Who must sign the annual CPNI certification, and what must the officer state?

What the officer certifies

The FCC’s suggested template has the signer certify “that I am an officer of the company named above, and acting as an agent of the company, that I have personal knowledge that the company has established operating procedures that are adequate to ensure compliance with the Commission’s CPNI rules,” and represent that the certification is consistent with 47 CFR § 1.17, which requires truthful and accurate statements to the FCC. False statements and misrepresentations are punishable under Title 18 of the U.S. Code (DA 26-139).

What “personal knowledge” has to cover

• a system that establishes each customer’s CPNI approval status before CPNI is used (§ 64.2009(a));
• training on when staff may and may not use CPNI, and an express disciplinary process (§ 64.2009(b));
• records, kept at least one year, of marketing campaigns that use CPNI and of every disclosure of or access to CPNI by third parties (§ 64.2009(c));
• supervisory review of outbound marketing requests for customer approval (§ 64.2009(d)).

The four deficiencies the FCC keeps finding

• The officer does not affirmatively state personal knowledge.
• No accompanying statement explaining how the procedures ensure compliance; saying procedures were adopted is not enough.
• No clear statement on actions against data brokers (proceedings or petitions at state commissions, courts or the FCC). If none, say so.
• No clear statement on customer complaints about unauthorized release of CPNI. If there were any, summarize them by number and category (DA 26-139).

Last reviewed: September 30, 2026

General information drawn from the rule text and the FCC documents listed below — not legal advice. You review, sign and submit your own filings.