TL;DR
Quick Answer
TL;DR
Key Facts
- Different objectives: KYC verifies the identity of a customer or business, while STIR/SHAKEN verifies caller ID information associated with a call.
- Identity versus authentication: KYC helps establish who an entity is, while call authentication helps determine whether caller ID information has been spoofed or altered.
- Different points in the lifecycle: KYC occurs before and throughout a customer relationship, while STIR/SHAKEN operates during call processing and delivery.
- Ongoing due diligence: KYCaaS can include verification, risk assessment, monitoring, recertification, and documentation throughout the customer lifecycle.
- Authentication is not identity verification: An authenticated call may still originate from an entity that has not been meaningfully verified.
- Complementary controls: The Federal Communications Commission (FCC) has proposed strengthening KYC, KYUP, and STIR/SHAKEN as part of a broader accountability framework.
- Trust requires both: Identity verification and caller authentication address different risks and are often most effective when used together.
How Are KYC and KYCaaS Different From STIR/SHAKEN?
Know Your Customer (KYC) and STIR/SHAKEN operate at different layers of the trust stack, and both are necessary. KYC and KYCaaS focus on verifying the identity and legitimacy of the businesses using communications services. STIR/SHAKEN focuses on authenticating caller ID information associated with individual calls.
In simple terms:
- KYC asks: Who is this business?
- STIR/SHAKEN asks: Can the caller ID information associated with this call be trusted?
A business may be fully verified through a KYC process, while its calls still require STIR/SHAKEN authentication. Likewise, a call may be authenticated through STIR/SHAKEN even though the entity placing the call has not undergone meaningful identity verification. For that reason, KYC and call authentication are generally viewed as complementary rather than interchangeable controls.
Numeracle’s KYC as a Service (KYCaaS) solution addresses that gap. It vets the business entity: who they are, what they do, whether any regulatory or legal exposure exists, and whether their intended use case is appropriate for the services they're requesting. The decisions made through proper KYC vetting then enable the trust frameworks above it to function with integrity.
Authentication tells you the call is signed. KYC tells you the signer can be trusted.
How It Works
How Do They Work?
What KYC Verifies
KYC helps organizations establish confidence in the identity of a customer before and during a business relationship.
A KYC program may include:
- Business identity verification
- Ownership validation
- Risk assessment
- Due diligence
- Ongoing monitoring
- Documentation and recordkeeping
The objective is to understand who is using a communications service and whether the relationship presents an acceptable level of risk.
What Does STIR/SHAKEN Verify?
STIR/SHAKEN is a caller authentication framework designed to help providers determine whether caller ID information has been spoofed. When a call is placed, the originating provider can apply an attestation and cryptographic signature that can be validated by downstream providers. This helps support trust in the caller ID information associated with the call.
STIR/SHAKEN is designed to answer questions such as:
- Is this caller ID likely legitimate?
- Has the caller ID been altered?
- Can the caller ID information be authenticated?
Authentication Alone Is Not Enough
Caller authentication and identity verification solve different problems. STIR/SHAKEN can help verify the legitimacy of caller ID information, but it does not automatically verify the legitimacy of the organization placing the call. Similarly, KYC can verify a business entity but does not authenticate individual calls.
This distinction is one reason the FCC has increasingly focused on multiple layers of accountability, including KYC, Know Your Upstream Provider (KYUP), caller authentication, traceback, and robocall mitigation measures.
Why This Matters
Why Are KYC and Call Authentication Both Important?
Trust in voice communications depends on both identity and authentication.
Identity verification helps establish who is using a communications network. Authentication helps establish whether caller ID information associated with a particular call can be trusted. Without identity verification, providers may have limited visibility into the businesses using their services. Without authentication, recipients and downstream providers may have limited confidence that caller ID information is accurate.
Together, these controls help improve transparency and accountability throughout the communications ecosystem.
How Do KYC, KYUP, and STIR/SHAKEN Work Together?
These frameworks address different layers of communications trust:
- KYC: Verifies customers using a provider's services.
- Know Your Upstream Provider (KYUP): Verifies the providers supplying traffic to a network.
- STIR/SHAKEN: Authenticates caller ID information associated with individual calls.
Collectively, they support a broader identity and accountability framework that extends across the call path.
Common Questions
Does STIR/SHAKEN replace KYC?
No. STIR/SHAKEN authenticates caller ID information, while KYC verifies the identity of the business using communications services. They address different risks and serve different purposes.
Can a call be authenticated if the caller has not completed KYC?
Yes. Call authentication and customer identity verification are separate processes. An authenticated call does not necessarily indicate that the calling entity has undergone a comprehensive KYC review.
Does KYC stop spoofing?
No. KYC helps verify business identity and supports accountability, but it does not authenticate caller ID information. STIR/SHAKEN was specifically developed to address caller ID spoofing.
Why is the FCC focused on both KYC and STIR/SHAKEN?
The FCC has increasingly emphasized accountability throughout the call path. Recent proposals involving KYC, KYUP, caller identity, and STIR/SHAKEN reflect a broader effort to improve trust, transparency, and enforcement capabilities across the voice ecosystem.
How does KYCaaS complement call authentication?
KYCaaS helps establish confidence in the identity of the businesses using communications services through verification, risk assessment, ongoing due diligence, and documentation. Call authentication technologies help verify caller ID information associated with individual calls. Together, they address different aspects of communications trust.
Our platform empowers organizations to manage branded calling, improve caller id reputation, and stay compliant with evolving regulatory and industry standards. FAQs and Glossary terms like this are designed to provide clear, actionable guidance backed by our expertise in verified identity, call labeling mitigation, and spam prevention.
To explore how Numeracle supports trusted and effective outbound communications, visit www.numeracle.com.
