KYC, KYB, and Now KYA: Know Your Agent

Banks have spent decades building rules to verify every customer and every business they serve. Know Your Customer confirms the person is real. Know Your Business confirms the company and the people who own it. These checks sit at the heart of BSA, AML, and fraud programs at every community bank.

But AI tools are now reading, summarizing, and even acting on that same customer data, often with far fewer checks. And a new kind of actor is starting to show up in banking: software that can log in, move money, or apply for products on someone’s behalf.

If the term KYA is new to you, you are not alone. It is still being defined. That is exactly why community banks should start paying attention now.

First, what is an AI agent?

Most people have used an AI assistant that answers questions. An AI agent goes one step further. It does not just answer. It acts.

An agent can be given a goal, like “pay my bills on time” or “find me a better savings rate,” and then take the steps to get there: logging in, comparing options, filling out forms, and completing transactions. It works on behalf of a person or a business, often without that person watching each step.

Some examples already showing up around banking:

• A shopping assistant that finds a product and checks out with the customer’s card
• A personal finance agent that moves money between accounts to avoid an overdraft
• A bookkeeping agent that pays a small business’s vendors and reconciles the books
• Inside the bank, tools that read documents, draft notes, or prepare a file for a banker

That is useful. It is also a new kind of risk. When an agent shows up at your digital front door, the person behind it may be real and verified. But the agent itself is not.

What KYA means

Know Your Agent applies the same logic banks already use for customers to the software acting for them. It answers three questions:

1. Is this agent who it says it is? Can it be identified and authenticated, so it cannot be impersonated by a fraudster’s bot?
2. Who is it acting for? Is it tied to a verified person or business, one who already passed KYC or KYB?
3. What is it allowed to do? Did that person give it permission for this specific action, with limits on amounts, merchants, or time?

Think of it like a power of attorney. A bank would never let someone act on a customer’s account just because they said they had permission. They would verify the person, confirm the authority, and check its limits. KYA asks for the same proof when the one acting is software.

• KYC verifies the Person, Core question Is this customer real?
• KYB verifies the Business and it's owners, Core question Who really owns it and controls it?
• KYA verifies the AI agent, Core question Who is it acting for, and what is it allowed to do?

Why it’s being defined right now

KYA is not a buzzword invented by a vendor. Over the past year, the payment networks, standards bodies, and community banking’s own trade association have all started building it.

• The card networks are building agent identity. In October 2025, Visa’s Trusted Agent Protocol and Mastercard’s Agent Pay introduced ways for merchants to recognize registered AI agents, link each agent to a consumer, and tell approved agents apart from malicious bots (Cloudflare).
• ICBA asked for it by name. In March 2026, ICBA told NIST that AI agents should be treated as a higher-risk category of AI because they take actions, not just produce text. ICBA urged strong identity controls under a “Know Your Agent” approach, so banks can tell which agent is acting, what it may do, and who approved that authority (Independent Banker).
• Global regulators are weighing in. In June 2026, the Financial Stability Board’s consultation on AI called for stricter controls on agents that execute financial transactions, including human approval above set thresholds, restricted payment access, and an audit trail for every agent transaction (The Asian Banker).

There is also a practical fraud reason. As one industry analysis put it, without a verified identity and mandate, agent behavior like round-the-clock activity and repeated retries looks a lot like a bot attack or account takeover. “Without it, agent-driven transactions are treated as suspicious noise” (PYMNTS).

The rules are still being written. The banks that understand them early will help shape how they work.

What this means for community banks

KYA touches three parts of the bank, and each one has a risk and an opportunity.

1. At the digital front door. Agents will start opening accounts, logging in, and moving money for customers. Fraudsters will dress up their bots as helpful agents. Banks that can tell a verified agent from a malicious one can say yes to good customers without opening the door to fraud.
2. Inside the bank. Your own staff and vendors are adding AI that reads documents, drafts notes, and prepares files. Each of these is an agent touching customer data. The same questions apply: what is it, who approved it, and what is it allowed to see and do? (We cover this in [Your Data Met AI. Do You Know Where It Went?] [link].)
3. In payments. Agents that pay bills or buy on a customer’s behalf will need clear limits and a clear record. When a customer says “I didn’t authorize that,” the bank needs to know whether a verified agent acted within its permission, or whether something went wrong.

The common thread is the one community banks already know well: trust, verified. KYA is simply that principle applied to a new kind of actor.

Questions to start asking now

You do not need a KYA program today. You do need to start asking the right questions.

About agents coming in:

• Can our digital channels tell the difference between a person, a verified agent, and a malicious bot?
• If an agent acts for a customer, can we tie it back to a verified identity?
• How would we know what a customer authorized an agent to do, and where the limits are?

About AI working inside the bank:

• Which AI tools and vendor features already touch customer data today?
• Who approved each one, and what is it allowed to see and do?
• Do we keep a record of what each AI tool did, clear enough to show an examiner?

About our partners:

• Are our vendors following how the networks and standards bodies are defining agent identity?
• Will they tell us before turning on new AI features that act on our data?

Trust, verified, for whoever comes next

KYC took years to become standard practice. KYB followed as business fraud grew. KYA is arriving faster, because AI is moving faster.

At Linker Finance, control is built into the platform, in multiple ways. Every action on an account answers the same questions KYA asks: who is acting, on whose behalf, and with what permission.

• Verified identity at the start. KYC and KYB run inside onboarding, with every business owner verifying themselves, before an account ever reaches the core.
• Permissions the bank defines. Role-based access, approval queues, and dual approvals decide who can do what, and how much, inside every account.
• Rules the bank owns. Risk thresholds and fraud rules are set by your team, not hard-coded by a vendor, and can be tightened the same day a new pattern appears.
• Eyes on every action. Anomaly alerts flag behavior that breaks from the norm, and a clear record of every event supports investigations and exams.
• Data protected by design. Sensitive identifiers are tokenized, and the platform is SOC 2 compliant.

These controls are layered with world-class fraud and device intelligence from our partners. As agent identity standards take shape, the same foundation of identity, permission, and audit is what will let community banks welcome trusted agents and stop the rest.

‍