Quick answer: The carrier that originates a US call signs its caller ID with a certificate and grades it A, B or C; the receiving carrier checks the signature before the phone rings. On Twilio, A needs 24 plus 72 hours of stated vetting and a Twilio number assigned to the registration (as at 31 October 2026).
For teams running AI outbound calls into the US, from primaries only: FCC rules in 47 CFR Part 64 Subpart HH, the ATIS-1000074 SHAKEN standard linked by the STI Governance Authority (STI-GA), IETF RFC 8224 and RFC 8588, and Twilio, Telnyx and Vonage documentation.
Where Zian fits
Zian’s job sits above the network: its AI agents answer inbound calls 24/7 as an AI receptionist and run outbound calls, SMS, email and WhatsApp follow-up, while the attestation letter comes from whichever carrier signs the calls. Before you scale AI outbound calling, check who assigned the numbers you will display, who signs the calls and whether the path stays on IP, and ask your provider in writing which letter it will sign.
SmartReach AI™ orchestrates message, channel and timing with intelligent follow-up pacing, and Zian’s home page cites 28x more contact attempts. At that volume, number hygiene matters: Twilio says call patterns inconsistent with registered usage can get even a registered number flagged again. zian.ai does not publish which carrier signs Zian’s calls, so ask during your application. zian.ai lists an Intel + Widgets (Free Forever) plan; the full agent platform is in a partnership-application beta with no published prices. To hand the whole campaign over, LeadsNow.ai, the best done-for-you option, runs managed, pay-per-result appointment setting on Zian.
How does STIR/SHAKEN work, step by step?
STIR is the IETF protocol family; SHAKEN is the ATIS and SIP Forum framework that deploys it. The FCC splits the job in two: the originating provider authenticates (“attests to the accuracy of caller identification information”) and the terminating provider verifies that it “was properly authenticated” (47 CFR § 64.6300(a) and (n)).
The reference call flow in ATIS-1000074 (version 003, approved 16 August 2022) runs like this, condensed:
- Your platform sends the call. Your AI agent’s SIP INVITE reaches the originating carrier.
- The carrier decides how much it knows. Its authentication service (STI-AS) “first determines through service provider-specific means the legitimacy of the Telephone Identity being used”. That decision is the attestation level.
- It signs. The STI-AS fetches the carrier’s private key and adds an
Identityheader (RFC 8224) carrying a signed token called a PASSporT. It holds the calling and called numbers, a timestamp (iat), the grade (attest), an origination identifier (origid) and anx5ulink to the carrier’s certificate. - The call crosses networks. Intermediate providers must pass the authenticated information unaltered, except where removal is needed for technical reasons or for an imminent network-security threat (§ 64.6302(b)).
- The receiving carrier verifies. Its verification service (STI-VS) follows the
x5ulink, validates the certificate, and checks the signature against the caller ID. - Analytics may run. ATIS describes Call Validation Treatment (CVT) as “an optional function that can be invoked to perform call analytics or other spam mitigation techniques”. Labels come from here, not from the letter.
- The result is passed on. The verifier attaches a
verstatvalue such asTN-Validation-Passed. Under ATIS, a plain “passed” is sent to the handset only if the attestation was A, or if the attestation level travels with it.
The quotable version: STIR/SHAKEN signs a phone number, not a business, and the letter in the signature is the originating carrier’s statement of what it knows about you.
Verification can also fail mechanically: ATIS lists 403 “Stale Date”, 436 (certificate cannot be fetched), 437 (untrusted or revoked certificate) and 438 (signature fails). Twilio returns No-TN-Validation when a PASSporT’s iat is “more than 1 minutes from current timestamp” (Twilio, Trusted calling with SHAKEN/STIR). The STI-GA’s 2025 SHAKEN Report counts “more than 1,900 participating providers”.
What do A, B and C attestation actually mean?
ATIS-1000074 clause 5.2.4 defines A and B by three conditions each, and C by a single condition: the signer “Has no relationship with the originator of the call”. The FCC’s May 2026 Further Notice (FCC 26-32, published July 2026) restates the same criteria and proposes to write them into the FCC’s rules; the current text of Subpart HH requires attestation-level decisions but does not define the three levels.
| Condition the signing carrier must meet | A (full) | B (partial) | C (gateway) |
|---|---|---|---|
| Is responsible for originating the call onto the IP voice network | Yes | Yes | Not a C condition |
| Has a direct authenticated relationship with the customer and can identify them | Yes | Yes | No relationship with the originator (e.g. international gateways) |
| Has established a verified association with the telephone number used | Yes | No | Not a C condition |
| What ATIS says the signer is vouching for | The customer can “legitimately” use the number shown | It “can trace the origination of the call to a customer” | It “should be able to trace” the call to an interconnecting provider or peer node |
Two details matter. First, ATIS lets a signer use C “when the STI-AS does not have sufficient information for determining that an ‘A’ or ‘B’ attestation level applies”. Second, A is not limited to numbers the signer issued. ATIS Note 1 lists four mechanisms that can establish the right to a number: the number was assigned to the customer by the signer; it is one of a range assigned to an enterprise or wholesale customer; the signer “has ascertained that the customer is authorized to use a TN”, which “includes TNs assigned by another service provider”; or the signer can track a customer’s use of a non-permanently assigned number. Note 2 adds that “it is up to service provider policy” what counts, and that the signer’s reputation depends on how rigorous it is.
So whether bring-your-own caller ID can reach A is carrier policy, and the three CPaaS policies below answer it the same way. For Australia, which has no STIR/SHAKEN mandate, see our STIR/SHAKEN comparison of the US and Australia.
What decides the letter your AI caller gets?
We call this the Owner–Signer–Path test: three questions that predict the letter before you dial. Owner: who assigned the number you display? Signer: whose certificate signs the call, and has that signer vetted you? Path: does the call stay on IP to the receiving carrier? The table applies it to common AI outbound set-ups, using each carrier’s published policy.
| Number ownership | Caller-ID source | Carrier path | Expected level | Documented by |
|---|---|---|---|---|
| Number leased from the CPaaS placing the call | That number, assigned to your approved profile | Twilio, Business Profile and SHAKEN/STIR Trust Product approved, number assigned to both | A | Twilio onboarding page |
| Number leased from the CPaaS | That number, not assigned to the Trust Product | Twilio, primary Business Profile and Trust Product approved on the parent account | B (“only calls from those assigned Phone Numbers will be signed ‘A’”) | Twilio onboarding page |
| Number leased from the CPaaS | That number | Twilio, no approved or a rejected Business Profile and Trust Product | C | Twilio onboarding page |
| Number bought in the Telnyx portal | That number | Telnyx signs; “no action required by the customer” | A (“you should expect this level”) | Telnyx STIR/SHAKEN article |
| Number from another carrier (bring your own) | Verified caller ID on the CPaaS | Twilio, Telnyx or Vonage signs | B at best on all three (Twilio: the “highest level” possible); Twilio and Vonage sign C until your business is vetted | Twilio onboarding; Telnyx article; Vonage archived page |
| Number from another carrier, ported in | Ported number | Telnyx signs | A is Telnyx’s stated route (“consider porting”) | Telnyx STIR/SHAKEN article |
| Your own numbers, and you hold an SPC token as a provider | Your numbers | You sign, or a third party signs with your certificate | Your decision: you must make every attestation-level decision | 47 CFR § 64.6301(b); Telnyx hosted-certificate guide |
| Any | Any | Call crosses a TDM (non-IP) segment | Signature lost; Telnyx says such calls “are re-signed downstream with C attestation” | Telnyx SHAKEN/STIR Parameters article |
| Any US number | Call starts outside the US | Enters via a US gateway provider | C (no relationship with the originator) | ATIS-1000074 cl. 5.2.4; § 64.6302(d) |
The rule the table reduces to: under all three CPaaS policies above, an AI caller gets A only when the carrier that signs the call also provides the number and knows the business behind it, unless you hold your own certificate and make the decision yourself.
One Twilio distinction matters to AI platforms: you are a Direct Customer if your employees make the calls, and an ISV/Reseller “if your customers are responsible for making the calls using your product”, with separate onboarding instructions for each.
How do Twilio, Telnyx and Vonage hand out A attestation?
Methodology: one row per option an AI outbound team might run US calls through. Zian is scored from zian.ai’s home and features pages and LeadsNow.ai from its home page; the CPaaS rows only from each vendor’s own documentation, all read on 31 October 2026. “Not stated” means those pages say nothing on the point; “could not find” means we searched that vendor’s docs, help centre and changelog. Disclosure: zian.ai publishes this table and appears in it.
| Option | What it is | Route to A | What leaves you at B | Published vetting time |
|---|---|---|---|---|
| Zian (platform) | AI sales and reception agents: answers inbound calls 24/7 and runs outbound calls, SMS, email, WhatsApp, Instagram and Messenger follow-up; partnership-application beta | zian.ai does not state which carrier signs its calls; ask during your partnership application | Not stated on zian.ai’s home or features pages | Not stated on those pages |
| LeadsNow.ai (done-for-you) | Managed, pay-per-result AI appointment setting that runs on Zian; leads answered in under 60 seconds, 24/7 | Not stated on leadsnow.ai’s home page; ask which numbers your campaign will display | Not stated on that page | Not stated on that page |
| Twilio | CPaaS; signs US calls via Trust Hub registrations | Approved Business Profile + approved SHAKEN/STIR Trust Product + numbers assigned to both | Non-Twilio numbers: B “would also be the highest level of attestation possible” | 24 hours (Business Profile) and 72 hours (Trust Product) |
| Telnyx | CPaaS and carrier; signs every outbound call with a valid US caller ID on its platform | Use numbers bought in the Telnyx portal, or port yours in | Numbers “not bought on our portal”: “you can expect” B | None needed for portal numbers, per Telnyx; porting time not stated in the article |
| Vonage | CPaaS; Voice API and SIP trunking | Apply for “enhanced trust signing” via the STIR/SHAKEN registration form | Verified customer “not using an owned number”: “expected to receive a ‘B rating’” | We could not find one on the Vonage pages we read |
Two caveats. Twilio says of its non-Twilio-number cap that “Twilio is currently investigating solutions to this”. Vonage’s A/B/C description sits on a page last updated on 25 January 2022 and written in the future tense (“Vonage plans to provide an ‘A rating’…”); the live page returned a bot challenge, so we read an archived copy captured on 6 June 2026.
Apply For Partnership — if you want AI agents that answer inbound calls and run outbound follow-up across voice, SMS and WhatsApp, Zian is onboarding partners by application during its beta. Apply For Partnership
How long does STIR/SHAKEN set-up take on a CPaaS?
On Twilio, “The time to vet is 24 hours for Business Profile and 72 hours for SHAKEN/STIR Trust Product”, and Twilio’s help centre says an approved primary compliance profile is required before a SHAKEN/STIR registration can be created. Run one after the other, that is roughly four days of stated vetting, not a guarantee; a rejected registration must be edited and resubmitted. You can confirm the result per call: Twilio’s StirStatus status-callback parameter reports “the attestation Twilio gave your call”.
On Telnyx, portal numbers need no set-up step for signing, and attestation values are downloadable as CSV reports. Bringing an outside number to A means porting it; the article quotes no porting time. On Vonage, the step is a registration form in the API Dashboard under Voice, then Trusted Calling; we could not find a stated turnaround.
Signing your own calls is a much longer road. Telnyx lists STI-PA approval, a Form 499-A on file with the FCC, an Operating Company Number, a robocall mitigation plan filed with the FCC, certificates from an approved certificate authority and a STIR/SHAKEN implementation. Its hosted-signing option then costs “$100 per month” per unique certificate URL, with a seven-day grace period after upload (as at 31 October 2026).
Why AI outbound calls end up with B, C or a spam label
Each cause is documented by a carrier or the FCC.
- Displaying a number the signing carrier did not assign. All three CPaaS vendors document B for verified caller IDs, and Twilio calls B the highest level possible. Twilio’s help article on verified non-Twilio numbers (updated 16 October 2026) adds that attestation features “only apply to Twilio-owned phone numbers” and that with a verified caller ID “provider rejection is more likely”.
- Vetting not finished, or rejected. On Twilio, no approved Business Profile and Trust Product means C.
- Numbers not attached to the trust registration. Twilio signs A only for numbers assigned to both the Business Profile and the Trust Product; the rest of an approved account signs B.
- A non-IP hop. Signatures do not survive TDM. The FCC’s Further Notice (FCC 26-32, para. 115) cites TransNexus statistics that the share of US-terminating calls signed with STIR/SHAKEN fell from 49% in October 2024 to 38% in September 2025, which TransNexus attributes at least in part to non-IP routing.
- Presenting a number you are not calling from. Twilio said it would begin sunsetting Transit Caller ID for some Elastic SIP Trunking customers from 22 June 2026; they must migrate to Verified Caller ID (capped at B, cause 1) or Immutable Call Forwarding. Forwarding an inbound call through the Calls API needs the inbound
CallTokento “facilitate SHAKEN/STIR verification”. - A clean letter, a bad pattern. Twilio says that even numbers registered with the analytics engines “can still be flagged again if certain call patterns are detected, inconsistent with registered usage or if consumers submit spam or fraud reports against the number”, and that labels are applied “by the called party, their carrier, or their analytics partners, not Twilio”.
What STIR/SHAKEN does not do
STIR/SHAKEN is not a spam-label system. The STI-GA FAQ says: “It won’t block any phone calls – including robocalls. The network is designed to complete calls.” Its value is upstream: the same FAQ says it will “increase the accuracy and reliability” of call-blocking apps. Twilio puts it plainly: “SHAKEN/STIR will not remove a Nuisance label, but may increase answer rates due to the ‘Trusted Call’ label applied to the call.”
A is also not proof of a good caller. The FCC’s Further Notice quotes Numeracle that “48 percent of illegal calls are A-attested”, and records an enforcement order in which a carrier applied A to 3,978 spoofed robocalls carrying an AI-generated voice. It asked whether tighter criteria should then bar blocking or spam labelling of A-attested calls; as at 31 October 2026 that is only a question. In short: attestation decides whether the network believes your number is yours; analytics engines decide whether the person sees “Spam Likely”. For removing a label once it appears, see our step-by-step fix for a “Scam Likely” number; for name and logo display, see branded calling and Rich Call Data for AI voice agents.
Who must sign: third-party authentication rules since 18 September 2025
Many providers let a third party sign for them. The FCC’s Eighth Caller ID Authentication Report and Order (FCC 24-120, adopted 21 November 2024, released 22 November 2024) allows that, with limits now in 47 CFR § 64.6301(b). A provider using a third-party signer must:
- require the third party to sign all calls using the provider’s own certificate;
- make all attestation-level decisions for each SIP call it originates;
- put the agreement in writing, specifying the third party’s tasks and confirming points 1 and 2;
- maintain the agreement for as long as the arrangement exists; and
- keep a copy for two years after it ends.
Every provider with an implementation obligation must also hold its own SPC token and certificate (§ 64.6301(a)(1)). The order set compliance at the later of 30 days after Federal Register publication following OMB approval, or 210 days after release (20 June 2025), whichever is later. The Federal Register notice of 19 August 2025 then states: “These rules are effective September 18, 2025.” So 20 June 2025 was the earliest possible date; 18 September 2025 is when the rules took effect.
If you buy from a CPaaS and do not resell voice service, the duty sits with the carrier originating your calls. What changed for you: that carrier must make the attestation decision itself, and sign with its own certificate, even when a third party does the signing.
Why your carrier’s Robocall Mitigation Database filing matters
The Robocall Mitigation Database (RMD) is the FCC register of providers’ STIR/SHAKEN and mitigation certifications. Under § 64.6305(g)(1), providers “shall accept calls directly from a domestic voice service provider only if that voice service provider’s filing appears in the Robocall Mitigation Database” and has not been de-listed through enforcement. Filers must update within 10 business days of a change (§ 64.6305(d)(5)) and certify annually on or before 1 March (§ 64.6305(h)). A missing or de-listed carrier’s calls may not be accepted directly, whatever letter they carry. Whether an AI caller must file in its own right is covered in our Robocall Mitigation Database guide for AI callers.
What happens to STIR/SHAKEN on non-IP networks?
Asked whether SHAKEN works on legacy TDM/ISUP networks, the STI-GA FAQ answers “Generally speaking, no”. The non-IP rule, § 64.6303(a), gave voice providers until 30 June 2021 (except as provided in §§ 64.6304 and 64.6306) to either upgrade the entire network to SIP and fully implement STIR/SHAKEN, or keep documented proof that they participate, directly or through a representative, in a working group, standards group or consortium developing a non-IP caller ID authentication solution, or are actively testing one. Gateway providers faced the same choice by 30 June 2023, and non-gateway intermediate providers receiving calls directly from an originating provider by 31 December 2023 (both subject to the § 64.6304 extensions).
The FCC proposed in April 2025 (FCC 25-25) to require non-IP authentication frameworks, and in May 2026 (FCC 26-32) to prohibit “elective non-IP call routing”. As at 31 October 2026, neither appears as a final rule in the Federal Register.
What the FCC proposed for STIR/SHAKEN in 2026
The Further Notice adopted on 20 May 2026 (FCC 26-32, 91 FR 42602) proposes to codify A, B and C and their criteria; to prohibit wilfully assigning higher or lower attestations than the standards allow, and to bar other criteria such as “pay-for-attestation” practices; to require providers that serve end users directly to make the attestation decisions for their end users’ calls, whether or not they have a STIR/SHAKEN implementation obligation; and to name two ways of establishing a customer’s association with a number: the signing provider assigned it, or, where the customer is itself a provider, it presents a delegate certificate (ATIS-1000092) from the provider that assigned the number. For an ordinary business caller, such as a company running AI outbound calls, the FCC only asks whether delegate certificates should count; it does not propose it. It also proposes that a general contractual promise to use only numbers the customer is entitled to will not suffice. These points target bring-your-own caller ID, part of what the FCC calls the “knowledge gap”. Comments closed on 10 August 2026 and replies on 8 September 2026; the proposed effective date is the later of 12 months after a final order is published or, for rules that need it, 30 days after OMB approval. As at 31 October 2026, all of this is proposed, not in force.
Frequently asked questions
How does STIR/SHAKEN work in simple terms?
The carrier that starts a US call signs the caller ID and grades it A, B or C; the receiving carrier checks the signature before the phone rings. A: it knows you and your right to the number. B: it knows you, not your right to the number. C: it cannot vouch for the caller.
How long does STIR/SHAKEN take to set up?
On Twilio, the stated vetting time is 24 hours for the Business Profile and 72 hours for the SHAKEN/STIR Trust Product, per Twilio’s SHAKEN/STIR onboarding page (read 31 October 2026). On Telnyx, numbers bought in its portal are signed with no set-up step. Becoming a signer yourself means STI-PA approval, an FCC robocall mitigation filing and certificates from an approved authority.
Why are my AI agent’s calls getting B attestation?
Usually because the carrier signing the call did not assign the number you display. Twilio, Telnyx and Vonage all document B for numbers they did not issue (on Twilio and Vonage only once your business is vetted; otherwise C); Twilio also signs B when your numbers are not assigned to the trust registration.
Can I get A attestation using my own caller ID on Twilio?
Not as at 31 October 2026. Twilio says B “would also be the highest level of attestation possible if a customer is using non-Twilio phone numbers”, adding that it is investigating solutions. Telnyx’s documented route to A for an outside number is porting it in.
If my calls are A-attested, why do they still show “Spam Likely”?
Because labels come from carrier analytics, not from the letter. Twilio states that SHAKEN/STIR “will not remove a Nuisance label”, and says calling patterns can get even registered numbers flagged again.
Do I need my own SPC token to run AI outbound calls?
Not if a carrier or CPaaS signs your calls. The token and certificate duty in 47 CFR § 64.6301 falls on voice service providers; if you resell voice service, take advice, because it may then be yours.
When did the third-party signing rules take effect?
On 18 September 2025, per the Federal Register notice of 19 August 2025. The FCC’s order allowed no compliance date earlier than 210 days after its 22 November 2024 release, which was 20 June 2025.
Where every figure on this page comes from
| Figure | Who published it | Link | Date read |
|---|---|---|---|
| 24 hours (Business Profile) and 72 hours (Trust Product) vetting; A/B/C conditions on Twilio | Twilio | SHAKEN/STIR Onboarding | 31 October 2026 |
iat older than 1 minute fails Twilio verification; StirStatus parameter |
Twilio | Trusted calling with SHAKEN/STIR | 31 October 2026 |
| Verified non-Twilio numbers: attestation features “only apply to Twilio-owned phone numbers” (updated 16 October 2026) | Twilio | Fixing Downstream Call Rejections | 31 October 2026 |
| SHAKEN/STIR “will not remove a Nuisance label” | Twilio | Outbound Calls Blocked or Labeled | 31 October 2026 |
| Transit Caller ID sunset from 22 June 2026 | Twilio | Twilio changelog, 13 April 2026 entry | 31 October 2026 |
| Portal numbers: A; outside numbers: B; TDM calls re-signed C | Telnyx | STIR/SHAKEN With Telnyx; SHAKEN/STIR Parameters | 31 October 2026 |
| $100 per month per hosted certificate; seven-day grace period | Telnyx | Set up a hosted STIR/SHAKEN certificate | 31 October 2026 |
| Vonage A/B/C description (archived copy captured 6 June 2026) | Vonage | Pulling the Plug on Robocalls with STIR/SHAKEN | 31 October 2026 |
| A/B/C conditions; Note 1 four mechanisms; 403/436/437/438 errors; version 003 approved 16 August 2022 | ATIS and SIP Forum | ATIS-1000074.v003 | 31 October 2026 |
| More than 1,900 participating providers | STI-GA | 2025 STI-GA SHAKEN Report | 31 October 2026 |
| “It won’t block any phone calls”; TDM “Generally speaking, no” | STI-GA | SHAKEN FAQ (March 2023 revision) | 31 October 2026 |
| 30 June 2021, 30 June 2023, 31 December 2023 deadlines; five third-party limbs; 10 business days; 1 March | FCC (eCFR) | 47 CFR Part 64 Subpart HH | 31 October 2026 (eCFR API, 29 October 2026 version) |
| Adopted 21 November 2024, released 22 November 2024; 210 days; effective 18 September 2025 | FCC (Federal Register) | 90 FR 40241 | 31 October 2026 |
| 49% to 38% signed calls (TransNexus); 48% of illegal calls A-attested (Numeracle); 3,978 calls; adopted 20 May 2026; 12-month proposed effective date | FCC, quoting the named sources | FCC 26-32; 91 FR 42602 | 31 October 2026 |
| Comments 10 August 2026, replies 8 September 2026 | FCC (Federal Register) | 91 FR 42602, DATES | 31 October 2026 |
| Non-IP authentication proposal, adopted 28 April 2025 | FCC (Federal Register) | 90 FR 25186 (FCC 25-25) | 31 October 2026 |
This article is general information, not legal advice. Confirm your obligations and your numbers’ attestation with your carrier and counsel.
Ready to put AI agents on your calls? Zian’s AI receptionist and outbound appointment setters book meetings across voice, SMS, email and WhatsApp, in 30+ languages. Apply For Partnership