New five-layer framework aims to complement – not replace – existing KYC and AML obligations as AI agents gain the power to move money
October , 2026: Binance Global Policy has published a new insights paper, “Know Your Agent: Building the Compliance Layer for Agentic Finance,” authored by Steven McWhirter, Global Head of Policy, and Diego Montes Serralde,
Crypto Policy Manager,
with expert contribution from Tanveer Kalooji. The paper proposes a five-layer accountability framework designed to address a fundamental gap in financial crime compliance as agentic AI shifts the industry from software that assists to software that acts.
Quote attributable to Steven McWhirter, Global Head of Policy, Binance
“We’ve built much of financial crime compliance around knowing the customer. But in an agentic world, that is no longer enough. When software can investigate, decide and move money, we need to be able to say with confidence which agent acted, on whose authority, and who remains accountable. Know Your Agent isn’t about giving software legal personality; it’s about preserving accountability as autonomy scales. Autonomy should never outrun our ability to verify, bound and, where necessary, revoke it.”
As AI agents increasingly investigate alerts, trace funds across chains, screen sanctions exposure and, in growing instances, initiate payments, they promise significant efficiency gains – but they also introduce a new compliance risk that existing frameworks were never built to address. KYC answers “who is the customer.” It does not answer whether an instruction came from the customer, an authorised agent, a compromised agent, or a sub-agent operating beyond its mandate. The paper identifies unattributable action – not AI itself – as the core risk in agentic finance.
“Know Your Agent” (KYA): A Five-Layer Framework
The paper proposes that KYA sit alongside KYC and existing AML/CFT, Travel Rule and sanctions obligations. The framework comprises five layers:
- Agent identity & provenance – a distinct identity linked to provider, deployer, version and credentials.
- Link to an accountable principal – tied to the person or entity on whose behalf the agent acts.
- Mandate & permissions – least-privilege access that separates the ability to recommend from the authority to execute.
- Delegation & monitoring – authenticated delegation chains with continuous behavioural and transactional monitoring.
- Revocation & auditability – the ability to suspend an agent and trace every material action back to its principal and authority.
Bounded Autonomy: The Guiding Principle
At the heart of the proposal is the principle of “bounded autonomy”: agents may analyse, prioritise and recommend, but consequential actions should remain subject to deterministic, rules-based controls the agent cannot override, plus proportionate human or institutional oversight. Greater autonomy and potential consequence demand stronger identity, monitoring and approval requirements.
Regulators are already moving in this direction. MAS’s SAFR framework (July 2026) focuses on runtime safeguards and auditability, while the UK’s Financial Services AI Adoption Plan explicitly recommends a “Know Your Agent” protocol and interoperable machine-to-machine authentication for agentic payments. The IMF has framed this moment as a shift from “click-to-pay” to “decide-to-pay”.
The paper argues the future AML architecture rests on three complementary lenses: Know Your Customer (who), Know Your Transaction (what and why), and Know Your Agent (which software actor, under what authority, with whom accountable). As agents gain the power to move value, governance must follow that authority.
About the Paper:
“Know Your Agent: Building the Compliance Layer for Agentic Finance” is available in full here.
Steven McWhirter, Global Head of Policy at Binance, is available for interview on the AML/agentic-AI policy angle, the crypto payments use case, and what “bounded autonomy” should look like in practice.
