What changed
FACT: On 2026-07-09 the FCC published a Notice of Proposed Rulemaking that would enhance Know-Your-Upstream-Provider requirements, expand STIR/SHAKEN Governance Authority vetting and enforcement, codify attestation levels, and define improper attestations for voice service providers (federalregister.gov 2026-13874). HYPOTHESIS: if adopted largely as proposed, every US voice service provider — including thousands of small VoIP resellers and wholesalers — will need documented upstream-provider vetting, ongoing monitoring, and attestation-compliance records they do not have today.
Why now
FACT: the rule is at the proposed stage as of 2026-07-09, meaning a comment period is open and final obligations are likely 6-18 months out (standard FCC rulemaking cadence — inference, not stated in source). This is the ideal entry window for a solo founder: incumbents wait for final rules; a small operator can build the readiness/vetting layer now, capture the buyer list, and be first when compliance deadlines hit. Converging capability signals (GLM-5.2 long-horizon open-weights agents, ChatGPT autonomous multi-app task completion) make the labor-intensive part — collecting, verifying, and refreshing upstream-provider documentation — automatable at near-zero marginal cost.
Converging signals
1) FCC KYUP/STIR-SHAKEN NPRM creating a forced-buyer class (regulation, federalregister.gov). 2) Self-hosted long-horizon agentic reasoning with open weights (GLM-5.2, huggingface.co) — cheap autonomous document-collection/verification pipelines. 3) Frontier agents delivering finished multi-app deliverables (openai.com) — validates the 'agent does the compliance paperwork' product shape and threatens thin tools, pushing value to domain-specific data and workflow ownership.
Customer pain
HYPOTHESIS grounded in the rule text: small voice providers have no compliance staff; the NPRM would require them to collect and verify information about every upstream provider they accept traffic from, monitor attestation levels, avoid improper attestations, and survive Governance Authority vetting. Failure risk is existential — the FCC's enforcement pattern in robocall mitigation has been removal from the Robocall Mitigation Database, which cuts a provider off from the US phone network. The pain is 'I must produce documentation I've never produced, on a deadline, or my business dies.'
Who pays
Small and mid-size voice service providers, VoIP wholesalers, and resellers — specifically the compliance-responsible officer (often the owner). FACT-adjacent: this class is fully enumerable via the FCC's public Robocall Mitigation Database, which lists every provider certified to operate, with contact information — a rare case where the entire addressable market is a downloadable list (inference from public FCC infrastructure, not from the provided source text).
Solved today
HYPOTHESIS: larger providers use STIR/SHAKEN vendors (TransNexus, Numeracle) and telecom compliance law firms/consultancies (e.g., The Commpliance Group, Marashlian & Donahue) that charge recurring fees for RMD filings and mitigation plans. Small providers mostly do nothing or pay a consultant a few hundred to a few thousand dollars per filing event. No provided evidence of a purpose-built KYUP documentation tool — the regime is new.
Why current solutions are bad
Consultants are episodic and expensive per engagement; STIR/SHAKEN signing vendors solve certificate/signing, not upstream-vendor vetting paperwork. The proposed KYUP regime is a continuous obligation (collect, verify, monitor, re-verify), which is a workflow/agent problem, not a one-time filing — exactly the gap between a law firm and a signing platform.
Proposed product
KYUP Compliance Desk: (1) intake agent that collects each upstream provider's RMD status, FCC filings, corporate registration, and STIR/SHAKEN participation and assembles a verified 'vendor file'; (2) continuous monitors that re-check RMD status, FCC enforcement actions, and attestation-level changes and alert on drift; (3) an audit-ready evidence binder generated on demand for Governance Authority vetting or FCC inquiry; (4) improper-attestation flagging from the customer's own CDR/attestation exports (no live SIP access required in v1). Long-horizon agents (self-hosted per the GLM-5.2 signal to keep COGS low) do the collection/verification labor.
MVP version
A web app where a provider pastes their list of upstream carriers; the system auto-builds a vetting file per carrier from public FCC data (RMD, ECFS, enforcement releases) plus an agent-driven outreach/questionnaire flow, and outputs a KYUP compliance binder PDF + a live monitoring dashboard. Charge per vendor file plus a monthly monitoring fee. Buildable solo in 4-8 weeks with AI-assisted development; data sources are public.
30-day build
File a comment-period tracking page and 'KYUP Readiness Report' lead magnet; scrape/download the RMD list; build the vendor-file generator against public FCC data; run it on 20 real providers' likely upstreams as demo assets; begin direct outreach to RMD-listed small providers with a free readiness score for their named upstreams.
60-day build
Convert readiness-report leads to paid 'vendor file' builds ($99-$249 per upstream carrier file); add continuous monitoring + alerting; partner outreach to 3-5 telecom compliance consultancies and law firms who can white-label the binder for their small-provider clients (they keep the relationship, you keep the software fee).
90-day revenue plan
Target 15-30 paying providers at $199-$499/mo monitoring plus one-time file-build fees, and 1-2 consultancy white-label deals. Revenue does not depend on the rule being final: the NPRM itself creates 'get ready' demand, and existing robocall-mitigation obligations already require upstream diligence that this documentation satisfies (HYPOTHESIS — validate willingness to pay pre-final-rule in the first 20 outreach calls; if buyers say 'call me when it's final,' pivot to cheap list-building until adoption).
Distribution path
Direct, demonstrated-value outreach to the enumerable RMD provider list (email with their own upstreams' risk flags attached — the demo IS the pitch); white-label through telecom compliance consultancies; content/SEO on 'KYUP requirements' where competition is currently near zero because the term is days old. No ad spend, no enterprise procurement.
Pricing hypothesis
$99-$249 one-time per upstream vendor file; $199-$499/mo per provider for continuous monitoring and binder regeneration; consultancy white-label at volume discount. Anchored against what consultants charge for a single RMD filing engagement.
Technical difficulty
Moderate. Public-data scraping/normalization (FCC RMD, ECFS, enforcement), agent orchestration, document generation — all squarely in the founder's demonstrated skill set. Deliberately EXCLUDES real-time SIP/Identity-header inspection in v1, which would be carrier-grade infrastructure and the main complexity trap.
Legal / regulatory risk
Low-moderate. The product produces documentation; it is not itself a regulated voice provider. Main risks: (a) giving what looks like legal advice — mitigate with 'compliance documentation software, not legal advice' framing and consultancy partners; (b) the final rule differing materially from the NPRM — mitigate by keeping the product data-source-driven rather than hard-coding proposed rule text.
Platform dependency
Low. Depends on public FCC data availability (stable, government-run) and commodity/self-hosted models (GLM-5.2 signal shows an open-weights fallback exists, reducing frontier-API dependency).
Founder fit
VERY HIGH. This is structurally identical to the founder's proven FMCSA ELDT play: a federal mandate compels a class of small operators to produce filings/records against a government regime; he builds the automation layer and charges per transaction/seat. Adds his strengths in public records, AI workflows, and compliance monitoring. The applicable lesson ('government-portal mandate opportunities fit this founder best,' confidence 0.80) directly supports this, and fresh evidence (the NPRM) reinforces rather than contradicts it. One difference from ELDT: there is not yet a single submission portal to automate — the wedge is documentation/monitoring, with Governance Authority vetting workflows as the future portal-shaped layer.
Breakout potential
Good. Wedge (KYUP vendor files) expands to full robocall-mitigation compliance suite: RMD filing management, mitigation-plan generation, attestation analytics, 499/CPNI adjacent filings — a compliance OS for small voice providers, a segment incumbents ignore because deal sizes are small (which is exactly where per-seat SaaS with agent-driven COGS wins).
Final recommendation
BUILD, staged. This is the founder's proven playbook (federal mandate → forced small-operator buyers → automation layer → per-file/per-month fees) arriving at the ideal moment — pre-final-rule, pre-competition, with a fully enumerable buyer list. Stage the spend: build the public-data vendor-file engine and run 20-30 outreach conversations in the first 45 days for direct willingness-to-pay evidence BEFORE building monitoring/agent infrastructure. If pre-final-rule buyers won't pay anything, hold at lead-capture cost (~$0 burn) until the final rule, where demand becomes deadline-driven.
Next action
Download the FCC Robocall Mitigation Database, build a script that generates a one-page 'upstream provider risk snapshot' for any carrier from public FCC data, and send it to 25 small voice providers this week to test willingness to pay at the NPRM stage.