Federal Communications Commission: Call Authentication Trust Anchor

B-337811

September 11, 2025

The Honorable Ted Cruz
Chairman
The Honorable Maria Cantwell
Ranking Member
Committee on Commerce, Science, and Transportation
United States Senate

The Honorable Brett Guthrie
Chairman
The Honorable Frank Pallone, Jr.
Ranking Member
Committee on Energy and Commerce
House of Representatives

Subject: Federal Communications Commission: Call Authentication Trust Anchor

Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Federal Communications Commission (FCC) entitled “Call Authentication Trust Anchor” (FCC 24-120). We received the rule on December 5, 2024. It was published in the Federal Register on August 19, 2025.[1] 90 Fed. Reg. 40241. The stated effective date of the rule is September 18, 2025.

According to FCC, this rule strengthens FCC's caller ID authentication requirements by establishing clear practices for providers that rely on third parties to fulfill their STIR/SHAKEN implementation obligations. The rule authorizes providers with a STIR/SHAKEN implementation obligation to engage third parties to perform the technological act of digitally “signing” calls consistent with the requirements of the STIR/SHAKEN technical standards so long as: the provider with the implementation obligation makes the “attestation-level” decisions for authenticating caller ID information; and all calls are signed using the certificate of the provider with the implementation obligation—not the certificate of a third party. The rule also explicitly requires all providers with a STIR/SHAKEN implementation obligation to obtain a Service Provider Code token from the STIR/SHAKEN Policy Administrator and present that token to a STIR/SHAKEN Certificate Authority to obtain a digital certificate. Additionally, the rule includes recordkeeping requirements for third-party authentication arrangements to enable FCC to monitor compliance with and enforce FCC rules.

The Congressional Review Act (CRA) requires a 60-day delay in the effective date of a major rule from the date of publication in the Federal Register or receipt of the rule by Congress, whichever is later. 5 U.S.C. § 801(a)(3)(A). The House of Representatives received this rule on December 9, 2024. 170 Cong. Rec. H7315 (daily ed. Dec. 17, 2024). The Senate received the rule on December 10, 2024. 170 Cong. Rec. S6972 (daily ed. Dec. 11, 2024). The rule was published in the Federal Register on August 19, 2025. 90 Fed. Reg. 40241. The rule has a stated effective date of September 18, 2025. Therefore, the stated effective date is less than 60 days from the date of publication in the Federal Register.

Enclosed is our assessment of FCC's compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule. If you have any questions about this report or wish to contact GAO officials responsible for the evaluation work relating to the subject matter of the rule, please contact Charlie McKiver, Assistant General Counsel, at (202) 512-5992.

Shirley A. Jones
Managing Associate General Counsel

Enclosure

cc: Zachary Ross
Assistant Division Chief, Competition Policy Division, Wireline Competition Bureau
Federal Communications Commission

ENCLOSURE

REPORT UNDER 5 U.S.C. § 801(a)(2)(A) ON A MAJOR RULE
ISSUED BY THE
FEDERAL COMMUNICATIONS COMMISSION
ENTITLED
“CALL AUTHENTICATION TRUST ANCHOR”
(FCC 24-120)

(i) Cost-benefit analysis

The Federal Communications Commission (FCC) prepared an analysis of the costs and benefits for this rule. 90 Fed. Reg. 40241, 40248–49 (Aug. 19, 2025). FCC estimates that the benefits of the rule will greatly exceed the costs imposed on providers. Id.

(ii) Agency actions relevant to the Regulatory Flexibility Act (RFA), 5 U.S.C. §§ 603–605, 607, and 609

FCC determined that this rule will have a significant economic impact on a substantial number of small entities, and prepared a Final Regulatory Flexibility Analysis. 90 Fed. Reg. 40241, 40250–54.

(iii) Agency actions relevant to sections 202–205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. §§ 1532–1535

As an independent regulatory agency, FCC is not subject to the Act.

(iv) Other relevant information or requirements under acts and executive orders

Administrative Procedure Act, 5 U.S.C. §§ 551 et seq.

On May 5, 2023, FCC published a proposed rule. 88 Fed. Reg. 29035. FCC stated that they received comments from various interested parties. See 90 Fed. Reg. 40241, 40243–51. FCC responded to comments in the rule. Id.

Paperwork Reduction Act (PRA), 44 U.S.C. §§ 3501–3520

FCC determined that this rule contains information collection requirements under the Act. 90 Fed. Reg. 40241, 40254.

Statutory authorization for the rule

FCC promulgated this rule pursuant to sections 227b(b)(1)(A), 227(e), and 251(e) of title 47, United States Code.

Executive Order No. 12866 (Regulatory Planning and Review)

FCC indicated in its submission to us that the agency did not discuss the Order in this rule.

Executive Order No. 13132 (Federalism)

As an independent regulatory agency, FCC is not subject to the Order.