FCC Proposes Major Robocall Database Overhaul: What Small Businesses Need to Know

What Is the FCC’s 2026 Robocall Mitigation Database Proposal?

As of August 2026, the FCC has proposed a sweeping overhaul of its Robocall Mitigation Database (RMD) that would expand filing requirements for VoIP providers, tighten compliance enforcement, and create new screening measures to block bad actors from the U.S. voice network. The proposal, adopted on July 22, 2026, opens a public comment period and signals the most significant restructuring of robocall prevention rules since the TRACED Act took effect in 2021. For any business that depends on a VoIP phone system, these changes directly affect whether your provider can continue carrying your calls.

Broader provider coverage: The FCC would require VoIP resellers, virtual network operators, and cloud calling platforms to file in the RMD for the first time, not just traditional carriers.

Stricter enforcement: Providers that submit inaccurate filings face a $10,000 base fine per violation, and the FCC is proposing a one-step removal process for egregious conduct.

Direct business impact: If your VoIP provider is removed from the RMD, downstream carriers can refuse to deliver your calls, effectively shutting down your business phone service.

What the FCC Proposed on July 23

On July 23, 2026, the FCC voted 3-0 to release a Further Notice of Proposed Rulemaking (FNPRM) targeting the Robocall Mitigation Database. The RMD is the federal registry where every voice service provider in the United States must certify how it prevents illegal robocalls from traveling across its network. Downstream carriers are only allowed to accept call traffic from providers listed in the database. If a provider is removed, every call it tries to route gets blocked.

The July 2026 FNPRM is not the first change to the RMD this year. It is the fourth major robocall-related rulemaking the FCC has launched since March 2026. The others address Know Your Customer (KYC) verification, Know Your Upstream Provider (KYUP) obligations, and number resale reforms. Together, they represent the most aggressive push against illegal robocalls the FCC has ever undertaken in a single calendar year.

The proposal covers three main areas. First, the FCC wants to significantly expand which entities must file in the RMD. Second, providers would be required to submit far more detailed information about their business, ownership structure, and upstream relationships. Third, the FCC is proposing enhanced screening, faster removal procedures, and a debarment process to permanently block repeat offenders from the database. Public comments are due 30 days after the proposal is published in the Federal Register, with reply comments due at the 60-day mark.

Who Does the Robocall Mitigation Database Affect?

The RMD affects every business that uses a phone, but not in the way most owners expect. The filing obligations fall on voice service providers, not on end-user businesses. Your VoIP company, traditional carrier, or cloud phone platform is the entity that must register, certify its robocall mitigation practices, and keep that information current.

The reason small businesses should pay attention is that compliance failures at the provider level cascade directly to customers. When a provider’s RMD filing is removed or suspended, other carriers in the call chain are required to stop accepting traffic from that provider. In practical terms, that means your outbound calls stop connecting and your inbound calls never arrive. There is no grace period for end users. The disruption is immediate.

The July 2026 FNPRM expands the definition of “voice service provider” to include VoIP resellers, mobile virtual network operators (MVNOs), cloud service providers, over-the-top calling apps, and even certain call centers. This matters because many small businesses use services built on top of wholesale VoIP platforms. If the underlying provider loses its RMD standing, every business running on that platform is affected. In our experience helping businesses choose affordable VoIP phone service, the lowest price means nothing if the provider behind it cannot keep its calls on the network.

Why the FCC Is Tightening the Rules Now

The FCC’s enforcement data tells the story. In 2025, the agency removed over 1,200 provider certifications from the RMD after those providers failed to update deficient filings even after multiple warnings. Earlier in 2026, new rules imposed a $10,000 base forfeiture for submitting false or inaccurate information and a $1,000 penalty for failing to update changed information within 10 business days. The annual recertification deadline of March 1, 2026, was the first under this stricter regime.

Despite these measures, the FCC found that bad actors continued to exploit gaps in the system. Some providers used shell companies to refile after removal. Others submitted minimal information that made it difficult for enforcement teams and downstream carriers to verify legitimacy. The July 2026 FNPRM directly targets these loopholes by proposing parent-subsidiary disclosure requirements, third-party filing transparency rules, and a formal debarment process.

The timing also reflects a broader regulatory pattern. The FCC adopted KYC requirements for originating VoIP providers in April 2026, KYUP obligations in May, and number resale reforms around the same time. The RMD overhaul is the compliance layer that ties all of these together. Providers that cannot demonstrate they know their customers, verify their upstream sources, and actively block illegal calls will face removal from the database and, with it, removal from the U.S. voice network.

What Does This Mean for Your Business Phone Service?

For most small businesses, the direct action required is minimal. You do not file in the RMD yourself, and the FCC is not proposing new obligations for end-user businesses. What you do need is confidence that your VoIP provider is compliant, well-established, and positioned to meet the new requirements without disruption.

We talk to business owners every week who chose their phone provider based on price alone and never asked a single question about regulatory compliance. The problem only surfaces when calls start failing. By then, the provider may already be in enforcement proceedings, and switching to a new service takes days your business does not have. A provider that already maintains full STIR/SHAKEN implementation, files accurate RMD certifications, and supports rapid traceback requests is one that will not be caught off guard by these new rules.

Requirement	Current RMD Rules	Proposed July 2026 Changes
Who must file	Originating, intermediate, terminating, and gateway providers	All of the above plus VoIP resellers, MVNOs, cloud platforms, OTT apps, and some call centers
Ownership disclosure	Basic company information	Full parent, subsidiary, and affiliate disclosure with separate filings required
Robocall mitigation plan standard	“Reasonable steps” to prevent illegal calls	“Affirmative, effective measures” covering all illegal calls, not just robocalls
False filing penalty	$10,000 per violation (effective Feb. 2026)	Same, plus proposed one-step removal for egregious conduct
Removal process	Multi-step with cure period	Expedited one-step removal proposed for serious violations
Traceback cooperation	24-hour response required	Automated traceback participation may become mandatory

Source: FCC FNPRM FCC-26-49, adopted July 22, 2026. Status: proposed, not yet finalized.

Phone Service Now maintains full STIR/SHAKEN implementation across its network, files accurate RMD certifications, and operates on infrastructure built around Cisco and Poly hardware. The proposed changes reinforce what compliant providers already do. The businesses most at risk are those using cut-rate services built on reseller platforms that may not survive the new scrutiny.

How to Verify Your VoIP Provider Is Compliant

You do not need to read FCC filings to check on your provider. These six steps give you a clear picture of where your phone service stands.

1. Search the Robocall Mitigation Database directly. The FCC publishes all active RMD filings at fcc.gov/robocall-mitigation-database. Enter your provider’s name and confirm they appear with a current filing date.
2. Ask whether your provider implements STIR/SHAKEN. Full implementation means your outbound calls carry a cryptographic signature verifying the caller ID is legitimate. Partial or no implementation increases the chance your calls get flagged or blocked.
3. Confirm the provider’s annual recertification is current. Under the rules that took effect in February 2026, every provider must recertify by March 1 each year. A lapsed recertification is a red flag.
4. Check whether your provider is facilities-based or a reseller. Resellers depend on upstream carriers for network access. If the upstream carrier has compliance issues, every reseller on that network is exposed. Ask your provider to identify who carries its traffic.
5. Request a copy of the provider’s robocall mitigation plan. Compliant providers should be able to describe their call analytics, traceback response procedures, and customer vetting practices without hesitation.
6. Review your call quality and delivery patterns. Unexplained increases in calls marked “Spam Likely” or a spike in unanswered outbound calls can indicate that your provider’s caller ID reputation is degraded. This is often an early sign of compliance problems. Choosing the right

Common Misconceptions About Robocall Rules

Several misunderstandings circulate among business owners about what the FCC’s robocall rules mean in practice. Clearing these up can prevent costly mistakes.

The first misconception is that small businesses are exempt. The RMD filing requirement applies to providers, not to the size of the business using the service. A two-person startup and a 500-employee company face the same exposure if their provider is removed from the database. The second is that STIR/SHAKEN eliminates spam calls entirely. It does not. STIR/SHAKEN verifies that the caller ID has not been spoofed, but it does not evaluate the content or legality of the call itself. A verified call can still be unwanted.

The third is that switching providers is simple if something goes wrong. Porting a phone number from a provider under FCC enforcement action can be complicated and slow. In some cases, the number may be tied up in the provider’s account while the enforcement proceeding plays out. Building a relationship with a compliant provider before a problem arises is far less disruptive than scrambling after one.

Finally, some business owners assume that registering with the Free Caller Registry is enough to protect their calls. The registry helps legitimate businesses submit their number information to carrier analytics engines, but it does not replace the provider-level compliance that the RMD requires. Both layers work together, and neither substitutes for the other. If you are evaluating affordable business cell phone plans or VoIP options, make sure the provider behind those plans can pass the compliance test.

Frequently Asked Questions

Next Steps

Review your current VoIP provider’s RMD filing status using the FCC’s public database search tool.

Ask your provider whether they implement full STIR/SHAKEN and whether their March 2026 recertification is current.

If your provider cannot confirm compliance, explore alternatives with a provider like Phone Service Now that maintains full STIR/SHAKEN implementation and transparent RMD filings.

For a breakdown of what to look for in a business phone system, read our guide to the best cordless VoIP phones for offices.