From KYC to KYA: The New Trust Layer in AI Commerce

Every year, shopping becomes more convenient. Today, it is not necessary to go to a mall on the other side of town to buy groceries for the week or find an outfit for a party. A couple of taps on a phone is enough, and everything will be delivered to the door as quickly as possible.

AI agents seem to be a new stage in making shopping even more convenient. In a few seconds, they can scan hundreds of websites to find the best deals or pick out an item from a vague description like “it was something small, round, and green.” At first glance, AI appears to be just another step in the evolution of user-friendly interfaces. However, treating it that way is a serious mistake. Beneath this comfort lies changes to the entire infrastructure of commerce never seen before.

Knowing Who Exactly Makes a Purchase

E-commerce platforms were built around the quite simple idea that every purchase is made by a human. Who else could have made it 10 or 15 years ago? The entire chain of user actions was shaped by KYC systems and fraud monitoring tools, and they were largely effective at preventing abuse. Until everything changed recently.

The emergence of AI agents completely disrupted these established systems, because there is now an autonomous intermediary between the human and the “pay now” button. The logic  driving its actions is not always easy to trace. Like its owner, an agent can search for a product, compare prices and apply a promo code, but at the moment of purchase, the user may not even be in the room. This raises more and more concerns about authorization and accountability.

And that is also the reason why KYC is becoming insufficient. A platform may be able to verify the user, but how would it make sure the purchase was not made by their agent, who was, maybe, not even authorized to act in that way at all? This creates the need for a new system, which can be called Know Your Agent, or KYA, to track agent activity.

To operate effectively, this new protocol will need to address several important questions simultaneously. It must determine how trustworthy the agent is, who exactly stands behind it, what authority it received from the user, and what evidence can be preserved if a dispute arises. The last question is, in fact, one of the most important, because multibillion-dollar losses may depend on it.

Attracting the Attention of the Black-Box Machine

Once e-commerce companies start taking all these questions into account, they will realize just how radically their whole model is changing. The reason is that the user now gives the agent a commercial task, which the machine then interprets on its own, though it’s kind of a black box. Sellers and platforms will have to adapt to the machine’s logic and try to draw its attention to their products.

People often choose brands that stand out visually or use advertising to appeal to experience and emotion. To impress an agent this way will be much harder. People are also often lazy, and look only at the first couple of pages of search results, or simply click the first promoted listings. By contrast, an agent can scan dozens of pages in seconds and find, even on the last one, the exact product it considers the best match. As a result, platforms may no longer be able to earn the same way from advertising and brand promotion, while sellers may find it harder to increase visibility and reach through paid placement.

Surviving in this fast-moving world will require e-commerce platforms to develop a whole new intent-centred infrastructure that relies on the identity’s purchase intentions. The largest players have already begun competing for agents’ attention, so OpenAI and Stripe are embedding purchasing into their AI interfaces. However, once commerce starts relying on delegated intent, it should decide what to do when that intent is disputed.

This is where the shift becomes especially important for fintech and payment infrastructure, as it is not enough to verify that the client uses a valid card and that the transaction does not appear fraudulent. Payment companies should review each operation to determine whether it was performed by a trusted agent on behalf of a real user. These tasks became increasingly important day by day, as almost 40% of clients have already used agentic AI in shopping one way or another.

Shaping the Payment Infrastructure

To overcome this challenge, the next generation of payment infrastructure will have to connect layers of identity, intent, and transaction execution into a single system. Payments should be centred on context rather than the transaction itself. Using traditional metrics such as card credentials, merchant category, location, and device would be insufficient in a world filled with AI agents. A platform needs to find a way to understand who exactly triggers a transaction and what their mandate is in this regard.

Lowering the risk of agents performing the wrong transaction would actually become the most important task for payment systems. KYA, of course, will not replace traditional fraud scoring next to it, and it should be another layer around the system.

The well-established companies are already moving into this direction, and MasterCard, for example, is building an Agent Pay system as infrastructure for secure payments in agentic commerce, which is centred around registered agents and traceable transactions. Google, in turn, introduced a new Agents Payment Protocol, shaping how transactions are made. These examples are not the only ones, more and more companies are recognising that it should be the next stage in payment infrastructure development.

Building such systems matters because many businesses may not yet be measuring the problem. Some merchants may not distinguish between agent and bot traffic, while others may allow every AI transaction without issue. Fintech companies here may build a whole new product, providing real-time analysis on its side, building trust from commerce providers and finding new revenue sources.

The future of commerce may not simply depend on who makes a payment, but also on which agent made the decision and whether that decision truly reflected the customer’s intent.