KYA is due diligence on an autonomous AI agent or third party acting on a customer's behalf, establishing its identity, the scope of its authority, who controls it, and the risk it brings. As agentic and delegated transactions grow, the party actually initiating activity may not be the accountable human.
What is KYA, in plain English?
Know Your Agent is due diligence aimed at the thing acting on a customer's behalf rather than only the customer. That agent might be an autonomous AI system that makes purchases or moves money, or a third party authorized to transact for someone. KYA asks the same core questions of the agent that KYC asks of a person: who or what is this, what is it allowed to do, who controls it, and how risky is it?
It exists because of a shift in who actually presses the button. As agentic commerce and delegated transactions grow, the party initiating an action increasingly is not the accountable human at all. An AI agent with a payment credential can transact continuously, at machine speed, without a person in the loop for each step. Traditional controls assume a human customer behind every action, and that assumption is starting to break.
The heart of KYA is confirming the chain of authority and accountability behind the agent. An unverified agent can obscure who is really directing the funds, and if you cannot trace an action back to a responsible person, you have lost the thread that the rest of your controls depend on. Knowing the customer is not enough when something else is pushing the buttons on their behalf; you also have to know that something, and who stands behind it.
The chain of authority
- Identify — Identify the agent. Establish what the agent is, its credentials, and how it authenticates when it acts.
- Scope — Define its authority. Determine what the agent is permitted to do, and the limits on amounts, counterparties, and actions.
- Control — Find who controls it. Trace who deployed and directs the agent, and who is accountable for its behavior.
- Trace — Tie actions to a person. Ensure every action can be traced back to a responsible human, not just to the agent.
What it looks like in practice
In practice
A customer authorizes an AI shopping agent to make purchases and payments within set limits. To the payment system, the transactions look like the customer's own activity, arriving steadily and at machine speed. The human is nowhere in the individual decisions.
Without KYA, the firm cannot tell a legitimate delegated agent from a compromised one draining the account, because both look like the customer. With KYA, the agent is identified, its authority is bounded, and its actions trace back to the accountable customer. When the agent suddenly tries to pay a new high-risk counterparty outside its defined scope, the firm has the context to stop it, because it knew what the agent was allowed to do in the first place.
Why it matters to operators
The whole edifice of financial-crime control assumes a human customer behind each action, someone you identified, risk-rated, and can hold accountable. Autonomous agents break that assumption. When an agent initiates the activity, KYC on the customer alone leaves a blind spot: you know the account holder, but not the thing actually moving the money, or whether it is behaving as authorized.
For operators, KYA is about preserving traceability in a world of delegated action. If you cannot trace an agent's transaction back to a responsible person and confirm it fell within granted authority, you have lost the thread the rest of your controls hang on. As agentic commerce grows, being able to identify the agent, bound its authority, and tie its actions to an accountable human becomes as fundamental as knowing the customer ever was.
What to watch
- Unverified agents. An agent acting with no established identity obscures who is really directing the funds.
- Undefined authority. No clear scope on what the agent may do makes it impossible to tell authorized from anomalous activity.
- Broken traceability. Actions that cannot be tied back to a responsible human sever the accountability chain.
- Out-of-scope behavior. An agent transacting with new counterparties or amounts beyond its granted limits.
- Machine-speed anomalies. Bursts of activity at a pace or volume no human would generate, without agent context to explain them.
Quick questions
How is KYA different from KYC?
KYC establishes and risk-rates the human customer. KYA applies similar diligence to an agent, human or AI, acting on that customer's behalf: its identity, its authority, who controls it, and its risk. KYA complements KYC; it does not replace it.
Why is KYA becoming important now?
Because agentic commerce and delegated transactions are growing. Increasingly the party initiating an action is an AI agent, not the accountable human, and traditional controls that assume a person behind each transaction start to leave gaps.
What does KYA actually try to establish?
The agent's identity, the scope of its authority, who controls and is accountable for it, and the risk it brings, all so that every action can be traced back to a responsible person.
What is the main risk of an unverified agent?
It obscures who is really directing the funds. If you cannot trace an agent's action to an accountable human, you lose the thread the rest of your controls depend on, and a compromised agent looks just like a legitimate one.
Does KYA apply only to AI agents?
No. It applies to any agent acting on a customer's behalf, including authorized third parties. AI agents are the fast-growing case, but the principle of verifying delegated authority is broader.
How does KYA connect to agentic commerce risk?
KYA is a core control for it. Agentic commerce risk is the broader exposure created by autonomous agents transacting; KYA is the due-diligence discipline that keeps those agents identified, bounded, and traceable.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.