TL;DR
Quick Answer
TL;DR
Key Facts
- Verify upstream provider identity: Use authoritative business and telecom data to validate upstream providers rather than relying solely on self-reported information.
- Apply consistent risk assessment: Establish a standardized framework for evaluating upstream providers so vetting decisions are repeatable, documented, and defensible.
- Review upstream compliance: Assess whether upstream providers are meeting applicable FCC requirements and maintaining appropriate practices to prevent illegal traffic.
- Link monitoring to verified identity: Connect ongoing traffic monitoring to verified upstream entities so suspicious activity can be investigated and addressed at the provider level.
- Maintain audit-ready records: Keep time-stamped, easily retrievable records of provider information, verification results, risk assessments, monitoring, and responsive actions.
- Prepare before requirements are finalized: The FCC's proposed KYUP framework would establish more specific baseline requirements for upstream-provider information collection, verification, monitoring, and responsive action. Building these capabilities now can make it easier to adapt if the rules are finalized.
- Gateway providers already have responsibilities related to upstream-provider oversight under existing FCC robocall mitigation requirements.
- The FCC's proposed KYUP framework includes information collection, verification, monitoring, compliance review, and responsive-action obligations.
- The proposed rules would require providers to refuse or discontinue relationships when evidence indicates an upstream provider is facilitating illegal traffic.
Gateway providers should prepare for Know Your Upstream Provider (KYUP) by establishing a documented process for identifying, verifying, evaluating, monitoring, and responding to risks associated with upstream providers. The FCC's proposed KYUP framework would require more structured due diligence practices, including information collection, verification, monitoring, and responsive action.
Preparation should focus on maintaining verified provider records, applying consistent risk review procedures, monitoring provider activity over time, and preserving documentation that demonstrates reasonable diligence. Taking these steps before any final rules are adopted can help providers operationalize KYUP requirements more efficiently if the FCC proceeds with its proposal.
How It Works
How Can Gateway Providers Prepare for KYUP?
The best approach is to build a repeatable upstream-provider vetting process that connects verified business identity, risk assessment, ongoing monitoring, and documentation.
1. Verify the Identity of Every Upstream Provider
Start by establishing a verified identity record for each provider from which you directly receive traffic. This should go beyond relying solely on information supplied by the provider. A strong verification process can validate business identity against authoritative corporate, commercial, and telecom-specific sources and identify discrepancies that warrant further review.
The goal is to establish a clear answer to a fundamental KYUP question:
Who is the entity sending traffic into my network?
This identity record should become the foundation for subsequent risk assessment and monitoring.
2. Collect Relevant Information About Upstream Providers
The FCC's proposed KYUP framework would require providers to obtain detailed information directly from upstream providers and verify the validity and authenticity of that information.
Gateway providers should maintain sufficient information to establish provider identity, evaluate risk, and support ongoing compliance review. The FCC's proposed KYUP framework would establish more specific categories of information collection and verification requirements. Providers seeking detailed regulatory guidance should review the proposed FCC requirements.
The FCC has also proposed using RMD information as a source for cross-checking upstream-provider information and identifying inconsistencies.
3. Assess the Risk of Each Upstream Relationship
Verification establishes who the provider is. Risk assessment determines whether the relationship presents an unacceptable level of risk. Gateway providers should establish consistent criteria for evaluating upstream providers rather than relying on ad hoc decisions. Relevant considerations can include the provider's identity, regulatory history, compliance practices, traffic patterns, business model, and any evidence of illegal calling activity.
A standardized risk framework makes decisions more consistent and creates a defensible record of why an upstream provider was approved, flagged for additional review, or restricted.
4. Review Compliance Controls
KYUP is not simply about identifying the company immediately upstream. The FCC's proposed framework would require providers to conduct due diligence regarding an upstream provider's compliance with certain Commission rules.
For gateway providers, that means asking questions such as:
- Does the upstream provider know and verify its own customers?
- Does it maintain appropriate robocall mitigation practices?
- Does it have a filing in the FCC's Robocall Mitigation Database?
- Does the information it provides align with information available from authoritative sources?
- Can it demonstrate processes for identifying and addressing illegal traffic?
This creates a chain of accountability in which each provider is responsible for exercising appropriate diligence on the provider immediately upstream.
5. Connect Traffic Monitoring to Verified Provider Identity
KYUP should not be treated as a one-time onboarding exercise. Monitoring should support investigation and escalation workflows rather than operate independently from provider due diligence records.
The FCC's proposed rules include baseline monitoring obligations and would require providers to refuse or discontinue service when an upstream provider is, or is likely to be, the source of illegal calls. Gateway providers should therefore connect traffic monitoring with their upstream-provider identity records. This makes it possible to identify unusual traffic behavior and determine which verified entity is responsible for the traffic.
Examples of potential warning signs include:
- Sudden or unexplained increases in traffic volume
- Traffic patterns associated with known illegal calling activity
- Significant changes in traffic behavior following onboarding
- Inconsistencies between a provider's stated business activities and observed traffic
- Evidence that an upstream provider is facilitating illegal calls
The purpose is not simply to identify suspicious calls. It is to identify the provider relationship behind the traffic so that appropriate action can be taken.
6. Maintain an Audit-Ready Record of Due Diligence
A gateway provider should be able to demonstrate not only that it performed vetting, but what it verified, when it verified it, what risks it identified, and what action it took.
An audit-ready KYUP record should document items such as:
- Information collected from the upstream provider
- Sources used to independently verify that information
- Verification dates and results
- Risk assessment results
- Compliance and RMD checks
- Monitoring activity
- Reviews triggered by suspicious activity
- Corrective actions or escalations
- Decisions to restrict, suspend, or terminate an upstream relationship
Maintaining this information in a centralized, retrievable system makes it easier to demonstrate reasonable diligence to regulators, partners, or other stakeholders.
Why This Matters
Why Early KYUP Preparation Matters
Gateway providers can play an important role in preventing illegal traffic from entering the broader voice ecosystem because they often serve as an entry point between networks. The FCC's existing rules already recognize the importance of gateway providers knowing their upstream providers, particularly when foreign-originated traffic enters the U.S. network. The FCC's 2026 KYUP proceeding would make upstream-provider due diligence more specific and systematic. The proposal would establish requirements around information collection, verification, compliance review, monitoring, and responsive action. As a result, providers may need to demonstrate that they understand who is sending traffic into their network and what steps they have taken to identify risk.
Preparing for KYUP before any enhanced requirements are finalized allows providers to build repeatable processes, reduce operational disruption, and maintain documentation that supports compliance and accountability. For gateway providers, this means KYUP readiness is more than a customer onboarding exercise.
Building these capabilities can help gateway providers strengthen their existing robocall mitigation programs while preparing for potential changes resulting from the FCC's KYUP rulemaking. The FCC's KYUP NPRM was published in the Federal Register on July 9, 2026, with initial comments due August 10 and reply comments due September 8. The proposed enhanced requirements are not yet final rules.
Common Questions
Is KYUP already a requirement for gateway providers?
Gateway providers already have obligations under existing FCC rules to know their upstream providers and take reasonable and effective steps to address illegal traffic. The FCC's 2026 proceeding proposes to make KYUP obligations more specific and comprehensive. The enhanced requirements remain subject to the rulemaking process and are not yet final.
What information should a gateway provider collect from an upstream provider?
The FCC's proposal contemplates business, ownership, operational, service, and other information needed to identify and evaluate upstream providers. Providers should review applicable FCC guidance and maintain sufficient information to support due diligence and compliance activities.
How often should gateway providers verify upstream providers?
The proposed framework contemplates verification at specified points in the provider relationship, including before entering into a new agreement, before renewing an existing agreement, and when credible evidence of illegal traffic is identified.
What happens if an upstream provider is associated with illegal traffic?
A gateway provider should investigate the available evidence, evaluate the upstream provider, document its findings, and take appropriate responsive action. The FCC's proposal would require documentation of decisions to refuse or discontinue service based on KYUP information.
Should gateway providers wait for final FCC rules before preparing?
No. The FCC's enhanced KYUP requirements remain under consideration, but many of the proposed concepts involve documented provider due diligence, monitoring, and recordkeeping. Establishing these processes early can help providers adapt more efficiently if new requirements are adopted.
Our platform empowers organizations to manage branded calling, improve caller id reputation, and stay compliant with evolving regulatory and industry standards. FAQs and Glossary terms like this are designed to provide clear, actionable guidance backed by our expertise in verified identity, call labeling mitigation, and spam prevention.
To explore how Numeracle supports trusted and effective outbound communications, visit www.numeracle.com.
