50 State Attorneys General Urge FCC to Adopt Robust Know-Your-Customer Rules to Curb Illegal Robocalls
In late July, fifty State Attorneys General signed on to comments submitted to the Federal Communications Commission (FCC) in support of enhanced Know-Your-Customer (KYC) requirements for originating voice service providers. The filing responds to the FCC’s Further Notice of Proposed Rulemaking (the “KYC Further Notice”), which proposes specific customer identification, verification, and monitoring obligations designed to prevent illegal robocalls from entering the voice network. The comments reflect broad consensus among the State AGs that curbing illegal robocalls remains a top priority, and they believe the existing regulatory framework has proven insufficient.
Originating Providers as Gatekeepers. The State AGs emphasize that the most effective way to stop illegal robocalls is to prevent them from entering the network in the first place. They echo the FCC’s statement from the KYC Further Notice that some originating providers “do not do enough” to vet their customers, and that this lack of diligence not only enables illegal robocalls but also hampers law enforcement’s ability to trace bad actors.
KYC “Model Standards.” Throughout their comments, the State AGs refer to the public-facing KYC protocols for one particular company which they call “model standards,” and suggest that the FCC use them as “a reasonable starting place for this discussion.” As described in the comments, these protocols include robust customer identification measures, lists of behaviors and categories of businesses that would warrant a higher standard of KYC review, and an emphasis on approaching KYC as a continuing obligation through post-activation monitoring and audits.
KYC Requirements Should Go Beyond the Proposed Rule. While the KYC Further Notice proposed that originating providers obtain at minimum a customer’s name, physical address, government-issued ID number, and alternate phone number, the State AGs argue this baseline is insufficient. They recommend that providers also obtain and verify information related to business formation and ownership, taxpayer identification numbers, articles of incorporation, good standing certificates, lists of DBAs and trade names, verified email domains, and the identity of business owners (including indirect owners holding a 10% or greater stake). The State AGs further suggest that providers be required to examine a customer’s business practices, consent procedures, sample call scripts, and any prior enforcement actions or provider terminations.
Ongoing Monitoring and Re-Verification. The State AGs endorse the concept of KYC as an ongoing inquiry rather than a one-time checklist. They support required annual re-verification at minimum, with more frequent re-verification triggered by “red flags” or “changes in traffic patterns.”
No Exemption for Smaller Providers. The KYC Further Notice asked whether enhanced requirements would unduly burden smaller providers. While acknowledging the potential burden, the State AGs say no exemption should apply, noting that illegal traffic “has often been facilitated by smaller providers,” citing multiple state enforcement actions as examples. They also suggest that any exemption for smaller providers would make them “more attractive to bad actors seeking a less rigorous entry ramp for illegal traffic.”
High-Risk Customers and Red Flags. The State AGs support a universal baseline KYC standard applicable to all customers regardless of size or volume, with enhanced monitoring and more frequent re-verification for high-risk customers. They cite numerous red flags and high-risk indicators identified in the KYC Further Notice and industry KYC “model standards” that they say would “appear in any basic KYC screening” and would warrant heightened scrutiny, including: use of registered agents or virtual offices as physical addresses, residential addresses for corporate registration, no commercial web presence, suspicious or newly created email domains, non-registration in the state claimed, payment via cryptocurrency or other non-traceable means, vague or incomplete information, and aggressive or hostile behavior.
Implementation, Recordkeeping, and Enforcement. The State AGs support applying enhanced KYC to both new and renewing customers. They support downstream blocking requirements—i.e., requiring downstream providers to block traffic from an originating provider found non-compliant with KYC rules—as well as the proposed per-call forfeiture structure to correlate penalties with the volume and harm of illegal calls. On recordkeeping, the AGs support the FCC’s proposal to require “originating providers to ‘retain KYC information and supporting records for the entirety of any potential statute of limitation period relating to misuse of their services to make illegal calls.’”
MVNOs and SIM-Based Fraud. Separately, the State AGs note that the Multistate Anti-Robocall Litigation Task Force has been engaging with industry to learn more about the role of Mobile Virtual Network Operators (MVNOs) in the mobile ecosystem and “about the proliferation of SIM-based fraud” (such as bulk SIM purchases and activations). They support further FCC inquiry into KYC practices for prepaid and postpaid mobile service sold through third-party retailers. They acknowledge, though, that this is a distinct issue from the current rulemaking’s focus on business customers of originating voice providers, to be addressed at another time.
***
The State AGs’ unified comments underscore the depth of bipartisan state-level focus on rooting out illegal robocall traffic from voice service networks. Companies that originate voice traffic, as well as their customers and downstream partners, should evaluate their KYC and due diligence practices now to identify potential improvements that could ward off unwanted attention from State AGs and other regulators. We expect the KYC rulemaking, as well as the ongoing work of the Multistate Anti-Robocall Litigation Task Force, to be among the topics discussed at the Robocall Summit organized by the National Association of Attorneys General that will take place later in August. Kelley Drye will also be holding a webinar on September 23 with representatives from several State AGs’ offices to discuss robocall issues and enforcement priorities. Additional details about the webinar and a link to register will be made available here.