DNCR compliance for VoIP providers: fail-closed vs fail-open

Australia's Do Not Call Register is a central database that allows individuals to opt out of receiving unsolicited telemarketing calls. For voice service providers carrying outbound calls to Australian numbers, compliance is not optional — the Do Not Call Register Act 2006 imposes civil penalties for contraventions, and the ACMA actively investigates complaints and issues formal warnings and infringement notices.

How the DNCR works

The Do Not Call Register Act 2006 prohibits making unsolicited telemarketing calls to numbers listed on the DNCR. The register covers landline and mobile numbers. Individuals register their numbers directly, and registration takes effect within 30 days. Once registered, a number remains on the register indefinitely unless the subscriber removes it.

Telemarketers and organisations making outbound calls are required to check — or "wash" — their call lists against the DNCR before dialling. Checking is done through a subscription service operated on behalf of the ACMA. Different subscription tiers allow different volumes of numbers to be checked, from 500 numbers to 100 million numbers per subscription period.

Exemptions

The DNCR does not apply to all outbound calls. Certain categories of calls are exempt, including calls made with the prior consent of the recipient, calls from registered charities, calls from government bodies, and calls that are not commercial in nature. Consent must be genuine and specific — a general marketing consent does not automatically override DNCR registration, and the ACMA takes a strict approach to consent claims that cannot be substantiated.

Fail-closed vs fail-open: why the distinction matters

For voice service providers implementing DNCR filtering at the network layer, the configuration choice between fail-closed and fail-open is operationally significant and has direct compliance implications.

A fail-open configuration means that if the DNCR check cannot be completed — due to a timeout, API unavailability, or connectivity issue — the call is permitted to proceed. This treats a failed check as equivalent to a clean result. The problem is that it creates a window during which calls to registered numbers can complete, which is exactly the outcome the DNCR regime is designed to prevent. If a compliance incident occurs during a period when the DNCR service was unavailable, a fail-open provider cannot demonstrate that the call should have been permitted.

A fail-closed configuration means that if the DNCR check cannot be completed, the call is blocked rather than permitted. This is the conservative approach: when in doubt, do not dial. It introduces operational risk — a sustained DNCR API outage could affect outbound call capacity — but it eliminates the compliance exposure of completing calls to registered numbers.

ACMA enforcement

The ACMA has issued formal warnings and infringement notices to organisations that made calls to DNCR-registered numbers. In several cases, the ACMA found that organisations could not demonstrate they had obtained valid consent from the called parties, and that their DNCR washing processes were inadequate or had been delegated to third parties without adequate oversight.

Importantly, the ACMA does not accept that responsibility for DNCR compliance can be fully delegated to a contracted calling partner or list provider. Each organisation in the call chain that has obligations under the Act must satisfy itself that those obligations are met.

What wholesale providers should implement

For wholesale voice carriers providing outbound calling capability to Australian resellers, the most defensible position is fail-closed filtering implemented at the SIP switching layer — not as an optional feature available to resellers, but as a default applied to all outbound traffic to Australian numbers. This means that DNCR API checks are integrated into the call routing logic, and calls are rejected at the network level if a check cannot be completed or if the number is confirmed as registered.

Contractual provisions requiring downstream resellers to conduct their own DNCR washing before submitting call lists are a necessary complement to network-level filtering, but they do not substitute for it. The carrier carries its own exposure if calls to registered numbers complete on its network.