TL;DR
Quick Answer
TL;DR
Key Facts
- Different relationships: KYC focuses on direct customers, while KYUP focuses on upstream providers from which a voice service provider receives traffic.
- Same identity foundation: Both use identity verification, risk assessment, due diligence, monitoring, and documentation to establish accountability.
- KYUP extends accountability upstream: Providers must understand not only who their customers are, but also who is sending traffic into their network.
- KYUP evaluates upstream practices: Providers would need to assess whether upstream providers are meaningfully vetting their own customers and managing illegal traffic risk.
- KYC and KYUP work together: A strong KYC program provides much of the identity and risk infrastructure needed to support KYUP.
- Different points in the call path: KYC addresses the relationship between an originating provider and its customer, while KYUP addresses the relationship between a downstream provider and the upstream provider supplying its traffic.
- Both support broader ecosystem accountability: Together, KYC and KYUP extend identity and compliance practices across more points in the voice call path.
How Are KYC and KYUP Different?
Know Your Customer (KYC) and Know Your Upstream Provider (KYUP) are identity and risk-management frameworks that apply to different relationships within the voice ecosystem.
KYC focuses on a provider's direct customers. It helps establish who a customer is, verify that entity's identity, assess risk, and monitor the relationship over time.
KYUP focuses on the upstream providers that send traffic into a provider's network. It extends similar identity and due-diligence principles to provider-to-provider relationships by helping organizations understand who is introducing traffic into their networks and whether those relationships present elevated risk. The Federal Communications Commission (FCC) has proposed enhanced KYUP requirements as part of its broader effort to combat illegal calls throughout the call path.
The simplest way to understand the distinction is:
KYC asks, "Who is my customer?"
KYUP asks, "Who is sending traffic into my network?"
While the relationships are different, both frameworks support accountability, risk management, and communications trust.
Does KYUP Replace KYC?
No. KYUP extends the identity and accountability framework established by KYC rather than replacing it. A provider can have strong KYC practices for its direct customers and still have limited visibility into the upstream provider supplying its traffic. Conversely, a provider that performs KYUP without meaningful customer-level KYC can still have gaps in accountability at the originating point.
KYC and KYUP therefore address different layers of the same ecosystem:
KYC → Direct customer → Voice service provider
KYUP → Upstream provider → Voice service provider
Together, they create a broader chain of identity and accountability across the call path.
How It Works
Where Does KYC Apply in the Call Path?
KYC applies to the relationship between a voice service provider and the businesses or entities receiving communications services.
A provider's KYC process can establish:
- The customer's legal and business identity
- Whether the business actually exists and operates as represented
- Ownership and relevant affiliations
- The intended use of communications services
- Relevant risk indicators
- Whether the customer continues to meet applicable requirements over time
Numeracle's KYCaaS framework describes KYC as an ongoing process that combines identity verification, risk-based decisioning, documentation, and ongoing due diligence rather than treating verification as a one-time onboarding check.
Where Does KYUP Apply in the Call Path?
KYUP applies to the relationship between a voice service provider and the upstream providers from which it receives voice traffic.
A KYUP program typically helps providers:
- Identify upstream providers
- Verify provider identity
- Assess provider risk
- Monitor provider activity
- Review compliance indicators
- Maintain documentation of due diligence
The FCC's proposed KYUP framework would establish more specific expectations around information collection, verification, monitoring, compliance review, and responsive action related to upstream-provider relationships.
What Does KYC and KYUP Have in Common?
Although they apply to different relationships, both frameworks use many of the same operational controls:
- Identity verification: Confirming that an entity is legitimate and accurately represented.
- Risk assessment: Evaluating factors that may indicate elevated compliance, fraud, or illegal-calling risk.
- Due diligence: Reviewing supporting information beyond basic identity details.
- Monitoring: Identifying changes that may warrant additional review.
- Documentation: Maintaining records of reviews, decisions, and actions.
The primary difference is the entity being evaluated, not the underlying compliance methodology.
How Do KYC and KYUP Work Together?
KYC and KYUP address different parts of the call path but share a common objective: increasing accountability for the entities involved in communications.
A simplified model looks like this:
Customer → KYC → Voice Service Provider ← KYUP ← Upstream Provider
When used together, KYC and KYUP help providers establish visibility into both the businesses they serve and the providers supplying traffic to their networks.
What Does KYUP Add to an Existing KYC Program?
For a provider with mature KYC infrastructure, KYUP does not necessarily require creating an entirely separate identity system.
The same foundational capabilities can support both programs:
→ Verified entity identity
→ Risk assessment
→ Due diligence
→ Ongoing monitoring
→ Documentation
The difference is that KYUP extends those capabilities to upstream-provider relationships. Numeracle's KYUP-ready KYCaaS approach specifically builds on existing KYC infrastructure by adding upstream entity verification, risk evaluation, and documentation capabilities.
Does KYUP Mean Providers Must Vet Their Upstream Providers' Customers?
Not in exactly the same way they vet their own customers. The FCC's proposed KYUP framework would require downstream providers to evaluate whether their upstream providers are conducting meaningful identity vetting of their own customers. That creates a form of accountability that reaches further into the call path without necessarily requiring every downstream provider to duplicate the upstream provider's entire customer-level KYC process.
This distinction matters because KYUP is designed to create accountability across provider relationships, not require every provider to independently recreate every other provider's compliance program.
Why This Matters
Why Is the FCC Extending KYC Principles to Upstream Providers?
Illegal calling activity can move through multiple providers before reaching consumers. The FCC has increasingly focused on accountability throughout the call path, including both customer relationships and provider relationships. Its enhanced KYUP proposal is intended to strengthen oversight of upstream entities that may introduce illegal traffic into the network.
By extending identity-based due diligence beyond direct customers, KYUP seeks to address potential gaps that may exist between interconnected providers.
Why Are KYC and KYUP Important Together?
Strong KYC practices help providers understand their customers. Strong KYUP practices help providers understand the entities supplying traffic to their networks.
A provider could have robust customer verification while maintaining limited visibility into upstream-provider relationships. Conversely, strong upstream-provider diligence does not replace customer verification obligations.
Together, the two frameworks create a broader approach to identity, risk management, and accountability across communications networks.
What Happens When KYC Is Strong but KYUP Is Weak?
A provider can have rigorous customer verification and still accept traffic from an upstream provider that has weak or nonexistent vetting practices. For example, a provider could know exactly who its direct customer is while having limited information about the provider delivering traffic into its network. If that upstream provider has poor controls over its own customers, illegal traffic can enter the network despite strong downstream KYC.
KYUP is intended to close that gap.
What Does This Mean for Providers Today?
The enhanced KYUP requirements are still proposed, not final. The FCC's KYUP proposal was published in the Federal Register on July 9, 2026, with initial comments due August 10, 2026, and reply comments due September 8, 2026. Providers should therefore distinguish between existing requirements and the proposed enhanced KYUP framework.
Providers that already have a structured KYC program can use that foundation to begin addressing upstream identity, risk, monitoring, and documentation.
Common Questions
Is KYUP just KYC for upstream providers?
Not exactly. KYUP applies many of the same identity and due-diligence principles as KYC, but it focuses on a different relationship. KYC evaluates customers, while KYUP evaluates upstream providers and their associated risks.
Can a provider be compliant with KYC but not KYUP?
Yes. A provider may have strong customer-verification processes while lacking documented procedures for identifying, verifying, monitoring, or evaluating upstream-provider relationships.
Does KYUP apply only to gateway providers?
No. The FCC's proposed framework contemplates broader obligations for voice service providers, although the final scope remains subject to the rulemaking process.
Does KYCaaS support both KYC and KYUP?
Numeracle's KYCaaS platform provides the identity verification, risk assessment, monitoring, and documentation infrastructure needed for both processes. Numeracle has specifically extended its KYCaaS solution to support upstream entity verification and KYUP readiness.
Does STIR/SHAKEN make KYUP unnecessary?
No. STIR/SHAKEN helps authenticate caller ID information associated with calls, while KYUP focuses on provider identity, due diligence, monitoring, and accountability. The FCC has proposed strengthening both frameworks as complementary components of its robocall mitigation efforts.
What should a provider do if it already has a strong KYC program?
Providers can often use their existing identity-verification, risk-assessment, monitoring, and documentation processes as a foundation for expanding due diligence to upstream-provider relationships.
How can Numeracle help with both KYC and KYUP?
Numeracle's KYCaaS provides a managed framework for identity verification, risk-based decisioning, ongoing due diligence, and audit-ready documentation. Numeracle has extended those capabilities to support upstream entity verification and KYUP readiness, allowing providers to build on their existing identity infrastructure rather than managing KYC and KYUP as completely separate systems.
Our platform empowers organizations to manage branded calling, improve caller id reputation, and stay compliant with evolving regulatory and industry standards. FAQs and Glossary terms like this are designed to provide clear, actionable guidance backed by our expertise in verified identity, call labeling mitigation, and spam prevention.
To explore how Numeracle supports trusted and effective outbound communications, visit www.numeracle.com.
