KYA Know Your Agent with Laurel Papworth for Australian Finance Offices
|

KYA (Know Your Agent) introduction for Australian finance offices

ByLaurel Papworth

AI impacts KYC – meet KYA (Know Your Agent) and what it means for banks and Australian finance offices.

What is Know Your Agent (KYA), and how will it change KYC, AI governance and financial services in Australia? Explore the five dimensions of KYA, including identity, delegated authority, enforcement, accountability and Australian payment sovereignty.

Know Your Agent (KYA): The 5 Dimensions of AI Governance, KYC and Australia’s Payments Future

Know Your Customer (KYC) is already fundamental to Australian banking, financial services, AML/CTF compliance and risk management. But what happens when the customer is represented by an autonomous AI agent, or when AI and automation begin making financial decisions, purchasing goods and initiating payments?

In this video, Laurel Papworth explores Know Your Agent (KYA), an emerging governance framework for AI agents, automated transactions and agentic commerce. Drawing on her involvement in Australian finance, payments and emerging technology policy discussions, she explains why financial institutions, CFOs, compliance officers, risk managers and AI governance teams should be preparing now for developments through 2027–2028.

The five dimensions of KYA:

  1. Identity: Who owns and operates the AI agent, whom does it represent, and is it acting for a verified customer?
  2. Authority: What is the agent authorised to do? What are its delegated permissions, spending limits and transaction restrictions?
  3. Enforcement & Monitoring: Are permissions technically enforced? Can unauthorised transactions be blocked, unusual behaviour detected and access revoked?
  4. Accountability: Who is legally and operationally responsible when an AI agent exceeds its authority, makes an unsuitable purchase or causes financial loss?
  5. Infrastructure & Sovereignty: Who controls the payment rails, currencies, digital tokens and financial networks used by AI agents? Can Australian businesses retain access to AUD payments, domestic financial infrastructure and interoperable alternatives?

The fifth dimension raises significant questions for Australian payment sovereignty, international technology platforms, agent-to-agent transactions, digital currencies, stablecoins and competition in financial services. As AI agents become increasingly autonomous, organisations need more than identity verification. They need enforceable delegated authority, transaction monitoring, human accountability and an understanding of the financial infrastructure their agents depend upon.

KYA is moving from emerging industry discussion towards practical governance expectations. Now is the time to consider AI and Agent Registers, automation inventories, delegated mandates, risk controls, audit trails and payment interoperability—before major investments in agentic financial systems create dependencies that are difficult to reverse.

Emerging technology doesn’t simply arrive fully formed. Industry, government, regulators and organisations help shape how it develops.

Relevant to: Australian banks, fintechs, financial institutions, CFOs, finance departments, compliance and AML/CTF professionals, risk officers, AI governance specialists, payment service providers and organisations implementing autonomous AI agents.

Topics: Know Your Agent (KYA), Know Your Customer (KYC), AI governance Australia, agentic commerce, AI agents in banking, autonomous payments, AML/CTF, AUSTRAC, delegated authority, AI risk management, AI accountability, Australian payment rails, digital sovereignty, AUD stablecoins, financial services regulation.

Laurel Papworth on Know Your Agent regulations coming in 2027/28.

Transcript of Know Your Agent (KYA) 5 Things Australian Bans & Finance Teams Need to Knonw

Hello, my name is Laurel Papworth, and today I want to talk about Know Your Agent, KYA, which is very similar to KYC. I’m going to assume the people that are interested in KYC already know what it is, and so I would just want to reflect what happens when we shift from Know Your Human to Know Your AI. [00:00:23.19]

There are 4 fundamental features or I guess, dimensions to Know Your Agent. There is a 5th that’s on the table, but America is pushing back on us having this 5th one. So let me go through what the 4 are and then the 5th one, which is in jeopardy. I want to be clear that I’m on the working parties, papers and policies and tables and for finance and payment routes and things like that. So I have background in what’s being discussed, but this is emergent tech. So we’re looking at probably not first quarter next year, but certainly within 18 months, the KYA stuff should be fairly fully fledged. And I think it’s a good idea to prepare for it now because there’s stuff coming down the track that means we do not have years to get this sorted. So let me talk you through the 4 fundamental dimensions, and then we’ll look at the 5th one and see whether that’s possible or not. [00:01:26.20]

Right, number 1. KYA establishes IDENTITY. It establishes who the agent is, who operates it— so the business owner or the beneficial owner— and whom it represents— stakeholders. So a bank can own the agent and then the customer can use the agent. So you need to identify those parties. The practical question is, Is this a legitimate AI agent automation, one of those 3 or all of them? And is it acting for a verified customer? Not a fraud, not money laundering, not counterterrorism, anything like that. I’m conflating AI agent and automation because I think we’ll move to automation, whether it’s an AI automation or whether it’s a script automation, Doesn’t matter. The impact on individuals, companies, nations is the same. So let’s stick with automation. [00:02:32.25]

So the second one is AUTHORITY, which is where we establish the permissions. The same in KYC. Once we’ve identified the customer, the next thing is, are they permitted to do the things that they want to do, or does it fall under— money laundering or counterterrorism or, or dealing with sanctioned countries. So we need to make sure the agent’s compliant in those areas as well. The practical question would be along the lines of a constraint. Can this AI agent automation purchase $5,000 worth of equipment without needing additional approval, right? [00:03:18.17]

The third one is a follow-up on that one, which is called ENFORCEMENT (& monitoring). And it says— KYA says we need to establish where the permissions are technically enforced, monitored, and can be revoked. So the practical question is, can the AI agent be actually prevented from spending $5,001 or $6,000 or $60,000 or $600,000. So we set a hard limit of $5,000. What if it goes over that? And we’ve seen examples of where agents see priority weighting as a nice to have as opposed to a hard line. So those things will be you know, constraints are fairly important under the enforcement guidelines. [00:04:17.12]

The 4th one is ACCOUNTABILITY. And this is the human in the loop. This is the human who’s on the hook for what the agent does. So this is the one you want to pay attention to. So we want to establish whether actions can be traced, investigated, And the responsibility assigned when something goes wrong. The practical question is, who is responsible if the agent purchases the wrong equipment or spends $600,000 on tokens or $600,000 on the equipment when it was told to only spend $5,000? I actually saw an agent the other day that spent a lot of money trying to resolve a $5 problem. It just— the common sense thing’s not there. [00:05:10.16]

Anyway, so those 4 things will be built into KYA: identity, authority, enforcement, and human accountability. I’ve got another video on the accountability part coming out. [00:05:27.26]

The 5th one is the one that has pushback at the moment. And I don’t wanna go into it too much, but some of the discussions that are coming up are concerning because it’s how the agent, typically AI sits in domain knowledge, kind of like in verticals. And then so you’ve got a finance vertical and a health vertical and things like that. The harnesses. Agents sit inside matrix. So an agent talks to an agent, talks to an agent. So it’s a matrix structure. You might have a writing agent, writing reading comprehension agent talking to finance agent talking to, I don’t know, a research agent, for example. [00:06:15.16]

So INFRASTRUCTURE & SOVEREIGNTY. This is the part of the KYA which establishes which payment networks currencies, digital tokens, things like that. Providers, for example, the Chinese eWaybill system, and financial systems that the AI agent can use, is permitted to use. Who controls those choices? Because it’s not going to make the decision on its own which one it’s going to use. It’s going to be given the parameters to do that. And whether domestic alternatives remain viable and interoperable. There’s nothing more annoying than being an Australian company buying from an Australian company and having to jump through those currency converter hoops because the payment rails that you’re using are not, you know, direct, basically. Right. And this is why I’ll talk about in a moment what the issues are. The practical question is, can the AI agent choose Australian payment routes and AUD, or does its AI platform, Claude for finance, GPT for health, Google for education, automatically direct transactions through its preferred overseas providers. And this is something the American companies will push for and gate and use regulatory control to keep under their remit, that you must go through their payment rails. [00:08:03.23]

Whereas we are trying to set up a sovereign infrastructure. So how the agent plugs into the financial infrastructure Could be roadblocked, and this is why I want you to prepare now. Because there would be nothing worse than investing in agent finance agents. You get some big system in and set it all up, only to find out later on that you’ve been rejected from doing some of the things you want to do. You can’t plug it into your bank, and you can’t plug it into the tax, and you can’t plug it into any of the other systems because it’s being rejected because. The option for sovereignty isn’t there. It’s forcing vendors and suppliers and customers to go through a payment route that maybe we don’t want them to. [00:08:56.19]

Now, that’s kind of all I want to say on KYA for the moment, except, and this is really important, emergent tech doesn’t just emerge. It is guided. Into the world. So we have a say on how that is shaped, and typically we do it through regulations and then relationships with overseas tech companies and with historical precedents. And then we change things for the future. But there is stuff coming down the line by 2029, 2030 That means this must be in place, and if it’s not, we are facing, um, some reasonably big issues. Okay, this isn’t for me, this is from the reserve banks from around the world. So I want to put that in front of you. KYA is not something you worry about next year. This is something you need to start thinking about this year. Okay, it’s October, you can you can leave it a couple weeks 🙂 so yeah, I hope you found this helpful. [00:10:09.01]

Will the information in this video change? Yeah, probably. Just try and stay ahead of the game a little bit. I know that’s what I’m trying to do. All right then. My name’s Laurel Papworth, and I’ll see you in the next video. Thanks.

Note: while many countries are working on KYA, and there are tools becoming available it’s not here yet. But lets be prepared!

Resources for KYA Know Your Agent:

Australian regulation, KYC and payment sovereignty – These are the strongest starting points for course attendees who want to understand why KYA is becoming a serious financial-services governance issue.

The RBA’s Merchant Choice in Payments discussion is particularly valuable. It explicitly examines agentic commerce, payment-network preferences, merchant costs, liability, cybersecurity and the possibility that early technical decisions could become difficult to reverse. Students can also read the competing stakeholder positions rather than assuming there is agreement about the regulatory response. I recommend looking at overseas stances (below) on this as well. I read something from G7 World Leaders Forum in Finance but can’t find it now. If I do I’ll add it.

Know Your Agent: Industry implementations These show what companies are actually building around agent identity, authorisation, payments and trust.

Experian is particularly relevant because it explicitly uses the term Know Your Agent and describes human-to-agent identity binding, trust tokens and an agent registry, though it doesn’t go as far as digital economy infrastructure discusssions. Cloudflare offers a complementary example involving agent identities, virtual wallets, merchant restrictions and spending limits. These are industry initiatives, so students should consider both their practical benefits and the commercial interests of their developers. Keep an eye on banks and their requirements before your agents can interact with their assets. I am not including AI registry here as that is another topic for another day.

International AI agent governance and standards: These resources move beyond financial transactions into identity, delegated authority, human accountability and technical governance.

Singapore’s framework is especially useful for our discussion of identity, authority, enforcement and accountability. It covers bounding an agent’s powers, meaningful human oversight, technical controls and end-user responsibilities. The May update also includes practical case studies: we love a good case study!