KYC Was Built for Humans—Now We Need Know Your Agent

America’s know-your-customer (KYC) regime got its first real teeth thanks in part to the Bank Secrecy Act of 1970. Section 326 of the 2001 USA Patriot Act then gave it its modern form, requiring that a bank have a reasonable belief that it knows the true identity of each customer before opening an account.

Every rule that has been followed, in nearly every jurisdiction, inherits that same starting premise. A customer is a person, natural or legal, with a name, an address and a body of record a bank can check against. That premise held for more than 50 years because it was solid enough to support a global compliance industry. Now, it is no longer universally true.

The Category Error

An AI agent transacting on someone’s behalf is neither a natural person nor, in most jurisdictions today, a legal one. It has no name a registry recognizes, no address a bank can send mail to, and in some cases, no body of record that predates the transaction in front of you by more than a few minutes. Running that agent through a KYC process designed for humans and companies does not yield an incorrect answer. It produces a question that the process has no field for.

That’s the mistake compliance teams keep making when they describe agentic risk as KYC, but harder. It is not harder KYC. It is a different question entirely. KYC asks whether a person is who they claim to be. The question an agent raises is whether the entity behind this action has the authority to take it right now, and whether that authority can be confirmed at the moment it matters rather than reconstructed afterward. Those are not the same question stated at different difficulty levels. They are two different questions that happen to share a compliance department, and the second one deserves its own name: Know Your Agent, or KYA.

Why Bolting KYA Onto KYC Fails

The instinct to treat this as an extension of existing KYC is understandable and wrong. KYC is fundamentally a point-in-time exercise. It verifies identity once and monitors for material changes afterward, an architecture that assumes a customer’s identity and behavior are stable facts established at onboarding and unlikely to shift day-to-day.

An agent’s authority to act is not a stable fact. It is a permission that can be granted, scoped or revoked in the time it takes to call an API, and the entity actually directing the agent at 3 p.m. may not be the one that provisioned it at 9 a.m. A compliance framework built around periodic re-verification cannot govern something that continuously changes state. That is not a criticism of KYC. It is a description of a tool being used outside the problem it was built to solve.

What Know Your Agent Actually Has to Verify

One explanation of how KYC and AML function as related but distinct disciplines is a useful model here, because it shows what separating two adjacent compliance functions looks like in practice. Each answers a different question, using different tools, on a different cadence, even though both feed the same risk picture.

Know Your Agent needs that same kind of separation from KYC, not a merger with it. While KYC verifies identity, KYA must verify provenance and standing authority, tracing who built an agent and what permissions it currently holds, hence, so the chain of custody between human principal and autonomous action stays checkable in real time. Dynamic KYC orchestration, built for VIP onboarding, is the closer analog: risk-scoped checks that flex to the specific transaction rather than a single static gate everyone clears the same way. Agentic activity needs that same real-time flexibility, applied to a different question.

The Paperwork Problem, Automated

This isn’t theoretical. An AI agent cannot be the legal owner of a bank account. The system assumes a human behind every account, with KYC checks, legal identity and liability that attach to a named person. Fintechs are already testing that edge. Meow Technologies launched a service in April that lets an agent complete KYC, open a business account, issue corporate cards and move money without a human ever having to open a dashboard. Automating the paperwork is not the same as becoming the account holder. The account and the liability still land on a person, and no product design has closed that gap.

Building that category is not optional, and it is not a problem compliance departments can solve quietly on their own. It requires the same public reckoning KYC itself went through 50 years ago, a recognition that the customer in front of the institution has changed and the rules have to change with it. Know Your Agent is not a feature of Know Your Customer. It is the next discipline that compliance has to build from scratch.