What is Know Your Actor (KYA)?
Know Your Actor (KYA) is an identity framework for a world where the entity on the other side of a transaction may be a person, an AI agent acting on that person’s behalf, or something pretending to be either. It extends identity verification beyond a static one-time check into continuous trust across the whole customer journey.
The name is deliberate. Know Your Customer assumes a customer — a human who applies once and is thereafter known. An actor is whatever is acting, whenever it acts.
| What it establishes | Who or what is acting, and whether it is authorized to |
| Applies to | Humans, AI agents acting for a human, or both together |
| When | Continuously across the journey, not once at onboarding |
| Three capabilities | Behavioral signals, intent verification, contextual risk assessment |
| Driven by | Agentic commerce — AI agents transacting on people’s behalf |
| Relationship to KYC | Extends it; does not replace the regulatory obligation |
Why KYC needed extending
KYC was designed around a durable assumption: a human applies for an account, is identified once, and is thereafter the party transacting. Every control downstream inherits that assumption, and it is now breaking in two directions at once.
Legitimate activity is increasingly not human. AI agents book travel, make purchases, manage subscriptions and move money on their owners’ instructions. A system built to detect and block automation cannot distinguish an authorized agent from a malicious bot, because at the network and behavioral layer they look similar — and blocking the authorized one is a product failure, not a security win.
Malicious activity is increasingly good at looking human. Generated faces, synthetic documents and cloned voices have removed the skill and time costs that used to limit impersonation at scale.
The two pressures meet at the same place: a one-time check cannot answer a question that keeps changing. Knowing who opened an account says nothing about who is operating it eighteen months later, or on whose authority.
The three capabilities
| Capability | What it establishes | The question it answers |
|---|---|---|
| Behavioral signals | How an actor interacts with the system | Does this behave like a legitimate human or authorized agent? |
| Intent verification | A tether between a verified human and the agent they authorized | Is this agent doing what its principal actually asked? |
| Contextual risk assessment | The environment around the transaction | Does anything about this context indicate a deepfake or synthetic identity? |
Intent verification is the capability without an equivalent in existing frameworks. When an agent acts, two things need to be true rather than one: that a real, verified human stands behind it, and that the action falls within what that human authorized. An agent with valid credentials doing something its principal never asked for is a failure mode KYC has no vocabulary for — nothing was impersonated and nothing was stolen.
Why the first moment still decides everything
Continuous trust is the point of KYA, and it is worth being clear that continuous does not mean the initial check matters less. It means the opposite.
Behavioral signals compare activity against a baseline, and a baseline built from an account that was fraudulent from the start is a baseline of fraud, confirmed continuously. Intent verification tethers an agent to a human, and the tether is only as good as the evidence that the human is real and correctly identified. Contextual risk assessment scores an environment around an identity it did not establish.
All three inherit the initial verification. Establishing an authentic identity at the decisive first moment — with an authenticated document and a matched face — is what makes everything afterward mean anything — which is why KYA is an extension of document and biometric verification rather than a replacement for it.
KYA compared with KYC
| KYC | Know Your Actor | |
|---|---|---|
| Subject | A human customer | Any acting entity — human, agent, or both |
| Timing | At onboarding, refreshed periodically | Continuous across the journey |
| Core question | Who is this person? | Who or what is acting, and on whose authority? |
| Driver | Regulatory obligation | Fraud risk and agentic commerce |
| Treats automation as | Something to block | Something to authorize or refuse |
| Status | A legal requirement | A framework built on top of it |
The last row matters and is easy to misread. KYA does not discharge a KYC obligation. Regulated firms still identify customers under the rules that apply to them, and KYA addresses the risk that those rules were never written for.
What KYA does not do
It does not replace regulatory identification. AML and sanctions obligations are unchanged, and a KYA program sits alongside them.
It does not make agent activity inherently safe. Verifying that an agent is authorized establishes authority, not judgment. An agent acting exactly as instructed can still act on instructions the human should not have given.
It does not remove the need for evidence. Behavioral and contextual signals are inference. Establishing that a real person stands behind an actor requires document and biometric proof, and the inference layer is built on top of it.
It is not a settled standard. This is an emerging framework rather than a regulatory regime, and the terminology across the industry is still moving.
Frequently asked questions
What is the difference between KYC and KYA?
KYC identifies a human customer, usually once at onboarding, to satisfy a regulatory obligation. Know Your Actor establishes who or what is acting at any given moment — a person, an AI agent authorized by a person, or a bad actor imitating either — continuously across the journey. KYA extends KYC rather than replacing it.
Why does identity verification need to change for AI agents?
Because existing systems treat automation as something to block. When a legitimate customer authorizes an agent to act for them, blocking it is a product failure, and allowing it without establishing authority is a security failure. Distinguishing an authorized agent from a malicious bot needs a framework that can represent authority.
What is intent verification?
Establishing a tether between a verified human and the AI agent they authorized, so the agent’s actions can be checked against what its principal actually asked for. It addresses a failure mode with no equivalent in KYC: an agent with valid credentials doing something nobody asked it to do.
Does KYA replace KYC obligations?
No. Regulated firms still have to identify customers under the rules that apply to them. KYA is a framework layered on top, addressing risks that arise after the regulatory check is complete and that those rules were not written to cover.
Related reading
- Know your customer — the obligation KYA extends
- Deepfake — the impersonation capability driving the change
- Bot — the automation KYA distinguishes from authorized agents
- Liveness detection — the evidence the first decisive moment relies on
