STIR/SHAKEN attestation levels A, B, and C, explained

STIR/SHAKEN attestation levels tell the networks a call passes through how much the provider that placed it knows about the caller and the number. A (full) means it knows the customer and has verified the customer may use the number. B (partial) means it knows the customer but not the number. C (gateway) means it has no relationship with whoever started the call.

What STIR/SHAKEN is

STIR/SHAKEN is the caller ID authentication framework the FCC requires on US voice networks. It is a set of technical standards that lets the provider that originates a call sign its caller ID, so the networks after it can check that the number was not spoofed. The names stand for Secure Telephone Identity Revisited (STIR) and Signature-based Handling of Asserted information using toKENs (SHAKEN).

The mandate comes from Congress. The TRACED Act, enacted on 30 Dec 2019, required the FCC to mandate STIR/SHAKEN. On 31 Mar 2020 the FCC ordered originating and terminating providers to implement it in the IP parts of their networks by 30 Jun 2021. The FCC has since extended the duty to gateway providers, which bring calls from abroad into the US, and to intermediate providers that receive unsigned calls directly from an originating provider. The framework only works on IP networks, so providers that still run older networks must upgrade or work on a non-IP solution.

On each call, as the FCC’s May 2026 notice describes it:

1. The originating provider builds a signed token, called a PASSporT, with its name and digital signature, the calling number, and an attestation level.
2. The token travels with the call in the SIP Identity header, through any intermediate networks.
3. The terminating provider checks the signature and can use the result in its efforts to stop illegal calls.

This article covers the US rules, as of October 2026.

What A, B, and C attestation mean

The levels are defined in ATIS-1000074, a joint ATIS and SIP Forum standard and one of the 3 ATIS standards that FCC rules require providers to follow, at a minimum. Each level is a statement about what the provider knows, not about what the call says.

Level	Name	Placed the call onto its IP network	Knows and can identify the customer	Verified the customer may use the number	Typical case
A	Full	Yes	Yes	Yes	You call from numbers your provider assigned to you
B	Partial	Yes	Yes	No	Your provider knows you, but shows a number it has not verified
C	Gateway	No relationship with the caller	No	No	A call that enters the network through an international gateway

Two details matter in practice. The standard also lets a provider use C when it lacks the information for A or B, even for a call from its own customer. The FCC’s May 2026 notice asks whether a C from the provider that originated the call should count as an improper attestation. And the FCC notes that calls with B or C are not necessarily spoofed: the level shows that the provider does not know enough to say so.

Who assigns the level? The originating provider, the one that places your call onto the network. You cannot pick a level or add one yourself. As of October 2026, 47 CFR 64.6301 lets a provider hire a third party to sign its calls, but the provider must make every attestation decision itself and sign with its own certificate.

The terminating network can pass the result to the phone. Under ATIS-1000074, it may mark a call “TN-Validation-Passed” only if the verified level is A, or if it also passes on the level itself. Whether and how a phone shows that is up to the network and the device.

How a business gets full attestation

For A, the provider that places your calls must meet all 3 conditions in the table. The standard leaves it to each provider’s policy what counts as a legitimate right to use a number. Its examples start with a number the signing provider assigned to that customer, or a range of numbers assigned to a business, and it also allows a business agreement or evidence that the customer can use a number from another provider.

1. Call from numbers your provider assigned to you. When the same provider supplies your numbers and places your calls, it already has the verified link between you and each number.
2. Be a verified customer. Expect your provider to check who you are before it signs your calls. FCC rules already require voice service providers to know their customers and to take effective steps to keep new and renewing customers from originating illegal calls (47 CFR 64.1200(n)(4)).
3. Show only numbers you are entitled to use. If you show a number from another provider, such as your office phone system, the provider that places the call must confirm you are authorized to use it, or it can give B at most. Do not borrow numbers that are not assigned to your business.
4. Ask your provider directly. Ask which company signs your calls, what attestation level a sample of your calls carries, and whether that company is listed in the Robocall Mitigation Database.

The FCC wants to make these checks stricter. Its notice adopted on 20 May 2026 (FCC 26-32) proposes to write the A, B, and C criteria into its rules and to prohibit improper attestations. A provider would have to meet its know-your-customer duties before it gives A or B. Assigning the number to the customer would count as the verified link for A, while a general statement that a customer will only use numbers it is entitled to would not. As of October 2026, these are proposals, not rules.

The notice explains why with its own 2024 order against Lingo Telecom, in which the FCC found that Lingo applied A attestations to 3,978 spoofed robocalls carrying a deepfake AI voice message that claimed to be from then-President Joe Biden.

What attestation does not do

Attestation answers one question: can the provider vouch for the caller ID? It does not say who the business is, why it is calling, or whether the person wants the call. The FCC’s December 2025 report to Congress says STIR/SHAKEN was designed to give trust that the caller ID matches the caller’s real number, not to stop all illegal calls on its own.

That limit matters for spam labels. The same report says attestation decisions and other call information feed the call analytics engines that providers use to block and label calls. So a call with A attestation can still show Spam Likely. In its May 2026 notice the FCC asked whether it should bar blocking or spam labeling of calls with A attestation once the criteria are stricter. As of October 2026, that is a question for comment, not a rule.

Attestation also does not show your business name. A registered caller name (CNAM) does that, on networks and phones that display names. Our guide to why calls show Spam Likely covers who labels calls, the calling patterns that trigger labels, and how to check a number.

The Robocall Mitigation Database

The Robocall Mitigation Database (RMD) is the FCC’s register of voice providers, opened in April 2021 as part of its TRACED Act work. As of October 2026, 47 CFR 64.6305 requires every voice service provider, gateway provider, and non-gateway intermediate provider to file in it. A voice service provider’s filing:

• certifies whether it has implemented STIR/SHAKEN on all, part, or none of its network;
• describes its robocall mitigation program, including how it knows its customers and upstream providers, and the analytics it uses to find illegal traffic;
• commits to answer traceback requests within 24 hours.

Providers must recertify every year by 1 March. The database also has consequences: under 64.6305(g), other providers may accept calls directly from a US voice service provider only if its filing appears there and has not been removed by an enforcement action. On 22 Jul 2026 the FCC proposed further rules to keep bad actors out of the database (FCC 26-49).

Anyone can check a provider. The FCC’s RMD welcome page lets the public view, search, and download providers’ certifications. Before you choose a calling provider, look up the company that will sign your calls.

How DialSavvy handles this

DialSavvy is your carrier. We buy local numbers for your workspace, registered to your business, and file your business profile, SHAKEN/STIR, caller name (CNAM), and caller-ID registrations for them. As of October 2026, the SHAKEN/STIR review typically takes about 3 days: calls are signed from day one, and full attestation follows the review. Spam protection (label checks, fixes, and replacements, with your approval) and number health are coming. See managed telephony and local caller ID.

This week, ask your provider for the attestation level on a sample of your outbound calls, and look up the company that signs them in the RMD. To see how your numbers and registrations would be set up, book a demo.