originating provider from taking steps other than blocking the calls to eliminate this traffic, provided it can ensure that the method has the same effect as ongoing blocking. For example, if the originating provider stops the calls by terminating the customer relationship, it must ensure that it terminates all related accounts and does not permit the customer to open a new account under the same or a different name in order to resume originating illegal calls.

14. The record supports extending this rule and creating a uniform process, rather than treating gateway and originating providers differently. A single, clear standard requiring blocking by the first domestic voice service provider in the call path eliminates possible confusion, better aligns with industry practices, and provides greater certainty to voice service providers while also protecting consumers. Because voice service providers further down the call path from the originator may find it challenging to detect and block illegal traffic, the Commission limits the blocking requirement to originating and gateway providers but still requires non-gateway intermediate providers to play their part by identifying the source of the traffic and taking steps, if possible, to mitigate that traffic. By requiring blocking by originating and gateway providers, the Commission properly balances the burden of identifying and blocking substantially similar traffic on an ongoing basis with the benefit to consumers.

15. With these modifications to the Commission's rules, all traffic that transits the U.S. network will be subject to its blocking requirements, even if non-gateway intermediate providers are not generally required to block. While the Commission agrees with the 51 State attorneys general (AGs) that no traffic should be exempt from its blocking mandate, it does not agree that there should be no variation “across provider types or roles.” The Commission believes the key is to ensure that all traffic is subject to the rule so that bad actors can be identified and stopped. The rule the Commission adopts in this document holds originating providers responsible for the traffic their customers originate.

16. The Commission further declines to remove the requirement to block “substantially similar traffic” as one commenter asks. A rule that only requires an originating provider to block the traffic specifically identified in the initial notice would arguably block no traffic at all, as the Enforcement Bureau cannot identify specific illegal traffic before it has been originated. The requirement to block substantially similar traffic is therefore essential to the operation of the rule.

17. Obligations of a Terminating or Non-Gateway Intermediate Provider When Notified by the Commission. Any terminating or non-gateway intermediate provider that is notified under this rule must promptly inform the Commission that it is not the originating or gateway provider for the identified traffic, specify which upstream voice service provider(s) with direct access to the U.S. public switched telephone network it received the traffic from, and, if possible, take lawful steps to mitigate this traffic. Voice service providers that fail to take available steps to effectively mitigate illegal traffic may be deemed to have knowingly and willfully engaged in transmitting unlawful robocalls. The Commission notes that one clearly available tool is its safe harbor that, once the upstream provider has been notified of the identified illegal traffic by the Commission, permits the downstream provider to block all traffic from that upstream provider if the upstream provider fails to effectively mitigate the illegal traffic within 48 hours or fails to implement effective measures to prevent new and renewing customers from using its network to originate illegal calls. Voice service providers are already required to take these steps under the Commission's existing rules, reflecting their affirmative obligations to identify and mitigate traffic when notified by the Commission. However, the Commission is concerned that some voice service providers may provide inaccurate information, avoid responding, or continue to facilitate illegal traffic. The Commission makes clear that failing to respond or providing inaccurate information is unacceptable; in such cases, the Enforcement Bureau may make use of the downstream provider blocking requirement and move to the Initial Determination Order and Final Determination Order, consistent with the process the Commission discusses further below. The Commission has determined that a uniform set of procedures for all voice service providers reduces the burden of compliance with these rules and ensures due process in the event the Commission pursues enforcement action against providers carrying suspected illegal robocall traffic. Nothing in the record opposes this conclusion.

18. Downstream Provider Blocking. The Commission also requires blocking by voice service providers immediately downstream from any voice service provider when notified by the Commission that the voice service provider has failed to satisfy its obligations under these rules. This expands the Commission's requirement for voice service providers immediately downstream from a gateway provider to block all traffic from the identified provider when notified by the Commission that the gateway provider failed to block. If the Enforcement Bureau determines a voice service provider has failed to satisfy § 64.1200(n)(2), it shall publish and release an Initial Determination Order as described below, giving the provider a final opportunity to respond to the Enforcement Bureau's initial determination. If the Enforcement Bureau determines that the identified provider continues to violate its obligations, the Enforcement Bureau shall release and publish a Final Determination Order in EB Docket No. 22–174 to direct downstream providers to both block and cease accepting all traffic they receive directly from the identified provider starting 30 days from the release date of the Final Determination Order.

19. The record supports extending this requirement. The Commission agrees with commenters that urge it to limit this requirement to voice service providers immediately downstream from the identified provider. This limitation is consistent with the rule adopted in the Gateway Provider Order, and the Commission sees no reason to take a different approach here. If the voice service provider immediately downstream from the identified provider complies with the Commission's rules, then the calls should never reach any voice service providers further downstream. Further, voice service providers more than one step downstream from the identified provider may not know in real time that the call came from the identified provider, making it unreasonable to require them to block the calls. The Commission also agrees that this requirement should include the blocking of all traffic from the identified provider, rather than requiring the immediate downstream voice service provider to determine which calls to block. Because the Commission requires the blocking of all traffic from the identified provider, it sees no reason to provide detailed information regarding what traffic must be blocked.

20. Process for Issuing a Notification of Suspected Illegal Traffic. The Enforcement Bureau shall make an initial determination that the voice service provider is originating, carrying, or transmitting suspected illegal traffic and notify the provider by issuing a written Notification of Suspected Illegal Traffic. The Notification of Suspected Illegal Traffic shall: (1) identify with as much particularity as possible the suspected illegal traffic; (2) provide the basis for the Enforcement Bureau's reasonable belief that the identified traffic is unlawful; (3) cite the statutory or regulatory provisions the suspected illegal traffic appears to violate; and (4) direct the provider receiving the notice that it must comply with § 64.1200(n)(2) of the Commission's rules.

21. The Enforcement Bureau's Notification of Suspected Illegal Traffic shall specify a timeframe of no fewer than 14 days for a notified provider to complete its investigation and report its results. Upon receiving such notice, the provider must promptly investigate the traffic identified in the notice and begin blocking the identified traffic within the timeframe specified in the Notification of Suspected Illegal Traffic unless its investigation determines that the traffic is legal.

22. The Commission makes clear that the requirement to block on an ongoing basis is not tied to the number in the caller ID field or any other single criterion. Instead, the Commission requires the notified provider to block on a continuing basis any traffic that is substantially similar to the identified traffic and provide the Enforcement Bureau with a plan as to how it expects to do so. The Commission does not define “substantially similar traffic” in any detail here because that will be a case-specific determination based on the traffic at issue. The Commission notes that each calling campaign will have unique qualities that are better addressed by tailoring the analytics to the particular campaign on a case-by-case basis. The Commission nevertheless encourages originating providers to consider common indicia of illegal calls including, but not limited to: call duration; call completion ratios; large bursts of calls in a short time frame; neighbor spoofing patterns; and sequential dialing patterns. If the notified provider is an originating provider, the identity of the caller may be a material factor in identifying whether the traffic is substantially similar. However, an originating provider may not assume, without evidence, that the caller only has one subscriber line from which it is placing calls and must maintain vigilance to ensure that the caller does not use different existing accounts or open new accounts, under the same or a different name, to continue to place illegal calls. Additionally, the Commission strongly encourages any voice service provider that has been previously notified of illegal traffic as an originating provider to notify the Commission if it has reason to believe that the caller has moved to a different originating provider and is continuing to originate illegal calls. If the notified provider is a terminating or non-gateway intermediate provider, it must promptly inform the Commission that it is not the originating or gateway provider for the identified traffic, specify which upstream voice service provider(s) with direct access to the U.S. public switched telephone network it received the traffic from and, if possible, take lawful steps to mitigate this traffic.

23. Each notified provider will have flexibility to determine the correct approach for each particular case, but must provide a detailed plan in its response to the Enforcement Bureau so that the Bureau can assess the plan's sufficiency. If the Enforcement Bureau determines that the plan is insufficient, it shall provide the notified provider an opportunity to remedy the deficiencies prior to taking further action. The Commission will consider the notified provider to be in compliance with the Commission's mandatory blocking rule if it blocks traffic in accordance with its approved plan. The Enforcement Bureau may require the notified provider to modify its approved plan if it determines that the provider is not blocking substantially similar traffic. Additionally, if the Enforcement Bureau finds that the notified provider continues to allow suspected illegal traffic onto the U.S. network, it may proceed to an Initial Determination Order or Final Determination Order, as appropriate.

24. Provider Investigation. Each notified provider must investigate the identified traffic and report the results of its investigation to the Enforcement Bureau in the timeframe specified in the Notification of Suspected Illegal Traffic, as follows:

• If the provider's investigation determines that it served as the originating provider or gateway provider for the identified traffic, it must block the identified traffic within the timeframe specified in the Notification of Suspected Illegal Traffic (unless its investigation determines that the traffic is not illegal) and include in its report to the Enforcement Bureau: (1) a certification that it is blocking the identified traffic and will continue to do so; and (2) a description of its plan to identify and block substantially similar traffic on an ongoing basis.
• If the provider's investigation determines that the identified traffic is not illegal, it shall provide an explanation as to why the provider reasonably concluded that the identified traffic is not illegal and what steps it took to reach that conclusion. Absent such a showing, or if the Enforcement Bureau determines based on the evidence that the traffic is illegal despite the provider's assertions, the identified traffic will be deemed illegal.
• If the provider's investigation determines it did not serve as an originating provider or gateway provider for any of the identified traffic, it shall provide an explanation as to how it reached that conclusion, identify the upstream provider(s) from which it received the identified traffic, and, if possible, take lawful steps to mitigate this traffic. If the notified provider determines that the traffic is not illegal, it must inform the Enforcement Bureau and explain its conclusion within the specified timeframe.

25. Process for Issuing an Initial Determination Order. If the notified provider fails to respond to the notice within the specified timeframe, the Enforcement Bureau determines that the response is insufficient, the Enforcement Bureau determines that the notified provider is continuing to originate, carry, or transmit substantially similar traffic onto the U.S. network, or the Enforcement Bureau determines based on the evidence that the traffic is illegal despite the provider's assertions, the Enforcement Bureau shall issue an Initial Determination Order to the notified provider stating its determination that the provider is not in compliance with § 64.1200(n)(2). This Initial Determination Order must include the Enforcement Bureau's reasoning for its determination and give the provider a minimum of 14 days to provide a final response prior to the Enforcement Bureau's final determination as to whether the provider is in compliance with § 64.1200(n)(2).

26. Process for Issuing a Final Determination Order. If the notified provider does not adequately respond to the Initial Determination Order or continues to originate substantially similar traffic, or the Enforcement Bureau determines based on the evidence that the traffic is illegal despite the provider's assertions, the Enforcement Bureau shall issue a Final Determination Order. The Enforcement Bureau shall publish the Final Determination Order in EB Docket No. 22–174 to direct downstream providers to both block and cease accepting all traffic they receive directly from the identified provider starting 30 days from the release date of the Final Determination Order. The Final Determination Order may be adopted up to one year after the release date of the Initial Determination Order and may be based on either an immediate failure to comply with § 64.1200(n)(2) or a determination that the provider has failed to meet its ongoing obligation to block substantially similar traffic under that rule.

27. Each Final Determination Order shall state the grounds for the Enforcement Bureau's determination that the identified provider has failed to comply with its obligation to block illegal traffic and direct downstream providers to initiate blocking 30 days from the release date of the Final Determination Order. A provider that chooses to initiate blocking sooner than 30 days from the release date may do so, consistent with the Commission's existing safe harbor in § 64.1200(k)(4).

28. Safe Harbor. The Commission extends the limited safe harbor from liability under the Communications Act or the Commission's rules, which it adopted in the Gateway Provider Order, to include any voice service provider that inadvertently blocks lawful traffic as part of the requirement to block substantially similar traffic in accordance with the originating provider's approved plan. The record supports extending this safe harbor to protect voice service providers that take steps to prevent illegal calls from reaching consumers and the Commission sees no reason not to provide this protection.

29. Protections for Lawful Callers. Consistent with the Commission's existing blocking rules, voice service providers must never block emergency calls to 911 and must make all reasonable efforts to ensure that they do not block calls from public safety answering points (PSAPs) and government emergency numbers. The Commission declines to adopt additional transparency and redress requirements at this time or extend any other existing requirements that would not already apply to the blocking mandates it adopts in this document. These rules require the Commission to direct which types of calls voice service providers should block, so the blocking provider is not in a position to provide redress. The Commission did not receive specific comment on the need for additional protections for lawful calls.

“Know Your Upstream Provider”

30. The Commission requires all voice service providers accepting traffic from an upstream provider to take steps to “know” that immediate upstream provider. This extends its existing requirement for gateway providers to all voice service providers; it holds all voice service providers in the call path responsible for the calls that transit their networks. Specifically, the Commission requires every voice service provider to take reasonable and effective steps to ensure that the immediate upstream provider is not using it to carry or process a high volume of illegal traffic. The Commission therefore agrees with commenters urging it to adopt a rule that would hold all providers in the call path responsible for the traffic that transits their network. The Commission agrees with USTelecom that the best method to do so is by adopting a know-your-upstream-provider requirement.

31. The Commission finds that, while intermediate providers may be unable to identify the calling customer with sufficient accuracy to know whether they are placing illegal calls, the Commission cannot permit them to “intentionally or negligently ignore red flags from their upstream providers.” As YouMail noted, “the goal of every network should be to transit only legal calls.” Extending this requirement to every voice service provider that receives traffic from an upstream provider, rather than solely to gateway providers, ensures that all voice service providers in the call path are responsible for keeping illegal traffic off the U.S. network. Consistent with the Commission's existing rules, the Commission does not require voice service providers to take specific, defined steps to meet this requirement, and instead allows each voice service provider flexibility to determine the best approach for its network, so long as the steps are effective. In general, the Commission expects voice service providers will need to exercise due diligence before accepting traffic from an upstream provider, and may want to collect information such as “obtaining the [voice service provider's] physical business location, contact person(s), state or country of incorporation, federal tax ID (if applicable), and the nature of the [voice service provider's] business.” The Commission does not find that collecting this information is either uniformly necessary or sufficient, and voice service providers may need to take additional steps, such as adopting contract terms that allow for termination and acting on those terms in the event that the upstream provider attempts to use the network to carry or process a high volume of illegal traffic. As the Commission made clear in the Gateway Provider Order and Gateway Provider FNPRM, it does not expect perfection. However, all voice service providers must take effective steps, and if a voice service provider carries or transmits a high volume of illegal traffic that primarily originates from one or more specific upstream providers, the steps that provider has taken are not effective and must be modified for that provider to be in compliance with the Commission's rules. The Commission encourages voice service providers to regularly evaluate and adjust their approach so that that it remains effective.

32. Lastly, in the 2023 Caller ID Authentication Order,88 FR 40096 (June 21, 2023), the Commission adopted a requirement that originating, terminating, and intermediate providers describe any procedures in place to know their upstream providers in their robocall mitigation plans. Now that all voice service providers, including intermediate providers, will be required to take reasonable and effective steps to know their upstream providers, all such providers will also be required to describe those steps in their robocall mitigation plans filed in the Robocall Mitigation Database, pursuant to the requirement adopted in the 2023 Caller ID Authentication Order.

Other Issues

33. Updating Robocall Mitigation Database Certifications to Include Traceback Compliance. In this document, the Commission modifies § 64.1200(n)(1) to require all voice service providers to respond to traceback requests within 24 hours. Consistent with its rule applicable to gateway providers, which already were required to respond to traceback requests within 24 hours, the Commission now requires voice service providers to commit to responding fully and within 24 hours to all traceback requests consistent with the requirements it adopts in this document in § 64.1200 of its rules, and to include a statement in their Robocall Mitigation Database filings certifying to this commitment. The Commission concludes that these limited rule modifications will ensure that voice service providers' mitigation and filing obligations are in line with their underlying compliance duties, enhance the usefulness of the Robocall Mitigation Database to both the Commission and voice service providers, and promote rule uniformity and administrability. While no party commented on these specific changes, there was significant support to adopt Robocall Mitigation Database filing and mitigation obligations for all voice service providers in the call path. The Commission also updates cross-references to § 64.1200 in its Robocall Mitigation Database certification rules to account for the amendments it adopts in the Report and Order.

34. Effective Measures to Prevent New and Renewing Customers from Originating Illegal Calls. The Commission declines to further clarify its existing requirement for voice service providers to take affirmative, effective measures to prevent new and renewing customers from using their networks to originate illegal calls, as some commenters request. The Commission agrees with commenters that support its existing flexible approach under this rule. Flexibility to adapt to changing calling patterns is necessary to avoid giving the “playbook” to bad actor callers, thus an outcomes-based standard is most appropriate. The Commission thus decline to be more prescriptive on the steps voice service providers should take to block, as requested by some commenters.

35. The Commission further declines a commenter's request that it clarify that “adopting a know-your-customer or upstream-provider standard for new or renewing customers satisfies the effective measures standard.” The commenter did not define “know-your-customer” and the Commission is not aware of any universally accepted minimum standard in the industry. Without such a definition or minimum standard, there is no guarantee that a process that an individual voice service provider describes as “know-your-customer” would be sufficient. The rule requires “effective” measures; blanket approval of measures voice service providers deem “know-your-customer” clearly does not satisfy this requirement and could lead to voice service providers adopting ineffective processes. The Commission also declines to remove the “new and renewing customer” language, as one commenter requests. This limitation will have less impact the longer the rule is in effect; more contracts will include the new provision as they are renewed over time. This limitation recognizes the challenge of modifying existing, in-force contracts.

36. Differential Treatment of Non-Conversational Traffic. The Commission declines to adopt a requirement that originating voice service providers ensure that customers originating non-conversational traffic only seek to originate lawful calls. While many illegal calls are of short duration, it does not follow that all calls of short duration are inherently suspect. The Commission agrees with commenters that argue against such requirements and are persuaded that this sort of traffic segmentation is likely to harm wanted, or even essential, traffic. In fact, only one commenter urged us to adopt a rule treating non-conversational traffic differently from conversational traffic, and even that commenter acknowledged that not all non-conversational traffic is illegal. Such a rule could, for example, make it impossible for medical centers or schools in rural areas with few voice service providers to find a provider willing to carry their traffic, which may include emergency notifications, appointment reminders, or other important notifications; the Commission will not throw the baby out with the bathwater.

37. Moreover, the Commission does not believe that a strict rule for non-conversational traffic would lead to any real benefit. To do so, the Commission would need to adopt standards for whether calls are “non-conversational” or “conversational,” which bad actors could use ensure that their traffic does not meet the criteria for stricter treatment. As a result, not only is the risk of such a rule unacceptably high, but the potential benefit is low.

38. Strict Liability. The Commission similarly declines to adopt a strict liability standard for an originating provider when its customer originates illegal calls. The Commission asked about a strict liability standard in the Gateway Provider FNPRM in the context of differential treatment of non-conversational traffic, which it has declined to adopt. The Commission disagrees with commenters that ask it to adopt this standard more broadly and agree with those who argue strict liability is inappropriate. Protecting consumers from illegal calls cannot come at the cost of blocking high volumes of lawful traffic in order to avoid the possibility that some of those calls might be illegal—which is the behavior many voice service providers would have to undertake if the Commission imposed strict liability.

39. Public Traceback. The Commission declines to require that the industry make traceback information publicly available, as one commenter asks. The Commission believes this approach places too much weight on receipt of traceback requests as an indicator that a voice service provider is a bad actor. Voice service providers that handle a large volume of calls, especially as intermediate providers, are likely to receive a high volume of traceback requests even if they are not bad actors. A general rule requiring the publication of traceback information could hamper industry efforts by discouraging voice service providers from initiating traceback requests without law enforcement intervention. Publication of traceback information may be appropriate and beneficial in certain instances, particularly when the information is published in aggregate, rather than tied to individual, specific requests. Nothing here limits the ability of the Commission or another entity to publish such information.

Summary of Costs and Benefits

40. The record in this proceeding supports the Commission's conclusion in the Gateway Provider FNPRM that the Commission's proposed rules and actions, some of which it addresses in this document, “will account for another large share of the annual $13.5 billion minimum benefit we originally estimated” and that the benefits “will far exceed the costs imposed on providers.”

41. In this document, the Commission reaffirms that all voice service providers are responsible for all calls they originate, carry, or transmit. In doing so, the Commission expands several of its rules to cover a wider group of voice service providers. First, the Commission codifies its existing expectation that voice service providers respond to traceback requests within 24 hours by expanding the strict 24-hour requirement it adopted for gateway providers to all providers in the call path. Requiring rapid response to traceback complements the Commission's STIR/SHAKEN caller ID authentication rules by making it easier to identify bad actors even where caller ID authentication information is unavailable. This codification is a key piece of the Commission's comprehensive approach to combating illegal calls and supports the benefits of that approach without incurring a significant practical cost when compared to its existing requirements.

42. Second, the Commission extends its requirement to block following Commission notification to originating providers and makes clear that any voice service provider that receives such a notification is required to respond to the Commission and, if it is not an originating or gateway provider, inform the Commission where it got the traffic. If any voice service provider refuses to comply with this requirement, all voice service providers immediately downstream from the non-compliant provider may be required to block all traffic from that provider. Voice service providers must comply with Commission rules, and this rule provides clear, immediate consequences for voice service providers that refuse to do so, even if that voice service provider would be unable to pay a forfeiture. The Commission does not expect that originating providers will incur significant costs as a result of this rule because action by providers is required only when the Commission notifies the provider. Further, because providers generally adhere to Commission rules, the Commission expects that downstream providers will receive Commission notification to block only rarely. If the Commission were to issue such a blocking notification to a downstream provider, it would benefit consumers by stopping illegal calls while causing disruption to provider relationships and possibly stopping some legal calls. While the disruption of legal calls would harm consumers, the Commission expects this scenario to arise infrequently. The power of this aspect of the rule is that it gives providers strong incentives to comply with the Commission's blocking rules. Because illegal calls cause large harms to consumers, stopping even a small share of illegal calls benefits consumers significantly and, as explained above, the Commission expects this rule to have minimal costs. Therefore, the Commission finds that the benefits of this rule outweigh its costs.

43. Finally, the Commission expands the know-your-upstream-provider requirement to all voice service providers. This expanded requirement codifies that all voice service providers, regardless of their position in the call path, are responsible for preventing illegal calls. Because voice service providers should already be exercising due diligence by knowing their upstream call providers, this new rule has small costs. It has greater benefits in deterring providers from shirking their due-diligence responsibility.

44. These expanded rules will ultimately prevent illegal calls from ringing consumers' phones, both by deterring callers from placing them in the first instance and by stopping the calls before they reach the consumer. The rules also make bad actors, whether callers or voice service providers, easier to identify. Taken together, these new and expanded rules increase the effectiveness of all of the Commission's efforts to combat illegal calls, including its existing affirmative obligations and Robocall Mitigation Database filing requirements. These rules, together with the Commission's existing rules, make it easier to identify and stop illegal calls before they reach consumers. As the Commission found previously, an overall reduction in illegal calls will lower network costs by eliminating both unwanted traffic congestion and the labor costs of handling numerous customer complaints, and these new rules contribute to this overall reduction. This reduction in illegal calls will also help restore confidence in the U.S. telephone network and facilitate reliable access to emergency and healthcare services.

45. Although sparse in quantitative estimates, the record in this proceeding supports the Commission's conclusion that the benefits of these rules exceed their costs. A more uniform blocking standard will “provide additional benefits and reduce the overall burden” on providers. Extending these rules, originally adopted for gateway providers, to all voice service providers will not be overly costly or burdensome. The incremental costs of compliance with the Commission's new rules is “relatively small.” Given that robocalls reduce public welfare by billions of dollars annually, even a small percentage reduction in robocalls implies benefits that exceed the costs of the Commission's new rules.

Legal Authority

46. The Commission's legal authority to adopt these requirements stems from sections 201(b), 202(a), and 251(e) of the Communications Act of 1934, as amended (the Act) as well as from the Truth in Caller ID Act and the Commission's ancillary authority. Sections 201(b) and 202(a) grant the Commission broad authority to adopt rules governing just and reasonable practices of common carriers.

47. The Commission's section 251(e) numbering authority provides independent jurisdiction to prevent the abuse of North American Numbering Plan (NANP) resources; this particularly applies where callers spoof caller ID for fraudulent purposes and therefore exploit numbering resources, regardless of whether the voice service provider is a common carrier. Similarly, the Truth in Caller ID Act grants the Commission authority to prescribe rules to make unlawful the spoofing of caller ID information with the intent to defraud, cause harm, or wrongfully obtain something of value. Taken together, section 251(e) of the Communications Act and the Truth in Caller ID Act grant the Commission authority to prescribe rules to prevent the unlawful spoofing of caller ID and abuse of NANP resources by all voice service providers.

48. The Commission further finds that these rules reduce the chance of unlawfully spoofed calls reaching consumers and thus are within its authority under the statutes referenced above. In particular, the requirement to respond to traceback requests within 24 hours directly impacts a caller's ability to unlawfully spoof caller ID by making it easier to detect the originator of the call. The other requirements are aimed at curbing the use of NANP numbers (whether spoofed or not) for unlawful purposes as they are focused on mitigating and preventing illegal calls.

49. While the Commission concludes that its direct sources of authority provide an ample basis to adopt its proposed rules for all voice service providers, the Commission's ancillary authority in section 4(i) provides an independent basis to do so with respect to providers that have not been classified as common carriers. The Commission may exercise ancillary jurisdiction when two conditions are satisfied: (1) the Commission's general jurisdictional grant under Title I of the Communications Act covers the regulated subject; and (2) the regulations are reasonably ancillary to the Commission's effective performance of its statutorily mandated responsibilities. The Commission concludes that the regulations adopted in this document satisfy the first prong because providers that interconnect with the public switched telephone network and exchange IP traffic clearly offer “communication by wire and radio.”

50. With regard to the second prong, requiring voice service providers to comply with the Commission's proposed rules is reasonably ancillary to the Commission's effective performance of its statutory responsibilities under sections 201(b), 202(a), and 251(e) of the Communications Act and the Truth in Caller ID Act as described above. With respect to sections 201(b) and 202(a), absent application of the Commission's proposed rules to providers that are not classified as common carriers, originators of illegal calls could circumvent the Commission's proposed scheme by sending calls only via providers that have not yet been classified as common carriers.

Final Regulatory Flexibility Analysis

51. As required by the Regulatory Flexibility Act of 1980 (RFA), as amended, an Initial Regulatory Flexibility Analysis (IRFA) was incorporated into the Further Notice of Proposed Rulemaking adopted in May 2022 and published at 87 FR 42670 on July 18, 2022 ( May 2022 FNPRM). The Commission sought written public comment on the proposals in the May 2022 FNPRM, including comment on the IRFA. This Final Regulatory Flexibility Analysis (FRFA) conforms to the RFA.

Need for, and Objectives of, the Order

52. The Report and Order takes important steps in the fight against illegal robocalls by extending certain requirements to a broader range of voice service providers. First, the Report and Order requires all domestic voice service providers to respond to traceback requests within 24 hours of the request, extending the previous rule applicable to gateway providers to all providers. Second, it requires originating providers to block illegal traffic when notified of such traffic by the Commission and, if they fail to do so, requires all voice service providers in the U.S. to block all traffic from the bad-actor voice service provider, consistent with the existing rule for gateway providers. This modification eliminates potential ambiguity as to how providers should effectively mitigate illegal traffic and provides certainty to voice service providers that may otherwise be unsure how to comply. Finally, it requires all voice service providers accepting traffic from an upstream provider to take reasonable and effective steps to ensure that the immediate upstream provider is not using them to carry or process a high volume of illegal traffic. The expansion of these rules protects consumers from illegal calls, holds voice service providers responsible for the calls they carry, and aids in the identification of bad actors.

Summary of Significant Issues Raised by Public Comments in Response to the IRFA

53. While no comments specifically addressed the May 2022 FNPRM IRFA, the Commission did receive some comments that addressed the impact of the proposed rules on small providers. Some commenters raised concerns about the 24-hour traceback requirement. In particular, commenters noted that the Commission recognized that smaller providers may struggle to respond quickly and result in “significant burdens” to small entities. Still other comments urged us to adopt a tiered approach to provide flexibility for smaller providers that receive infrequent traceback requests. The Commission acknowledges these concerns in the Report and Order, and discusses steps taken to address these concerns in Section F of this FRFA. The rule the Commission adopts in the Report and Order codifies the expectation of the existing rule and provides flexibility to address requests received on evenings, weekends, and holidays. The Commission further considered the potential impact of the rules proposed in the IRFA on small entities and took steps where appropriate and feasible to reduce the compliance and economic burden for small entities.

Response To Comments by the Chief Counsel for Advocacy of the Small Business Administration

54. Pursuant to the Small Business Jobs Act of 2010, which amended the RFA, the Commission is required to respond to any comments filed by the Chief Counsel for Advocacy of the Small Business Administration (SBA), and to provide a detailed statement of any change made to the proposed rules as a result of those comments. The Chief Counsel did not file any comments in response to the proposed rules in this proceeding.

Description and Estimate of the Number of Small Entities to Which Rules Will Apply

55. The RFA directs agencies to provide a description of, and where feasible, an estimate of the number of small entities that may be affected by the rules adopted herein. The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” In addition, the term “small business” has the same meaning as the term “small-business concern” under the Small Business Act. A “small-business concern” is one which: (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the SBA.

56. Small Businesses, Small Organizations, Small Governmental Jurisdictions. The Commission's actions, over time, may affect small entities that are not easily categorized at present. The Commission therefore describes here, at the outset, three broad groups of small entities that could be directly affected herein. First, while there are industry specific size standards for small businesses that are used in the regulatory flexibility analysis, according to data from the Small Business Administration's (SBA) Office of Advocacy, in general a small business is an independent business having fewer than 500 employees. These types of small businesses represent 99.9% of all businesses in the United States, which translates to 32.5 million businesses.

57. Next, the type of small entity described as a “small organization” is generally “any not-for-profit enterprise which is independently owned and operated and is not dominant in its field.” The Internal Revenue Service (IRS) uses a revenue benchmark of $50,000 or less to delineate its annual electronic filing requirements for small exempt organizations. Nationwide, for tax year 2020, there were approximately 447,689 small exempt organizations in the U.S. reporting revenues of $50,000 or less according to the registration and tax data for exempt organizations available from the IRS.

58. Finally, the small entity described as a “small governmental jurisdiction” is defined generally as “governments of cities, counties, towns, townships, villages, school districts, or special districts, with a population of less than fifty thousand.” U.S. Census Bureau data from the 2017 Census of Governments indicate that there were 90,075 local governmental jurisdictions consisting of general purpose governments and special purpose governments in the United States. Of this number there were 36,931 general purpose governments (county, municipal and town or township) with populations of less than 50,000 and 12,040 special purpose governments—independent school districts with enrollment populations of less than 50,000. Accordingly, based on the 2017 U.S. Census of Governments data, the Commission estimates that at least 48,971 entities fall into the category of “small governmental jurisdictions.”

Wireline Carriers

59. Wired Telecommunications Carriers. The U.S. Census Bureau defines this industry as establishments primarily engaged in operating and/or providing access to transmission facilities and infrastructure that they own and/or lease for the transmission of voice, data, text, sound, and video using wired communications networks. Transmission facilities may be based on a single technology or a combination of technologies. Establishments in this industry use the wired telecommunications network facilities that they operate to provide a variety of services, such as wired telephony services, including VoIP services, wired (cable) audio and video programming distribution, and wired broadband internet services. By exception, establishments providing satellite television distribution services using facilities and infrastructure that they operate are included in this industry. Wired Telecommunications Carriers are also referred to as wireline carriers or fixed local service providers.

60. The SBA small business size standard for Wired Telecommunications Carriers classifies firms having 1,500 or fewer employees as small. U.S. Census Bureau data for 2017 show that there were 3,054 firms that operated in this industry for the entire year. Of this number, 2,964 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 5,183 providers that reported they were engaged in the provision of fixed local services. Of these providers, the Commission estimates that 4,737 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, most of these providers can be considered small entities.

61. Local Exchange Carriers ( LECs). Neither the Commission nor the SBA has developed a size standard for small businesses specifically applicable to local exchange services. Providers of these services include both incumbent and competitive local exchange service providers. Wired Telecommunications Carriers is the closest industry with an SBA small business size standard. Wired Telecommunications Carriers are also referred to as wireline carriers or fixed local service providers. The SBA small business size standard for Wired Telecommunications Carriers classifies firms having 1,500 or fewer employees as small. U.S. Census Bureau data for 2017 show that there were 3,054 firms that operated in this industry for the entire year. Of this number, 2,964 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 5,183 providers that reported they were fixed local exchange service providers. Of these providers, the Commission estimates that 4,737 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, most of these providers can be considered small entities.

62. Incumbent Local Exchange Carriers (Incumbent LECs). Neither the Commission nor the SBA have developed a small business size standard specifically for incumbent local exchange carriers. Wired Telecommunications Carriers is the closest industry with an SBA small business size standard. The SBA small business size standard for Wired Telecommunications Carriers classifies firms having 1,500 or fewer employees as small. U.S. Census Bureau data for 2017 show that there were 3,054 firms in this industry that operated for the entire year. Of this number, 2,964 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 1,227 providers that reported they were incumbent local exchange service providers. Of these providers, the Commission estimates that 929 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, the Commission estimates that the majority of incumbent local exchange carriers can be considered small entities.

63. Competitive Local Exchange Carriers (LECs). Neither the Commission nor the SBA has developed a size standard for small businesses specifically applicable to local exchange services. Providers of these services include several types of competitive local exchange service providers. Wired Telecommunications Carriers is the closest industry with a SBA small business size standard. The SBA small business size standard for Wired Telecommunications Carriers classifies firms having 1,500 or fewer employees as small. U.S. Census Bureau data for 2017 show that there were 3,054 firms that operated in this industry for the entire year. Of this number, 2,964 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 3,956 providers that reported they were competitive local exchange service providers. Of these providers, the Commission estimates that 3,808 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, most of these providers can be considered small entities.

64. Interexchange Carriers (IXCs). Neither the Commission nor the SBA have developed a small business size standard specifically for Interexchange Carriers. Wired Telecommunications Carriers is the closest industry with a SBA small business size standard. The SBA small business size standard for Wired Telecommunications Carriers classifies firms having 1,500 or fewer employees as small. U.S. Census Bureau data for 2017 show that there were 3,054 firms that operated in this industry for the entire year. Of this number, 2,964 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 151 providers that reported they were engaged in the provision of interexchange services. Of these providers, the Commission estimates that 131 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, the Commission estimates that the majority of providers in this industry can be considered small entities.

65. Cable System Operators (Telecom Act Standard). The Communications Act of 1934, as amended, contains a size standard for a “small cable operator,” which is “a cable operator that, directly or through an affiliate, serves in the aggregate fewer than one percent of all subscribers in the United States and is not affiliated with any entity or entities whose gross annual revenues in the aggregate exceed $250,000,000.” For purposes of the Telecom Act Standard, the Commission determined that a cable system operator that serves fewer than 677,000 subscribers, either directly or through affiliates, will meet the definition of a small cable operator based on the cable subscriber count established in a 2001 Public Notice. Based on industry data, only six cable system operators have more than 677,000 subscribers. Accordingly, the Commission estimates that the majority of cable system operators are small under this size standard. The Commission notes however, that the Commission neither requests nor collects information on whether cable system operators are affiliated with entities whose gross annual revenues exceed $250 million. Therefore, the Commission is unable at this time to estimate with greater precision the number of cable system operators that would qualify as small cable operators under the definition in the Communications Act.

66. Other Toll Carriers. Neither the Commission nor the SBA has developed a definition for small businesses specifically applicable to Other Toll Carriers. This category includes toll carriers that do not fall within the categories of interexchange carriers, operator service providers, prepaid calling card providers, satellite service carriers, or toll resellers. Wired Telecommunications Carriers is the closest industry with a SBA small business size standard. The SBA small business size standard for Wired Telecommunications Carriers classifies firms having 1,500 or fewer employees as small. U.S. Census Bureau data for 2017 show that there were 3,054 firms in this industry that operated for the entire year. Of this number, 2,964 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 115 providers that reported they were engaged in the provision of other toll services. Of these providers, the Commission estimates that 113 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, most of these providers can be considered small entities.

Wireless Carriers

67. Wireless Telecommunications Carriers (except Satellite). This industry comprises establishments engaged in operating and maintaining switching and transmission facilities to provide communications via the airwaves. Establishments in this industry have spectrum licenses and provide services using that spectrum, such as cellular services, paging services, wireless internet access, and wireless video services. The SBA size standard for this industry classifies a business as small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2017 show that there were 2,893 firms in this industry that operated for the entire year. Of that number, 2,837 firms employed fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 797 providers that reported they were engaged in the provision of wireless services. Of these providers, the Commission estimates that 715 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, most of these providers can be considered small entities.

68. Satellite Telecommunications. This industry comprises firms “primarily engaged in providing telecommunications services to other establishments in the telecommunications and broadcasting industries by forwarding and receiving communications signals via a system of satellites or reselling satellite telecommunications.” Satellite telecommunications service providers include satellite and earth station operators. The SBA small business size standard for this industry classifies a business with $38.5 million or less in annual receipts as small. U.S. Census Bureau data for 2017 show that 275 firms in this industry operated for the entire year. Of this number, 242 firms had revenue of less than $25 million. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 71 providers that reported they were engaged in the provision of satellite telecommunications services. Of these providers, the Commission estimates that approximately 48 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, a little more than of these providers can be considered small entities.

Resellers

69. Local Resellers. Neither the Commission nor the SBA have developed a small business size standard specifically for Local Resellers. Telecommunications Resellers is the closest industry with a SBA small business size standard. The Telecommunications Resellers industry comprises establishments engaged in purchasing access and network capacity from owners and operators of telecommunications networks and reselling wired and wireless telecommunications services (except satellite) to businesses and households. Establishments in this industry resell telecommunications; they do not operate transmission facilities and infrastructure. Mobile virtual network operators (MVNOs) are included in this industry. The SBA small business size standard for Telecommunications Resellers classifies a business as small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2017 show that 1,386 firms in this industry provided resale services for the entire year. Of that number, 1,375 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 293 providers that reported they were engaged in the provision of local resale services. Of these providers, the Commission estimates that 289 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, most of these providers can be considered small entities.

70. Toll Resellers. Neither the Commission nor the SBA have developed a small business size standard specifically for Toll Resellers. Telecommunications Resellers is the closest industry with a SBA small business size standard. The Telecommunications Resellers industry comprises establishments engaged in purchasing access and network capacity from owners and operators of telecommunications networks and reselling wired and wireless telecommunications services (except satellite) to businesses and households. Establishments in this industry resell telecommunications; they do not operate transmission facilities and infrastructure. Mobile virtual network operators (MVNOs) are included in this industry. The SBA small business size standard for Telecommunications Resellers classifies a business as small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2017 show that 1,386 firms in this industry provided resale services for the entire year. Of that number, 1,375 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 518 providers that reported they were engaged in the provision of toll services. Of these providers, the Commission estimates that 495 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, most of these providers can be considered small entities.

71. Prepaid Calling Card Providers. Neither the Commission nor the SBA has developed a small business size standard specifically for prepaid calling card providers. Telecommunications Resellers is the closest industry with a SBA small business size standard. The Telecommunications Resellers industry comprises establishments engaged in purchasing access and network capacity from owners and operators of telecommunications networks and reselling wired and wireless telecommunications services (except satellite) to businesses and households. Establishments in this industry resell telecommunications; they do not operate transmission facilities and infrastructure. Mobile virtual network operators (MVNOs) are included in this industry. The SBA small business size standard for Telecommunications Resellers classifies a business as small if it has 1,500 or fewer employees. U.S. Census Bureau data for 2017 show that 1,386 firms in this industry provided resale services for the entire year. Of that number, 1,375 firms operated with fewer than 250 employees. Additionally, based on Commission data in the 2021 Universal Service Monitoring Report, as of December 31, 2020, there were 58 providers that reported they were engaged in the provision of payphone services. Of these providers, the Commission estimates that 57 providers have 1,500 or fewer employees. Consequently, using the SBA's small business size standard, most of these providers can be considered small entities.

Other Entities

72. All Other Telecommunications. This industry is comprised of establishments primarily engaged in providing specialized telecommunications services, such as satellite tracking, communications telemetry, and radar station operation. This industry also includes establishments primarily engaged in providing satellite terminal stations and associated facilities connected with one or more terrestrial systems and capable of transmitting telecommunications to, and receiving telecommunications from, satellite systems. Providers of internet services ( e.g., dial-up ISPs) or voice over internet protocol (VoIP) services via client-supplied telecommunications connections are also included in this industry. The SBA small business size standard for this industry classifies firms with annual receipts of $35 million or less as small. U.S. Census Bureau data for 2017 show that there were 1,079 firms in this industry that operated for the entire year. Of those firms, 1,039 had revenue of less than $25 million. Based on this data, the Commission estimates that the majority of “All Other Telecommunications” firms can be considered small.

Description of Projected Reporting, Recordkeeping, and Other Compliance Requirements for Small Entities

73. The Report and Order requires voice service providers to meet certain obligations. These changes affect small and large companies and apply to all the classes of regulated entities identified above. First, all voice service providers must fully respond to traceback requests from the Commission, civil and criminal law enforcement, and the industry traceback consortium within 24 hours of receipt of such a request. The voice service provider should respond with information about the provider from which it directly received the call. Small entity voice service providers may need to identify dedicated staff of other professionals to act as a clear point of contact to respond to traceback requests in a timely manner.

74. Second, originating voice service providers, and any intermediate or terminating provider immediately downstream from the originate provider, must block calls in certain instances. Specifically, the originating provider must block illegal traffic once notified of such traffic by the Commission through its Enforcement Bureau. In order to comply with this requirement, small entities that are originating providers must block traffic that is substantially similar to the identified traffic on an ongoing basis. When an originating provider fails to comply with this requirement, the Commission may require small entity providers immediately downstream from an originating provider to block all traffic from the identified provider when notified by the Commission. As part of this requirement, a notified small entity originating provider must promptly report the results of its investigation to the Enforcement Bureau within 14 days, including, unless the originating provider determines it is either not an originating or gateway provider for any of the identified traffic or that the identified traffic is not illegal, both a certification that it is blocking the identified traffic and will continue to do so and a description of its plan to identify the traffic on an ongoing basis. In order to comply with the downstream provider blocking requirement, all providers must monitor EB Docket No. 22–174 and initiate blocking within 30 days of a Blocking Order being released.

Steps Taken To Minimize the Significant Economic Impact on Small Entities, and Significant Alternatives Considered

75. The RFA requires an agency to provide, “a description of the steps the agency has taken to minimize the significant economic impact on small entities . . . including a statement of the factual, policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the other significant alternatives to the rule considered by the agency which affect the impact on small entities was rejected.”

76. Generally, the decisions the Commission made in the Report and Order apply to all providers. Treating small providers differently from larger providers would have a significant impact on the success of the rules the Commission adopts in this document, meaning that fewer consumers would be protected from illegal calls and bad-actor callers would have more opportunities to find ways around these restrictions. However, the Commission did take steps to ensure that small entity and other providers would not be unduly burdened by these requirements. Specifically, the Commission allowed flexibility where appropriate to ensure that small providers, can determine the best approach for compliance based on the needs of their networks. For example, providers have the flexibility to determine their proposed approach to blocking illegal traffic when notified by the Commission and to determine the steps they take to “know the upstream provider.”

Report to Congress

77. The Commission will send a copy of the Gateway Provider Report and Order and Order on Reconsideration, including this FRFA, in a report to be sent to Congress pursuant to the Congressional Review Act. In addition, the Commission will send a copy of the Gateway Provider Report and Order and Order on Reconsideration, including this FRFA, to the Chief Counsel for Advocacy of the Small Business Administration. A copy of the Gateway Provider Report and Order and Order on Reconsideration (or summaries thereof) will also be published in the Federal Register .

Ordering Clauses

78. It is ordered that, pursuant to sections 4(i), 201, 202, 217, 227, 227b, 251(e), 303(r), and 403 of the Communications Act of 1934, as amended, 47 U.S.C. 154(i), 201, 202, 217, 227, 251(e), 303(r), 403, the Report and Order is adopted.

79. It is further ordered that the Report and Order shall be effective 180 days after publication in the Federal Register , except that the amendments to § 64.6305(d)(2)(iii) and (f)(2)(iii), 47 CFR 64.6305(d)(2)(iii) and (f)(2)(iii), which may contain new or modified information collection requirements, will not become effective until the later of: (i) 180 days after publication in the Federal Register ; or (ii) 30 days after the Office of Management and Budget completes review of any information collection requirements that the Consumer & Governmental Affairs Bureau determines is required under the Paperwork Reduction Act. In addition, the amendments to § 64.6305(d)(2)(ii) and (e)(2)(ii), 47 CFR 64.6305(d)(2)(ii) and (e)(2)(ii), will not become effective until the later of: (i) 180 days after publication in the Federal Register ; or (ii) 30 days after the Office of Management and Budget completes review of any information collection requirements that the Wireline Competition Bureau determines is required under the Paperwork Reduction Act for the changes made to these paragraphs in the 2023 Caller ID Authentication Order. The Commission directs the Consumer & Governmental Affairs Bureau and the Wireline Competition Bureau, as appropriate, to announce the effective dates for § 64.6305(d)(2)(ii) and (iii), (e)(2)(ii), and (f)(2)(iii) by subsequent Public Notice.

List of Subjects

47 CFR Part 0

• Authority delegations (Government agencies)
• Communications
• Communications common carriers
• Classified information
• Freedom of information
• Government publications
• Infants and children
• Organization and functions (Government agencies)
• Postal Service
• Privacy
• Reporting and recordkeeping requirements
• Sunshine Act
• Telecommunications

47 CFR Part 64

• Communications common carriers
• Reporting and recordkeeping requirements
• Telecommunications
• Telephone

Federal Communications Commission.

Marlene Dortch,

Secretary, Office of the Secretary.

Final Rules

For the reasons discussed in the preamble, the Federal Communications Commission amends 47 CFR parts 0 and 64 as follows:

PART 0—COMMISSION ORGANIZATION

Subpart A—Organization

1. The authority citation for part 0, subpart A, continues to read as follows:

Authority: 47 U.S.C. 151, 154(i), 154(j), 155, 225, and 409, unless otherwise noted.

2. Amend § 0.111 by revising paragraph (a)(27) to read as follows:

§ 0.111

Functions of the Bureau.

(a) * * *

(27) Identify suspected illegal calls and provide written notice to voice service providers. The Enforcement Bureau shall:

(i) Identify with as much particularity as possible the suspected traffic;

(ii) Cite the statutory or regulatory provisions the suspected traffic appears to violate;

(iii) Provide the basis for the Enforcement Bureau's reasonable belief that the identified traffic is unlawful, including any relevant nonconfidential evidence from credible sources such as the industry traceback consortium or law enforcement agencies; and

(iv) Direct the voice service provider receiving the notice that it must comply with § 64.1200(n)(2) of this chapter.

* * * * *

PART 64—MISCELLANEOUS RULES RELATING TO COMMON CARRIERS

3. The authority citation for part 64 continues to read as follows:

Authority: 47 U.S.C. 151, 152, 154, 201, 202, 217, 218, 220, 222, 225, 226, 227, 227b, 228, 251(a), 251(e), 254(k), 255, 262, 276, 403(b)(2)(B), (c), 616, 617, 620, 1401–1473, unless otherwise noted; Pub. L. 115–141, Div. P, sec. 503, 132 Stat. 348, 1091.

4. Amend § 64.1200 by:

a. Revising paragraphs (k)(5) and (6) and (n)(1);

b. Removing paragraph (n)(2);

c. Redesignating paragraphs (n)(3), (4), (5), and (6) as paragraphs (n)(4), (5), (2), and (3), respectively; and

d. Revising newly redesignating paragraphs (n)(2), (3), and (5).

The revisions read as follows:

§ 64.1200

Delivery restrictions.

* * * * *

(k) * * *

(5) A provider may not block a voice call under paragraphs (k)(1) through (4), paragraph (k)(11), paragraphs (n)(2) and (3), paragraph (n)(5), or paragraph (o) of this section if the call is an emergency call placed to 911.

(6) When blocking consistent with paragraphs (k)(1) through (4), paragraph (k)(11), paragraphs (n)(2) and (3), paragraph (n)(5), or paragraph (o) of this section, a provider must make all reasonable efforts to ensure that calls from public safety answering points and government emergency numbers are not blocked.

* * * * *

(n) * * *

(1) Upon receipt of a traceback request from the Commission, civil law enforcement, criminal law enforcement, or the industry traceback consortium, the provider must fully respond to the traceback request within 24 hours of receipt of the request. The 24-hour clock does not start outside of business hours, and requests received during that time are deemed received at 8 a.m. on the next business day. If the 24-hour response period would end on a non-business day, either a weekend or a Federal legal holiday, the 24-hour clock does not run for the weekend or holiday in question, and restarts at 12:01 a.m. on the next business day following when the request would otherwise be due. For example, a request received at 3 p.m. on a Friday will be due at 3 p.m. on the following Monday, assuming that Monday is not a Federal legal holiday. For purposes of this paragraph (n)(1), business day is defined as Monday through Friday, excluding Federal legal holidays, and business hours is defined as 8 a.m. to 5:30 p.m. on a business day. For purposes of this paragraph (n)(1), all times are local time for the office that is required to respond to the request.

(2) Upon receipt of a Notice of Suspected Illegal Traffic from the Commission through its Enforcement Bureau, take the applicable actions with respect to the identified traffic described in paragraphs (n)(2)(i) through (iii) of this section. The provider will not be held liable under the Communications Act or the Commission's rules in this chapter for providers that inadvertently block lawful traffic as part of the requirement to block substantially similar traffic so long as it is blocking consistent with the requirements of paragraphs (n)(2)(i) through (iii). For purposes of this paragraph (n)(2), identified traffic means the illegal traffic identified in the Notification of Suspected Illegal Traffic issued by the Enforcement Bureau. The following procedures shall apply:

(i)(A) The Enforcement Bureau will issue a Notification of Suspected Illegal Traffic that identifies with as much particularity as possible the suspected illegal traffic; provides the basis for the Enforcement Bureau's reasonable belief that the identified traffic is unlawful; cites the statutory or regulatory provisions the identified traffic appears to violate; and directs the provider receiving the notice that it must comply with this section. The Enforcement Bureau's Notification of Suspected Illegal Traffic shall give the identified provider a minimum of 14 days to comply with the notice. Each notified provider must promptly investigate the identified traffic and report the results of that investigation to the Enforcement Bureau within the timeframe specified in the Notification of Suspected Illegal Traffic. If the provider's investigation determines that it served as the gateway or originating provider for the identified traffic, it must block or cease accepting the identified traffic and substantially similar traffic on an ongoing basis within the timeframe specified in the Notification of Suspected Illegal Traffic. The provider must include in its report to the Enforcement Bureau:

( 1) A certification that it is blocking the identified traffic and will continue to do so; and

( 2) A description of its plan to identify and block or cease accepting substantially similar traffic on an ongoing basis.

(B) If the provider's investigation determines that the identified traffic is not illegal, it shall provide an explanation as to why the provider reasonably concluded that the identified traffic is not illegal and what steps it took to reach that conclusion. Absent such a showing, or if the Enforcement Bureau determines based on the evidence that the traffic is illegal despite the provider's assertions, the identified traffic will be deemed illegal. If the notified provider determines during this investigation that it did not serve as the gateway provider or originating provider for any of the identified traffic, it shall provide an explanation as to how it reached that conclusion and, if it is a non-gateway intermediate or terminating provider for the identified traffic, it must identify the upstream provider(s) from which it received the identified traffic and, if possible, take lawful steps to mitigate this traffic. If the Enforcement Bureau finds that an approved plan is not blocking substantially similar traffic, the identified provider shall modify its plan to block such traffic. If the Enforcement Bureau finds that the identified provider continues to allow suspected illegal traffic onto the U.S. network, it may proceed under paragraph (n)(2)(ii) or (iii) of this section, as appropriate.

(ii) If the provider fails to respond to the Notification of Suspected Illegal Traffic, the Enforcement Bureau determines that the response is insufficient, the Enforcement Bureau determines that the provider is continuing to originate substantially similar traffic or allow substantially similar traffic onto the U.S. network after the timeframe specified in the Notification of Suspected Illegal Traffic, or the Enforcement Bureau determines based on the evidence that the traffic is illegal despite the provider's assertions, the Enforcement Bureau shall issue an Initial Determination Order to the provider stating the Bureau's initial determination that the provider is not in compliance with this section. The Initial Determination Order shall include the Enforcement Bureau's reasoning for its determination and give the provider a minimum of 14 days to provide a final response prior to the Enforcement Bureau making a final determination on whether the provider is in compliance with this section.

(iii) If the provider does not provide an adequate response to the Initial Determination Order within the timeframe permitted in that Order or continues to originate substantially similar traffic onto the U.S. network, the Enforcement Bureau shall issue a Final Determination Order finding that the provider is not in compliance with this section. The Final Determination Orders shall be published in EB Docket No. 22–174 at https://www.fcc.gov/​ecfs/​search/​search-filings. A Final Determination Order may be issued up to one year after the release date of the Initial Determination Order, and may be based on either an immediate failure to comply with this section or a determination that the provider has failed to meet its ongoing obligation under this section to block substantially similar traffic.

(3) When notified by the Commission through its Enforcement Bureau that a Final Determination Order has been issued finding that an upstream provider has failed to comply with paragraph (n)(2) of this section, block and cease accepting all traffic received directly from the upstream provider beginning 30 days after the release date of the Final Determination Order. This paragraph (n)(3) applies to any provider immediately downstream from the upstream provider. The Enforcement Bureau shall provide notification by publishing the Final Determination Order in EB Docket No. 22–174 at https://www.fcc.gov/​ecfs/​search/​search-filings. Providers must monitor EB Docket No. 22–174 and initiate blocking no later than 30 days from the release date of the Final Determination Order. A provider that chooses to initiate blocking sooner than 30 days from the release date may do so consistent with paragraph (k)(4) of this section.

* * * * *

(5) Take reasonable and effective steps to ensure that any originating provider or intermediate provider, foreign or domestic, from which it directly receives traffic is not using the provider to carry or process a high volume of illegal traffic onto the U.S. network.

* * * * *

4. Amend § 64.6305 by revising paragraphs (a)(2) and (c)(2) to read as follows:

§ 64.6305

Robocall mitigation and certification.

(a) * * *

(2) Any robocall mitigation program implemented pursuant to paragraph (a)(1) of this section shall include reasonable steps to avoid originating illegal robocall traffic and shall include a commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement, and the industry traceback consortium, and to cooperate with such entities in investigating and stopping any illegal robocallers that use its service to originate calls.

* * * * *

(c) * * *

(2) Any robocall mitigation program implemented pursuant to paragraph (c)(1) of this section shall include reasonable steps to avoid carrying or processing illegal robocall traffic and shall include a commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement, and the industry traceback consortium, and to cooperate with such entities in investigating and stopping any illegal robocallers that use its service to carry or process calls.

* * * * *

5. Delayed indefinitely, further amend § 64.6305 by revising paragraphs (d)(2)(ii) and (iii), (e)(2)(ii), and (f)(2)(iii) to read as follows:

§ 64.6305

Robocall mitigation and certification.

* * * * *

(d) * * *

(2) * * *

(ii) The specific reasonable steps the voice service provider has taken to avoid originating illegal robocall traffic as part of its robocall mitigation program, including a description of how it complies with its obligation to know its customers pursuant to § 64.1200(n)(4), any procedures in place to know its upstream providers, and the analytics system(s) it uses to identify and block illegal traffic, including whether it uses any third-party analytics vendor(s) and the name(s) of such vendor(s);

(iii) A statement of the voice service provider's commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement, and the industry traceback consortium, and to cooperate with such entities in investigating and stopping any illegal robocallers that use its service to originate calls; and

* * * * *

(e) * * *

(2) * * *

(ii) The specific reasonable steps the gateway provider has taken to avoid carrying or processing illegal robocall traffic as part of its robocall mitigation program, including a description of how it complies with its obligation to know its upstream providers pursuant to § 64.1200(n)(5), the analytics system(s) it uses to identify and block illegal traffic, and whether it uses any third-party analytics vendor(s) and the name(s) of such vendor(s);

* * * * *

(f) * * *

(2) * * *

(iii) A statement of the non-gateway intermediate provider's commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement, and the industry traceback consortium, and to cooperate with such entities in investigating and stopping any illegal robocallers that use its service to carry or process calls; and

* * * * *