What changed
FACT: On 2026-07-09 the FCC published an NPRM proposing enhanced Know-Your-Upstream-Provider (KYUP) requirements, stronger STIR/SHAKEN Governance Authority oversight, raised caller-ID attestation standards, and closure of STIR/SHAKEN implementation gaps (Federal Register 2026-13874). HYPOTHESIS: large terminating/intermediate carriers will discharge these obligations by pushing standardized vetting questionnaires and evidence demands down onto thousands of small VoIP resellers via wholesale contracts.
Why now
FACT: the NPRM is one day old, so the comment/reply cycle over the coming months is when large carriers draft the cascade contract language. FACT (per convergence input): the FCC's existing Robocall Mitigation Database regime already removes non-filers, so the fear/cutoff mechanism is operational today — small providers already have a live compliance burden to sell against without waiting for the final rule. RISK: the rule is proposed, not final; the full cascade could lag 6-12 months.
Converging signals
One primary signal: the FCC KYUP/STIR-SHAKEN NPRM (FORCED BUYER, published 2026-07-09), appearing in both the FCC feed and the proposed-rules early-warning feed. No independent second signal was supplied (signals array empty); the 'cascade' mechanism is a pattern transfer from prior mandate-cascade cases, i.e. an inference, not an observed convergence of multiple facts.
Customer pain
HYPOTHESIS grounded in the mandate: a 5-50 person VoIP reseller/wholesale originator must repeatedly prove to each upstream carrier that it is RMD-filed, has a real robocall mitigation plan, holds/justifies its attestation level, and knows its own traffic sources — or lose termination. FACT (from convergence input): small providers already lose termination when flagged under existing orders. The pain is existential (loss of service) with a deadline, but the specific recurring-questionnaire form of it is unverified until the outreach test runs.
Who pays
Primary: small US VoIP resellers and wholesale originators (the FCC RMD filer list is a public, enumerable prospect list of exactly the obligated class). Secondary channel: the ~dozen large wholesale carriers and UCaaS/CPaaS platforms who each must vet hundreds of downstream customers — one platform deal yields many end users, but this is a slower partnership sale, not the first revenue.
Solved today
HYPOTHESIS: a mix of telecom regulatory consultants/law firms drafting mitigation plans ($1k-5k one-off engagements), in-house ad-hoc responses to carrier questionnaires, and point vendors (STI certificate providers like Peeringhub; analytics/identity vendors like TransNexus and Numeracle serving mostly the mid/large tier). No supplied evidence documents current spend — this whole picture needs verification.
Why current solutions are bad
Consultant plans are one-time PDFs that go stale as rules change; each upstream carrier asks slightly different questions so small providers redo the same evidence assembly repeatedly; existing vendors sell call-path analytics to carriers, not cheap self-serve evidence generation to the long tail. HYPOTHESIS — must be confirmed by the falsification test (if vetting is still a one-time signup checkbox, this product has no wedge).
Proposed product
A web app that connects to what a small provider already has — its FCC RMD filing (public data), 499 filer ID, STIR/SHAKEN certificate/token status, traffic-source list, existing KYC docs — and auto-generates: (1) filled KYUP-style vetting questionnaire responses per upstream carrier, (2) an attestation-level justification memo, (3) a living robocall-mitigation-plan artifact, plus change monitoring that flags when an FCC action (e.g., RMD removal risk, new order) requires regenerating the pack.
MVP version
Scrape the public RMD dataset and FCC dockets; build a 'compliance posture check' that takes a provider's company name/499 ID and returns a free instant report (RMD status, filing gaps, attestation posture). Behind it, a paid generator that produces one polished evidence pack (questionnaire answers + mitigation plan + justification memo) from a guided intake. Deterministic doc-generation plus Claude-assisted drafting; no carrier integration needed for v1.
30-day build
Run the testable prediction as customer discovery: contact 10+ small providers via r/VOIP, VoiceOps, and the RMD filer list; collect 3+ real vetting questionnaires received from upstreams in the last 6 months. Mine docket 17-59/24-213 comments for small-provider burden complaints (these are also warm leads). Ship the free RMD posture-check tool as the lead magnet.
60-day build
Build the paid evidence-pack generator around the 2-3 real questionnaire formats collected. Presell to the discovery contacts at founder pricing. File or monitor the NPRM comment cycle to track what obligations survive. Begin one conversation with a mid-size wholesale carrier about a co-branded 'send your downstreams here' vetting flow.
90-day revenue plan
Target 10-25 paying small providers at $99-299/mo (or $500-1,500 per pack one-off converting to monitoring subscriptions). Realistic first revenue day 60-100 given the buyer already faces termination risk under existing rules; the KYUP final rule then acts as a growth accelerant rather than the revenue precondition.
Distribution path
The RMD filer list is a public, complete, addressable list of every obligated buyer — rare and valuable. Channels: direct outbound to RMD filers, r/VOIP and VoiceOps communities, docket commenters (self-identified pain), SEO on 'robocall mitigation plan template / KYUP questionnaire', and later the upstream-carrier channel where one carrier mandates the tool to hundreds of downstreams.
Pricing hypothesis
$99-299/mo subscription (pack generation + change monitoring + regeneration on rule changes), or $750 one-off pack with $49/mo monitoring upsell. Anchor against $2k-5k consultant engagements. Carrier-channel pricing: per-downstream-vetted fee, mirroring the founder's proven per-upload ELDT model.
Technical difficulty
Low-moderate: public-data scraping (RMD CSV, dockets), document generation, a rules-mapping layer that must be maintained as the NPRM evolves. No carrier network integration, no telephony infrastructure. Well within solo AI-assisted build capacity; est. 4-7 weeks to sellable v1.
Legal / regulatory risk
Moderate but manageable: generating compliance documents edges toward legal-advice territory — mitigate with 'prepared from your inputs, review with counsel' framing, as established template/filing-prep businesses do. The product itself is not FCC-regulated. Wrong or stale generated content that contributes to a provider's termination is the real liability to disclaim carefully.
Platform dependency
Low. Depends on public FCC data and the regulatory regime itself, not on any private platform's API or approval. Main dependency risk is regulatory: if the NPRM is gutted, the KYUP-specific layer shrinks — but the existing RMD/mitigation-plan obligation (already in force) still supports the core product.
Founder fit
Strong. This matches the proven ELDT pattern — read a federal mandate, identify the forced filer class, build the evidence/submission layer, monetize per transaction — and the accumulated lesson (confidence 0.8) that government-mandate opportunities score highest for this founder. One honest deviation: KYUP evidence flows to upstream carriers via contracts, not into a government portal, so it is mandate-adjacent document automation rather than literal portal submission. Systems thinking, public-records mining, and demonstrated-value selling all apply directly.
Breakout potential
Good. Adjacent expansions: 10DLC campaign registry compliance, KYC packs for messaging aggregators, FCC 499/CPNI filing automation, and generalizing the engine to other mandate-cascade verticals. The upstream-carrier channel, if landed, converts this from micro-SaaS into an embedded vetting layer with per-vet pricing.
Final recommendation
CONDITIONAL GO — do not build the full product yet. The forced-buyer mandate is real but proposed, the cascade is unverified inference, and the supplied demand evidence is a single Federal Register document. Spend 1-2 weeks running the stated testable prediction (collect real vetting questionnaires from 10 small providers, check one large carrier's wholesale T&Cs, mine docket comments). If ≥3 providers confirm recurring evidence demands, build immediately — the addressable-list distribution and founder-fit are excellent. If vetting is still a one-time checkbox, kill the KYUP framing and keep only the RMD posture-check as a low-effort lead-gen asset.
Next action
This week: pull the public FCC Robocall Mitigation Database filer list, message 10-15 small VoIP/wholesale providers (r/VOIP, VoiceOps, direct email from RMD contacts) asking one question — 'has an upstream carrier sent you a vetting questionnaire or attestation-evidence demand in the last 6 months? Can I see it?' — and search dockets 17-59/24-213 for small-provider burden comments. 3+ confirmed artifacts = proceed to MVP.