06B Trust in Communications, Companion B: The Proposed FCC Rules

Know-Your-Customer, Enforcement, and the Gaps That Remain
TRUST IN COMMUNICATIONS · COMPANION VOLUME · ICA AI, Inc. · +Trusted Infrastructure · July 2026

A +Trusted Infrastructure series from ICA AI
Series editor: John Perkins, Chief Executive Officer
Drawn from the FCC public record (CG Dockets 17-59 / 02-278, WC Docket 17-97; FCC 26-27, FCC 26-32). Figures current as of July 2026; the docket posture is live and may change.

This companion to the Trust in Communications series explains the rules the industry is treating as its answer to voice fraud — what they require, who has to carry them out, how they are enforced, and, above all, when they actually take effect. Drawn entirely from the public record, it reaches a plain conclusion. The requirements that would genuinely tighten the network are still proposals in an open comment cycle. They run at the origin, where a provider vets who may put calls on the network, and never at the relationship between the two parties on a call. And the path from proposal to a rule taking effect runs for years. A solution that isn’t enforceable for years, and that structurally cannot reach the offshore edge, leaves the coverage gap open for a long time. The rules raise the floor — which is worth doing — but by their design they do not decide whether a given communication should be trusted.

Why they need something new
Start with the question the proposals themselves answer: if the existing rules worked, why write new ones? The network has not been unregulated. For years, originating providers have been required to know their customers, to authenticate calls through the STIR/SHAKEN caller-ID framework, to support one-day traceback, and to block categories of clearly illegal traffic. That framework is real, and it did real work. And yet, across those same years, reported fraud losses kept climbing and the share of calls people least want kept rising. The existence of a new, more demanding proposal is itself the admission: the rules in place did not close the gaps they were built to close. This is not to say the old rules failed outright — they narrowed some kinds of abuse — but the abuse that mattered most routed around them. Everything that follows is the FCC’s attempt to reach further. The question this companion asks is how much further it can actually reach.

Adopted law versus proposal
The single most important thing to hold onto is the difference between what is law today and what is merely proposed, because the industry’s confidence borrows from the second while the network only runs on the first. What is adopted law today is a baseline: originating providers already must take effective measures to know their customers and their upstream partners, every provider in the call path must file and stand behind a robocall-mitigation plan, and the FCC enforces this with real tools — removal from the mitigation database (which cuts a provider off from the U.S. network), traceback, cease-and-desist orders, and monetary settlements such as the Lingo Telecom AI-voice case. That baseline is genuine.

What is not yet law is everything that would turn that general duty into a detailed checklist. Today’s rule tells providers to know their customers but leaves the how to them; the proposals would replace that with an exact set of required steps — specific information to collect, verify, retain, and re-check. All of it lives in Further Notices of Proposed Rulemaking adopted for comment in spring 2026, with no final rules and no effective dates. When someone says the FCC “is requiring” these steps, they are describing a proposal in the present tense. That single tense shift is where the grand-solution story quietly overstates the record.

The Know-Your-Customer proposal (FCC 26-27)
The centerpiece is the Know-Your-Customer proposal, adopted for comment on April 30, 2026. It would convert today’s general duty into a concrete framework for originating providers — the phone companies that place calls onto the network, from a national carrier to a small VoIP or wholesale operator. Before such a provider may let a customer — the business or bulk caller buying the rightto originate calls — make calls, it would have to collect at least the customer’s name, physical address, government-issued identification number, and an alternate telephone number; verify that information; retain the records for four years; and re-verify when red flags arise. High-volume callers would face heavier checks, and the FCC declined to let providers rely on vetting that someone else already performed.

Two features of that list deserve a closer look, because the gap between what a rule says and what it can do lives in the details. The first is the government-issued identification number. Collecting a number is not the same as verifying it against the authority that issued it, and the proposal leans toward collection. A number is a string of digits: a determined actor can supply a stolen real one, a fabricated one that passes format checks, or a synthetic identity assembled from both. Unless the provider checks it against the issuing government’s records — which is hard to do at scale and often impossible across borders — the requirement stops casual fraudsters but not determined ones, and a foreign fraudster hands a U.S. provider an identity it has no practical way to confirm.

The second is the promise to re-verify when “unusual activity” or “a change in traffic patterns” arises. That sounds proactive, but it raises an obvious question: who is watching, and how? The proposal names the red flags without saying who monitors for them, against what baseline, or how quickly — so the re-verification is only as good as a monitoring capability the rule assumes but does not define, fund, or standardize. The instinct behind it is revealing: reaching for changes in behavior over time is a move toward watching conduct rather than checking a credential once. But a provider watching a customer’s aggregate traffic sees volume and destinations in bulk; it has no view into whether any single call fits the relationship between that caller and the person receiving it. The instinct points past a one-time check; the vantage point stops at the origin.

The proposal also asks whether prepaid and postpaid customers should be treated differently — and that this is still an open question is itself telling. Postpaid service is billed after the fact, which leaves a credit check and a paper trail; prepaid is paid up front with minimal identity, easily bought in bulk and discarded, which is exactly why a large share of fraud originates there. Leaving prepaid’s treatment unresolved means the ighest-risk, lowest-identity channel does not yet have a settled standard; if it lands lighter, the rule writes its own bypass. The deeper point is that prepaid is a lawful, mass-market product used by tens of millions, and it is not going to be banned. Applied to prepaid, the effect of KYC is to attach a verified identity to an account that today carries little or none — not to eliminate the product, but to remove its anonymity. Whether that can be done reliably, at scale,
and across borders against fabricated identities is the open question — and for the same reasons the identification check is weak, it is a question the origin-level approach struggles to answer.

.

The companion upstream proposal (FCC 26-32)
Riding alongside it is a Know-Your-Upstream-Provider proposal, taken up in May 2026. A call often passes through several carriers before it reaches a phone; the carrier that hands it to the next one is “upstream” of the carrier receiving it, and the originating carrier is furthest upstream of all. This proposal would require each provider to vet not just its own direct customer but the upstream provider that handed it the traffic — collecting business, ownership, and financial information, checking the upstream provider’s mitigation filings, and verifying what it claims — pushing accountability back up the chain. It would also tighten how the certificates that let a provider participate in call authentication are issued and revoked, and, importantly, codify the A, B, and C attestation levels with specific criteria. The proposal would turn those grades from a convention into a rule.

Who has to deliver it — and who is out of reach
The obligation falls on originating voice service providers on the U.S. network, and the proposed scope is broad, not limited to the largest carriers: wireline, mobile, interconnected VoIP, SIP-trunking and wholesale originators, calling-platform providers, and mobile virtual network operators — with particular attention to prepaid, bulk-SIM, and high-volume outbound accounts, where the crudest abuse concentrates. So the answer to who operationalizes it is: every originating provider touching U.S. traffic, each vetting its own customers and upstream partners as business entities.

What no version of the rule reaches is just as important. The rules vet identity — who a caller is, and whether they may put traffic on the network. They never reach the relationship — whether a given communication fits the history between the two specific parties on it. They do not reach a foreign originator or a transit carrier in a third country, which sit outside the FCC’s jurisdiction. And they do nothing about signatures stripped mid-path: a call signed correctly at its source can still arrive stripped, because the break happens in the middle of the path while the mandate sits at its start. The rule lands at the origin, in one jurisdiction, on identity; the fraud routes around all three of those limits.

How it is policed, and what failure costs
Policing runs through the same machinery that exists today, strengthened. A provider that fails is exposed to per-call forfeitures, to traceback that walks a bad call back to its origin, to cease-and-desist and blocking directives, and ultimately to removal from the mitigation database — the step that cuts a provider off from originating onto the U.S. network. The proposal sets that forfeiture at $2,500 per illegal call, tying the penalty to the volume of bad traffic. That final sanction is not a rarely-used relic; lately it has been used aggressively. In August 2025 the Enforcement Bureau removed 185 providers, then over 1,200 more three weeks later; further removals followed, and in January 2026 it cut off another 1,203. To size that against the whole: roughly 9,200 providers are registered in the database. The December 2024 show-cause cohort alone — about 2,400 flagged for deficient filings, some 1,400 ultimately removed — came to roughly fifteen percent of that universe, and the January tranche pushed cumulative removals past 2,500, disconnected in a matter of months.

That volume is real. But two things put it in proportion. First, this was the first time the tool had been swung at scale: the removals cleared a backlog of deficient filings that had built up for years under looser rules, after a 2024 order tightened the standard and directed those 2,400 providers to cure or be cut. A first-time catch-up is not a repeatable engine — a backlog can only be cleared once. Second, the removals were overwhelmingly for paperwork — inaccurate or incomplete certifications — not the slow, case-by-case adjudication of a provider proven to be originating fraudulent traffic, which still runs through detection, investigation, notice, and appeal before any sanction lands.

What comes next is the harder problem, and it is different from the cleanup. Small originating providers serve only a sliver of real subscribers, but they carry a disproportionate share of illegal traffic — which is exactly why they are the target, and why the removals hit real fraud volume rather than a rounding error. But they are cheap to start and quick to replace. Remove one and its fraud customers route to the next; the operator reconstitutes under a fresh filing while the clock resets. And the reconstitution need not even be sequential. Nothing in the framework stops one operator from registering several entities at once and holding the spares in reserve — in which case removal costs no time at all, because the successor is already filed and already registered. The enforcement sequence assumes a gap between being cut off and coming back; parallel registration closes that gap before it opens. The database can be swept clean of who is registered today. It cannot stop who registers tomorrow. Whether enforcement can keep pace with that turnover, rather than clear a one time backlog, is the open question the removal numbers do not answer.

The chronology
Here is the timing, which is the heart of the matter. The baseline duty dates to 2020; one-day traceback and expanded blocking came in 2023; further blocking and call-branding items came in2025 The two proposals that matter here were adopted for comment only in spring 2026 — the Know-Your-Customer item on April 30, with comments due June 25 and reply comments July 27, and the upstream item in May. As of this writing the record is still in its comment window. Nothing after that is scheduled: the FCC must still write and adopt final rules, set effective dates, and phase incompliance — each of which takes months to over a year, and effective dates in this area have a documented habit of slipping once set. The realistic path from today’s proposals to rules that actually bind and are actually enforced is measured in years.

What the record adds up to
Set the findings side by side, drawn only from the record:

• They are proposals, not law — and years away from taking effect.
• They act at the origin, vetting who may put calls on the network — never at the relationship between the two parties on a call.
• They cannot reach the offshore originators and transit segments where much of the fraud routes, which sit outside any single national rule.
• Their central identity check can be satisfied with an identity that was never verified at its source. Each is a way of saying the same thing: the rules raise the floor, and the floor is worth raising, but a floor is not a decision about whether a given call should be trusted.

That is not a case against the rules. It is a description of what they leave unsolved. The problem the proposals are chasing — deciding, in the moment, whether a communication is what it claims to be — remains unsolved when the last proposal is adopted, because it sits at a layer these rules do not operate on. The current path can raise the floor but, by its own structure, cannot be enough, and the problem is still open. That opening is what invites a different approach — one aimed not at who maoriginate a all, but at whether the call fits the relationship it claims. ICA AI is pursuing exactly that approach, and says so plainly here; this companion makes its case on the public record alone and leaves the reader to judge whether the gap it documents is real. If it is, closing it is work that still has to be done — attempted, and proven — by someone. That much the record makes clear.

About this series
Trust in Communications is a seven-part white-paper series, with two companion volumes and a concluding epilogue, examining one question: whether verifying identity is enough to establish trust in voice communications. The list below is in reading order — the companions sit where they are best read, not at the end.

1. What Trust Actually Is
   ◇ Companion — Voice Fraud: The Evidence
2. The Role of Caller Authentication in Establishing Trust
3. The One Layer That Can Stand Alone
4. The Permanent Coverage Gap
5. Even If the Proposed FCC Rules Work Perfectly, Will They Be Enough?
   ◆ Companion — The Proposed FCC Rules (this volume)
6. Why a Relationship Cannot Be Faked at Scale
7. The Compromised Account
   ◆ Epilogue — What Changed, What Remains True

Read the full series at ICATrusted.ai.

Drafted with AI assistance; all analysis, claims, and conclusions rest with the series editor.