The Case for 'Know Your Agent' in Financial Compliance

America’s know-your-customer (KYC) regime originated in part from the Bank Secrecy Act of 1970. [1] Section 326 of the 2001 USA Patriot Act modernized this framework, mandating that banks form a reasonable belief about a customer's true identity prior to opening an account. [1] This approach assumes that a customer is a natural or legal person possessing a name, an address, and a verifiable record. [1] KYC operates as a point-in-time exercise that verifies identity once at onboarding and monitors for changes later. [1]

An AI agent conducting transactions on someone's behalf is typically neither a natural nor a legal person. [1] These agents lack recognized names, mailing addresses, and occasionally any record existing more than a few minutes before a transaction. [1] While KYC confirms if a person is who they claim to be, agents introduce a different question regarding whether the underlying entity currently possesses the authority to act. [1] Because an agent's authority is a dynamic permission rather than a stable fact, compliance teams need a separate framework called Know Your Agent, or KYA. [1]

The conceptual shift from KYC to KYA represents a fundamental structural change in financial compliance, moving from static identity verification to dynamic authority validation. By highlighting that agents are neither natural nor legal persons under current frameworks, the source indicates that existing banking infrastructure simply lacks the data fields to process agentic transactions. The assumption of stable, point-in-time identity verification breaks down entirely when the transacting entity relies on temporary permissions that can be granted or revoked dynamically. What the sources don't address: how financial institutions plan to technically verify these dynamic agent permissions in real-time without severely disrupting transaction processing speeds.