Know Your Agent: banks and fraud vendors move to identify AI agents

Discussed by: ID Tech, citing account terms from JPMorgan Chase and Wells Fargo and statements from their chief executives

No shared way exists to verify an agent is acting within limits a customer set, and the cheapest response is to refuse the connection. JPMorgan says it wants secure agentic connections but has set no timeline, and Bank of America is restricting agents from consumer deposits while working on protocols. If the terms published in November and January keep password-based agent access out, the block becomes the default rather than a stopgap.

Discussed by: LexisNexis Risk Solutions, which says customers already use KYA in live risk decisions

Banks that cannot verify agents can still screen them. LexisNexis pitches KYA as an add-on to fraud workflows banks already run, so the decision to buy is smaller than the decision to allow. If enough banks take that path, agent detection becomes a routine feature of identity platforms rather than a separate product category.

Discussed by: Analysts quoted by ID Tech, who note agreement on what to verify but not how

The banks, the OCC framework and both KYA vendors ask the same questions: who the agent represents, what it is authorized to do, and whether that authority still holds. A technical standard that answers them would let a bank check authorization rather than infer it from a password. Without one, each bank writes its own terms and its own blocks.