Know Your Upstream Provider (KYUP): A Deep Dive Into the FCC's 2026 Rule

In May 2026, the FCC adopted new "Know Your Upstream Provider" (KYUP) rules that fundamentally shift responsibility onto every voice service provider in the call chain — not just the originator. If you accept traffic from any upstream partner, these rules now apply directly to you.

What KYUP Actually Requires

At its core, KYUP requires voice service providers to treat their relationship with upstream providers as an ongoing compliance responsibility rather than a one-time vetting exercise at the start of a business relationship. The rule has four main components: collecting and verifying business information, ongoing monitoring, watching for specific red flags, and investigating inconsistencies.

1. Collect and Verify Business Information

Providers must collect business information directly from each upstream provider — not rely on third-hand or self-reported data without verification — and retain those records for four years. This typically includes the upstream provider's legal business name, FCC registration details (499 Filer ID, OCN if applicable), business address, and the nature of the traffic being passed.

2. Ongoing Monitoring With Call Analytics

A one-time check at onboarding is no longer sufficient. KYUP requires providers to monitor their upstream providers on an ongoing basis using call analytics — meaning you need visibility into call patterns, volumes, and anomalies for traffic coming from each upstream partner, not just a static vendor file.

3. Watch for Specific Red Flags

The rules direct providers to watch for evidence that an upstream provider is transmitting illegal calls, failing to authenticate calls that should carry attestation, or authenticating calls with an attestation level that doesn't match what the underlying relationship actually supports (for example, signing with A-level attestation for traffic the provider has no real basis to vouch for).

4. Investigate Inconsistencies

If information about an upstream provider doesn't add up — mismatched business details, unexplained changes in traffic patterns, or conflicting information from different sources — providers are expected to investigate rather than simply continue accepting the traffic.

Why This Matters: Liability Flows Downstream

The practical effect of KYUP is that you can now be held accountable for problems originating with your upstream provider if you failed to exercise the diligence the rule requires. "We didn't know" is a much weaker defense when the FCC has explicitly defined what providers are expected to know and verify.

Building a KYUP Compliance Process

A practical KYUP program typically includes a standardized intake process for new upstream relationships that collects all required documentation upfront, a periodic re-verification schedule (annual at minimum) rather than a one-time check, call analytics tooling that flags anomalies by upstream source rather than just in aggregate, and a documented escalation process for when red flags are identified — including criteria for when to suspend a relationship.

How This Connects to the Broader 2025-2026 Rule Changes

KYUP doesn't exist in isolation — it works alongside the Third-Party Authentication Order's requirement that providers make their own attestation decisions using their own certificates. Together, these rules are designed to close the same gap from two directions: making sure the provider closest to the call source takes ownership of authentication, and making sure every provider in the chain is actively vetting who they're passing traffic to and from.

Conclusion

KYUP represents a meaningful expansion of compliance obligations beyond your own direct certificate and attestation practices. Providers who treat upstream relationships as "set and forget" vendor relationships are now operating with real regulatory exposure — building an active verification and monitoring process isn't optional anymore.