- Current rules require "affirmative, effective measures" to know your customers, but the FCC has never specified what they are. FCC 26-27 proposes minimum identity information before service starts.
- FCC 26-32 proposes five baseline duties for every upstream provider: information collection, compliance review, verification, monitoring, and responsive action.
- Both proposals would require records to be kept for four years, and the FCC proposes a $2,500 per call base forfeiture for know-your-customer violations.
- These are proposals. Comment periods have closed, and final rules could follow at any time.
Where the rules stand today
Every originating voice provider must already “take affirmative, effective measures to prevent new and renewing customers from using its network to originate illegal calls, including knowing its customers.” Providers that receive traffic must take “reasonable and effective steps” to ensure an upstream provider is not using them to carry a high volume of illegal traffic. What the FCC has never done is say exactly what those measures are.
That has not stopped enforcement. The FCC has proposed multimillion-dollar fines for vetting it considered inadequate, as covered in our analysis of the Voxbeam and Telnyx cases. Two pending proposals would now turn the general duty into specific requirements.
Know Your Customer: FCC 26-27
Released May 1, 2026, this further notice asks whether providers should, at a minimum, obtain and retain each new and renewing customer’s:
- name and physical address;
- government-issued identification number; and
- an alternate telephone number,
before granting access to service. For high-volume customers, including business and foreign customers, providers would also collect the intended use of the service and verify more: corporate formation records, good standing, and evidence of a real commercial presence.
The FCC tentatively concludes that certain red flags should alert a provider, such as a registered agent or virtual office as the address, a newly created website or email, and untraceable payment such as cryptocurrency. It also asks about re-verification when traffic patterns change, and whether an accredited third-party verification service should earn a safe harbor.
Know Your Upstream Provider: FCC 26-32
Released May 21, 2026, this further notice would replace the current “high volume” standard with a broader duty to take “affirmative, effective measures” against upstream providers transmitting illegal calls. It proposes five baseline duties:
- Information collection directly from the upstream provider;
- Compliance review, including its Robocall Mitigation Database filing;
- Information verification, such as confirming that phone numbers and email addresses are active;
- Monitoring, including ongoing call analytics; and
- Responsive action, up to refusing or discontinuing service.
The duties would apply before a new agreement, before a renewal, and whenever new evidence arrives. The same proposal would tighten STIR/SHAKEN attestation, covered in our analysis of attestation.
What it would cost to fall short
Penalties and paperwork. The FCC proposes to codify a $2,500 per call base forfeiture for know-your-customer violations. Both proposals would require records to be kept for four years, matching the four-year statute of limitations for spoofing. A provider that cannot produce the evidence would be judged as if the checks never happened.
Status. Both items are proposals. Comments closed on July 27 (KYC) and September 8, 2026 (KYUP). The FCC has asked whether the KYC rules should take effect six months after approval of the new paperwork requirements.
Questions to answer now
Provider leaders should be able to answer the following with confidence:
| # | Question for your leadership team | When |
|---|---|---|
| 1 | For every customer able to place high volumes of calls, what identity evidence do we hold today? | Now |
| 2 | Which of the five proposed upstream duties could we already demonstrate, with records? | Now |
| 3 | Would we recognize the red flags the FCC lists, such as virtual offices and cryptocurrency payments, at onboarding? | This quarter |
| 4 | Could we retrieve four years of vetting records for a customer we no longer serve? | This quarter |
Answering these questions takes evidence, not policy documents. The VoiceAlerts Compliance Team can review where you stand in a free 30-minute briefing.
Key dates
| Date | Milestone |
|---|---|
| May 1, 2026 | FCC releases the Know Your Customer proposal (FCC 26-27). |
| May 21, 2026 | FCC releases the Know Your Upstream Provider and STIR/SHAKEN proposal (FCC 26-32). |
| Jul 27, 2026 | Reply comments close on the KYC proposal. |
| Sep 8, 2026 | Reply comments close on the KYUP proposal. |
| Pending | Final rules. |
How VoiceAlerts helps
VoiceAlerts runs Know Your Customer and Know Your Upstream Provider verification as a managed service, monitors the traffic each customer and upstream provider sends, and keeps the four-year audit trail the FCC proposes.
- Identity verification for new and high-volume customers
- The five proposed upstream-provider duties
- Records that would satisfy a four-year retention rule
Common questions
What does the FCC currently require for Know Your Customer?
Under 47 CFR 64.1200(n)(4), originating providers must take affirmative, effective measures to prevent new and renewing customers from originating illegal calls, including knowing their customers. The FCC has not mandated specific measures.
What would the FCC's KYC proposal require?
FCC 26-27 seeks comment on requiring providers to obtain and retain, at a minimum, the name, physical address, government-issued identification number, and an alternate telephone number of new and renewing customers before service, with more verification for high-volume customers, and four years of records.
What is Know Your Upstream Provider (KYUP)?
The duty to make sure providers that send you traffic are not using your network for illegal calls. FCC 26-32 proposes five baseline duties: information collection, compliance review, information verification, monitoring, and responsive action, with records kept for at least four years.
How can VoiceAlerts help providers prepare for KYC and KYUP rules?
VoiceAlerts runs KYC and KYUP verification as a managed service, monitors the traffic customers and upstream providers send, and keeps a four-year audit trail, so a provider can show how it knows who it carries.
Sources
- docs.fcc.govFCC 26-27: Enhancing Know-Your-Customer Requirements, Further Notice of Proposed RulemakingReleased May 1, 2026
- federalregister.govFederal Register: Enhancing Know-Your-Customer Requirements (FCC 26-27)Comments due June 25, replies July 27, 2026
- docs.fcc.govFCC 26-32: Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKEN, Further Notice of Proposed RulemakingReleased May 21, 2026
- federalregister.govFederal Register: Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKEN (FCC 26-32)Comments due August 10, replies September 8, 2026
This article is for general information and is not legal advice. Proposed rules can change before adoption; check the FCC record for the final text.
