What changed
FACT (Federal Register, 2026-07-09): the FCC published a proposed rule to enhance Know-Your-Upstream-Provider (KYUP) requirements, expand STIR/SHAKEN Governance Authority vetting and enforcement, codify attestation levels, and define improper attestations. If adopted, every voice service provider faces new upstream-provider information-collection, verification, monitoring, and compliance-review obligations.
Why now
The rule was proposed yesterday, so the comment/adoption cycle is just starting — first-mover window to build the tooling and the prospect list before the Report & Order lands. Cheap multilingual OCR (PP-OCRv6, sub-35M params) and falling frontier-model cost-per-task (GPT-5.6 announcement) make automated carrier-document analysis economically viable for a solo operator. HYPOTHESIS: providers who were burned by prior robocall enforcement will buy ahead of the final rule rather than wait.
Converging signals
(1) FCC KYUP/STIR-SHAKEN proposed rule creating a forced-buyer class [federalregister.gov]; (2) small, self-hostable OCR for ingesting carrier docs/LOAs/interconnection agreements [huggingface.co/blog/PaddlePaddle/pp-ocrv6]; (3) lower LLM cost-per-task making per-provider document reasoning affordable [openai.com/index/gpt-5-6]. Honest note: signals 2 and 3 are enablers, not demand; the regulation is the real driver, so convergence is moderate, not exceptional.
Customer pain
Small VoIP providers, resellers, and CPaaS shops must (today) file in the Robocall Mitigation Database and maintain robocall-mitigation programs, and (if this rule is adopted) must additionally collect and verify upstream-provider information, monitor attestation levels, and keep compliance-review records — with FCC enforcement (removal from the RMD = business death) as the penalty. They have no compliance staff. HYPOTHESIS as to intensity: no complaint/hiring evidence was provided in demand_evidence, so pain intensity beyond the mandate itself is inferred, not proven.
Who pays
US voice service providers and intermediate providers — especially the long tail of small VoIP resellers and wholesalers listed in the FCC's public Robocall Mitigation Database. The owner/GC of a 5–50-person provider pays to avoid an existential enforcement risk. FACT: the mandate class exists per the proposed rule; HYPOTHESIS: willingness to pay pre-adoption.
Solved today
HYPOTHESIS (industry-standard but not in provided evidence): telecom regulatory law firms and consultants handle RMD filings and mitigation plans for flat fees; platforms like TransNexus and Numeracle sell STIR/SHAKEN and robocall-mitigation software aimed mostly at carriers with real budgets. Many small providers do the minimum themselves with templates.
Why current solutions are bad
Law firms are expensive, slow, and produce static documents — not the continuous upstream-provider monitoring and attestation-level tracking the proposed rule contemplates. Carrier-grade platforms are priced and designed for larger operators. Nothing productized exists yet for the specific KYUP recordkeeping workflow because the rule is days old.
Proposed product
A KYUP Compliance Copilot: onboard your upstream providers, upload their docs (LOAs, RMD certifications, interconnection agreements) → OCR + LLM extraction builds a vetting file per upstream; the system cross-checks each upstream against the public RMD and FCC enforcement lists, monitors attestation levels on sampled traffic metadata the customer exports, flags gaps, and auto-generates the periodic compliance-review record the rule requires. Charge per upstream vetted plus a monthly monitoring fee.
MVP version
A web app that: (1) ingests the FCC Robocall Mitigation Database (public CSV) and enforcement actions; (2) lets a provider list its upstreams and instantly get a vetting report (RMD status, certification type, enforcement history, red flags); (3) stores uploaded carrier docs with AI-extracted key fields; (4) exports a dated, signed compliance-review PDF. This is valuable under TODAY'S rules (reasonable-steps/know-your-upstream expectations and RMD reliance) and becomes mandatory-shaped if the rule is adopted.
30-day build
Read the full NPRM and map every proposed obligation to a checklist artifact. Scrape/refresh the RMD and enforcement data. Build the vetting-report generator. Get 10 conversations with small providers (RMD contains contact emails — a public-records prospecting goldmine). File nothing with the FCC yourself; you are a tool, not a filer.
60-day build
Ship document-upload + AI extraction + compliance-file export. Pilot with 3–5 providers free-to-cheap in exchange for testimonials and workflow feedback. Publish a free 'KYUP readiness check — is your upstream in the RMD?' lookup tool as lead-gen; write the plain-English explainer of the NPRM that ranks for 'KYUP requirements'.
90-day revenue plan
Convert pilots to $149–$399/mo subscriptions (tiered by upstream count) plus $49–$99 per-upstream vetting reports for one-off use. Direct outreach to the RMD long tail (thousands of listed providers with emails). Target: 10–25 paying providers by day 120–180. HYPOTHESIS: pre-final-rule urgency will be the main conversion variable.
Distribution path
Direct email/LinkedIn outreach using the public RMD list (every prospect, pre-qualified, with contact info — a rare fully-enumerable market); the free RMD-lookup tool for inbound; guest content in VoIP operator communities and trade press; referral deals with telecom law firms who don't want to do the monitoring grunt work.
Pricing hypothesis
$149–$399/mo monitoring subscription by upstream count; $49–$99 per one-off upstream vetting report; $500–$1,500 one-time 'KYUP readiness audit'. Anchors against law-firm hourly rates, not software comparables.
Technical difficulty
Moderate and squarely in the founder's lane: public-data ingestion (RMD, enforcement releases), OCR + LLM document extraction, report generation, simple SaaS. No carrier network integration needed for the MVP (attestation-level monitoring from customer-exported CDR/SIP metadata is the hardest piece — defer or keep manual-upload).
Legal / regulatory risk
Low-moderate. The tool generates records; the provider remains the responsible filer. Must avoid unauthorized-practice-of-law framing (sell software + reports, not legal advice) and be accurate about what the rule does and doesn't require, especially while it is only PROPOSED. Misstating compliance status to customers is the main liability; disclaim accordingly.
Platform dependency
Depends on public FCC data (stable) and LLM/OCR (commodity, self-hostable OCR per the PP-OCRv6 signal). No app-store or social-platform gatekeeper. Main dependency is regulatory: the rule's final shape and timing are outside anyone's control.
Founder fit
Very high. This is the ELDT pattern the founder has already monetized: a federal mandate compels a class of businesses to collect/verify/maintain records against a government system, and a solo operator builds the automation layer and charges per transaction/seat. Differences worth noting: KYUP is recordkeeping/vetting more than portal submission, so the per-filing toll-booth is slightly weaker than ELDT — but public-records prospecting via the RMD plays directly to his strengths. The accumulated lesson (confidence 0.80) that government-portal mandate opportunities score 8–9 founder-fit applies and is corroborated by this evidence.
Breakout potential
Good: KYUP is one obligation in a stack small providers face (RMD updates, robocall mitigation plans, CPNI certifications, Form 499s, 911 obligations). Winning the KYUP wedge positions the product as the 'compliance department in a box' for the small-provider long tail — an expandable, enumerable market of forced buyers.
Final recommendation
PURSUE, staged. Build the RMD-powered upstream-vetting report now (valuable under existing rules, ~2–4 weeks), use it to acquire the prospect list and pilot customers cheaply, and gate the heavier monitoring/attestation features on the rulemaking's progress. The forced-buyer signal is the strongest kind, the market is fully enumerable via public records, and founder fit is near the top of his pattern — the only serious risk is timing, which the staged build neutralizes because the founder has runway.
Next action
Read the full NPRM at the Federal Register URL, extract every proposed obligation into a compliance checklist, download the current Robocall Mitigation Database, and build the automated upstream-vetting report against it; simultaneously email 20 small RMD-listed providers asking how they vet upstreams today.