HadloTechnologies
All posts
FCCComplianceKYC

KYC and KYUP: what’s coming, and why we built for it early

Hadlo Technologies · Invalid Date · 3 min read

Two parallel FCC efforts are quietly reshaping what it means to run a legitimate US voice network. Know Your Customer moves onboarding from a signed agreement toward verified originator identity. Know Your Upstream Provider pushes accountability up the chain, to the traffic sources you accept calls from. Neither is a finished rule as of writing, but the direction of travel is unambiguous, and providers who wait for the final text before acting will be retrofitting under deadline pressure while their competitors are already compliant. This is a case where getting ahead of the rule is simply the cheaper path.

From signed agreement to verified identity

For years, onboarding a wholesale voice customer meant a contract and a handshake: the customer signed an agreement asserting they would behave, and that was largely that. The FCC’s Know Your Customer proposals move decisively away from that model toward requiring providers to verify who their customers actually are — confirming business registration, screening against sanctions lists, and establishing that the entity originating traffic is who it claims to be. The signed agreement does not go away; it stops being sufficient on its own.

For a provider, this is less a burden than it sounds if it is built into the onboarding flow from the start. Verifying identity, screening a name, and checking a filing are all things software can do the moment a prospective customer submits their details — routing only the genuinely ambiguous cases to a human. Bolt the same checks on after the fact, under a compliance deadline, and they become a brittle, manual scramble.

Know Your Upstream Provider

Running in parallel is a shift in accountability up the interconnection chain. Know Your Upstream Provider proposals would require providers to take active, demonstrable steps to confirm that the networks sending them traffic are not conduits for illegal robocalls. In practice, that means every upstream peer you accept traffic from needs a documented vetting record rather than a handshake relationship — a check that they are properly listed, that they sign their own traffic, and that they cooperate with traceback.

This is the natural extension of the same discipline applied to customers, turned around to face the other direction. It reflects a broader regulatory intent: to make every provider in the chain responsible for knowing who they are connected to, so that illegal traffic has nowhere to hide behind a chain of unaccountable intermediaries.

The third-party signing loophole is already closed

It is worth remembering that one significant change is not a proposal but current law. As of the FCC Eighth Report and Order, the loose third-party authentication practices that once allowed traffic to be signed with an unaffiliated provider’s certificate are prohibited. The provider with the STIR/SHAKEN obligation must make its own attestation decisions and, where it outsources the technical signing, the vendor must use the provider’s own certificate and follow its decisions. Carriers are not supposed to sign unaffiliated third-party traffic under someone else’s certificate. If any part of your traffic still relies on that practice, it is already out of step with the rules.

Why early is cheaper

The recurring theme across all of this is that the providers who wait pay more. Retrofitting identity verification into an onboarding process under deadline pressure produces a brittle workflow and an unhappy sales team. Building it in now — automated checks at onboarding, documented upstream vetting, an audit trail produced as a by-product of normal operation — means that when the rules finalise, you are already filing rather than scrambling. It also produces exactly the record the FCC is increasingly expecting to see: evidence, not assertion.

Hadlo built verified onboarding and documented upstream vetting into the network early, precisely because the direction of the rules was clear. Every customer is verified at onboarding; every upstream peer carries a vetting record. Compliance here is not a department; it is in the network. If you want a wholesale partner who is ahead of the rulemaking rather than behind it, talk to us.