What changed
FACT: On 2026-07-09 the FCC published a proposed rule (NPRM) to enhance Know-Your-Upstream-Provider requirements, expand STIR/SHAKEN Governance Authority vetting and enforcement, codify attestation levels, and define improper attestations (federalregister.gov 2026-13874). FACT: Provider-hosted long-running agent infrastructure (Gemini managed agents with background tasks/remote MCP; ChatGPT deliverable-producing agents) now makes multi-hour research/dossier work automatable by a solo builder (blog.google; openai.com).
Why now
FACT: The NPRM was published one day ago — comment window is open and the compliance-vendor land-grab has not happened yet. HYPOTHESIS: Providers already face RMD removal and traffic-blocking enforcement under existing robocall rules, so upstream-vetting pain is present today even before the KYUP rule is final; the NPRM sharply raises the expected future obligation and gives a concrete sales narrative ('be ready before it's adopted').
Converging signals
A regulation-shaped forced-buyer signal (FCC KYUP/STIR-SHAKEN NPRM) converging with two AI-capability signals (managed long-running agents in Gemini API; autonomous deliverable-producing ChatGPT agents) that make continuous vendor-dossier production and monitoring feasible for a solo operator without building agent-loop infrastructure.
Customer pain
FACT (from NPRM summary): every voice service provider would face KYUP information-collection, verification, monitoring, and compliance-review obligations. HYPOTHESIS (strongly implied by market structure): most affected entities are small VoIP resellers and wholesale intermediaries with zero compliance staff, for whom manually collecting corporate records, RMD status, 499 filer status, enforcement history, and attestation posture for every upstream carrier — and re-checking it continuously — is unstaffable.
Who pays
Small and mid-size voice service providers, VoIP resellers, and wholesale intermediate providers already registered in the FCC Robocall Mitigation Database. HYPOTHESIS: the RMD itself (public, thousands of filers, contact info included) is a directly downloadable list of every prospective buyer — an unusually clean outbound channel. Secondary payers: telecom compliance consultancies and law firms who would white-label the dossier engine.
Solved today
HYPOTHESIS (no direct evidence in input): manual due-diligence spreadsheets, telecom compliance consultants/law firms billing hourly, and incumbent robocall-mitigation vendors (TransNexus, Numeracle) whose products focus on call authentication and traffic analytics rather than automated upstream-provider dossier production. Many small providers likely do nothing until an enforcement letter arrives.
Why current solutions are bad
Consultant vetting is slow and expensive per upstream relationship; incumbent STIR/SHAKEN vendors sell signing/analytics infrastructure, not recurring KYUP paperwork automation; doing nothing now carries RMD-removal risk and, under the proposed rule, explicit violation exposure. Continuous monitoring (the NPRM's recurring duty) is exactly what humans do worst and agents do cheapest.
Proposed product
'UpstreamCheck' — a micro-SaaS that (1) ingests a provider's list of upstream carriers, (2) uses long-running agents plus public data (RMD, FCC 499 filer database, Federal Register/EB enforcement actions, state SOS records) to auto-generate an audit-ready KYUP dossier per upstream provider, (3) continuously monitors for status changes (RMD removal, enforcement actions, attestation downgrades) with alerts, and (4) exports the documentation pack a provider shows the FCC/Governance Authority to demonstrate compliance review. Charge per monitored upstream provider per month.
MVP version
Dossier generator for one upstream carrier: pull RMD entry, 499 filer status, enforcement-history search, corporate registration, and produce a timestamped PDF/JSON compliance dossier plus a monitoring cron that re-checks weekly and emails diffs. Built on the existing convergence-style stack: Python + Postgres + headless agent calls. No telecom network integration required — this is public-records automation, squarely in the founder's proven lane.
30-day build
File-comment-period research: read the full NPRM, extract the exact proposed duties; build the dossier generator against 10 real upstream carriers; interview 10 small VoIP operators pulled from the RMD list about current vetting practice and willingness to pay; publish a free 'KYUP readiness checklist' as lead capture.
60-day build
Ship monitoring + alerting; land 3-5 design partners at founder pricing ($99-$199/mo); pitch 2-3 telecom compliance consultancies/law firms on white-label dossiers (they already bill for this and can resell at markup); post comment-period analysis content to rank for KYUP searches while volume is near zero.
90-day revenue plan
Convert design partners to paid; direct outbound to RMD filers (email/phone from public filings) with a free sample dossier of their own upstream — demonstrated value, not relationship sales; target 15-25 paying providers at $99-$299/mo ($2-6k MRR) plus one white-label consultancy deal.
Distribution path
Outbound to the public RMD filer list with a free personalized sample dossier; SEO/content on KYUP (brand-new term, near-zero competition); partnerships with telecom compliance consultancies and the small bar of telecom law firms serving VoIP resellers; comment-period visibility (filing a public comment gets the product name into the docket).
Pricing hypothesis
Per-monitored-upstream subscription: e.g. $29/upstream/mo with $99/mo minimum, or tiers $99/$249/$499 by upstream count; one-off audit-ready dossier pack $149. White-label consultancy pricing at 2-3x. Mirrors the founder's proven per-filing ELDT monetization shape.
Technical difficulty
Low-moderate for the founder: public-records scraping/API work, document generation, scheduled monitoring, agent orchestration — all demonstrated skills. No STIR/SHAKEN cryptographic signing infrastructure needed (deliberately avoid competing there). Hardest part is data hygiene on enforcement-history matching.
Legal / regulatory risk
Low for the tool itself (it consumes public data and produces documentation; it is not a regulated voice provider). Two real risks: (1) the NPRM may be adopted in modified form or delayed, changing the required dossier contents — mitigated by selling monitoring value that exists under current KYC/RMD rules; (2) must avoid implying legal advice — position as documentation tooling, partner with attorneys.
Platform dependency
Low. Data sources are government (FCC RMD, 499 database, Federal Register) — stable and public. Agent layer is swappable (Gemini/ChatGPT/Claude). No app-store or marketplace approval in the loop.
Founder fit
VERY HIGH. This is structurally identical to his proven FMCSA ELDT play: a federal mandate compels a class of small operators to perform recurring compliance actions against a government framework; he builds the automation layer and charges per unit. Public-records mining, monitoring pipelines, and AI-agent workflows are his exact stack. Applied lesson (conf 0.80): government-portal mandate opportunities score highest founder-fit for this founder. No enterprise procurement required — buyers are small businesses reachable by direct outreach.
Breakout potential
Moderate-good: expands into a general 'carrier trust bureau' — attestation-level tracking, RMD change alerts, C-CIST/enforcement watchlists, and eventually a data product sold to the same incumbents (TransNexus/Numeracle class) who would rather buy the dossier feed than build it. Also portable to adjacent FCC mandates (RMD certifications, 499 filings).
Final recommendation
PURSUE as a staged bet. The forced-buyer signal is real but pre-final: spend the next 30-45 days on cheap validation (build the dossier generator, run RMD-list outreach with free sample dossiers, count conversions to paid pilots) while the NPRM is in comment period. If ≥3 providers pay before the rule is final, scale outbound; the rule's adoption then becomes a demand accelerant he is already positioned for. Kill only if RMD-list outreach shows providers flatly won't pay pre-adoption AND current-rule pain is absent.
Next action
Read the full NPRM text at the Federal Register URL, extract the exact proposed KYUP collection/verification/monitoring duties into a dossier schema, and pull the current RMD filer list to size and segment the outbound universe (this week, zero cost).