‘Know your agent’: Banks face a new compliance challenge as AI agents shop and pay on their own

Financial institutions that have spent decades mastering “Know Your Customer” (KYC) regulations now face a new and undefined compliance challenge. The emergence of autonomous AI agents—programs capable of independently shopping and executing payments on behalf of users—is pushing the industry to develop a new framework: “Know Your Agent” (KYA).

From Human Customers to Autonomous Agents

Traditional compliance, including anti-money laundering (AML) and Bank Secrecy Act rules, is built around verifying the identity of a human customer. These regulations were not designed to accommodate transactions initiated by non-human entities. When an AI agent makes a purchase, it raises fundamental questions about who the transacting party is—the human user or the autonomous algorithm.

Navigating a Regulatory Blind Spot

This technological shift creates a significant regulatory gray area. Financial firms must now determine how to apply existing fraud detection and transaction monitoring systems to AI agents, which can learn and alter their behavior. The core issue is establishing a clear line of accountability for an agent’s actions, a task that current compliance infrastructure is ill-equipped to handle.

The Critical Question of Liability

A primary concern is assigning liability in cases of fraudulent activity or money laundering. If an AI agent is compromised or used for illicit purposes, it remains unclear who is legally responsible: the user who deployed it, the developer who created it, or the platform that hosts it. This ambiguity poses a substantial risk to financial institutions, which could be held accountable for failing to prevent such activities.

The Path Forward for a New Compliance Era

As AI agents become more integrated into digital commerce, banks and regulators must collaborate to establish clear KYA standards. This will likely require significant investment in new technologies capable of identifying, verifying, and monitoring autonomous agents. For the financial sector, proactively defining these new rules is essential to fostering innovation while safeguarding against emerging digital threats.