TL;DR
Quick Answer
TL;DR
Key Facts
- Upstream provider inventory: Identify all carriers, wholesale providers, gateways, aggregators, and other entities that send voice traffic into your network.
- Identity verification: Verify upstream-provider business identities using authoritative business, regulatory, and telecommunications data sources.
- Risk assessment: Apply consistent criteria to evaluate provider legitimacy, compliance practices, and potential risk indicators.
- Traffic monitoring: Connect observed traffic behavior to verified upstream-provider identities to support investigations and escalation.
- Documentation: Maintain retrievable records of verification, risk assessment, monitoring, and responsive actions.
- FCC proposed requirements: The Federal Communications Commission's proposed KYUP framework would establish more structured requirements for provider due diligence, monitoring, and responsive action.
The time to act is before final rules are issued, not after. CPaaS and UCaaS providers can get started with Know Your Upstream Provider (KYUP) compliance by applying the same identity-first principles used in KYC to their upstream provider relationships. Instead of focusing only on the businesses they directly serve, providers should establish who is sending traffic into their networks, verify those entities, evaluate their risk and compliance practices, and maintain ongoing oversight.
Know Your Upstream Provider (KYUP) is the process of identifying and evaluating the providers from which a voice service provider receives traffic. It extends the identity and due-diligence principles of Know Your Customer (KYC) further up the communications chain. While KYC focuses primarily on a provider's direct customers, KYUP focuses on the upstream entities responsible for introducing traffic into the network.
Communications Platform as a Service (CPaaS) and Unified Communications as a Service (UCaaS) providers can begin preparing for Know Your Upstream Provider (KYUP) by establishing a repeatable process for identifying, verifying, assessing, monitoring, and documenting upstream-provider relationships.
Preparation often starts with creating an inventory of all entities that provide voice traffic to the platform, validating provider identity information, evaluating risk indicators, and establishing procedures for ongoing monitoring and escalation. Providers should also maintain records demonstrating the due diligence performed throughout each upstream relationship.
The Federal Communications Commission's (FCC) proposed KYUP framework would introduce more specific requirements related to provider information collection, verification, monitoring, compliance review, and responsive action. While those requirements have not been finalized, many providers are already evaluating how to operationalize these practices within existing compliance workflows.
How It Works
How Does KYUP Compliance Work for CPaaS & UCaaS Providers?
A CPaaS or UCaaS provider can build KYUP readiness around six core steps:
1. Inventory Upstream Relationships
Inventory the carriers, wholesale providers, gateways, aggregators, and other entities that send traffic into your network or platform. The objective is to establish a complete picture of your upstream relationships rather than relying only on your direct customer records.
2. Verify Upstream Provider Identity
Create a verified identity profile for each upstream provider using authoritative business, corporate, regulatory, and telecom-specific information. Self-reported information can be part of the process, but it should be independently validated. A verified identity record should serve as the foundation for risk assessment, monitoring, and compliance review activities.
3. Assess Provider Risk
Evaluate the legitimacy and risk profile of each upstream provider. Relevant considerations can include ownership, operating history, regulatory or enforcement activity, customer-vetting practices, robocall mitigation practices, traffic characteristics, and alignment between the provider's stated business and observed activity.
4. Monitor Provider Activity
KYUP is not simply a point-in-time onboarding check. Providers need ongoing visibility into upstream relationships and traffic. Connecting observed traffic behavior to verified business identities allows potential anomalies or illegal activity to be investigated at the provider level.
5. Establish Escalation and Response Procedures
When risk indicators or evidence of illegal traffic emerge, providers should have a documented process for investigation and escalation. Depending on the circumstances, that may involve requesting additional information, enhanced due diligence, remediation, traffic restrictions, or termination.
6. Maintain An Audit Trail
Keep evidence of the information collected, verification performed, risk assessments, monitoring, investigations, and decisions. A centralized record helps demonstrate the diligence performed throughout the upstream relationship.
Why This Matters
Why Does KYUP Matter for CPaaS and UCaaS Providers?
CPaaS and UCaaS providers frequently operate between multiple communications providers, customers, and networks. As a result, understanding who is supplying traffic into a platform can be an important part of broader robocall mitigation and compliance efforts.
The FCC has increasingly emphasized accountability throughout the call path, including diligence related to upstream-provider relationships. Its proposed KYUP framework would establish more detailed expectations around provider verification, monitoring, compliance review, and responsive action.
For CPaaS and UCaaS providers, KYUP therefore represents an extension of existing identity and risk-management practices:
KYC: Who is my customer?
KYUP: Who is sending traffic into my network, and can I demonstrate that I have exercised appropriate diligence on that relationship?
By establishing documented due-diligence processes today, providers may be better positioned to support ongoing compliance activities, investigations, traceback efforts, and future regulatory requirements.
Common Questions
Is KYUP already required?
Voice service providers currently have obligations related to upstream-provider diligence as part of the Federal Communications Commission's robocall mitigation framework. The FCC's 2026 Further Notice of Proposed Rulemaking (FNPRM) proposes more detailed and standardized KYUP requirements, but those requirements are not yet final.
Does KYUP replace STIR/SHAKEN?
No. STIR/SHAKEN and KYUP address different layers of the communications ecosystem. STIR/SHAKEN provides caller ID authentication, while KYUP focuses on upstream provider identity, due diligence, monitoring, and accountability.
Do CPaaS and UCaaS providers need KYUP?
The applicability of specific requirements depends on an organization's role in the voice ecosystem and whether it qualifies as a voice service provider under applicable Federal Communications Commission rules. Providers should evaluate both their regulatory status and their upstream-provider relationships.
Can KYUP be performed manually?
Yes, but manual processes can become difficult to maintain as the number of upstream relationships, verification requirements, monitoring events, and documentation obligations increases. A structured workflow can help standardize verification and maintain an auditable record.
What is the first step toward KYUP readiness?
The first step is identifying and documenting all upstream-provider relationships. Providers cannot effectively verify identity, assess risk, monitor activity, or maintain due-diligence records if they do not have a complete understanding of who supplies traffic to their network or platform.
Our platform empowers organizations to manage branded calling, improve caller id reputation, and stay compliant with evolving regulatory and industry standards. FAQs and Glossary terms like this are designed to provide clear, actionable guidance backed by our expertise in verified identity, call labeling mitigation, and spam prevention.
To explore how Numeracle supports trusted and effective outbound communications, visit www.numeracle.com.
