KYA vs KYC vs KYB: How AI Agent Governance Differs

As organisations layer AI agents on top of regulated workflows, a third acronym is joining KYC and KYB: KYA, or Know Your Agent. The three share a goal — knowing who (or what) you are dealing with and proving it — but they verify different subjects across different lifecycles. Understanding the distinction matters because applying a person-shaped control to an agent-shaped risk leaves real gaps.

KYC — Know Your Customer

KYC verifies an individual's identity before and during a financial relationship. A modern KYC check extracts an identity document, matches a live selfie to the document photo, confirms the person is physically present (liveness), and screens the person against sanctions and watchlists. The output is an auditable decision and a risk rating. KYC is largely a point-in-time event with periodic re-verification.

KYB — Know Your Business

KYB verifies a company's legal existence, registration status and ownership. In the UK it draws on Companies House (incorporation and Persons with Significant Control), GLEIF for global entity identifiers and HMRC for VAT validation, then maps Ultimate Beneficial Owners (UBOs) and screens the entity and its officers against sanctions and adverse media. KYB is more graph-shaped than KYC — the risk often hides in the ownership chain, not the company itself.

KYA — Know Your Agent

KYA governs autonomous AI agents. It registers each agent with an archetype, scope and human owner; issues it a short-lived Digital Agent Certificate; screens every inbound instruction for prompt injection; enforces the data scopes the agent declared; and monitors behavioural drift in real time. Unlike KYC and KYB, the subject is non-human and its risk is behavioural — an agent that was safe yesterday can be compromised or mis-prompted today — so KYA is continuous by design.

Side-by-side: what each framework verifies

• Subject — KYC: a person. KYB: a company and its beneficial owners. KYA: an autonomous software agent.
• Primary question — KYC: is this person who they claim to be? KYB: is this business legitimate and who controls it? KYA: which agent is this, on whose authority, and what is it permitted to do?
• Core signals — KYC: document, biometrics, liveness, sanctions. KYB: registry data, UBO mapping, VAT, sanctions/adverse media. KYA: cryptographic identity, prompt-injection screening, scope enforcement, behavioural baseline.
• Lifecycle — KYC: point-in-time + periodic. KYB: point-in-time + ongoing monitoring. KYA: continuous, real-time.
• Primary failure mode — KYC: impersonation/synthetic identity. KYB: hidden ownership/shell structures. KYA: compromise, prompt injection, scope creep, drift.

Where they overlap

All three depend on the same backbone: sanctions and watchlist screening, an immutable audit trail, and a risk score that turns raw signals into an approve/review/reject decision. An agent acting on behalf of a verified business inherits context from KYB; an agent serving a verified consumer inherits context from KYC. The cleanest architectures treat KYC, KYB and KYA as one identity-and-governance layer rather than three disconnected products.

Which do you need?

If you onboard consumers, you need KYC. If you onboard or transact with businesses, you need KYB. If autonomous agents take consequential actions in your systems — moving money, accessing regulated data, making decisions — you need KYA, and you need it before the EU AI Act's traceability and oversight requirements bite. TrustVerify delivers all three from a single platform so the audit trail, sanctions screening and risk scoring are consistent across people, businesses and agents.