Annual CPNI certification for VoIP providers and carriers, prepared for your officer to sign
Every telecommunications carrier and interconnected VoIP provider must file, each year on or before March 1, an officer-signed certificate of compliance with the FCC’s customer proprietary network information (CPNI) rules — with a statement explaining how its procedures actually comply. The next one is due Monday, March 1, 2027, covering calendar year 2026.
Last updated: September 2026
If you sell interconnected VoIP or telecom service, it’s you.
- Interconnected VoIP providers are covered. For the CPNI rules, “telecommunications carrier” includes an entity that provides interconnected VoIP service (47 CFR § 64.2003(o)) — a service that enables real-time, two-way voice, requires a broadband connection and IP-compatible equipment, and lets users receive calls from and place calls to the public telephone network (47 CFR § 9.3).
- Resellers are covered. The FCC’s February 2026 advisory lists local exchange carriers, interexchange carriers, CMRS providers, resellers, prepaid providers and calling-card providers as examples of carriers that must file (DA 26-139).
- No small-company exemption. The requirement applies regardless of size (DA 26-139).
- One certification per Form 499 Filer ID. A separate certification is required for each affiliate with its own Filer ID (DA 26-139).
- Due on or before March 1, with the Enforcement Bureau, in EB Docket No. 06-36, for the previous calendar year (47 CFR § 64.2009(e)). In 2026 March 1 fell on a Sunday, so the FCC set March 2 (47 CFR § 1.4(j)). In 2027 March 1 is a Monday.
- It is not your Form 499 or USF filing. The FCC says so explicitly (DA 26-139).
The four mistakes the FCC keeps finding
From the Enforcement Bureau’s review of prior years’ filings (DA 26-139):
- The signing officer doesn’t affirmatively state personal knowledge that the company’s operating procedures are adequate.
- No accompanying statement explaining how the procedures ensure compliance — “we have adopted procedures” is not enough.
- No clear statement on actions against data brokers — if there were none, you must say so.
- No clear statement on customer complaints about unauthorized release of CPNI — if there were none, you must say so.
Failure to comply can bring forfeitures of up to $251,322 per violation or per day of a continuing violation, up to $2,513,215 — the figures in the FCC’s February 11, 2026 advisory.
Five required elements, one accompanying statement.
47 CFR § 64.2009(e) and the FCC’s 2026 advisory require all five. We follow the FCC’s suggested template for the certificate, and write the statement from your actual procedures.
The certificate
- Signed by an officer, as agent of the company
- The officer’s statement of personal knowledge that the operating procedures are adequate to ensure compliance
- An explanation of any actions taken against data brokers — or an affirmative “none”
- A summary of all customer complaints in the past year about unauthorized release of CPNI, by category — or an affirmative “none”
- The accompanying statement, attached
The accompanying statement covers
- How you use CPNI, and approvals and notices if you seek them (§§ 64.2005, 64.2007, 64.2008)
- Your approval-status system, training and disciplinary process (§ 64.2009(a)–(b))
- Records of campaigns and third-party access, and supervisory review (§ 64.2009(c)–(d))
- Authentication for phone, online and in-store access, and account-change notices (§ 64.2010)
- Breach notification to the Secret Service and FBI within seven business days (§ 64.2011)
Part of the Annual Compliance Pack — $790 per year
Most providers owe the CPNI certification and the RMD annual recertification on the same day, March 1. One pack covers both.
- The certificate, ready for your officer’s signature, following the FCC’s template
- The accompanying statement, written from your procedures
- The data-broker and complaint statements (with a categorized summary if you had complaints)
- Filing instructions for ECFS (EB Docket No. 06-36) or the FCC’s CPNI web form
- Plus the RMD recertification, an updated robocall mitigation plan, a compliance calendar and one mid-year change update
What we don’t do
- Legal advice, or representation before the FCC
- Filing the certification for you
- Designing security systems or running breach notifications
- Form 499 filings or universal service contributions
CPNI certification questions
We resell a wholesale provider’s service. Isn’t CPNI their job?
If you provide the interconnected VoIP or telecommunications service to your customers, the certification is yours to file; the FCC’s advisory lists resellers among the carriers that must file (DA 26-139). Your wholesale provider’s safeguards can be part of how you comply, and the statement says so.
We had no complaints and took no action against data brokers. Do we still have to say it?
Yes. The FCC lists the missing “none” statements among the deficiencies it keeps finding; if there were none, the filing must say so affirmatively (DA 26-139).
Can we use the FCC’s template?
Yes — it is optional, and it is what we follow for the certificate. The template alone is not enough: the accompanying statement has to explain how your procedures work.
Where is it filed?
In the FCC’s Electronic Comment Filing System, in EB Docket No. 06-36, or through the FCC’s CPNI web application. The FCC asks companies not to send copies to Enforcement Bureau staff unless a consent decree requires it (DA 26-139).
Can we buy the CPNI certification on its own?
Today it is sold inside the Annual Compliance Pack, with the RMD recertification. If your situation is different, say so in your request.
Your officer signs. We make sure it's complete.
A fixed price and a delivery date, in writing. No call, no sales meeting. Send it tonight, read it in the morning.