Key Facts
- The KYUP FNPRM is a proposal, not a final rule: The FCC has initiated a rulemaking process and is seeking industry feedback before adopting any requirements.
- The proposal expands accountability across the call path: Providers may be required to vet upstream providers, not just direct customers.
- KYUP builds on existing KYC principles: The proposal extends identity verification and due diligence requirements beyond end-user relationships.
- Ongoing monitoring is a major focus: The FCC proposes continuous oversight of upstream providers and their traffic patterns.
- Provider relationships may become a compliance obligation: The FCC is considering requirements to take corrective action or terminate risky upstream partners.
- The proposal is tied to broader anti-robocall efforts: KYUP is part of the FCC's effort to strengthen trust and accountability throughout the voice ecosystem.
- The FNPRM signals a shift toward ecosystem-wide responsibility: Identity and suitability may become expectations for every participant in the call path, not just the originator.
TL;DR
A Proposed Expansion of Telecom Accountability
The Know Your Upstream Provider (KYUP) Further Notice of Proposed Rulemaking (FNPRM) is a proposal issued by the Federal Communications Commission (FCC) that would establish more specific obligations for voice service providers to verify and monitor the upstream providers that send traffic into their networks. The proposal was released on May 20, 2026 as part of the FCC's continuing effort to combat illegal robocalls, strengthen caller identity, and improve accountability across the voice ecosystem.
Unlike traditional Know Your Customer (KYC) programs, which focus on direct customers, the KYUP FNPRM focuses on provider-to-provider relationships.
Building on Existing KYC Efforts
The FCC views KYUP as a natural extension of the broader identity-verification initiatives already taking shape across telecom. Under the proposal, providers would not only need to understand who their customers are, but also who is sending traffic into their network and whether those upstream providers demonstrate responsible operational behavior.
Closing Accountability Gaps
One of the FCC's primary concerns is that illegal traffic can move through multiple providers before reaching consumers. Historically, some bad actors have been able to exploit weak controls between providers, creating situations where responsibility becomes fragmented across the call path. The FCC's proposal seeks to address those gaps by placing greater due-diligence responsibilities on providers that accept traffic from upstream partners.
A Shift From Reactive to Proactive Oversight
Rather than focusing exclusively on investigations after harm occurs, the proposal emphasizes preventing abuse earlier in the process. The FCC is considering requirements that would push providers toward ongoing verification, monitoring, documentation, risk assessment, and intervention when upstream partners present elevated risk.
How It Works
How It Works
The FCC Is Collecting Industry Input
An FNPRM is not yet a regulation. It is a formal request for public comment that allows the FCC to gather information before determining whether new rules should be adopted. Industry participants, providers, trade groups, and other stakeholders are given an opportunity to provide feedback and recommendations.
Proposed Requirements Focus on Upstream Providers
The proposal asks whether providers should be required to:
- Collect information about upstream providers
- Verify that information
- Monitor traffic patterns and business practices
- Evaluate risk indicators
- Take action when providers facilitate unlawful traffic
- Terminate relationships when appropriate
These obligations would significantly expand provider accountability beyond existing customer-only models.
Identity and Monitoring Work Together
A central theme of the proposal is that identity verification alone is not enough. Providers may also be expected to continuously evaluate upstream relationships to determine whether participants remain suitable for network access. This creates a closer connection between identity verification, operational oversight, and fraud prevention.
Why This Matters
The Proposal Could Change Telecom Compliance Expectations
If adopted, KYUP requirements would introduce new operational responsibilities for voice service providers. Organizations may need to enhance onboarding processes, establish new monitoring procedures, document due-diligence activities, and maintain evidence supporting provider-risk decisions.
Responsibility Would Extend Beyond Customers
Historically, much of telecom due diligence focused on direct customer relationships. The FCC's proposal signals that regulatory expectations may increasingly cover every participant involved in originating, transmitting, or enabling traffic across the voice ecosystem.
The FNPRM Reflects a Broader Industry Trend
The proposal reinforces a growing industry movement toward verified identity, accountability, and suitability as prerequisites for participation in communications networks. Whether through KYC, KYUP, caller authentication, or ongoing monitoring programs, trust is increasingly being treated as an operational requirement rather than a compliance afterthought.
Common Questions
Is the KYUP FNPRM a law?
No. The KYUP FNPRM is a proposed rulemaking, not a final rule. The FCC released the proposal to gather public input and evaluate potential requirements. Providers are not yet subject to final KYUP regulations, although many organizations are already evaluating how the proposal could affect their operations.
How is the KYUP FNPRM different from KYC?
Traditional KYC focuses on verifying direct customers. The KYUP FNPRM proposes extending due diligence further upstream to the providers and entities sending traffic into a network. Rather than replacing KYC, KYUP would expand accountability beyond customer onboarding to include provider relationships throughout the call path.
Why is the FCC focused on upstream providers?
The FCC believes bad actors can exploit weak oversight between providers to move illegal traffic through the voice ecosystem. By increasing accountability for upstream relationships, the Commission hopes to reduce opportunities for unlawful traffic to enter or persist within the network.
What should providers do now?
While the rulemaking process continues, providers can begin reviewing upstream-provider relationships, documenting due-diligence processes, evaluating monitoring capabilities, and assessing how existing KYC programs may need to evolve if KYUP requirements are ultimately adopted. Many organizations are already using the proposal as a framework for improving identity and accountability practices.
Our platform empowers organizations to manage branded calling, improve caller id reputation, and stay compliant with evolving regulatory and industry standards. FAQs like this are designed to provide clear, actionable guidance backed by our expertise in verified identity, call labeling mitigation, and spam prevention.
To explore how Numeracle supports trusted and effective outbound communications, visit www.numeracle.com.
