TL;DR
Quick Answer
TL;DR
Key Facts
- Know Your Upstream Provider (KYUP): A framework for identifying, verifying, evaluating, and monitoring upstream providers that send traffic into a network.
- Upstream-provider accountability: KYUP helps voice service providers understand who is introducing traffic into their networks.
- Know Your Customer (KYC) relationship: KYC focuses on direct customers, while KYUP applies similar identity and due-diligence principles to upstream-provider relationships.
- Risk management: KYUP can include provider verification, risk assessment, compliance review, monitoring, and responsive action.
- Federal Communications Commission (FCC) requirements: Existing FCC rules require voice service providers to take reasonable and effective steps regarding certain upstream providers from which they directly receive traffic.
- Enhanced KYUP proposal: The FCC has proposed more specific requirements related to information collection, verification, monitoring, compliance review, and responsive action.
- Rulemaking status: The FCC's enhanced KYUP requirements remain proposed and have not been adopted as final rules.
What Is Know Your Upstream Provider (KYUP)?
Know Your Upstream Provider (KYUP) is the process of identifying, verifying, evaluating, and monitoring the providers from which a voice service provider receives traffic.
In simple terms, KYUP helps answer a fundamental question: Who is sending traffic into my network?
KYUP extends identity and accountability practices beyond direct customer relationships to the upstream providers that introduce traffic into the voice ecosystem. While Know Your Customer (KYC) focuses on the businesses a provider serves directly, KYUP focuses on the providers supplying traffic to that provider.
This distinction is important because voice traffic can pass through multiple interconnected providers before reaching its destination. Understanding who is introducing traffic into a network can help providers assess risk, conduct due diligence, investigate suspicious activity, and maintain accountability throughout the call path.
The Federal Communications Commission (FCC) currently requires voice service providers to take reasonable and effective steps regarding certain upstream providers from which they directly receive traffic and has proposed more specific KYUP requirements as part of its ongoing robocall mitigation efforts.
How It Works
How Does KYUP Work?
A KYUP program typically includes several connected activities:
Identify Upstream Providers
A provider first establishes which entities are sending traffic into its network. Depending on the provider's role, these relationships may include originating providers, intermediate providers, gateway providers, wholesale carriers, aggregators, or other interconnected voice providers. The goal is to establish visibility into the businesses behind the traffic a provider accepts.
Verify Upstream Provider Identity
Providers can verify upstream entities using authoritative business, corporate, regulatory, and telecom-specific information. This is an important distinction between collecting information and knowing an entity. Self-reported information may be part of the process, but meaningful verification requires a provider to establish that the entity exists, is represented accurately, and can be associated with the relevant network activity.
The FCC's proposed KYUP framework specifically calls for providers to verify the validity and authenticity of information obtained about upstream providers.
Evaluate Upstream Provider Risk
Identity verification establishes who the provider is. Risk evaluation helps determine whether the relationship presents an unacceptable level of risk.
Relevant information can include:
- Business identity and operating history
- Ownership and affiliate relationships
- Financial information
- Internet and commercial presence
- Operational characteristics
- Service information
- Compliance history
- Customer-vetting practices
- Traffic behavior
The FCC's proposed framework specifically identifies several of these information categories for upstream-provider due diligence.
Evaluate Upstream Provider Vetting Practices
KYUP also looks beyond the upstream provider's own identity. A provider needs to understand whether its upstream partner is taking meaningful steps to identify and manage the businesses and traffic it serves. This is what allows KYUP to create accountability across multiple layers of the call path rather than stopping at the immediately adjacent provider.
Monitor Traffic and Provider Behavior
KYUP is not simply an onboarding exercise. Ongoing monitoring can identify changes in traffic patterns or other indicators that an upstream relationship may require additional review. Connecting traffic behavior to verified provider identity gives compliance teams a way to investigate which entity is associated with a potential risk rather than treating suspicious traffic as an isolated technical event. Monitoring is one of the five baseline KYUP measures proposed by the FCC.
Take Responsive Action
When an upstream relationship presents evidence of illegal traffic or other significant risk, a provider needs a defined process for investigation and response. That can include requesting additional information, conducting enhanced due diligence, requiring remediation, restricting traffic, escalating the relationship, or discontinuing service when appropriate. The FCC's proposed framework includes responsive action as a baseline KYUP measure.
Why This Matters
Why Does KYUP Matter?
Illegal and fraudulent calling activity can move through multiple providers before reaching consumers. As a result, understanding direct customer identity alone may not provide complete visibility into the sources of traffic entering a network.
KYUP helps extend accountability to provider-to-provider relationships by helping organizations understand:
- Who is sending traffic into my network?
- Is that entity legitimate and independently verifiable?
- What do I know about its ownership and operations?
- Does it meaningfully vet its own customers?
- What does its traffic look like over time?
- What happens if suspicious or illegal activity emerges?
- Can I demonstrate the diligence I performed?
By connecting traffic activity to verified provider identities, KYUP can support compliance, investigations, risk management, and broader robocall mitigation efforts.
How Does KYUP Support a More Trusted Voice Network?
KYUP shifts the focus from simply accepting and monitoring traffic to understanding the entities responsible for that traffic. That distinction is important because traffic monitoring alone may tell a provider what is happening, while verified provider identity can help establish who is responsible. The combination gives providers a stronger foundation for investigation, risk management, and corrective action.
How Does KYUP Relate to KYC?
Know Your Customer (KYC) and Know Your Upstream Provider (KYUP) use similar identity and risk-management principles but apply them to different relationships.
KYC: Who is my customer?
KYUP: Who is sending traffic into my network?
A provider with established KYC processes may already have foundational capabilities such as identity verification, risk assessment, monitoring, and documentation that can also support KYUP activities.
Related: How Is KYUP Different From KYC?
How Does KYUP Relate to Robocall Mitigation?
KYUP is one component of a broader robocall mitigation strategy.
While technologies such as Secure Telephone Identity Revisited and Signature-based Handling of Asserted Information Using toKENs (STIR/SHAKEN) help authenticate caller identity information, KYUP focuses on the identity and accountability of the providers responsible for introducing traffic into the network. Together, these approaches address different aspects of communications trust and compliance.
Common Questions
Is KYUP already required by the Federal Communications Commission (FCC)?
Yes. Existing FCC rules require voice service providers to take reasonable and effective steps regarding certain originating and intermediate providers from which they directly receive traffic. The FCC has also proposed enhanced KYUP requirements that would establish more prescriptive obligations. Those proposed requirements are not yet final.
What does the FCC's proposed KYUP rule require voice service providers to do?
The FCC's proposed enhanced KYUP requirements would require voice service providers to collect and verify information about upstream providers, review compliance indicators, monitor provider activity and traffic, take appropriate responsive action when concerns arise, and maintain documentation supporting their due-diligence activities. The proposal remains part of the FCC's rulemaking process and has not yet been adopted as a final rule.
Is KYUP the Same as KYC?
No. KYC focuses on a provider's direct customers, while KYUP focuses on the upstream providers that send traffic into a provider's network.
Who needs to know their upstream providers?
The FCC's existing requirements apply to voice service providers that directly receive traffic from originating or intermediate providers. The scope of any future enhanced requirements will depend on the outcome of the FCC's rulemaking process.
Does KYUP Require Ongoing Monitoring?
Yes. KYUP is generally considered an ongoing process rather than a one-time onboarding activity. The FCC's proposed framework specifically includes monitoring as a core component.
How Can Providers Prepare for KYUP?
Providers can begin by identifying upstream-provider relationships, verifying provider identities, assessing risk, monitoring provider activity, and maintaining documentation of their due-diligence activities.
Related:
Our platform empowers organizations to manage branded calling, improve caller id reputation, and stay compliant with evolving regulatory and industry standards. FAQs and Glossary terms like this are designed to provide clear, actionable guidance backed by our expertise in verified identity, call labeling mitigation, and spam prevention.
To explore how Numeracle supports trusted and effective outbound communications, visit www.numeracle.com.
