From KYC to KYA, do we now need to give AI agents a "ID card"?

Null

Written by: Tiger Research

Translated by: AididiaoJP, Foresight News

The era of AI intelligent agents is accelerating, and at the same time, concerns about uncontrolled creation and behavior of agents are growing. The Know Your Agent (KYA) system, which assigns identities to agents and regulates their behavior, is gaining increasing attention. Why is KYA infrastructure needed? Which companies are building it?

Summary

AI intelligent agents have entered an era where they can autonomously execute contracts, payments, and transactions, but there is currently no shared standard to verify “who this agent is.” In agent-to-agent (A2A) scenarios, KYA is more prominent than KYC.

KYA is not required in all scenarios. Inside centralized platforms (Google, OpenAI, Coinbase), existing KYC is sufficient. The real importance of KYA lies in scenarios where autonomous agents are independently deployed to reach DEX, A2A payments, and merchant payments.

The KYA standard competition has already begun:

ERC-8004: Issuing AgentID on top of NFTs, building on-chain identity, reputation, and verification systems

Visa TAP: Visa issues identity credentials to agents, verified through TAP’s triple signature (legitimacy, delegate, payment method)

Trulioo: Uses SSL CA model, issuing DAP via DPA

Sumsub: Overlay KYA system on top of its own compliance system

Regulatory actions have already started at the national level. The EU AI Act requires operational logs of high-risk AI systems to include operator identities. The US NIST has listed agent identity management as a priority standard area. Singapore has released the world’s first national-level AI governance framework for agents. Just as the FATF Travel Rule in 2019 determined which crypto exchanges could survive, whether one has KYA infrastructure will decide who can enter the next market phase.

Why does KYA appear now?

KYC: Reshaping the financial layer

Before 1989, global finance lacked a unified identity standard. This gap made it difficult to trace drug money and illegal funds.

After FATF was established in 1989, KYC became a mandatory requirement in finance, blocking illegal funds at the entry point.

Without agent identities, systems regress

AI intelligent agents execute contracts, payments, and transactions without human involvement, but currently cannot verify “who they are.”

In A2A environments, accountability becomes blurred, dispute risks increase, and users are exposed to fraud modes like money laundering.

The role and response of KYA (Know Your Agent)

KYA (Know Your Agent) is a trust layer that pre-verifies the origin, permissions, and accountability of agents.

Unverified agents pose three major risks: unauthorized transactions, fraud, and accountability gaps.

The necessity of KYA is demonstrated

Every layer needs KYA

Inside centralized platforms, user KYC + platform accountability are enough. But outside platforms, in interoperable scenarios, KYA becomes crucial for verifying specific behaviors and security of agents.

Within a country (inside a platform), an ID card (KYC) suffices for free movement. But once crossing borders (outside a platform), changing environments require entry and trust checks (KYA).

Market participants

ERC-8004: NFT-based agent identity

ERC-8004 adds an identity layer on top of ERC-721, minting an NFT as a unique ID for each agent.

It also introduces three on-chain registries (Identity, Reputation, Validation), serving as identity, reputation, and verification records.

Two markets built on Ethereum standards, with a third upcoming

ERC-20 (Token issuance standard): Before standardization, each token required new code. After ERC-20, most major assets are issued on it.

ERC-721 (NFT standard): CryptoPunks, BAYC, ENS rely on it to establish NFT markets themselves. As the agent era accelerates blockchain integration.

ERC-8004 will serve a similar standard role for agents.

Visa TAP: Certification on the Visa track

Visa issues identity credentials (Agent Intent) to agents, similar to an ID card. Without keys, transactions cannot occur. Keys are issued only after Visa pre-approval. Each transaction is signed and submitted to merchants.

Merchants receive three signatures, not one: Visa approval, delegate, payment method, all confirmed.

Visa: Strategic move to bring transactions into the Visa network

Just as Visa previously captured the payment track, it is now packaging the agent era.

Through Visa Intelligent Commerce (VIC), Visa launches a solution bundle that combines KYA with payments.

If agent payments still use card rails and this bundle becomes the default, Visa’s market share can remain stable even during transition.

Trulioo: Extending verification infrastructure into the KYA era

Trulioo is a global compliance operator on the KYC/KYB track, expanding its verification stack into KYA.

DPA acts as an SSL-CA role. Unlike SSL (domain only), DPA verifies developer KYB and user KYC, then issues DAP.

Banks and fintech are legally required to verify human and corporate identities. As agents enter finance, Trulioo’s KYC/KYB position will be further strengthened.

DAP, the agent’s digital passport, refreshes with each transaction

DAP is the digital passport of an agent. DPA verifies developer (KYB) and user (KYC), packaging both into a token granted to the agent.

Unlike paper passports, it is a live token that refreshes and re-verifies with each transaction. If delegation is revoked or anomalies are detected, DAP is immediately invalidated.

KYA is not a one-time verification. Trust must be re-established with each transaction.

Sums sub (AI agent verification): Detecting agent anomalies

Sums sub’s approach: whenever an agent attempts an abnormal transaction, it re-verifies the current human identity in use.

It leverages verification systems from compliance operations since 2015, more accurately detecting agent anomalies.

Operators with technology to address new threats in the AI era

Other KYA participants focus on one-time pre-transaction identity verification. Sums sub focuses on real-time post-issuance verification.

As agent permissions expand, anomaly detection becomes critical; as fraud scales with technology, Sums sub’s real-time verification stack is gaining attention.

Proactively shaping regulation and leading entry rules

The gap caused by the FATF Travel Rule may be replayed in KYA

After the 2019 FATF Travel Rule, VASPs diverged on whether they could bear the costs of KYC/AML infrastructure. Peer exchanges like CryptoBridge, Deribit, that cannot afford it, either shut down or migrated to lighter regulation regions.

The EU, Singapore, and the US are already competing for leadership. KYA will become the core layer of the agent era.

KYA will differentiate by market segment, not by a single winner

In standard competition, the real variable is the combination. Mainstream players have already entered the cooperation - combination phase. In the future, who partners with which merchants, payment networks, and KYC clients will determine the leaders in each segment.

The market will not have a single winner; it will be segmented.