A transaction-monitoring alert lands on a crypto account, and in the workflow Binance Global Policy sketches in its newest paper, no analyst has to pick it up first. One AI agent pulls the customer profile. Another runs the linked wallets through blockchain analytics, following the money from a fiat on-ramp across several chains to the point where it leaves for another platform. A third checks the counterparties for sanctions exposure, and a case-management agent stitches the findings into a chronology that ends with a recommendation on whether to escalate. By the time a human investigator opens the file, software has done most of the legwork, picking its own tools and deciding the order of its own steps.

The investigator now has a new kind of question to ask. Which agent decided that a particular wallet was clean? Was it allowed to make that call, or only to suggest it? If the recommendation turns out to be wrong, who answers for it? Customer due diligence, the bedrock of financial crime compliance, was built to identify people, and it has nowhere to record any of this.

On October 1, 2026, Binance Global Policy published Know Your Agent: Building the Compliance Layer for Agentic Finance, written by Steven McWhirter, Global Head of Policy, and Diego Montes Serralde, Global Policy Manager, with expert contribution from Tanveer Kalooji, Regional Head of Compliance MEASAT at Binance. It builds on the team's September 10, 2026 paper, The Financial Architecture of the Agentic Era, which mapped how AI agents, tokenized assets and stablecoins are coming together into a financial system where software can take economic action.

The new paper makes a simple argument. Know Your Customer obligations remain necessary, but once software can act on its own, they are no longer sufficient.

Its answer is Know Your Agent, or KYA, a five-layer accountability framework designed to sit alongside KYC. When software starts to actCompliance has always grown up alongside the system it protects. As payments sped up and markets went digital and global, compliance teams took on automated screening, transaction monitoring, blockchain analytics and machine learning. Binance sees agentic AI as the next step in that progression, and the difference it draws comes down to initiative.

A rules engine does what it was told, and a generative AI application answers when prompted. An agent is handed an objective and works out the route itself, pulling information from several systems, choosing which tools to use, comparing courses of action and changing its approach when circumstances shift. That capability rarely lives in a single model. An agentic system usually wires one or more models to tools, memory, orchestration, outside data and a set of permissions.

These systems sit along a spectrum, from assistants that draft recommendations for a person to approve through to agents that carry out tasks or initiate actions on their own authority. The World Economic Forum has called for governance that weighs an agent’s role, autonomy, authority, predictability and operating context, and the United Kingdom’s Digital Regulation Cooperation Forum describes the moment as a move from AI as a tool to AI as an actor. Binance draws the practical conclusion that a system’s safeguards ought to match what it can actually do, whatever it happens to be called.

The upside for compliance teamsThe paper is openly enthusiastic about what agents can do for compliance, and crypto investigations show why. Once an alert is raised, an investigative agent could map funds as they move from fiat into digital assets, trace wallet activity across chains and counterparties, identify where the money leaves, retrieve supporting records, and draft the case narrative.

A second agent could then read that narrative with a sceptic’s eye, test the conclusion against the evidence, and mark anything contradictory or unsupported. The Financial Action Task Force’s 2026 work makes a similar point. It notes that artificial intelligence, machine learning and big-data analytics could strengthen blockchain analytics, while stressing that those tools work best alongside conventional investigative techniques and experienced human decision-making.

The same pattern runs through the rest of the compliance function. At onboarding, an agent could work through corporate registries and beneficial ownership information to spot gaps and inconsistencies. In sanctions screening, it could look past simple name matches to ownership, control and indirect exposure, then rank the resulting cases by confidence and urgency. It could judge whether an adverse-media hit genuinely refers to the customer, and map new legislation, guidance, and enforcement decisions against a firm’s own controls.

What joins these together is the agent’s ability to connect information that usually sits in separate systems, so that human experts spend their time on the cases that need judgment. If every data source, tool call, intermediate finding and approval is kept as part of one evidentiary record, the investigation also becomes easier to audit. Decisions with real consequences, such as filing a suspicious activity report or ending a customer relationship, stay with accountable people.

Binance is candid that these gains come with conditions. Agents can hallucinate or lean on weak sources, and investigators can defer too readily to a recommendation that looks sophisticated. Models developed on past decisions can inherit earlier biases, and agents connected to outside tools can be exposed to prompt injection or data leakage.

The paper’s answer is controlled delegation: agents analyse, prioritise, and recommend, while consequential outcomes pass through deterministic safeguards, documented approvals, and human or organisational accountability. The question KYC was never askedKYC tells an institution who the customer is, and that question stays essential. An institution can know exactly who stands behind an account, though, and still be unable to say where a particular instruction came from.

It might have come from that customer, from an agent the customer authorised, from a compromised agent, or from a sub-agent that has drifted beyond its mandate. Two agents connected to the same system can also carry very different risk levels. One may be cleared only to read data, while another can change a customer’s risk classification, close an alert or initiate a transfer.

Filling that gap means knowing which agent acted, who developed and deployed it, and on whose behalf it was working. It also means knowing the edges of its mandate. That includes the data and systems it could reach, whether it could execute or only recommend, whether it could pass work to other agents, what financial, temporal or geographic limits applied, and how its permissions could be suspended. The risk Binance singles out is unattributable action, an outcome that cannot be traced to an identifiable actor working under a known authority.

Conventional access controls only go part of the way here, since they mostly decide whether an account may enter a system and perform a defined function. KYA also has to capture the agent’s relationship to its principal, the purpose of its mandate, its right to delegate and the party accountable for what follows. The paper cites the OpenID Foundation’s observation that agents often behave in ways indistinguishable from human users.

It also notes that existing authorisation models may have difficulty with asynchronous activity, recursive delegation and agents acting for several users at once. Steven McWhirter, Global Policy Lead at Binance, put the case plainly: “We’ve built much of financial crime compliance around knowing the customer. But in an agentic world, that is no longer enough. When software can investigate, decide and move money, we need to be able to say with confidence which agent acted, on whose authority, and who remains accountable. Know Your Agent isn’t about giving software legal personality; it’s about preserving accountability as autonomy scales. Autonomy should never outrun our ability to verify, bound and, where necessary, revoke it.”

The five layers of Know Your AgentBinance defines KYA as the process of identifying, authenticating, authorising and continuously governing an AI agent that acts within, or interacts with, a financial service. The aim is operational accountability, and legal responsibility stays with the people and companies behind the software, in line with the technology-neutral approach in FATF’s 2026 work on decentralised finance.

The framework starts by naming the parties in any agent-mediated activity. The agent is the software instance doing the task, and the principal is the person or entity it acts for. The provider or deployer builds, configures or offers it. The relying institution, whether a bank, a virtual asset service provider or a payment firm, is the one letting it in. Sometimes one organisation plays several of these roles, as when a bank deploys its own internal AML agent. Sometimes they are spread out, as when a customer authorises an agent from a third-party technology company to deal with several financial institutions on their behalf. Either way, the agent stays tied to whoever is ultimately accountable.

Go back to the investigator’s file, and the five layers start to read like the questions that file has to answer.

The first layer, agent identity and provenance, gives every material agent its own identity, linked to its provider, deployer, responsible legal entity, model version and credentials. The investigator can then see that a specific, authorised wallet-tracing agent did the work, whereas a system today might show only that a valid account was used.

The second layer links the agent to an accountable principal, the individual or organisation it serves. Technology providers and regulated firms can divide responsibilities between them by contract, but bringing in an agent does nothing to dilute the regulated institution’s own AML/CFT obligations.

The third layer, mandate and permissions, sets out exactly which actions, data and tools an agent may use and for what purpose, on the principle of least privilege. Where personal information is involved, purpose limitation and data minimisation are built in. This layer also separates the ability to analyse or recommend from the authority to execute. The agent tracing wallets in this example could be cleared to recommend escalation without ever holding the power to close the alert itself.

The fourth layer, delegation and monitoring, follows the work as it gets passed along. Midway through the case, the case-management agent might hand the sanctions check on a single counterparty to a sub-agent. That sub-agent carries credentials the institution can trace back up the chain, and its brief is narrow: run the name against the lists and report what it finds, within the limits its parent agent was given in the first place. Suppose it tried to open the customer’s payment history, which was never part of that brief. The attempt would surface in the institution’s monitoring, as would any sign that the agent had been tampered with.

For agents cleared to initiate payments, that monitoring extends to every transaction they generate. The fifth layer, revocation and auditability, lets an institution suspend an agent, narrow its permissions or add a human approval step at any point. Every material action stays traceable to the agent, its principal, the authority in force, the tools and data it used, any human intervention and the outcome. These layers come together at the moment an agent tries to do something that matters.

Binance calls for point-of-action verification, a check just before execution. It confirms that the agent’s credentials are still valid, that the action falls inside its current mandate, and that no approval, risk or revocation condition stands in the way. Behind that check sits a minimum KYA record covering the agent’s identity, its principal and the party that deployed it. The record also holds the scope and duration of its authority, any right to delegate, its current status and where it is allowed to operate.

It travels with the agent through the interaction and remains available for review afterwards. It supports attribution without suggesting the agent takes on the regulatory status of the person it serves. Bounded autonomy in practiceBack in the AML workflow, this is how the pieces fit. Each specialised agent has its identity, mandate and permissions verified before it opens the case. Their findings are pulled together and independently challenged before anyone accepts a recommendation.

Consequential outcomes then pass through fixed, rules-based controls the agent cannot override, along with human approval. The process keeps a record of the evidence considered, the agents and models involved, the material tool calls, any human involvement and the final decision. The division of labour is clear: agents analyse and recommend, controls enforce what is mandatory, and accountable people decide when the stakes are significant.

Binance calls this bounded autonomy. Regulators are arriving at a similar place. In July 2026, the Monetary Authority of Singapore announced its Safeguards for Agentic Finance at Runtime framework, or SAFR, developed with industry participants under its BuildFin.ai initiative. SAFR centres on real-time safeguards for AI agents in financial services, including policy-bound execution, validation before action, auditability and interoperability. Its attention on checking and recording an agent’s proposed actions before they run lines up closely with the KYA approach.

When agents can payThe stakes rise again once agents can move money. The International Monetary Fund describes a possible shift from “click-to-pay” to “decide-to-pay.”In that world, software compares options, decides the conditions for a purchase have been met, and initiates payment under delegated authority. In June 2026, Sarah Breeden of the Bank of England described agentic AI moving payments and commerce away from a recommendation mode, in which people still complete the transaction.

The direction is toward systems in which agents automate the final step. She raised practical questions about how users securely give agents their consent and how disputes and liability should work when a transaction is erroneous or fraudulent. She also asked how authorities can avoid fragmentation as AI firms, merchants and payment systems each build their own agent-interaction protocols. The United Kingdom’s Financial Services AI Adoption Plan is the most explicit. It names agentic payments as a near-term use case for autonomous financial systems.

It recommends a trust framework built on legal and liability standards, Know Your Agent protocols and interoperable machine-to-machine authentication. For Binance, that places KYA well beyond any single firm’s compliance manual, as part of the shared trust infrastructure agentic finance will need. The paper is explicit about the engineering tension underneath.

AI systems are probabilistic and adaptive, while payment rails depend on predictability, legal certainty and deterministic execution. Binance’s proposed model separates the two across three layers. In the first, the agent does what it does best: interpreting the user’s objective, weighing alternatives, and assembling a proposed transaction. That proposal then meets a deterministic regulation layer that checks the agent’s identity, mandate, spending limits, counterparty restrictions and approval requirements, and anything that fails is rejected or escalated.

Only an authorised transaction reaches the third layer, settlement on the relevant payment or blockchain infrastructure, where it becomes final. An agent can decide a payment makes commercial sense, while the rules on whether it's authorised stay out of its hands. Crypto lends itself to building this directly into the plumbing. A programmable wallet could restrict an agent to certain assets, approved addresses, transaction sizes or time windows.

It could also call for human approval the moment a risk indicator or threshold is triggered. Before processing an agent-initiated transaction, a VASP or payment provider should be able to confirm the agent’s identity and status, the principal behind it and whether the transaction fits its delegated authority. Every existing obligation keeps applying whether the instruction comes from a person or an authorised agent. That covers sanctions screening, the Travel Rule, wallet-risk assessment and enhanced controls for higher-risk cross-chain or DeFi activity.

KYA sits on top of all of it and replaces none of it. The framework is also proportionate by design. An agent that only fetches information needs lighter controls than one that recommends transactions. An agent that can actually move value needs the strongest identity, monitoring and approval requirements of all.

Agents get room to work within clearly authorised limits, and the safeguards tighten as their ability to affect customers, compliance outcomes or the movement of money grows. Three lenses for the next AML architectureBinance closes by describing future anti-money laundering through three complementary lenses. Know Your Customer establishes who an individual or legal entity is and what risk they carry. Know Your Transaction looks at how value moves, why the activity is happening and whether it fits expected behaviour.

Know Your Agent identifies the software actor involved, the authority it operates under, the limits of its permissions and the person or entity that remains accountable for it. Much of what comes next depends on how portable that third lens becomes. Binance envisions elements of the KYA record expressed in machine-readable and, where appropriate, cryptographically verifiable form. That would let an agent’s identity, principal, mandate, limits and status be checked the same way at every institution and payment network it touches.

As regulators and industry work toward shared standards for agent identity, verification and machine-to-machine authentication, an agent could one day carry its credentials from one institution to the next, its authority confirmed at every step. As agents gain more power to influence decisions and move value, Binance argues that governance ought to follow that authority wherever it goes, and the full paper sets out how the industry might build it.