Financial services
Banks, asset managers and insurers need to trace who triggered a transaction. When an AI agent acts, this requires verifiable evidence rather than a log entry.
In short
Financial institutions use KYA to verify whether an AI agent was authorized for a payment, order or claim – mandate, scope, revocation, receipt and time, independently recomputable.
Typical agent actions
- Payments and standing orders on behalf of customers
- Securities orders within agreed limits
- Claims and applications an agent prepares and submits
- Account queries by third-party agents
Which checks decide
| Check | Why it matters here |
|---|---|
| Mandate validity | Was the authorization in force at the time of the action? |
| Scope | Were amount, counterparty and action type within the limits? |
| Revocation | Was the authorization withdrawn before the action? |
| Execution binding | Does the receipt match the transaction actually executed? |
| Timestamp assurance | Is the point in time independently proven, for audits or disputes? |
Example flow
- The customer grants her agent a mandate with an amount limit and permitted counterparties.
- Before each payment, a service decides whether the action lies within the mandate.
- The agent executes; a receipt is appended to the chain and timestamped.
- Audit or counterparty verify the evidence pack with KYA and receive the same certificate.
Implementation
Verification runs in the browser, in the pipeline or entirely within your own network, without evidence leaving the organization. Mandates and decisions are issued by a mandate service, for example the reference implementation Mandact from the operator of KYA.
Typical scenarios
Payments on behalf of customers: an agent pays invoices up to a limit and only to known payees. Securities: an agent places orders within agreed limits and asset classes. Insurance: an agent prepares and submits claims, while payouts require a person's approval.
In all cases: the institution must be able to show afterwards that the action was covered by the customer's instruction. An evidence pack bundles mandate, decision, receipt and timestamp for this.
Supervision and governance
In Switzerland, FINMA set out expectations for governance and risk management in the use of artificial intelligence in its Guidance 08/2024, for example on inventory, responsibilities, data quality and traceability. In the EU, the requirements for strong customer authentication under PSD2 are added.
Verifiable evidence of agent actions supports traceability but does not replace a supervisory assessment. More in the article AI agent liability.
Adoption in three steps
- Pilot: a clearly limited use case, such as payments to known payees up to a limit, is secured with mandate, decision and receipt.
- Verification: every payment is checked before execution; samples are also verified with KYA in the pipeline.
- Expansion: further use cases follow with the same rule and the same minimum level.
What a certificate means for audit
Internal and external audit ask not only whether a payment was booked correctly, but also who initiated it and on what basis. For agents, the answer is one certificate per payment: it shows mandate, decision and receipt, the level reached and the verification date. Because it is reproducible, auditors can recompute it themselves with the same data, without relying on the institution's logs. This shortens audits and makes deviations visible before they turn into damage.
Frequently asked questions
May banks accept payments from AI agents?
In principle yes, within contractual and supervisory requirements. What matters is that the bank can trace that the payment was covered by the customer's instruction.
Which KYA level makes sense for payments?
At least KYA-A3, meaning a proven mandate, checked scope and checked revocation. For disputes, KYA-A4 with an independently anchored point in time is advisable.
Does customer data leave the institution during verification?
No. The engine runs in the browser, in your own pipeline or entirely within your own network, without network requests.
How does KYA relate to strong customer authentication?
KYA does not replace it. Strong customer authentication confirms the customer; KYA checks whether the agent acted within her instruction. The two complement each other.
How do institutions handle escalated payments?
Above a defined threshold, a person decides. Their approval is also recorded as a signed record, so the evidence remains complete for escalated payments too and auditors can trace every step. The institution sets the threshold according to its risk.