KYC wurde für Menschen entwickelt – jetzt benötigen wir Know Your Agent

Amerikas Know‑Your‑Customer‑Regime (KYC) erhielt dank des Bankgeheimnisgesetzes von 1970 seine ersten wirklichen Zähne. Abschnitt 326 des USA‑Patriot‑Acts von 2001 gab ihm dann seine moderne Form, indem er verlangte, dass eine Bank mit vernünftiger Sicherheit die wahre Identität jedes Kunden kennt, bevor sie ein Konto eröffnet.

Every rule that has been followed, in nearly every jurisdiction, inherits that same starting premise. A customer is a person, natural or legal, with a name, an address and a body of record a bank can check against. That premise held for more than 50 years because it was solid enough to support a global compliance industry. Now, it is no longer universally true.

Der Kategorienfehler

An AI agent transacting on someone’s behalf is neither a natural person nor, in most jurisdictions today, a legal one. It has no name a registry recognizes, no address a bank can send mail to, and in some cases, no body of record that predates the transaction in front of you by more than a few minutes. Running that agent through a KYC process designed for humans and companies does not yield an incorrect answer. It produces a question that the process has no field for.

That’s the mistake compliance teams keep making when they describe agentic risk as KYC, but harder. It is not harder KYC. It is a different question entirely. KYC asks whether a person is who they claim to be. The question an agent raises is whether the entity behind this action has the authority to take it right now, and whether that authority can be confirmed at the moment it matters rather than reconstructed afterward. Those are not the same question stated at different difficulty levels. They are two different questions that happen to share a compliance department, and the second one deserves its own name: Know Your Agent, or KYA.

Warum das Anbringen von KYA an KYC scheitert

The instinct to treat this as an extension of existing KYC is understandable and wrong. KYC is fundamentally a point-in-time exercise. It verifies identity once and monitors for material changes afterward, an architecture that assumes a customer’s identity and behavior are stable facts established at onboarding and unlikely to shift day-to-day.

An agent’s authority to act is not a stable fact. It is a permission that can be granted, scoped or revoked in the time it takes to call an API, and the entity actually directing the agent at 3 p.m. may not be the one that provisioned it at 9 a.m. A compliance framework built around periodic re‑verification cannot govern something that continuously changes state. That is not a criticism of KYC. It is a description of a tool being used outside the problem it was built to solve.

Was Know Your Agent tatsächlich verifizieren muss

Eine Erklärung, wie KYC und AML als verwandte, aber unterschiedliche Disziplinen funktionieren ist hier ein nützliches Modell, weil es zeigt, wie die Trennung zweier benachbarter Compliance‑Funktionen in der Praxis aussieht. Jede beantwortet eine andere Frage, nutzt andere Werkzeuge, in einem anderen Rhythmus, obwohl beide dasselbe Risikobild liefern.

Know Your Agent needs that same kind of separation from KYC, not a merger with it. While KYC verifies identity, KYA must verify provenance and standing authority, tracing who built an agent and what permissions it currently holds, hence, so the chain of custody between human principal and autonomous action stays checkable in real time. Dynamic KYC orchestration, built for VIP onboarding, is the closer analog: risk-scoped checks that flex to the specific transaction rather than a single static gate everyone clears the same way. Agentic activity needs that same real-time flexibility, applied to a different question.

Das Papierkram‑Problem, automatisiert

This isn’t theoretical. An AI agent cannot be the legal owner of a bank account. The system assumes a human behind every account, with KYC checks, legal identity and liability that attach to a named person. Fintechs are already testing that edge. Meow Technologies hat im April einen Service gestartet, der einem Agenten ermöglicht, KYC zu erledigen, ein Geschäftskonto zu eröffnen, Firmenkarten auszugeben und Geld zu bewegen, ohne dass ein Mensch jemals ein Dashboard öffnen muss. Automating the paperwork is not the same as becoming the account holder. The account and the liability still land on a person, and no product design has closed that gap.

Den Aufbau dieser Kategorie zu wählen ist nicht optional, und es ist kein Problem, das Compliance‑Abteilungen stillschweigend allein lösen können. Es erfordert dieselbe öffentliche Abrechnung, die KYC vor 50 Jahren durchlief, also die Erkenntnis, dass sich der Kunde vor der Institution geändert hat und die Regeln sich mit ihm ändern müssen. Know Your Agent ist kein Feature von Know Your Customer. Es ist die nächste Disziplin, die Compliance von Grund auf neu aufbauen muss.