Clear, authoritative definitions of the key terms in identity verification, fraud prevention, AML compliance and AI agent governance.
Know Your Agent (KYA)
Know Your Agent (KYA) is the discipline of identifying, governing and continuously monitoring autonomous AI agents the way Know Your Customer (KYC) governs people. A KYA framework registers each agent, issues it a cryptographic Digital Agent Certificate, screens its inbound instructions for prompt injection, enforces the data scopes it declared at registration, and watches for behavioural drift — producing an auditable trail suitable for the EU AI Act era. TrustVerify pioneered the Know Your Agent standard for AI compliance.
KYA solution →Know Your Customer (KYC)
Know Your Customer (KYC) is the regulated process of verifying an individual's identity before granting access to a financial product or service. A modern KYC check extracts and validates an identity document, matches a live selfie to the document photo, confirms the person is physically present (liveness), and screens the individual against sanctions and watchlists — returning an auditable decision in seconds.
KYC solution →Know Your Business (KYB)
Know Your Business (KYB) is the verification of a company's legal existence, registration status, and ownership structure. In the UK this draws on Companies House for incorporation data and Persons with Significant Control (PSC) filings, GLEIF for global entity identifiers, and HMRC for VAT validation — then maps the ultimate beneficial owners and screens the entity and its officers for sanctions and adverse media.
KYB solution →Anti-Money Laundering (AML)
Anti-Money Laundering (AML) refers to the laws, controls and screening procedures that detect and prevent the use of financial services to launder the proceeds of crime. In practice AML combines sanctions screening, Politically Exposed Person (PEP) checks, adverse-media monitoring and ongoing transaction monitoring, with suspicious activity reported to the relevant Financial Intelligence Unit.
AML solution →Trust Score
A Trust Score is a single 0–100 measure of how confident a platform can be that an identity or transaction is genuine. TrustVerify computes it from independent signals — biometric face-match confidence, liveness, document authenticity, sanctions/AML outcome and device/IP risk — so a higher score means lower fraud risk. It lets teams approve, review or reject in one number rather than reading raw signal output.
Liveness Detection
Liveness detection confirms that a biometric capture comes from a real, physically-present person rather than a photo, video replay, mask or deepfake. Passive liveness analyses a single selfie for the micro-signals of a live face; active liveness asks the user to perform an action. It is the primary defence against presentation attacks in remote identity verification.
Deepfake
A deepfake is synthetic media — typically a face or voice — generated by AI to impersonate a real person. In identity verification, fraudsters use deepfakes to defeat selfie and video checks. Defences combine liveness detection, texture and depth analysis, and face-match scoring against a verified document photo to flag synthetic identities.
Ultimate Beneficial Owner (UBO)
An Ultimate Beneficial Owner (UBO) is the natural person who ultimately owns or controls a company, even through layers of intermediate entities. UK regulation generally treats anyone holding more than 25% of shares or voting rights as a beneficial owner. KYB checks map the UBO chain so a business cannot hide a sanctioned or high-risk controller behind corporate structures.
Politically Exposed Person (PEP)
A Politically Exposed Person (PEP) is someone entrusted with a prominent public function — and, by extension, their close relatives and associates. PEP status does not imply wrongdoing, but it carries a higher money-laundering and bribery risk, so regulated firms must identify PEPs and apply Enhanced Due Diligence (EDD).
Sanctions Screening
Sanctions screening checks a person or business against government and international sanctions lists — such as OFAC, the UN, EU and UK HMT consolidated lists — before and during a business relationship. A match (or a strong fuzzy match) blocks onboarding and triggers manual review, ensuring a firm does not transact with sanctioned parties.
Adverse Media Screening
Adverse media screening (negative news screening) searches global news and other open sources for credible reports linking a person or business to financial crime, fraud, corruption or other reputational risk. It surfaces risk that may not yet appear on a formal sanctions or PEP list, supporting a risk-based AML programme.
Biometric Verification
Biometric verification confirms identity by comparing a captured biometric — usually a selfie of the face — against a trusted reference such as the photo in an identity document. A face-match score above a calibrated threshold, combined with liveness, gives high assurance that the document holder is the person present.
Machine-Readable Zone (MRZ)
The Machine-Readable Zone (MRZ) is the band of standardised characters (ICAO 9303) at the bottom of passports and many ID cards. It encodes the holder's name, document number, nationality, date of birth and expiry with check digits, allowing fast, accurate, tamper-evident extraction of document data.
Device Fingerprinting
Device fingerprinting derives a stable identifier for a browser or device from attributes such as user agent, screen, fonts, and hardware signals, without storing personal data. It links sessions to spot account-takeover, multi-accounting and bot behaviour, and feeds a fraud risk score alongside IP and behavioural signals.
IP Intelligence
IP intelligence enriches an IP address with geolocation, network type and reputation — including VPN, proxy and Tor detection and a risk score. Anonymising or high-risk infrastructure raises the fraud risk of a transaction and can route it to manual review.
Presentation Attack Detection (PAD)
Presentation Attack Detection (PAD) is the set of techniques that detect attempts to spoof a biometric system with an artefact — a printed photo, a screen replay, a 3D mask or a deepfake. PAD is what makes liveness detection trustworthy and is standardised under ISO/IEC 30107.
Strong Customer Authentication (SCA)
Strong Customer Authentication (SCA) is a regulatory requirement (under PSD2, and continuing under PSD3) to authenticate electronic payments with at least two independent factors from knowledge, possession and inherence. It reduces payment fraud at the cost of added friction, which risk-based exemptions aim to minimise.
Financial Action Task Force (FATF)
The Financial Action Task Force (FATF) is the global standard-setter for anti-money-laundering and counter-terrorist-financing. Its recommendations shape national AML law, and its grey- and black-lists of high-risk jurisdictions are used to apply enhanced scrutiny to customers and transactions linked to those countries.
Enhanced Due Diligence (EDD)
Enhanced Due Diligence (EDD) is the deeper level of checks applied to higher-risk customers — such as PEPs, high-value clients or those in high-risk jurisdictions. EDD may add source-of-funds and source-of-wealth verification, senior-management sign-off, and more frequent ongoing monitoring than standard due diligence.
Chargeback
A chargeback is a forced reversal of a card payment initiated by the cardholder's bank, often due to fraud or a dispute. Excessive chargebacks carry fees and can jeopardise a merchant's payment processing. Identity verification and device/behavioural risk scoring reduce fraudulent chargebacks before the transaction completes.
KYC-Gated Escrow
KYC-gated escrow holds a buyer's funds with a neutral third party and releases them to the seller only after both parties have passed identity verification and the agreed conditions are met. Requiring KYC before any deposit blocks anonymous fraudsters from the transaction entirely.
Suspicious Activity Report (SAR / STR)
A Suspicious Activity Report (SAR), known internationally as a Suspicious Transaction Report (STR), is a confidential filing a regulated firm submits to its Financial Intelligence Unit (in the UK, the National Crime Agency) when it knows or suspects money laundering or terrorist financing. Filing a SAR is a legal obligation and must not be disclosed to the subject (no tipping off).
SIM Swap Fraud
SIM swap fraud is an attack in which a criminal convinces a mobile operator to move a victim's phone number to a SIM they control, intercepting SMS one-time passcodes and taking over accounts. Detection queries the telco network for the date of the last SIM change; a recent swap is a strong account-takeover signal.
Prompt Injection
Prompt injection is an attack that hides malicious instructions inside the input given to an AI agent or large language model, attempting to override its guardrails and make it leak data or take unauthorised actions. In a Know Your Agent (KYA) framework, every inbound instruction is screened for injection before the agent is allowed to act.
