From KYC to KYA: Banking's New Question
A Scene That Is No Longer Science Fiction
At Sibos 2026, Federal Reserve Governor Christopher Waller described an everyday example: a person gives an AI agent access to a prefunded virtual card. The instruction: buy groceries online based on past purchases.
The person sets the rules. The agent does the rest.
Waller distinguished between two models:
Assisted: the agent searches and compares, but the person decides and pays.
Delegated: the person grants the agent the authority to buy and pay on their behalf, within set limits.
In the second model, something fundamental changes. It is no longer enough to prove that the buyer can pay. Now, it must be proven that the agent has the authority to pay on their behalf.
What Is KYA
KYA is a framework for verifying the identity, authorization, and accountability of AI agents that interact with financial institutions on behalf of customers or businesses.
The difference with KYC is simple:
Question it answers | |
|---|---|
KYC → | Who is the customer? |
KYA → | What is the agent acting on their behalf allowed to do, and what did it do? |
KYA does not replace KYC: it complements it. One verifies the person; the other verifies who acts on their behalf.
It is an evolving concept. Terminology and standards are still being defined, but the problem it solves is already real.
Why It Matters to Society
It all comes down to one word: trust.
In September 2026, six global banks (Bank of America, Capital One, ING, NatWest, Commonwealth Bank, and ASB) published joint principles for AI agent commerce. They recognized that many consumers are unclear about whether these agents will act in their best interest.
Their proposal stems from a basic idea: all parties should know when an agent intervenes and on whose behalf it is acting.
Waller posed it with a question that anyone can understand: if an agent buys what it shouldn't have, who is held accountable?
Why It Impacts Financial Institutions
KYA is not just an issue for large global banks. It affects any entity that has customers or members operating through digital channels.
Fraud: anti-fraud systems are calibrated for human behavior. According to Waller, they may not work with agents and will need to be recalibrated.
Banks with corporate clients: B2B purchases fit well with agents because they follow rules, such as approved vendors and budgets. However, higher amounts amplify the impact of any mistake.
Cooperatives, MFIs, and credit unions: their value relies on trust and proximity to their members. When an agent comes between the institution and the member, that trust requires clear rules to be sustained.
And it is not a distant topic. Visa launched its Agentic Ready program in Latin America and the Caribbean for issuing banks to test agent-initiated payments with live cards and real merchants. BBVA is participating, and in Brazil, Bradesco, Banco do Brasil, Santander, XP, and Dock are taking part.
How KYA Is Approached
There is no single standard yet, but the industry is already converging on five practices:
Register the agent. In Mastercard Agent Pay, only registered agents can operate, and they are identified via network tokens.
Verify its identity. Visa's Trusted Agent Protocol allows an agent to cryptographically prove its identity and authorization to the merchant.
Define clear limits. An agent authorized to schedule payments should not be able to modify account ownership.
Leave a trail of every action. Every agent decision must be logged and traceable.
Monitor behavior, not just identity. Traditional onboarding verifies at the beginning of the relationship; agents require continuous monitoring.
The logic is the same that banking already knows from KYC: register, authorize, and audit. The difference is that it is now applied to a non-human actor.
The Upcoming Question
Waller left open questions: what standards are missing for agents to carry identity, consent, and credentials, and what is the right balance between convenience and intentional friction.
Institutions that start asking themselves today, “who is this agent?” will be prepared.
Where Bankingly Fits In
KYA is still emerging. But it relies on pillars that institutions already need to solve today: verifying identities, preventing fraud, and securely onboarding AI agents.
These are the same pillars Bankingly works on:
Digital Onboarding: verified identity from the very first customer touchpoint.
Fraud Prevention: digital channel protection.
Agentic Banking: AI agents integrated into the banking experience.
Certified security: ISO/IEC 27001 and SOC 2.
With a presence in more than 15 countries and experience working with banks, cooperatives, microfinance institutions, and credit unions, Bankingly is ready to support institutions in this new era.
Because the future of banking is not an isolated app; it is an integrated digital ecosystem. And in that ecosystem, knowing the agent will be just as important as knowing the customer.
Bankingly: technology that humanizes the banking experience.
