STIR/SHAKEN attestation levels A, B and C, explained

STIR/SHAKEN attestation levels tell the receiving network how much the originating provider vouches for a call's caller ID. A (full) means the provider knows its customer and has verified that the customer may use the number. B (partial) means it knows the customer but not the number. C (gateway) means it only knows where the call entered its network.

This is not legal or regulatory advice. It summarises public standards, FCC documents and regulator pages as they stood in October 2026. Obligations depend on your role (caller, reseller, carrier) and country, so consult counsel.

#What is STIR/SHAKEN?

STIR/SHAKEN is a set of standards that lets the provider originating a call digitally sign its caller ID, and lets every later network check that signature. The FCC describes it as a framework that allows "the phone company of the consumer receiving the call to verify that a call is in fact from the number displayed on Caller ID" (FCC, 2026).

Two families of documents define it:

• STIR (IETF). RFC 8225 defines the signed token, called a PASSporT. RFC 8224 defines how it travels in the SIP Identity header (IETF, 2018). RFC 8588 (May 2019) adds the SHAKEN-specific claims, including attest (IETF, 2019).
• SHAKEN (ATIS and the SIP Forum). ATIS-1000074 sets out how providers use those tokens, including the definitions of the three attestation levels. Version 3 was approved on 16 August 2022 (ATIS, 2022).

The signature works only where calls are carried over IP. Where a call crosses an older TDM segment, the signature can be lost, which is one reason some legitimate calls arrive unsigned.

#What do attestation levels A, B and C mean?

RFC 8588 says the attest claim "can be one of the following three values: 'A', 'B', or 'C'", corresponding to full, partial and gateway attestation, and points to ATIS-1000074 for the definitions. The ATIS conditions are:

Two ATIS notes are worth reading closely. For A, what counts as a "legitimate" right to a number is left to each provider's policy, and "the service provider's reputation may be directly dependent on how rigorous they have been". For B and C, the standard stresses that the signer should be able to trace the call back to its customer or the network that handed it over. The attestation is also a tool for traceback, not only a trust label.

#What does attestation not tell you?

It doesn't say whether a call is wanted, lawful or honest. An A attestation means that the originating provider vouches for its customer's right to use that number. It says nothing about why the customer is calling. A properly assigned number can still carry illegal robocalls, and bad actors can obtain real numbers from providers with weak customer checks.

Other limits to keep in mind:

• No signature doesn't prove spoofing. Calls can lose their signature on non-IP segments or pass through providers without an obligation to sign.
• C isn't proof of fraud. Legitimate international calls often arrive with gateway attestation.
• Attestation is about the number, not the name. The displayed caller name comes from separate databases. In December 2025 the FCC proposed requiring terminating providers to show verified caller name or identity information whenever they indicate an A-level attestation, but that is a proposal, not a rule (Federal Register, 2025).

#Which rules require STIR/SHAKEN in the US?

The TRACED Act, signed on 30 December 2019 (Public Law 116-105, section 4, now 47 U.S.C. §227b), directed the FCC to require the framework (GPO, 2019). In its Report and Order adopted on 31 March 2020 (FCC 20-42), the FCC required voice service providers to implement STIR/SHAKEN in the IP parts of their networks by 30 June 2021 (FCC, 2020). Later orders gave some smaller providers extra time (FCC, 2026).

Since then the obligation has widened. The FCC says that most providers, including gateway providers and intermediate providers that receive unauthenticated calls directly from originating providers, must now authenticate caller ID. Providers on non-IP networks must upgrade or work on a non-IP solution. All providers must file robocall mitigation plans and certifications in the Robocall Mitigation Database (FCC, 2026).

Three more recent steps matter for anyone who buys voice service:

• Third-party signing (effective 18 September 2025). Providers may use a third party to sign calls, but the provider with the obligation must make the attestation decision and sign with its own certificate (Federal Register, 2025).
• Proposed stricter attestation rules (July 2026). The FCC proposed codifying the attestation levels, defining improper attestations and specifying acceptable ways to verify that a number belongs to a customer. Reply comments were due on 8 September 2026 (Federal Register, 2026), and no final rule had been published by 29 September 2026. If adopted, providers will likely ask business callers for stronger proof of number ownership.
• Proposed Robocall Mitigation Database changes (September 2026). The FCC proposed clarifying which entities must file, improving the accuracy of filings and adding tools to remove non-compliant providers from the database. Comments are due on 9 October 2026 and reply comments on 9 November 2026 (Federal Register, 2026).

#How do Canada and France apply it?

Both use the same A/B/C model, with different legal framing.

Canada. In Decision 2018-32 (25 January 2018), the CRTC first set 31 March 2019 as the deadline for caller ID authentication on IP voice calls. After extensions, Decision 2021-123 (6 April 2021) directed providers to implement STIR/SHAKEN as a condition of offering telecom services, effective 30 November 2021 (CRTC, 2021).

France. Article 10 of Law 2020-901 (the "Naegelen" law) added caller-number authentication duties to the telecom code, in force since 25 July 2023. French operators implement them with a shared mechanism called the MAN (mécanisme d'authentification des numéros), based on STIR/SHAKEN. According to Arcep's operator guidance (updated 27 March 2026), only level A meets the legal requirement to check that the caller may use the number. Levels B and C don't, and Arcep says calls signed B or C should be interrupted. Calls that present a French mobile number (06 or 07) follow a separate regime: since 1 January 2026, when such a call comes from abroad and can't be authenticated, the operator must mask the caller ID instead (Arcep, 2026). For businesses calling French numbers, that makes proper number assignment a delivery issue, not only a labelling one.

#Does attestation affect spam labels?

It is one input among several. US carriers and call-analytics services decide spam labels with their own models. Those models combine attestation with call volume, call duration, answer rates, complaints and reports. None of these providers publishes its full formula, so no attestation level guarantees a clean label.

In practice:

• B or C attestation removes a positive signal. Your calls then depend more on behavioural signals, and short, high-volume campaigns look worse.
• An A attestation doesn't protect a number with a poor history. Complaint data shows how quickly bad reputation builds. Our analysis of FTC and FCC complaint data found that half of complaints arrive within about five hours of the call.
• Spoofing of your numbers hurts you. If someone else displays your number, complaints may land on it. A-attested calls from you, and unsigned or C-attested calls from the spoofer, help networks tell the two apart.

#What should a call center do?

On the outbound side, aim for A attestation on every call:

1. Use numbers assigned by the provider that originates your calls, or give that provider documented proof that you may use numbers from elsewhere. Ask your provider which evidence it accepts. The FCC's 2026 proposal may tighten this.
2. Ask which attestation your calls actually receive. Test calls to a line you control, where the SIP headers are visible, show the attest value.
3. Keep caller ID consistent with the numbers you register and verify. Rotating many numbers to avoid labels can backfire.
4. Monitor the reputation of your own numbers. Our spam reputation check (limited access) returns a risk level with reasons, which you can run on your outbound numbers regularly.
5. Follow calling rules. Attestation doesn't make an unlawful call lawful. See our TCPA checklist for consent, quiet hours and opt-outs.

On the inbound side, treat attestation as one signal in a screening decision:

Our guide to screening inbound calls with spam reputation covers the reputation side, and the call center screening use case shows the full flow.

#What are the key takeaways?

• STIR/SHAKEN lets the originating provider sign caller ID. The attest claim (RFC 8588) takes A, B or C, as defined in ATIS-1000074.
• A means customer and number verified, B means customer known but number not verified, and C means no relationship with the originator.
• Attestation vouches for the right to use a number, not for the call's purpose. A-attested calls can still be unwanted or illegal.
• The US has required STIR/SHAKEN on IP networks since 30 June 2021 for most providers, and Canada since 30 November 2021. In France, only A satisfies the legal duty, and B- or C-signed calls should be interrupted, with a separate regime for calls showing French mobile numbers.
• Spam labels combine attestation with behaviour and complaints. Aim for A on outbound calls and screen inbound calls with several signals.
• This is guidance, not legal advice. The FCC's July 2026 proposal may change attestation rules, and its September 2026 proposal may change who must file in the Robocall Mitigation Database.