For decades, Know Your Customer (KYC) rules have rested on one premise: a business opening an account can establish that a real, identifiable person stands behind it. The rules started with banks. The same judgment now opens a sportsbook wallet, a crypto exchange account, a buy now, pay later credit line and a marketplace seller profile, and every control after onboarding inherits it. That premise is failing in two directions at once. Synthetic identities pass for people who never existed, and AI agents transact on behalf of people who never touch the screen. Know Your Agent (KYA) is the discipline built for the second failure: the controls that confirm an AI agent is genuine, tied to a real customer and acting within the authority that customer granted, at the moment it acts.
This spring, Redwood Research handed an AI agent built on Claude Opus 4.7 a $5,000 stake, an internet-connected computer and about four days to make as much money as possible. Across four runs, it made nothing, METR reported in its Frontier Risk Report. Each time, the agent named CAPTCHAs and identity verification as the obstacles. It found workarounds, including paid CAPTCHA-solving services and crypto platforms that asked for no ID, then usually failed to carry them out. METR notes that a setup built for this kind of task might have done better.
Reading that result as proof the front door holds would be a mistake. The checks stood because this agent fumbled the workarounds, and the workarounds themselves are for sale. The harder problem begins once an agent gets through, legitimately with a real customer’s authority or illegitimately with a stolen one. To the business on the other end, both look the same.
Why a Session Proves Less Than It Used To Against AI Agents
The checks that held in that experiment are weakening. In 2024, researchers at ETH Zurich solved 100% of Google’s reCAPTCHA v2 image challenges with automated tools, up from 68% to 71% in earlier studies, and found no significant difference between the number of challenges their bot needed and the number a human did. Commerce is where the agents are heading.
From July to December 2025, commerce accounted for 47.9% of the AI bot traffic on Akamai’s network, and commerce firms left more than 90% of that activity in the monitor category rather than blocking it. Exposure has outrun readiness, and the traffic is already arriving with most merchants watching it rather than deciding on it. A session that clears a real device, a clean IP address and a solved challenge says less each year about who sits on the other end.
Much of that traffic is legitimate. A customer’s own shopping assistant or treasury bot is an authorized proxy, and a growing share of genuine sessions will look exactly like one. The problem is that today’s risk stack has no reliable way to tell an authorized proxy from an agent acting without authority, because both present the same signals at login.
Why the Fraud Stack Misses Agents
Most rules in a mature fraud stack were tuned against a specific opponent, usually a person impersonating another person or a bot farm impersonating many. Velocity checks catch someone opening accounts faster than a human plausibly could. Device-reuse rules catch hardware recycled across identities. Behavioral biometrics catch typing and mouse movement too smooth to be human. Each assumes human limits, and an agent has none of them. It completes a form in the time a person takes to read the first field, and it can be provisioned, used once and discarded at almost no cost.
An agent leaves a different kind of trace. It has credentials with no history, a device record that begins minutes before the transaction, and sometimes a remote-access tool running quietly in the background while someone else’s account is spent. The most durable signal is continuity, the years of ordinary activity that a real identity accumulates and that an agent provisioned this morning cannot fake.
“An agent can be spun up in minutes, but the customer behind it either has years of real history, or they don’t. That depth is the one thing automation can’t fake, so it’s what the decision should rest on once the behavioral signals drop out.”
Conner Keele, Senior Solutions Engineer II at SEON
Document checks still catch forgeries, but a convincing synthetic document is now cheap to produce. A missing history is far harder to manufacture. Timing matters as much as signal depth. A login check runs once, and everything that follows inherits its verdict. Session monitoring treats the session as a continuous thread, so a device fingerprint that changes after login, or a remote-access tool switched on at checkout, raises the alarm the original check never could.
Naming the Discipline: The Four Links of Know Your Agent
Compliance teams often describe agentic risk as harder KYC. The framing hides the actual problem. KYC asks whether a person is who they claim to be. An agent raises a different question: whether whoever directs this action has the authority to take it right now, and whether that authority can be confirmed at the moment it matters rather than reconstructed afterward. That discipline now has a name, but no standards body owns a definition yet.
KYC verifies identity once and monitors for material change, because it assumes identity is a stable fact. An agent’s authority is a permission that can be granted, scoped or revoked in the time it takes to call an API, and the party directing an agent at 3 p.m. may not be the one that set it up at 9 a.m. A KYA program has to confirm four things, each a separate control point:
| Link | Question | Where trust breaks |
| Agent | Is the agent genuine, and who provides or controls it? | Spoofed identity, compromised code, stolen credentials |
| Customer | Who instructed or authorized the agent? | Account takeover, synthetic identity, a false customer-agent link |
| Permission | What actions, limits and conditions apply? | Scopes that are too broad, expired or passed to another agent without the customer’s knowledge |
| Action | Did the outcome stay within those permissions? | A changed amount or recipient, or actions the customer never authorized |
Passing one link proves nothing about the next. A verified agent can still initiate a fraudulent payment, and a compromised agent can represent a verified customer. Verification narrows the uncertainty about who is operating a payment without establishing that the payment is safe.
Where Know Your Agent Standards Stand
Regulators are moving toward the question at different speeds. In the U.K., HM Treasury’s Financial Services AI Adoption Plan, published July 14, 2026, made a trust framework for agentic payments a high-priority recommendation, with Know Your Agent protocols as one of its three pillars. The plan calls for standardized identity and verification frameworks built for autonomous software agents.
The European Union is stretching existing law rather than writing new categories. The AI Act does not define an agent separately, so an agent performing a high-risk function such as credit assessment falls under the act’s high-risk rules. Those rules will arrive later than planned. The AI Omnibus, in force since July 27, 2026, moved the deadline for stand-alone high-risk systems from Aug. 2, 2026, to Dec. 2, 2027.
Singapore took the opposite approach. In January, the Infocomm Media Development Authority launched a Model AI Governance Framework for Agentic AI, written specifically for autonomous systems. It asks organizations to bound an agent’s risk up front, make named people accountable for it and keep the ability to intercept or override what it does. Singapore is also where the largest payment networks are coordinating. In September, Ant International, Mastercard and Visa agreed to work toward common Know Your Agent principles through BuildFin.ai, an industry platform convened by the Monetary Authority of Singapore. The work centers on tracing each agent to a validated operator, certifying agents against shared requirements and continuously monitoring them. No specification or timeline has been published.
None of this pauses existing obligations. Fraud and AML duties attach to the regulated service a firm provides, regardless of the route an instruction took. Open banking already works this way, since the payment providers in a chain run their own controls even when a third party initiates the payment.
Where to Start
Agent-identity infrastructure is arriving from the payment networks. Mastercard’s Agent Pay, announced in April 2025, registers and vets agents before they can pay and issues them their own payment tokens. Those tools answer what a declared agent claims about itself. They do nothing about agents that never declare themselves, and malicious agents rarely do. Even a declared agent proves less than it seems, because the protocol verifies the agent rather than the customer behind it. As SEON’s Conner Keele has written, a cryptographically valid agent acting for a stolen or synthetic identity can pass protocol-level checks. Every program, therefore, starts with visibility and keeps identity signals in the decision-making process.
- Measure the traffic. Find out how much of your activity is already automated and which journeys it touches, from signup to login to checkout.
- Separate declared agents from undeclared automation. Route the first to verification. Challenge or block the second. Blocking every agent by default turns away customers who chose to delegate.
- Step up through a channel the agent does not control. Confirm high-risk payments with identity verification, a liveness check or an in-app approval that software cannot complete alone.
- Treat an invisible permission as risk. Where you cannot see what an agent was allowed to do, apply lower limits and restrict higher-risk actions until the customer confirms.
- Keep the evidence. Record the agent, the session, the signals and the decision, so an investigator or regulator can reconstruct why a payment was allowed, challenged or blocked.
SEON’s role in that sequence is specific. It flags sessions associated with known agents, including those from OpenAI, Devin, Manus AI and Opera Neon, as well as automated browsers, spoofed environments and device farms, and those flags feed into the scoring rules fraud teams already run. Its identity verification and liveness checks confirm the person behind a high-risk action and session monitoring, transaction monitoring and case management track what happens after it. SEON does not issue agent credentials or verify the permissions an agent provider grants, and the two layers need each other. A credential states what an agent claims. The surrounding signals indicate whether the claim holds.
The Rules Are Being Written
KYC took decades of regulation and enforcement to become routine. Know Your Agent will not get that long, because agents are already transacting. Businesses that build the discipline before a mandate arrives will choose their own controls.
Those that wait will have the controls chosen for them by a deadline. The harder change does not depend on any regulator’s timetable. The customer on the other end of a transaction is no longer reliably a person. Every control built on that assumption now has to ask a second question: who authorized this, and does that authority still hold?
Tamás Kádár published a series of contributed articles at Unite.AI:
