STIR/SHAKEN in Canada: What the CRTC Requires

What STIR/SHAKEN is, in one paragraph

STIR/SHAKEN is how Canadian phone companies digitally sign the caller ID on internet-based (IP) voice calls, so the company at the receiving end can check whether the number shown is genuine. STIR (Secure Telephone Identity Revisited, the name of the IETF working group; CRTC and CST-GA texts write "Telephony") is the IETF technical standard; SHAKEN (Signature-based Handling of Asserted information using toKENs) is the framework for putting it into carrier networks. The Canadian governance body puts it this way: "STIR defines how you could implement the protocol, while SHAKEN documents how you will implement the protocol" ^[1]. In the CRTC's words, providers "certify the extent to which a given caller's identity can be trusted", that information travels in "tokens", and the called party's provider uses it to verify the caller ID, which depends on "Certificate Authorities (CAs) administering and issuing certificates" to providers ^[2].

This page covers the Canadian rules as of October 2026. It is educational information, not legal advice. For the US rules, the attestation statistics and how spam labels work, see our research brief STIR/SHAKEN signs the call. It does not vouch for the caller.

Why the CRTC mandated it

The problem is caller ID spoofing. The CRTC lists the illegitimate versions it sees: a caller ID altered "to match the first 6-digits of your telephone number" ("neighbouring"), altered "to display your own telephone number" ("mirroring"), or altered to pose as "a recognizable brand or a government organization" ^[3]. It also lists legitimate uses, such as a call centre showing its client's number or a doctor showing the hospital's call-back number. Telemarketers who spoof break the Unsolicited Telecommunications Rules, with fines "up to $1,500 per violation for an individual and up to $15,000 per violation for a corporation" (same page).

In Decision 2018-32 the CRTC concluded that STIR/SHAKEN "is likely the only current viable solution that can provide consumers with a measure of additional trust in caller ID" and that it would make call filtering and network blocking more effective ^[4].

How the deadline moved: a timeline

The Rogers extension request cited COVID-19 resource shifts, missing VoIP interconnections between providers, unfinished standards, and the US date of 30 June 2021 ^[5].

The Canadian rule: Decision 2021-123

The operative rule is short. Under sections 24 and 24.1 of the Telecommunications Act, "as a condition of offering and providing telecommunications services, TSPs must implement STIR/SHAKEN in order to authenticate and validate IP-based voice calls, effective 30 November 2021" ^[6]. Three features matter for businesses:

• It applies to every provider. The Independent Telecommunications Providers Association argued the mandate would be "overly burdensome for smaller TSPs". The CRTC disagreed: "Excluding some TSPs from the obligation ... would undermine the effectiveness of the system" ^[6].
• It covers IP calls only. The obligation "applies to calls that travel over a TSP's IP-based network, including any portion of its network that is able to initiate, transit, or terminate IP-based calls" (same decision). The CRTC accepted in 2018 that STIR/SHAKEN cannot be deployed "on legacy circuit-switched networks" but expected providers to extend its benefits to non-IP networks "to the largest extent possible" ^[4].
• It is a duty to sign and verify, not to block. Nothing in 2021-123 tells a provider to reject an unsigned call. The CRTC framed it as "a tool to identify the level of trustworthiness of a call" that will "empower consumers to take the appropriate actions" ^[6].

Who runs it: CST-GA, Policy Administrator, Certificate Authorities

Decision 2019-403 sets out three roles ^[2]:

1. Governance Authority ensures "the integrity of the issuance, management, security, and use of certificates". In Canada that is the CST-GA, founded by Bell Canada, Eastlink, Rogers, SaskTel, Shaw, TELUS and Videotron with the Canadian LNP Consortium.
2. Policy Administrator, selected by the Governance Authority, applies its rules and makes sure certificates "are issued only to authorized TSPs". The CRTC calls it "the administrator and primary trust anchor of the system".
3. Certificate Authorities "issue certificates to validated TSPs".

The CST-GA says it "has selected Neustar as the Policy Administrator and has authorized Neustar and Sansay as Certification Authorities" ^[7]. Its participants page also shows a third Certification Authority logo (Somos) and the logos of participating providers ^[8]. The founders' start-up fund was $250,000, with about $325,000 a year in projected operating costs once vendors were in place ^[2].

Who can get a certificate. Originally only providers with direct access to Canadian numbering resources qualified. Decision 2021-267 explained the consequence: calls from other providers "would only be authenticated when they reach an eligible TSP" and "would likely only be given level B or level C attestation". The CRTC told the CST-GA to rewrite its eligibility rules within 60 days so that access is refused only where a provider "cannot be trusted to maintain the integrity of the STIR/SHAKEN framework" ^[9]. The CST-GA's current sign-up form still starts with "Do you have direct access to telephone numbers?" and lets CRTC-registered voice providers join "either as a Shareholder or a Non-Shareholder Participant" ^[10].

Attestation levels A, B and C

The attestation is the signing provider's statement about what it knows. RFC 8588 defines the values A, B and C as "'Full Attestation', 'Partial Attestation', and 'Gateway Attestation'" and points to ATIS for the definitions ^[11]. From ATIS-1000074.v003 ^[12]:

ATIS leaves the proof of number ownership to each provider: "Ultimately it is up to service provider policy to decide what constitutes 'legitimate right to assert a TN'". Examples it gives include a number assigned by the signing provider, or a provider that "has ascertained that the customer is authorized to use a TN", including numbers "assigned by another service provider" (ATIS-1000074.v003).

Providers versus small businesses: who has to do what

The obligations in 2021-123 and 2025-343 fall on telecommunications service providers. A business that buys phone service is not a TSP and has no filing or signing duty under these decisions. Your carrier signs your outgoing calls; the carrier of the person you call verifies them.

What you control is the information your carrier relies on: which number you present as caller ID, whether that number is yours, and which provider places the call. If an outside call centre or dialler places calls showing your main number, that provider decides the attestation, and under ATIS it can only give an A if it has verified you may use the number.

Why your calls may still show "unverified" or be mislabelled

Several causes are on the public record, none of which you can fix by yourself:

• The call was not IP end to end. The CRTC's consumer page lists "network compatibility", "calls being not entirely performed over an IP-voice network" and "complex call scenarios" ^[3].
• The recipient's phone cannot show it. The same page says "only smartphones are able to display the STIR/SHAKEN information".
• The recipient's carrier does not send a display indicator. Decision 2025-343 still asks providers "Whether you send the Verstat (Verification Status) parameter ... to end users", which means sending it is not universal ^[13].
• Your provider signed with B or C. That happens when it has not verified your number, or when the call arrives from a provider without its own certificate ^[9].
• Labels come from analytics, not the signature. The IETF standard says verification "does not entail any particular treatment of the request" ^[14], and the CRTC expects STIR/SHAKEN "to partner with the analytical capacity of service providers" ^[3]. A fully signed call can still be labelled.

Reporting changes in 2025: Decision 2025-343

On 16 December 2025 the CRTC found that "the TSPs with a STIR/SHAKEN token have worked diligently" and that "on average, TSPs employ STIR/SHAKEN successfully to authenticate the vast majority of their IP-based voice calls" ^[13]. It therefore:

• ended semi-annual reports for providers that had already filed four, effective 16 December 2025, replacing them with "targeted requests for information" when needed;
• required providers that have or will obtain a token but had not filed four reports to file "two annual reports", due 31 May each year, after which "No further reports will be required".

The CRTC kept oversight for providers "just now converting from legacy Time-Division Multiplexing networks to IP networks" (same decision). The simplified report asks for counts by attestation level (A, B, C, none) for calls sent and received.

What changed in 2026

We checked the CRTC's 2026 lists of decisions and notices (archived copy dated 13 August 2026) for STIR/SHAKEN items. We found no 2026 decision changing the STIR/SHAKEN mandate or the 2025-343 reporting regime. Two related items:

• Decision 2026-52, titled "Mandatory call traceback participation for all providers of voice telecommunications services" ^[15]. Traceback is how providers trace a nuisance call back to its source. As its title says, the decision makes taking part in traceback mandatory for every voice provider. We could not load the decision text, so we do not describe its other terms.
• Compliance and Enforcement Notice of Consultation 2026-132, "Review of the Unsolicited Telecommunications Rules", with interventions due 27 July 2026 and replies due 11 August 2026 ^[16]. It concerns the telemarketing rules, not the STIR/SHAKEN mandate itself. No decision appears in the CRTC's lists through 13 August 2026; until one issues, the current rules stay in force.

What to do: a checklist for a Canadian business

• Ask your carrier in writing whether it signs your outgoing calls itself and what attestation level they normally get. If it is not A, ask what it needs from you to verify the number.
• Check whether your provider holds its own certificate. The CST-GA participants page shows participating providers. A reseller may be signed by its upstream carrier instead.
• Present only numbers you own, and the same number customers call back on.
• If a call centre or dialler calls for you, ask that provider what attestation your calls get and how it verified your right to the number.
• If someone spoofs your number, the CRTC points to its complaint process for telemarketing and, for suspected fraud, the Canadian Anti-Fraud Centre at 1-888-495-8501 ^[3]. Keep dates, times and the numbers called.
• Do not expect a checkmark on every phone; display depends on the device and the recipient's carrier.

Our Canada page covers Canadian numbers, and the glossary defines terms such as caller ID and porting.

FAQ

Does STIR/SHAKEN block spam?

Not by itself. It signs and verifies caller ID; what a carrier does next is its own policy ^[14]. Blocking in Canada comes from other measures: providers without an opt-in filtering service must block calls whose caller ID exceeds 15 digits or is not dialable under the North American Numbering Plan ^[3].

Does it cover landlines?

Only the IP parts of the network. The mandate covers IP-based calls; old circuit-switched equipment cannot do STIR/SHAKEN, and the CRTC treats that as a shrinking gap as networks move to IP ^[4][6].

Is it the same as the US system?

Same standards, separate governance. Both use the IETF and ATIS specifications. The US has its own Governance Authority and Policy Administrator (the CRTC noted iconectiv was named US Policy Administrator on 30 May 2019), while Canada uses the CST-GA ^[2]. The CRTC aligned Canada's 30 June 2021 date with the US ^[5], but Canada gave smaller providers no separate deadline.

Auto Attendant answers inbound calls only and places no outbound calls, so the attestation on your outgoing calls depends on whichever provider places them.

Sources

1. Compliance and Enforcement and Telecom Decision CRTC 2018-32 — CRTC, 25 January 2018, original expectation and 31 March 2019 date, legacy-network limits. Read via Internet Archive copy. Accessed 2026-10-28.
2. Compliance and Enforcement and Telecom Decision CRTC 2019-402-2 — CRTC, 15 September 2020, extensions to 30 September 2020 and 30 June 2021. Read via Internet Archive copy. Accessed 2026-10-28.
3. Compliance and Enforcement and Telecom Decision CRTC 2019-403 — CRTC, 9 December 2019, CSTGA approval, roles, tokens and certificates. Read via Internet Archive copy. Accessed 2026-10-28.
4. Compliance and Enforcement and Telecom Decision CRTC 2021-123 — CRTC, 6 April 2021, condition of service effective 30 November 2021, reporting, scope. Read via Internet Archive copy. Accessed 2026-10-28.
5. Compliance and Enforcement and Telecom Decision CRTC 2021-267 — CRTC, 5 August 2021, certificate eligibility. Read via Internet Archive copy. Accessed 2026-10-28.
6. Compliance and Enforcement and Telecom Decision CRTC 2025-343 — CRTC, 16 December 2025, reduced reporting. Read via Internet Archive copy. Accessed 2026-10-28.
7. Caller ID Spoofing — CRTC consumer page, spoofing types, fines, display limits, universal blocking. Read via Internet Archive copy. Accessed 2026-10-28.
8. Decisions 2026 — CRTC, list including Decision 2026-52. Read via Internet Archive copy of 13 August 2026. Accessed 2026-10-28.
9. Notices 2026 — CRTC, list including Notice 2026-132 and its deadlines. Read via Internet Archive copy of 13 August 2026. Accessed 2026-10-28.
10. CST-GA: Trust in Telecommunications — CST-GA, role and STIR versus SHAKEN. Accessed 2026-10-28.
11. About — CST-GA, Policy Administrator and Certification Authorities, founders. Accessed 2026-10-28.
12. Participants — CST-GA, Certification Authorities and participating providers. Accessed 2026-10-28.
13. TSPs — CST-GA, participation and eligibility form. Accessed 2026-10-28.
14. ATIS-1000074.v003, SHAKEN — ATIS and SIP Forum, approved 16 August 2022, attestation definitions. Accessed 2026-10-28.
15. RFC 8588: PASSporT Extension for SHAKEN — IETF, attest values A, B, C. Accessed 2026-10-28.
16. RFC 8224: Authenticated Identity Management in SIP — IETF, STIR standard; verification does not dictate treatment. Accessed 2026-10-28.
17. Compliance and Enforcement and Telecom Decision CRTC 2019-402 — CRTC, 9 December 2019, deadline of 30 September 2020 and action plans due 24 February 2020. Read via Internet Archive copy. Accessed 2026-10-28.
18. Secure Telephone Identity Revisited (stir) — IETF Datatracker, working group name. Accessed 2026-10-28.