Just When We Figured Out KYC, Now There's KYA?

Agents are back, yet again 🕵️

With the rise of AI, machine learning, and generative technologies, and as access to these technologies increases, we’re hearing more and more about agents.

Even though AI, especially language models and generative tech, are becoming tools more people use, agents aren’t as distant a concept as they might seem. Today’s technology is enough for agents to handle many financial transactions on our behalf.

But what about after that? Imagine a world in the near future where everyone has one or more agents handling everything from payments to buying and selling, all on our behalf.

Believe me, that world isn’t far off, and soon you’ll be setting up and running agents for yourself just like you use a mobile banking app.

But having more agents than humans in the world brings up some big issues besides orchestration and coordination: Security.

Think of it like this: the security of transactions, being able to trace them, having a record of what each agent was thinking when they acted, and ultimately, who is responsible for what those agents do.

So, what if an agent you activated through an app to handle payments doesn’t make a payment, makes it to the wrong place, or gets compromised and finds a way to make transactions you didn’t approve? These are the kinds of issues we’re talking about.

In Turkey, and increasingly worldwide, we’ve been using systems like “digital/mobile banking” and stock exchange apps for a while now, under the “KYC - Know Your Customer” systems. When you open an online bank account, you take a selfie or have a live chat with an agent via WhatsApp/FaceTime/bank app, or you upload an ID document when logging into a crypto exchange. When you register a card on a travel app, you verify your address with a bill or an e-government output. KYC, the “Know Your Customer” process, is a routine, indispensable part of all digital processes involving finance. Developed to prevent money laundering, fraud, and terrorism financing, this system has become the standard way to track who does what through centralized structures and is used everywhere.

Now, the same question is being asked for a much more complex entity: agents acting on our behalf, whose identities we don’t know.

Why does KYC exist? Because centralized systems (banks, exchanges, crypto exchanges) need to know the account holder and who is using their infrastructure.

The world of protocols and smart contracts, blockchain/Web3, was built on different principles: anonymity, decentralization, a world that doesn’t ask for or need identity. That equation was never set up.

But AI agents sit somewhere in between these two worlds.

They act on our behalf. They make payments. Last month, I mentioned an agent that, without human intervention, set up a company in the US and obtained a tax ID from the IRS; that was ClawBank’s agent named “Manfred.”

The security side of this picture looks a bit unsettling: According to Darktrace’s 2026 report, 92% of security managers are concerned about agent security, but only 37% have an official policy on it. Where does responsibility lie, and who will be accountable?

Two different worlds are developing two different answers.

The centrally managed real world :)

In Mastercard’s April 2025 announcement, they said: “Today’s payment systems weren’t designed for AI agents to transact.” Agent Pay came to fill this gap. In partnership with Microsoft, IBM, Braintree, and Checkout.com, they developed a system where each agent is assigned an “Agentic Token”; the cardholder, the agent’s identity, and the scope of authority are tied to a single cryptographic document. When an agent makes a payment, this token is verified by the network; predefined rules check who the agent can act for, how much, and for what.

Visa chose a different architecture with its Trusted Agent Protocol: instead of embedding it in the token, it adds a separate “approval header” to each transaction, agent identity, human approval, and transaction intent are all signed and added to each payment. Both systems are built on top of the existing card infrastructure, not changing it.

The decentralized and digital world

W3C, the rule-maker of the internet, standardizing HTML and CSS, updated the DID (Decentralized Identifier) standard to v1.1. Think of it as a “digital passport, but you control it, not the state”: a DID is an identity document recorded on a blockchain or distributed system, controlled by its owner. It was designed for humans but can also be applied to agent identities.

ERC-8004, which went live on the Ethereum mainnet in January 2026, was written directly for agents. This standard, co-authored by Marco De Rossi from MetaMask, Davide Crapis from the Ethereum Foundation, Jordan Ellis from Google, and Erik Reppel from Coinbase, opens three separate records for each agent on the chain: identity record (name, capabilities, service points), reputation record (past performance, evaluations by other agents), and verification record (proofs of task completion). These records are public, immutable, and agents can look at them to verify each other.

These two solutions aren’t competitors. Different ecosystems are giving different answers to the same question, and both are evolving.

Are the immutable, cryptographic solutions of the decentralized world finding real use cases through entirely different technologies if they don’t have ZK (zero knowledge) approaches?

Will our agents act with our identity? Or will both their approval and ours be required? If I have multiple agents, how will I distinguish between them? How will I see step-by-step what the agent that says “transaction completed / Done ✅” actually did behind the scenes and trace it back? How will I be sure these records haven’t been altered? From a security perspective, these questions are endless :)

The KYC issue has been debated and resisted for years for people and has become a norm. Are we looking at a similar path for agents?

And the even bigger question is: Are the identity solutions of the decentralized world, which set out with the philosophy of anonymity, finding a place for themselves in real life, in a matter that’s quite the opposite? How will this affect both the problems and the manifestos? We’ll have to wait and see.