KYA, KYC, KYB: why agents need a check of their own

Key points

• KYC verifies people, KYB companies, and KYA the individual action of an AI agent.
• The decisive difference is timing: KYA checks every action, not just onboarding.
• The checks build on each other: identity once, authority with every action.
• Government identities such as the e-ID strengthen identity but do not replace checking authority.

Three checks, three subjects

KYC identifies a natural person, KYB a company and the people behind it. Both checks have an outcome that lasts a while: an identified person stays identified until something material changes.

An AI agent is neither a person nor a company. It is software acting on someone's behalf, and it often acts hundreds of times a day. For it, identity is not the hard question; authority in the individual case is.

Timing is the difference

An agent that was set up correctly yesterday can today trigger a payment that exceeds its mandate, goes to an unintended counterparty or relies on a mandate that has since been revoked. A one-time check detects none of this. KYA therefore takes place on every action and assesses validity at the moment of execution.

How the three fit together

1. KYC or KYB identifies the principal.
2. The mandate connects the principal to a specific agent and defines the scope.
3. KYA checks on every action whether it lies within the mandate and produces a receipt.

Without the first step it is unclear to whom an action is attributable. Without the second there is nothing to check. Without the third every action remains a claim.

What a KYA result says

The result is not “known” or “unknown” but one of three verdicts: valid, indeterminate or invalid. On top comes a level from A0 to A4 that shows how far the evidence carries. An agent can be perfectly identified and still perform an invalid action – exactly the case KYA is meant to expose.

What this means for operators

Anyone deploying agents needs two things: a verifier before execution that decides fail-closed, and receipts that can be verified without access to their own systems. An implementation such as Mandact provides the first part, any open verifier the second. Verify evidence

What KYA has in common with KYC

Despite the differences, the checks share a principle: trust comes from evidence, not assertion. For KYC, that is an identity document or an electronic identity; for KYB, a commercial register extract; for KYA, a signed mandate with decision and receipt.

The role of the verifying party is also shared. It decides which issuers it trusts, how current information must be and which result is sufficient for which action. KYA takes this way of thinking and applies it to the individual action of an agent.

How the three checks work together

In practice, the checks build on each other. KYC or KYB establishes who the principal is. The mandate binds an agent to this principal and sets the limits. KYA checks with every action whether it stayed within those limits.

A bank can, for example, keep using its existing customer identification and additionally require that payments by agents be backed by a mandate and a decision. Identity is checked once, authority with every payment.

The role of government identities

With the Swiss e-ID and the European EUDI wallet, government-issued digital identities with selective disclosure are emerging. They improve the identity side: whoever issues a mandate can identify with strong evidence without revealing more details than necessary.

They change nothing about the question of authority. Even a perfectly identified person can give their agent overly broad limits, and even a correctly identified agent can act outside its limits. That is why KYA is needed in addition to KYC.

An example from payments

A customer opens an account and goes through the usual identification. Months later, she instructs an agent to pay recurring invoices up to CHF 300 to known payees. The bank already knows the customer; KYC does not need to be repeated. What is new is the question with every payment: is it within the mandate? KYA answers exactly this question, payment by payment, with evidence that bank and customer can verify alike.

Frequently asked questions

Does KYA replace customer identification under KYC?

No. KYC establishes who the principal is. KYA builds on this and checks with every action of the agent whether it stayed within the limits granted.

What is the most important difference between KYC and KYA?

Timing. KYC happens at onboarding and holds for a while. KYA happens with every single action, because authority can differ from one action to the next.

Does every agent need its own KYC?

An agent is not a person and needs no KYC in the classic sense. The principal and the operator are identified; the agent itself is bound through keys and a mandate.

What is Know Your Business?

Know Your Business (KYB) is the check of a company and the people behind it, for example through commercial registers and beneficial owners. For company agents, KYB is the basis on which mandates are issued.

Sources

1. E-ID: offizielle Informationen des Bundes: https://www.eid.admin.ch/de
2. SD-JWT VC (IETF): https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/