06A Trust in Communications, Paper 5: Even If the Proposed FCC Rules Work Perfectly, Will They Be Enough?
Even If the Proposed FCC Rules Work
Perfectly, Will They Be Enough?
Why Know-Your-Customer and Authentication Mandates Cannot Be the Sole Arbiter of Trust
TRUST IN COMMUNICATIONS · PAPER 5 OF 7 · ICA AI, Inc. · +Trusted Infrastructure · July 2026
A +Trusted Infrastructure series from ICA AI
Series editor: John Perkins, Chief Executive Officer
This paper grants the proposed know-your-customer and know-your-upstream rules the most generous assumption available: a flawless rollout and full compliance. The argument does not rely on the relationship layer, and makes no claim about any product. The argument is entirely about the rules on their own terms. Even granting perfect compliance at origin, the enforcement remedy behind these rules is a slow sequence ending in a sanction so severe it is never used quickly — which means a bad actor can operate in the lag. Prevention leaks at the edges by the rules’ own scope, and enforcement arrives too late to patch it. That is why compliance, even flawless, cannot be the sole arbiter of which calls get through.
Granting the best case
Assume everything the rules’ strongest advocate would ask for. Every originating provider knows its customers. Every upstream provider is vetted. Attestation is applied correctly and consistently across the compliant network. This paper does not argue that outcome is impossible or that the rules are misguided — it stipulates the ideal and asks a narrower question: with compliance working exactly as designed, is the framework enough to serve as the arbiter of trust?
What perfect means here needs defining, because otherwise the argument looks like it wants things both ways — granting perfect prevention and then relying on evasion. It does not. Perfect compliance with the rules as written is not the same as perfect prevention. The rules are origin level, and the previous paper showed that origin-level coverage cannot reach the edges where fraud routes — the under-resourced originator, the foreign segment, the transit hop that strips a signature. So even a flawless rollout leaves a prevention gap, and it leaves it not through any failure to comply but by the rules’ own scope. Grant perfect compliance, then. Evasion still occurs, by scope rather than by breach, and the real question becomes what the framework does about the traffic that gets through anyway.
The remedy is a sequence, not a switch
When a bad actor slips through, the rules do not stop them at the moment of the offense. Enforcement is a sequence, and the length of the sequence is the point. Walk it stage by stage. First the violation has to be detected, which itself takes time, since the harm usually surfaces before its source is identified. Then it is investigated, to establish who is responsible and whether the conduct meets the standard for action. Then the provider is noticed and given an opportunity to respond, and to appeal — due process that a fair system owes even to bad actors. And only then, at the far end and only sometimes, comes removal from the Robocall Mitigation Database, the step that effectively ends a company’s ability to originate traffic. Each stage takes time because fairness requires it. The framework is built to prevent and to punish, but the punishment arrives at the end of a process measured in weeks, months, and sometimes years — while the harm is measured in the length of a phone call.
The first stage is usually the longest and the least visible. Detection is not instantaneous, because fraud announces itself through its effects, not its source. The harm surfaces first — a wave of complaints, a spike in a particular scam, a pattern of losses — and only then does the work of tracing it back to a responsible originator begin. By the time the source is identified with enough confidence to act, the operation has often been running for a long stretch, and the damage that triggered the detection is already done. Everything downstream of detection — investigation, notice, appeal, removal — then adds its own time on top. So the lag is not one delay but a stack of them, and the first and largest is the one that runs before anyone even knows where to point.
The severe sanction is never used quickly — for good reason
Removal from the database is the framework’s ultimate sanction, and the record shows how deliberately it is used. The first mass removals came in August 2025: an initial 185 providers, then the certifications of more than 1,200 more three weeks later; another 1,203 followed in January 2026 — the first mass sweeps in the database’s history. None of it was quick. The compliance deadline the August cohort missed fell in February 2024; the show-cause order reached 2,411 providers in December 2024; removal landed in August 2025 — eighteen months from missed deadline to disconnection, and a removed provider may refile only with the agency’s approval. Set that against the scale of the problem: U.S. consumers received 52.5 billion robocalls in 2025 alone, 29.6 billion of them scam calls, while reported fraud losses reached a record of roughly $16 billion. It is important to read that record correctly. The pace is not slow because the agency is failing. It is slow because due process and proportionality are real constraints that a fair regulator observes, and because even a mass removal comes only after warnings, cure periods, and a formal show cause process. The restraint is reasonable. An agency that pulled that sanction casually, on thin evidence, would be acting lawlessly, and the same caution that makes the process fair is what makes it slow. The slowness is not a bug that better administration would fix; it is the cost of doing enforcement fairly, and it is a cost worth paying — which is exactly why the remedy cannot also be the real-time arbiter of a live call.
The lag is the opportunity
A bad actor does not need the enforcement process to fail. They need it to be slow, and it is slow by design. So they operate inside the lag — the interval between the offense and the sanction — and they treat that interval as the business model rather than a risk to it. Spin up an originating entity, run traffic through the gap while the clock on detection and investigation and appeal runs its course, and when removal finally lands, the entity has already earned out. The mass-fraud economics of the space make it cheap to reconstitute under a new name and begin the clock again. Meanwhile the policy response to a genuinely new evasion is often another rulemaking, which runs on the timescale of months and years while the traffic runs on the timescale of seconds. Prevention is a rule; fraud is a race — and the remedy is always running a lap behind, catching the runner who has already finished.
Why removal does not end the traffic
Even when the sequence runs to its end and the sanction lands, the traffic does not necessarily stop, because the entity that was removed is not the same thing as the operation behind it. Removal ends a company’s registration; it does not end the people, the capital, or the know-how that ran it. In a market where standing up a new originating entity is cheap and fast, the rational response to removal is not to exit the business but to reconstitute it — a new name, a new registration, the same operation, and the enforcement clock reset to zero. The regulator, having spent months of process to remove one entity, then faces the same operation again under a different label and must begin the sequence anew from detection. This is not a failure of the removal; the removal did exactly what it was designed to do. It is a mismatch of speed and cost. The sanction is expensive and slow to apply, and the thing it removes is cheap and fast to replace, and a remedy that costs the enforcer more than it costs the offender to evade cannot, on its own, win a volume game. The math of the contest favors the side that can reset the clock, and that is the side the rules are trying to stop.
A referee who can only review the goal
The structural picture is a referee who is not on the field during the play but reviews it afterward from the replay booth — and who, by rule, may overturn the call only in the clearest cases, and rarely does. Every part of that is fair. The referee is impartial; the review is careful; the standard for reversal is appropriately high, because reversing a result is a serious act. And the goal still counts, far more often than not, because by the time the review concludes the play is long over and the score already stands. Nothing about this describes a broken referee. It describes a referee built to review rather than to intervene — and a system that decides trust only in the replay booth cannot decide, in the moment the call is live, whether this particular call should be trusted. The competence of the review is not the issue. Its timing is. The series never asks whether the offender is eventually punished; it asks whether the person receiving the call should trust it before answering.
Prevention leaks, enforcement lags
This paper and the one before it are two halves of a single argument. The previous paper showed that prevention leaks at the edges, because the economics of authentication break down exactly where fraud routes. This paper shows that enforcement lags because a fair remedy is, by necessity, a slow one. Those are the only two things a compliance regime can do — prevent and punish — and each has a structural gap the other cannot close. Prevention cannot reach the edge; enforcement cannot arrive in time. Between them they leave a space, and the space is not incidental — it is exactly the space in which a live trust decision has to be made: this call, right now, before it connects and before any enforcement process could possibly run.
What a live decision actually needs
What falls into that space can be named. A live trust decision needs something present at the moment of the call, specific to the parties on it, and able to weigh behavior rather than only origin. Prevention offers a pre-call credential that says nothing about conduct; enforcement offers an after the-fact judgment that arrives too late to inform the call it concerns. Neither operates at the moment and place where the decision is actually made. This is not an argument that the rules should be weaker or that compliance is pointless — it is a real and valuable improvement, and granting it its perfect day is the fairest test available. It is an argument that a framework which can only prevent at origin and punish after the fact has, by its own structure, left the live decision unmade. Granting the rules their perfect day does not close that gap. It clarifies where it is.
About this series
Trust in Communications is a seven-part white-paper series, with two companion volumes and a concluding epilogue, examining one question: whether verifying identity is enough to establish trust in voice communications. The list below is in reading order — the companions sit where they are best read, not at the end.
- What Trust Actually Is
◇ Companion — Voice Fraud: The Evidence - The Role of Caller Authentication in Establishing Trust
- The One Layer That Can Stand Alone
- The Permanent Coverage Gap
- Even If the Proposed FCC Rules Work Perfectly, Will They Be Enough? (this paper)
◇ Companion — The Proposed FCC Rules - Why a Relationship Cannot Be Faked at Scale
- The Compromised Account
◆ Epilogue — What Changed, What Remains True
Read the full series at ICATrusted.ai.
Drafted with AI assistance; all analysis, claims, and conclusions rest with the series editor.