TL;DR
Quick Answer
TL;DR
Key Facts
- FCC robocall mitigation requirements: Voice service providers are already required to take reasonable and effective steps regarding certain upstream providers from which they directly receive traffic.
- Enhanced KYUP requirements: The Federal Communications Commission (FCC) has proposed more prescriptive obligations covering information collection, verification, monitoring, compliance review, and responsive action.
- Robocall Mitigation Database (RMDB) participation: FCC enforcement has demonstrated that removal from the RMDB can affect a provider's ability to exchange traffic with other U.S. voice service providers.
- Ongoing monitoring: The proposed KYUP framework emphasizes continuous oversight rather than one-time provider verification.
- Responsive action: The FCC proposal would require providers to take action when evidence indicates an upstream provider presents unacceptable risk or is associated with illegal traffic.
- Compliance documentation: Providers should be able to demonstrate how due diligence, monitoring, investigations, and decisions were performed and documented.
What Are the Consequences of Failing KYUP Compliance?
A voice service provider that cannot demonstrate Know Your Upstream Provider (KYUP) compliance may face regulatory, operational, and commercial consequences. While enforcement outcomes depend on the specific facts, applicable regulations, and provider conduct, the inability to demonstrate reasonable upstream-provider due diligence can increase compliance risk and regulatory scrutiny.
Potential consequences may include:
- Federal Communications Commission (FCC) enforcement actions
- Increased scrutiny during investigations or traceback activities
- Robocall Mitigation Database (RMDB) compliance issues
- Restrictions on exchanging traffic with other providers
- Service disruption or provider relationship termination
- Remediation costs and corrective-action requirements
- Increased risk exposure when illegal traffic traverses the network
As the FCC continues to evaluate enhanced KYUP requirements, providers may increasingly need to demonstrate not only that they have policies in place, but that those policies are consistently implemented, monitored, and documented.
How It Works
How Can a Provider Demonstrate KYUP Compliance?
The FCC's proposed KYUP framework is structured around four interconnected areas:
Maintain Verified Upstream Provider Information
Providers should be able to demonstrate that they have collected and verified information about the upstream providers from which they receive traffic. The FCC's proposed framework would establish more specific expectations around provider information collection and verification.
Monitor Provider Activity Over Time
Compliance is not limited to onboarding. The proposed KYUP framework emphasizes ongoing monitoring of provider activity, compliance indicators, and evidence associated with illegal traffic.
Investigate and Respond to Risk
Providers should have documented procedures for reviewing risk indicators, investigating concerns, and taking appropriate responsive action when necessary. The FCC's proposal contemplates circumstances in which service may need to be refused or discontinued.
Preserve Compliance Records
Providers should maintain records demonstrating what information was collected, how it was verified, what monitoring occurred, and what actions were taken in response to identified risks. Documentation can be critical during audits, investigations, or enforcement proceedings.
KYUP is not satisfied by knowing who an upstream provider is. Providers must also establish that the relationship remains compliant over time and act when the risk changes.
What Happens if a Provider Is Removed From the Robocall Mitigation Database?
The FCC requires voice service providers to maintain required certifications in the Robocall Mitigation Database (RMD). Providers that are not properly listed in the database may face significant operational consequences because other providers generally may not accept traffic from entities that are not compliant with RMDB requirements.
The FCC has already demonstrated the practical impact of RMD enforcement. In October 2024, the FCC ordered 2,411 voice service providers to cure deficiencies in their RMD certifications or face removal. Numeracle's reporting on that action notes that downstream providers are expected to block traffic from entities that are not properly listed, making RMD compliance a network-access issue rather than merely an administrative filing requirement.
In August 2025, the FCC removed another 1,200 providers from the RMD. Numeracle reported that the removals effectively restricted those providers' ability to interconnect and exchange traffic with U.S. networks.
This makes RMD compliance particularly consequential for voice service providers. Failure to maintain compliant status can affect whether other providers are permitted or willing to accept the provider's traffic.
Can KYUP Noncompliance Lead to Traffic Blocking?
Yes, depending on the circumstances. Traffic blocking can occur at multiple points in the voice ecosystem when providers identify illegal traffic, noncompliant entities, or providers that do not meet applicable network participation requirements.
The FCC's proposed KYUP rules specifically contemplate requiring providers to refuse or discontinue service to upstream providers under circumstances including when the provider cannot establish that the upstream entity is a valid and authentic entity, when the upstream provider is likely to use the network to transmit illegal calls, or when the upstream provider does not satisfy specified regulatory requirements.
This is an important distinction from ordinary call blocking.
- Call blocking can target individual calls or traffic patterns.
- KYUP-related service refusal addresses the upstream provider relationship itself.
That distinction makes identity verification and provider-level monitoring important components of an effective KYUP program.
Does KYUP Noncompliance Increase Liability for Illegal Calls?
Potentially, particularly when a provider cannot demonstrate that it took the required or appropriate steps to identify and manage upstream risk. KYUP does not mean a provider automatically becomes legally responsible for every illegal call that crosses its network. Liability depends on the applicable law, facts, regulatory requirements, and enforcement action.
However, the absence of credible documentation can make a provider's compliance position more difficult to defend when illegal traffic is traced through its network. The FCC's proposed framework emphasizes affirmative provider responsibilities, including verification, monitoring, and responsive action.
Numeracle's prior KYC analysis makes a similar point from an identity governance perspective: having a written policy is not enough if the provider does not actually monitor customers or enforce the consequences established by that policy.
Why This Matters
Why Documentation Matters for KYUP Compliance
A provider needs to be able to demonstrate what actions it performed, when those actions occurred, and what decisions were made. A written policy alone may not be sufficient if the provider cannot show that its procedures were actually followed.
A defensible KYUP compliance record may include:
- Verified upstream-provider identity information
- Information collected during onboarding and review
- Risk-assessment results
- Monitoring activity and investigations
- Compliance reviews
- Escalation records
- Corrective actions taken
- Service restrictions or termination decisions
- Reverification history
As the FCC considers more detailed KYUP requirements, documentation may become increasingly important in demonstrating compliance and accountability.
Common Questions
Is KYUP compliance mandatory?
Voice service providers are already subject to Federal Communications Commission (FCC) requirements related to upstream-provider diligence and robocall mitigation. The FCC's 2026 Further Notice of Proposed Rulemaking (FNPRM) proposes more detailed KYUP requirements, but those proposed enhancements have not yet been adopted as final rules.
What happens if a provider is not listed in the Robocall Mitigation Database?
Failure to maintain appropriate RMD status can affect the provider's ability to exchange traffic with other providers. FCC enforcement actions have resulted in providers being removed from the RMD and losing network participation.
Does KYUP replace STIR/SHAKEN?
No. STIR/SHAKEN authenticates caller ID information associated with calls. KYUP addresses the identity, compliance, monitoring, and accountability of upstream provider relationships.
Is a KYUP policy enough to demonstrate compliance?
Not necessarily. Providers should be able to demonstrate that their Know Your Upstream Provider (KYUP) processes are actively implemented through verification, monitoring, investigations, documentation, and responsive action. Compliance typically depends on evidence of execution, not simply the existence of a written policy.
What is the biggest KYUP compliance risk?
One of the most significant risks is being unable to demonstrate the diligence performed on upstream-provider relationships. Even when policies exist, the absence of supporting documentation can make compliance activities difficult to verify during investigations, audits, or enforcement reviews.
Our platform empowers organizations to manage branded calling, improve caller id reputation, and stay compliant with evolving regulatory and industry standards. FAQs and Glossary terms like this are designed to provide clear, actionable guidance backed by our expertise in verified identity, call labeling mitigation, and spam prevention.
To explore how Numeracle supports trusted and effective outbound communications, visit www.numeracle.com.
