What KYC and KYUP Mean for Call Recipients
For the person answering the phone, KYC and KYUP are mostly invisible, but the goal is a network where a ringing phone carries more trustworthy information than it does today. In theory, tighter identity requirements upstream mean fewer spoofed numbers, fewer AI-voice-clone scams like the one that triggered the Lingo Telecom settlement, and more accurate caller ID.
Neither the FCC nor independent researchers have projected how much the proposed KYC and KYUP rules will reduce fraudulent call volume. Americans receive roughly 4.2 billion robocalls / month (~13 per person) and carriers have pushed STIR/SHAKEN implementation past 95%, yet illegal traffic persists because authentication alone doesn’t stop a bad actor from being onboarded in the first place. That’s the gap KYC and KYUP are designed to close, and the FCC has shown it’s willing to use the threat of network exclusion to enforce it: 185 voice providers were removed from the Robocall Mitigation Database in a single sweep for failing to demonstrate adequate compliance. Whether that translates into a measurable drop in fraudulent calls will depend on how the final rules are written and enforced.
On the positive side, new Branded Calling ID™ initiatives (for example, the Commio service in partnership with Numeracle) deliver calls a recipient can trust, complete with the caller’s logo. Companies who wish to use the services must have their identity independently verified. Calls travel through a closed system to ensure they’re spoof proof and appear on the caller’s screen not only with the caller’s logo, but also proof of their identity verification plus the reason for calling. For the first time, call recipients can be confident that when they answer the phone, the caller will be who they expected.
What They Mean for Enterprises and Legitimate Businesses
Enterprises that place a lot of legitimate calls (appointment reminders, delivery notifications, fraud alerts, debt servicing, political or nonprofit outreach) sit on the other side of this equation. For them, KYC/KYUP compliance is both a new operational burden—and potentially a competitive advantage.
The burden: Enterprises should expect communication providers to ask for more upfront documentation than they may be used to: business registration details, tax ID, a description of calling use case and volume, or even proof of consent practices. And they may be asked to re-verify if their calling patterns change or volume spikes. Providers are also being pushed to apply ongoing monitoring, not just one-time checks, so enterprises should expect periodic requests to reconfirm information.
If a provider elects to utilize Branded Calling ID such as Commio’s, the brand registration process will be even more onerous.
The advantage: Businesses that go through rigorous KYC vetting may receive higher STIR/SHAKEN attestation levels, improving the odds of having their calls labeled appropriately on delivery. A legitimate business that can’t get a provider to vouch for its identity risks having its calls mislabeled as “Spam Likely” by carrier analytics, which is a real revenue and reputational risk regardless of any wrongdoing on the business’s part.
Additionally, businesses that qualify for Branded Calling ID initiatives display their verified business name and logo to call recipients—which directly affects answer rates and supports more positive customer relationships. (Note: businesses who utilize text messaging to reach their customers can achieve similar benefits by upgrading from SMS to RCS for Business.)
There’s also a supply-chain dimension enterprises often overlook: if an enterprise’s calling or messaging platform relies on an under-vetted upstream provider, the enterprise’s own traffic can get caught up in blocking or de-prioritization when that upstream provider is flagged, even though the enterprise did nothing wrong. That’s one more reason vetting a provider’s own KYC/KYUP posture—not just complying with what they ask of you—has become a real business consideration.
Questions to Ask a Potential Provider
Whether you’re an enterprise choosing a voice/messaging platform or an individual consumer sizing up a smaller VoIP or calling app provider, it’s reasonable to ask some direct questions before signing on:
- Are you listed and current in the FCC’s Robocall Mitigation Database, and can you show me your robocall mitigation plan? A provider that can’t answer this is clearly a red flag.
- What KYC process will you apply to me as a customer, and what happens if my calling volume or pattern changes? This tells you whether the provider treats KYC as a one-time gate or an ongoing practice.
- What attestation level (A, B, or C) will my calls typically receive, and why? A “C” attestation level attestation in particular can mean your calls are more likely to be flagged or blocked downstream.
- How do you vet the upstream providers or carriers you rely on to complete calls? A provider’s KYUP diligence on its own partners affects whether your traffic reaches recipients reliably.
- What happens if my numbers get mislabeled as spam or blocked? What’s the remediation process? Providers with a mature compliance program should have a defined path for this.
- How do you handle and secure the business/personal information you collect for KYC purposes? Since KYC requires sensitive business and identity data, it’s fair to ask about data retention and security practices.
- Have you been the subject of FCC or state enforcement actions, or removed from the RMD? This is public information a provider should be willing to discuss candidly.
Asking these questions doesn’t always protect against compliance risk. However, it’s a reasonable proxy for whether a provider takes network integrity seriously, which affects call deliverability and reputation for everyone downstream.
The Bottom Line
KYC and KYUP have moved from best practice to existential business requirements for anyone operating in the voice and messaging ecosystem. Regulators are enforcing it, state attorneys general are litigating it, and plaintiffs’ attorneys are using it as a theory of liability against carriers who look the other way. The providers best positioned to weather this environment are the ones treating identity verification of both customers and upstream partners as a continuous discipline rather than a one-time compliance checkbox.
As the regulatory landscape keeps shifting, the safest assumption for any voice service provider, VoIP company, or enterprise communications platform is simple: if you can’t clearly document who your customers and upstream partners are as per the proposed frameworks, and why you trust them, you’re already behind.
This article is intended for general informational purposes and is not legal advice. Providers with specific compliance questions should consult qualified telecommunications counsel. If you’d like to know more about Branded Calling IDTM or RCS for Business, please contact us.
Part 1: Background & Costs of Non-compliance
Part 2: The Shifting Legal Perspective
Part 3: Why It Matters to You | Conclusion
