From KYC to KYA: why banks now have to verify your AI agent, too

Last week we talked about bounded delegation — which financial tasks are safe to hand an agent today. This week's story is about the layer underneath that: how a bank or payment network even knows it's your agent acting, and not someone else's script wearing your credentials.

This week in the agent economy

• KYA has a name now, and it's not just KYC with new letters. Industry writeups in 2026 are treating "Know Your Agent" as its own discipline — verifying not just that an agent exists, but its provenance, its permissions, and whether its actions stay auditable over time. What it means for you: if a tool can't answer "which of my actions were the agent's and which were mine," it's behind, not ahead.
• Mastercard's Agent Pay ties every agent transaction back to a KYC'd human. Agents get enrolled through the developer's side, producing a cryptographic agent ID that rides alongside your card token at checkout — so the network can score risk per agent, not just per session. What it means for you: the card networks are building the identity layer first. Bank and fintech tools will plug into this over the next year or two; it's not something you configure yourself yet.
• Visa and others are taking a parallel, credential-based path. Alongside Mastercard's token approach, Visa's Trusted Agent attestations and emerging standards (Verifiable Credentials, W3C DIDs) are all racing to answer the same question in slightly different ways. What it means for you: there's no single standard yet — expect the tools you use to support one approach before another, and don't assume "no agent support" means "behind," it might just mean "waiting to see which standard wins."\n- Banks are starting to keep their own agent directories. Some banking-technology guidance is now telling banks to maintain a certified registry of agents — their own and their customers' — with cryptographic keys tied back to a verified owner. What it means for you: this is exactly the "bounded" instinct from issue one, just implemented at the bank's end instead of yours.

The deep dive: From KYC to KYA

Know Your Customer answers one question, once: who is this person, at onboarding. Know Your Agent has to answer a harder version of the same question, continuously: which agent is this, who does it act for, what is it allowed to do, and can someone prove that after the fact.

That last part — provable after the fact — is the piece most freelancer-facing tools still skip. A tool can categorize your spending and still have no real answer to "show me exactly what the agent touched last month and why."

Why this matters more than it sounds like it should

This connects directly to the three-tier framework from issue one. An agent operating at Tier 1 (observe only) doesn't need much identity infrastructure — it can't do damage. But the moment you consider Tier 2 or Tier 3 — drafting real communications, moving real money — the question "can this agent's identity and authority actually be verified" stops being a compliance abstraction and becomes the thing standing between you and a bad afternoon.

A practical filter for evaluating tools

Next time a finance tool advertises "AI agent support," ask one question: can it show you a log of what the agent did, tied to a specific, verifiable agent identity — not just "the account did X"? If the answer is no, you're not getting agent support, you're getting automation with better marketing.

— FinAgentHub