Know Your Customer (KYC) checks are often viewed as a barrier to traditional finance's onboarding into on-chain ecosystems and the broader development of DeFi.

For those unfamiliar, these verifications are a necessary component of financial institutions fulfilling their anti-money laundering (AML) and counter-terrorist financing (CFT) obligations under the Bank Secrecy Act (BSA). This process requires coordination among card issuers, verification providers, and regulators, each operating under distinct incentive structures, timelines, and legal requirements.

For banks, brokerages, and other BSA-regulated entities, the challenge in bringing tokenized products onto the blockchain lies in balancing compliance demands with customer acquisition and liquidity access—compliance measures that can introduce additional time and complexity. For example, new customers are frequently required to undergo repeated identity verification even if they’ve already completed similar checks elsewhere. Fortunately, new KYC tools built specifically for blockchain promise reusable verification outcomes, moving beyond outdated legacy models from traditional finance.

The starting point is clarifying who institutions must identify. In traditional finance, institutions conduct transactions through an established network of pre-verified intermediaries, each independently fulfilling its own KYC obligations. The same logic applies on-chain: a bank’s customer identification duty extends only to its own clients, not every participant in the underlying settlement infrastructure.

The core principle of customer identification is who holds an account at that bank. Under this interpretation, users do not automatically become a bank’s client merely by trading with a bank’s client or exchanging with a liquidity pool provided by the bank. As long as a bank implements a suitable compliance framework covering its own clients and related transactions, it can meet its BSA obligations.

The U.S. Department of the Treasury is currently exploring how financial institutions can leverage new technologies and methodologies to satisfy AML/CFT requirements, including Customer Identification Programs (CIP) and KYC. With the implementation of the GENIUS Act, regulators must research and promote innovative solutions and standards to achieve modern AML/CFT objectives more efficiently.

This article first analyzes the legal conditions and practical prerequisites for implementable reusable KYC, then examines the roles of zero-knowledge proofs, verifiable credentials, non-transferable tokens, and on-chain analytics tools. Finally, we look ahead to "Know Your Agent": identifying AI agents, the entities they represent, and the operational permissions granted to them.

Applying KYC to the On-Chain World

Traditional KYC processes are conducted independently by each financial institution. Each platform verifies identities during user registration via CIP, maintains records independently, and conducts ongoing customer due diligence. Identity information is held by the institution, making it a trusted intermediary. When users open accounts on new platforms, they must repeat the entire verification process—even when assets are transferred between individuals and enterprises who have already undergone identity verification.

Blockchain transactions add another layer of complexity. Assets move across chains, protocols, and wallets without intermediaries performing KYC. One wallet address may originate from a BSA-regulated exchange, a DeFi protocol, or a consumer-facing application. These services operate under different risk frameworks and liability allocations, with regulatory differences across jurisdictions. Some intermediaries lack KYC obligations altogether, and even when mandatory, no unified regulatory framework currently allows A institution’s verification results to be directly migrated to B institution. Institutions thus repeatedly verify the same users, increasing costs and delays.

Former SEC Commissioner Peirce recently stated, “The approach to combating illicit financial activity has remained unchanged: collect as much data as possible. This method has proven ineffective; technological advancements have far outpaced this outdated system, and the time for change has arrived.”

Financial institutions, blockchain developers, and regulators are co-creating new solutions to meet KYC and AML/CFT goals. One direction involves allowing institutions to reuse identity verifications already completed by other parties. To make this mechanism viable, clear rules must define which entities’ verification results are acceptable and who bears compliance responsibility.

Reusability and Trust Ecosystems

Users wish to complete KYC just once and use the result anywhere—a model also known as reusable KYC, trust-based KYC, or custodial KYC.

In off-chain scenarios, users still repeat verification. Opening accounts at two banks means undergoing KYC twice, though most individuals don’t frequently open new bank accounts. However, in crypto, users constantly join new products, yet there is no trusted intermediary enabling KYC results to remain valid throughout the entire transaction lifecycle.

Institutions aren’t seeking to eliminate KYC but rather avoid redundant verifications. Every time a user joins a new exchange or application, the KYC process restarts from scratch. This imposes high costs on platforms and creates friction for users. With the rise of deepfake tools, the reliability of traditional verification methods continues to decline. Banks and other BSA-regulated institutions are hindered by a costly, privacy-invasive, and ineffective identity verification system that fails to effectively deter illicit financial activity.

Repeated verifications force users to submit sensitive personal information to multiple institutions. Even when submitting digital documents like ID cards, users face heightened risks to personal safety, increased exposure to targeted scams, tracking, identity theft, and other unauthorized uses of their data. Mobile identity credentials typically disclose full name, address, date of birth, and photos in one go.

Such centralized repositories of personal identity data constitute “honeypots” highly attractive to financial criminals. Once compromised, improperly stored, or retained beyond retention periods, the consequences are severe. Coin Center notes that the current system forces individuals to “repeatedly submit sensitive personal information to centralized databases, bearing substantial personal risk.” To mitigate these unnecessary security threats, privacy advocates urge regulators to consider alternative digital identity verification methods beyond government-issued ID records.

A relevant precedent in traditional finance is SWIFT’s KYC Registry. Global banks have long used the SWIFT messaging network to transmit cross-border payment instructions. In 2014, SWIFT launched its KYC Registry, extending this infrastructure into compliance: banks need only upload their documentation once to share it with any interested counterpart. The registry now covers nearly 8,000 institutions across over 200 countries. Its success hinges on business occurring between institutions where counterpart identities are known.

The crypto industry currently lacks a comparable centralized registry. If Coinbase has completed KYC on a user according to banking-grade standards, can other platforms directly accept this verification? If a Robinhood-completed KYC user wishes to access an on-chain lending protocol, can Robinhood’s prior compliance work travel with the user?

This is what is known as “whitelist liquidity.” Onboarding pre-verified users into capital pools essentially distributes compliance capability—but it is not legally mandated. Whether clients trade in whitelist pools or permissionless pools, an institution’s compliance obligations remain unchanged. For tokenized securities, access controls and transaction eligibility criteria may trigger regulatory obligations under the SEC’s latest innovation safe harbor provisions. While asset issuers have proactively connected with major global exchanges to leverage their compliance frameworks, the corresponding commercial architecture remains under development.

Outsourcing and Compliance Acceptance

New solutions tailored for the crypto industry can reduce unnecessary data collection and offer auditable, verifiable alternatives, moving away from the old “check-the-box” KYC model. Indeed, increasingly more trust-based KYC implementations are emerging in crypto.

Compliance acceptance can be understood as a “trust ecosystem”: large-scale KYC service providers (or provider consortia) build trust networks akin to single sign-on. Examples include Sumsub ID, World ID, MoonPay, and Stripe via Privy. Initial verification typically costs $1–2 per initiating platform; subsequent platforms only perform partial KYC (e.g., live detection), reducing per-user verification costs.

A recent example is Fireblocks’ Open Transaction Layer (OTL), an open protocol stack standardizing identity, compliance, and messaging for on-chain finance participants. Notably, KYC is performed by regulated entities within the network—not by OTL itself. OTL establishes shared protocols; once a network entity verifies a user, others can recognize the verification status without repeating the process.

Analogous solution is Privado ID (formerly Polygon ID, spun off from Polygon Labs in 2024, recently merged with Disco.xyz), which enables reusable electronic KYC. Verifiable credentials are issued by trusted sources such as government agencies, banks, or KYC providers. Users apply for, collect, and store these credentials in a digital identity wallet. Verification parties can query the user’s wallet for relevant credentials, both on-chain and off-chain.

SpruceID is another solution based on identity standards. Trusted sources like DMVs or state licensing authorities issue verifiable digital credentials, stored on users’ phones. These tools simplify reuse of verification results, but institutions must still understand their legal liability when accepting third-party verifications.

Institutions can outsource KYC, but legal classification depends on the service provider and collaboration model. According to the FFIEC’s Bank Secrecy Act / Anti-Money Laundering Handbook, acceptance is a specific legal provision applicable only when accepting verification results from another regulated financial institution. If the partner is an identity verification vendor or credit reporting agency lacking qualifying status, it counts as outsourcing. In such cases, the institution remains fully responsible for its CIP obligations independently.

Similarly, the Financial Action Task Force (FATF), which sets global AML/CFT standards, stipulates that countries may allow financial institutions to delegate part of customer due diligence to third parties—but only if all three conditions are met:

This rule cannot be directly applied to the crypto industry. First, the requirement for “immediate access to original data” implies that regulators or law enforcement must be able to retrieve user identity information at any time—directly conflicting with the privacy-preserving designs of most on-chain KYC solutions.

Moreover, many crypto platforms do not qualify as “regulated institutions” under U.S. federal AML and CIP acceptance rules, even if they are registered money services businesses, state-chartered trust companies, or carry their own AML responsibilities. Therefore, they cannot serve as formal counterparties in acceptance relationships.

This is a key obstacle the U.S. Department of the Treasury must resolve when advancing more flexible, natively encrypted customer identification solutions. Decentralized approaches are lower-cost, higher-efficiency, better protect user privacy, and reduce network breach risks—but law enforcement still requires a trusted source capable of confirming real identities and providing written evidence for investigations or courtroom testimony.

Beyond AML requirements, financial institutions must also comply with funds transfer rules—commonly known as the “Travel Rule.” Any financial institution or virtual asset service provider (VASP)—in the U.S., including BSA-regulated entities transferring amounts exceeding thresholds (typically $3,000; lower in other jurisdictions)—must collect and pass along payer and payee identity information to the next entity in the chain. This process runs smoothly in traditional finance because banks already hold KYC data and possess mature messaging channels like SWIFT. But in crypto, on-chain transactions and KYC information exist in isolation.

Several established service providers offer crypto-specific Travel Rule compliance solutions. These include TRUST (Travel Rule Universal Solution Technology), led by the Coinbase-led industry coalition, and similar offerings from Notabene and Sumsub.

In the U.S., Travel Rule message transmission is required only between financial institutions. Financial institutions and VASPs are not required to send such data to non-financial institutions or non-VASP entities (e.g., self-custody wallets).

When interacting with non-intermediary blockchain technologies like DeFi or self-custody wallets, institutions need not overly concern themselves with Travel Rule compliance. Banks or exchanges may still request user information for deposits/withdrawals to self-custody wallets—this falls under the institution’s own risk-based AML/CFT program—but the Travel Rule itself does not mandate this.

However, positions differ outside the U.S. Jurisdictions vary on the triggering threshold amount and whether VASPs must collect data from non-VASP individuals or entities. Regulatory bodies worldwide are still exploring how to apply KYC, AML, and the Travel Rule to on-chain environments.

The good news is that the U.S. does not require new legislation. Existing laws and regulatory frameworks can be adapted through guidance, rule revisions, or innovation exemptions. Congress has already acknowledged the responsibility division logic described above. The GENIUS Act assigns AML and sanctions obligations to licensed stablecoin issuers—the application-layer identifiable subjects—not the permissionless underlying network through which stablecoins circulate. Regulators also recognize the value of new technologies in compliance. FinCEN’s April 2026 proposal lists machine learning, generative AI, digital identity, blockchain monitoring analytics, and API interfaces as innovative solutions to fulfill regulatory obligations.

FinCEN’s proposal supports financial institutions adopting emerging technologies, signaling that institutions “responsible experimentation with innovative technology in their AML/CFT programs will not face significant regulatory scrutiny or enforcement actions simply for using innovative technology.” To facilitate practical implementation, the crypto industry urges FinCEN and banking regulators to issue formal rules or written guidance clarifying when digital identity can satisfy AML program requirements—including CIP/KYC.

Even with clearer guidance, not all KYC judgments can be reduced to binary cryptographic proofs. Zero-knowledge proofs can demonstrate age, nationality, sanctions screening results, or credential possession—but more complex, judgment-intensive AML investigations still rely on traditional due diligence.

Verifiable credentials can assist or even replace parts of the CIP/KYC process, but they won’t fully supplant risk-based customer due diligence. Treasury’s current rules already permit non-documentary verification methods, allowing institutions to combine various verification approaches based on their risk assessment. FinCEN’s September 2026 FAQ explicitly acknowledges that qualified verifiable digital credentials can be used in banks’ CIP, though it does not endorse all decentralized identity or credential designs.

FinCEN and relevant banking regulators can enhance guidance within existing authority. Options include issuing interpretive guidance, adding FAQs, targeted exemptions, pilot programs (with post-pilot approval), standardization for credential issuers, or rule amendments. This approach would enable traditional financial institutions, qualified public or private entities, to issue verification credentials under uniform standards, reducing redundant identity record creation by each bank.

Until then, financial institutions can already adopt tools compliant with existing rules. Below are feasible implementation pathways.

Feasible Solutions

Institutions can leverage a trusted, compliant backend system to enable identity credentials to be reused across various on-chain applications. A trusted service provider verifies user identity and generates a digitally signed credential recording the result. Users present this credential to other applications, which only need to verify the issuer’s credentials and confirm alignment with their own verification standards.

This concept is not novel—traceable at least to Vitalik Buterin’s 2022 proposal on soulbound tokens. Supporting frameworks include W3C-standardized decentralized identity (DID) and verifiable credentials, which are not exclusive to crypto.

In practice, verified compliance KYC providers, banks, or even governments act as trusted issuers, verifying user identity and issuing credentials. Credentials are stored in user wallets, allowing selective disclosure to requesting applications.

Similarly, zero-knowledge succinct proof systems allow users to prove they’ve completed KYC without disclosing personal identity information, preserving privacy. Users can reuse these credentials as long as they meet the recipient institution’s CIP requirements, reducing redundant verification.

Verification mechanisms must also be composable: applications can embed verification logic into their own compliance checks. More specifically, to maximize effectiveness, issuers and platforms can embed this logic into token contracts or application-layer smart contracts. Institutions can enforce their compliance requirements internally, without external components or lowering compliance logic to the base layer blockchain.

Implementation Methods

Other viable tools help financial institutions meet risk-based AML program requirements: Know Your Wallet (KYW), Know Your Asset (KYA), and Know Your Transaction (KYT). Exchanges and money transfer service providers have already integrated these into their holistic AML frameworks.

Know Your Wallet (KYW)

KYW binds identity verification to the blockchain addresses customers use, helping institutions confirm wallet controllers and determine which assets and services clients are eligible to access. KYW includes:

Most crypto KYC follows traditional models. Providers like Onfido, Veriff, Trulioo, Socure, Incode, ID.me, Persona, Sumsub, and Sardine offer identity binding, document verification, live detection, and AML screening. These identity verifications typically occur off-chain, and alone they cannot confirm which wallet address a user controls—linking verification to a wallet address is an additional step.

On-chain applications can use non-transferable tokens to record verification results, employ zero-knowledge proofs to limit personal data disclosure, and use human verification schemes to confirm users are independent humans. Multiple approaches can be combined.

This approach leverages non-transferable, non-sellable tokens commonly referred to as soulbound tokens, permanently bound to specific wallet addresses. Within KYW systems, compliant providers verify user identity off-chain and mint a token into the user’s wallet as a verification record. Quadrata exemplifies this: generating soulbound tokens to verify attributes like nationality and age.

These tokens facilitate audit trails of verification but their non-transferability alone cannot prevent someone else from taking control of a wallet. For instance, if a wallet’s private key is stolen or control transferred, the token no longer matches the current controller. Systems require expiration and revocation mechanisms depending on product implementation; Quadrata supports issuer revocation of credentials.

An alternative approach embeds compliance logic directly into asset tokens. DTCC’s ComposerX, an institutional tokenization platform, uses a Compliance-Aware Token Framework (CATF), enforcing regulatory and transaction rules during execution. Whether an asset transfer succeeds depends on whether compliance conditions are met.

Some startups plan to issue identity tokens—for example, Burrata—but while technically feasible, poor product-market fit led to shutdown.

Zero-knowledge proofs solve another pain point: users can prove identity-related claims without exposing underlying raw data. Several solutions already allow generating zero-knowledge proofs from document scans.

Finally, human verification schemes do not verify who the user is, but only confirm that the wallet is controlled by a unique, real human.

Worldcoin’s World ID uses dedicated hardware Orb to capture iris biometrics, proving human uniqueness. After capturing an iris image, Orb encrypts and transmits it to the user’s phone and deletes the original image on-device; it then compares the hash against others to complete uniqueness verification. Users generate key pairs in the World App and produce zero-knowledge proofs when proving unique human identity.

Human verification paired with identity binding (proving who this real human is) strongly resists deepfakes and reduces identity spoofing in certain scenarios, such as opening bank accounts. World has partnered with Zoom to compare user video footage with World ID, tagging Zoom accounts as “verified human.” Another solution, Human Passport, originally designed to protect Gitcoin grant projects, provides modular identity verification and sybil attack defense tools.

Please note: human verification only addresses sybil attacks and deepfakes—it does not satisfy regulatory identity identification requirements. A complete solution still requires integration with other KYC methods.

The above solutions focus on the person behind the wallet. Assets themselves pose another set of compliance issues, including origin, holding, and transfer permission restrictions.

Know Your Asset (KYA)

KYW focuses on who holds assets; KYA focuses on what the asset can do and with whom it can transact.

Overall, AML statutes are broad. The BSA does not care about asset type; asset classification is assessed by market regulators—whether securities, commodities, etc. However, KYA is a crucial tool for financial institutions assessing multiple compliance risks. KYA focuses on asset origin: how the asset was issued and by whom, including compliance attribute verification throughout issuance and the entire lifecycle.

The most direct implementation is embedding transfer restrictions directly into token contracts at issuance. RWA tokenization platforms like Securitize embed compliance logic at the token level. When issuing BlackRock BUIDL and Apollo ACRED, Securitize’s token contracts enforce transfers only between whitelisted wallets. The asset doesn’t depend on external access layers—transfer restrictions are executed directly by the token contract. Ondo’s OUSG and Superstate’s USTB follow similar patterns: each transaction triggers a hook that checks the on-chain whitelist; both sender and receiver must pass verification before settlement.

An unresolved challenge in KYA is asset provenance: confirming not just token attributes but tracing asset origins. Tokens issued by regulated platforms with clean KYA records have clear origin histories. But after cross-chain bridging, packaging, or use as collateral in DeFi protocols, the provenance chain can break. While issuance can generate a clear initial record, maintaining and interpreting that record during subsequent asset movements remains a persistent challenge—related to the upcoming KYT transaction due diligence.

However, this is more an operational challenge than a legal trap. The U.S. Office of Foreign Assets Control (OFAC) does not hold institutions responsible for sanction risks associated with every address through which an asset passes. Blockchain analysis tools can distinguish direct risk exposure (asset transferred directly from a sanctioned address) from multi-hop indirect exposure. Institutions manage the latter through risk thresholds, asset segregation, and suspicious transaction reporting—not by rejecting all assets flowing through permissionless infrastructures.

Know Your Transaction (KYT)

KYT helps institutions assess these risks, track associations between wallets, and map asset movement paths across wallets.

Transaction monitoring is a foundational tool for financial institutions, observing client behavior to identify suspicious activities requiring reporting. For a given asset, KYT can reconstruct the full lifecycle transaction history, showing which wallets and protocols the asset has interacted with. Simply put, KYT focuses on the transaction itself and can operate independently or in conjunction with identity review of transaction parties. This tool satisfies ongoing due diligence (CDD) and enhanced due diligence (EDD) requirements.

On-chain analytics providers like Chainalysis, Elliptic, and TRM can trace wallet associations and track fund flows across chains and protocols. Combined with on-chain and off-chain data and emerging AI tools, these products help financial institutions meet BSA and sanctions-related compliance obligations.

Examples of related AI tools include Eunice.ai, leveraging an asset classification framework for risk monitoring and disclosure; Didit offers screening and transaction monitoring for real-time wallet risk analysis; Sardine.ai performs initial screening and provides daily continuous transaction monitoring.

Beyond KYW, KYA, and KYT, some blockchains and protocols include built-in compliance controls.

Blockchain-Level Solutions

Permissioned and permissionless blockchains are increasingly offering tools for access control and privacy protection. These tools can intercept transactions before conditions are met, safeguard sensitive information from leakage, while preserving regulatory audit trails.

The BSA and sanctions regulations do not require validators to be permissioned, identify all network participants, or impose universal access controls across the entire network. Regardless of the network used, institutions are accountable only for their own clients and transactions. Institutions can select from the following solutions based on business and product needs, provided they meet compliance obligations.

For example, Canton is a public permissioned network where the transaction privacy model exposes transaction details only to relevant parties with legitimate need. Compliance logic is deeply integrated with smart contracts. Another example is Circle’s Arc, which uses a permissioned validator model but operates as a public blockchain; validators are real-name participants who have undergone KYC/KYB verification. In contrast, permissionless protocols let the protocol itself choose validators for each transaction. Processing a transaction does not make the validator a counterparty to the institution or client.

Some permissionless protocols also support access-controlled capital pools, gateways, or rules, enabling institutional users to manage access. Solana leverages token extension features for compliance: via transaction hooks, every transfer checks an on-chain whitelist; only if both sender and receiver are on the whitelist can the transaction proceed. Asset-level enforcement is applied, while the underlying network remains permissionless—whitelists are generally generated off-chain.

Uniswap v4, as a permissionless protocol, features hook functionality that allows custom logic to be attached at critical points in the swap lifecycle, enabling the creation of permissioned capital pools. The token itself remains permissionless, but the pool enforces entry barriers. Third-party deployed pools with access restrictions do not turn the protocol into a permissioned chain; the deployer assumes responsibility for the associated obligations. Hyperliquid also supports HIP-3 proposals, allowing deployers to restrict transactions to approved addresses.

Decentralized lending protocols like Morpho allow users and market participants to build compliance controls themselves. The protocol does not execute KYC or identity verification. In Morpho Blue, a variable-rate credit protocol, if the market uses KYC-enabled USDC or similar whitelisted tokens as collateral, compliance controls can be enforced at the asset level—only verified users can interact with that specific market.

Morpho Midnight, a intent-based fixed-rate credit protocol, and Morpho Vaults V2 vaults offer more flexible access controls. Morpho Vaults V2 allows independent managers to set custom access thresholds, restricting lender qualifications and enabling capital to be allocated across networks to borrowers with specific compliance credentials. This modular design allows institutions wanting to transact only with verified counterparties to use permissioned markets and vaults without compromising overall protocol ecosystem liquidity efficiency. This is a choice based on product and risk preference—the institution’s compliance obligations do not depend on whether other participants in a shared market have completed verification.

Interchain Compliance Information Transfer

Access control determines who can participate in a specific market or vault. When assets transfer across chains, issuers and applications face another challenge: transmitting relevant compliance information and enforcing consistent rules across multiple networks.

LayerZero supports interchain transmission of “compliance status,” eliminating the need to rebuild and maintain compliance logic on every chain separately. Its omnichain fungible token (OFT) standard supports customizable logic hooks: compliance verification must be completed on both source and destination chains before asset transfer settlement.

LayerZero V2 introduces a configurable decentralized validation network (DVN) to verify interchain messages. DVN can be configured to enforce compliance checks: verifying whether users/wallets have completed KYC, screening addresses against sanctions lists, confirming presence of Travel Rule metadata—messages are deemed valid only if these conditions are met.

Chainlink similarly bridges off-chain verification with on-chain compliance needs, using Chainlink Automated Compliance Engine (ACE) to bring KYC provider data on-chain. ACE enables reusable KYC, supporting cross-chain wallet binding: verification and registration once, reusable multiple times.

Macro Perspective

These tools address different aspects of on-chain compliance. Practical implementation requires integration with existing compliance frameworks to enable tokenized products to reach customers.

The simplest short-term approach is partnering with established exchanges featuring mature compliance systems to reach more customers—though this is not a compliance requirement. Issuers can also embed control logic directly into tokens themselves—examples include BUIDL, OUSG, and USDC—allowing assets to circulate on public blockchains while remaining constrained by contract-level rules.

The next opportunity lies in making compliance verification results reusable within the DeFi ecosystem. That is, applications and institutions can accept verification information from other service providers and evaluate it against their own standards. Implementation of this system will likely depend on unified protocol standards, specialized compliance software providers, and traditional platforms with existing KYC user bases acting as distribution channels.

Future Direction: Know Your Agent

Reusable credentials can confirm human client identities. But when AI agents conduct on-chain transactions, manage vaults, or initiate payments on behalf of users, institutions must also determine: who authorized this agent, and what operational permissions it holds. Know Your Agent (KYA) extends this discussion to software representing clients, defining the boundaries of its authority.

Just as humans applying for loans need credit scores, AI agents conducting transactions need cryptographic signature credentials. This is the emerging Know Your Agent framework: KYC for AI agents. Without a robust Know Your Agent framework, responsibility gaps could lead to situations where no one is accountable—or everyone might be.

The Know Your Agent framework requires new types of credentials proving who authorized the agent, whom it represents, and within what constraints it operates. Each agent must be identifiable, registerable (bound to an individual or entity), and maintain a reputation record, with permission constraints validated before interaction. Some solutions run on-chain, others off-chain, but an increasing number share the same cryptographic primitives, including RFC 9421 signatures and W3C verifiable credentials.

On-Chain Solutions

The ERC-8004 standard deployed to Ethereum mainnet in January 2026 is the first major on-chain AI agent identity standard, achieving over 30,000 registrations in its first week. It provides an on-chain system for registering AI agents, tracking reputation, and recording independent verification results. Each agent receives an ERC-721 token pointing to its registration file. On-chain records are immutable, trust-neutral, and composable, reducing dependency on single platforms.

self.xyz’s Self Agent ID, based on this standard, is an on-chain identity registry binding AI agent identity to human identity proof via Self. Each agent holds a non-transferable NFT backed by passport verification, enabling applications to reuse this credential to validate that the agent represents a real human.

Advantages of on-chain Know Your Agent solutions: immutability, trust neutrality, and composability.

Off-Chain Solutions

Many solutions use off-chain credentials and signed messages to identify agents and define permissions, even when payment actions occur on-chain.

Delegating financial operations to AI agents raises questions about authorization and control—returning to the fundamental topic of how institutions apply compliance verification to products and services.

Bringing financial systems onto the blockchain also presents an opportunity to optimize compliance frameworks. Most of the above solutions do not require new legislation. Treasury’s current rules already acknowledge non-documentary verification methods; the September 2026 FAQ recognizes verifiable digital credentials for CIP. FinCEN’s stance indicates that institutions responsibly experimenting with new technologies will not face enforcement penalties. Institutions wishing to avoid redundant KYC processes should begin with existing tools.

By: Maggie Hsu, Michele Korver, a16z crypto; Translated by: Chopper, Foresight News