Traditional identity verification is hindering institutions from entering the blockchain.

Written by: Maggie Hsu, Michele Korver, a16zcrypto

Translated by: Chopper, Foresight News

The "Know Your Customer (KYC)" checks are often seen as obstacles to traditional financial access to the on-chain ecosystem and hinder the overall development of DeFi.

For the unfamiliar, these checks are a necessary component of financial institutions' obligations to combat money laundering and terrorism financing under the Bank Secrecy Act (BSA). This process requires coordination among issuing institutions, verification entities, and regulatory agencies, with various parties having different incentives, timelines, and legal requirements.

For banks, broker-dealers, and other institutions subject to the Bank Secrecy Act, the challenge of bringing tokenized products on-chain lies in how to meet compliance requirements while reaching more customers and obtaining liquidity, as compliance requirements may increase time and complexity. For example, when new customers register, institutions often need to repeat identity verification, even if that user has already completed similar verification elsewhere. Fortunately, new KYC tools specifically designed for blockchain promise to make identity verification results reusable, breaking free from the outdated models inherited from traditional finance.

The starting point for discussion is clarifying whom institutions need to identify. In the traditional financial system, institutions conduct transactions through a network of intermediaries that have already completed identity verification, with each institution independently fulfilling its KYC obligations. This logic applies similarly in on-chain scenarios: a bank's customer identity verification obligations apply only to its own customers, and not to every participant in the underlying settlement infrastructure.

The core of customer identity verification rules is who is opening an account at the bank. Under this interpretation, a user does not become a customer of the bank simply by transacting with a bank customer or exchanging with a liquidity pool provided by the bank. As long as banks establish an appropriate compliance framework covering their own customers and related transactions, they can meet their compliance obligations under the Bank Secrecy Act.

The U.S. Department of the Treasury is currently studying how financial institutions can leverage new technologies and methods to meet Anti-Money Laundering/Counter-Terrorism Financing (AML/CFT) requirements, which includes Customer Identification Programs (CIPs) and KYC. With the introduction of the GENIUS Act, regulators need to explore and implement innovative solutions and standards to more efficiently achieve modern AML and CFT objectives.

This article will first analyze the legal conditions and practical prerequisites for reusable KYC implementation, and then discuss the roles that tools like zero-knowledge proofs, verifiable credentials, non-transferable tokens, and on-chain data analysis can play. Finally, we look ahead to "Know Your Agent": identifying AI agents, the entities they represent, and the operational permissions granted to them.

Applying KYC in the On-Chain World

Traditional KYC processes are independently completed by various financial institutions. Each platform verifies identities through Customer Identification Programs (CIP) when users register for accounts, independently retains records, and continues conducting customer due diligence. Identity information is stored by the institution, making that institution a trusted intermediary. When users create new accounts, they must repeat the verification process, even if assets are flowing between individuals and businesses that have already completed identity verification.

Blockchain transactions introduce another layer of complexity. Assets transferred cross-chain, across protocols, and between wallets often do not have intermediaries to execute KYC. A wallet address may originate from an exchange regulated by the Bank Secrecy Act, a DeFi protocol, or a consumer application. These services each have their own risk frameworks and responsibilities, and rules vary across different jurisdictions. Some intermediaries do not have KYC obligations themselves, and even if KYC is a mandatory requirement, there is currently no unified regulatory framework that allows verification results from Entity A to be directly transferred for use by Entity B. Institutions are forced to repeatedly verify the same user, increasing costs and delays.

Former SEC Commissioner Peirce recently stated, "In the past, the approach to combating illegal financial activities has remained unchanged: collect as much data as possible. This method is not very effective, as technological advancements have far exceeded this outdated system, and the time for change has come."

Financial institutions, blockchain developers, and regulators are creating new solutions to meet KYC and AML/CFT objectives. One direction is to allow institutions to reuse identity verifications completed by other entities. To implement this mechanism, it is necessary to clarify rules, define which entities' verification results can be trusted, and who bears the compliance responsibilities.

Reusability and Trust Ecosystem

Users prefer to undergo KYC verification only once and use it everywhere, a model known as reusable KYC, trust-based KYC, or custodian KYC.

In off-chain scenarios, users also undergo repeated verifications. When a person opens accounts with two banks, both banks will require KYC completion; however, the average user does not frequently open new bank accounts. In the crypto space, users constantly connect to new products, yet no trusted intermediary exists to allow KYC results to remain effective throughout the transaction lifecycle.

Institutions do not intend to eliminate KYC, but rather wish to avoid redundant KYC processes. Each time a user accesses a new exchange or application, the KYC process must start anew. This is costly for platforms and creates a barrier to user experience; as deepfake tools become more prevalent, the reliability of traditional verification methods continues to decline. Banks and other institutions subject to the Bank Secrecy Act are burdened by this costly, privacy-invasive, and inefficient identity verification mechanism that struggles to curb illegal financial activities.

Repeated verification means users must submit sensitive personal information to more institutions. Even submitting identification documents in digital form can pose risks to personal safety and make users more vulnerable to targeted scams, tracking, identity theft, and other illegal use of information. Mobile identity credentials often reveal a user's full name, address, birth date, and photo all at once.

Such centralized storage of personal identity information is a "honey pot" for financial criminals. If information is intercepted, improperly stored, or if institutions retain data beyond permissible periods, the consequences can be severe. Coin Center notes that the existing system forces individuals to "repeatedly submit sensitive personal information to centralized databases, exposing them to significant personal risk." To mitigate such unnecessary security risks, privacy advocates urge regulators to consider alternatives to government-issued identification records for digital identity verification.

A case for reference exists in traditional financial markets: SWIFT's KYC registry. Global banks have long used the SWIFT communication network to transmit cross-border payment instructions. In 2014, SWIFT launched its KYC registry, extending this infrastructure into compliance: banks need only upload information once to share it with any counterparty in need. This registry now covers nearly 8000 institutions in over 200 countries, and its operation hinges on business occurring between institutions where the identities of counterparties are known.

The crypto industry currently lacks a corresponding centralized registry. If Coinbase has completed KYC for a particular user according to bank-grade standards, can other platforms directly rely on that verification result? If users who have completed KYC with Robinhood wish to access on-chain credit protocols, can Robinhood's previous compliance work transfer with the user?

This is what is referred to as "whitelist liquidity." Accessing pre-verified user funds essentially constitutes the distribution of compliance capabilities, but it is not a legally mandated requirement. Whether customers trade in a whitelisted liquidity pool or an unpermitted pool, the institution's own compliance obligations remain unchanged. For tokenized securities, management of fund pool access and setting transaction entry standards may trigger regulatory obligations under the SEC's latest innovation exemption provisions. Issuers are already proactively connecting with major exchanges worldwide, hoping to leverage the exchanges' compliance frameworks, but the corresponding business architecture is still under development.

Outsourcing and Compliance Acceptance

New solutions designed specifically for the crypto industry can reduce unnecessary data collection, provide auditable and verifiable alternatives, and free themselves from the "process-driven" KYC of the past. In fact, an increasing number of trust-based KYC implementation cases have emerged in the crypto space.

KYC acceptance can also be understood as a "trust ecosystem": a trust network established by large-scale KYC service providers (or service alliances), similar to the concept of single sign-on. Examples of service providers include Sumsub ID, World ID, MoonPay, and Stripe via Privy. The initial verification typically charges the initiating platform $1-2, while subsequent platforms only need to perform part of the KYC process (such as live verification), reducing the verification cost per user.

A recent example is Fireblocks' Open Trading Layer (OTL), an open protocol stack that standardizes identity, compliance, and message transmission for on-chain financial participants. Notably, KYC is completed by regulated entities within the network, not by OTL itself. OTL builds a shared protocol so that once any institution within the network verifies a user, other participants can recognize that verification status, eliminating the need for repeated verification.

Another similar solution is Privado ID (previously Polygon ID, spun off from Polygon Labs in 2024, and recently merged with Disco.xyz), which enables reusable electronic KYC. Verifiable credentials are generated by issuers such as government entities, banks, and KYC service providers; users apply for, collect, and store these credentials in identity wallets. Verifiers can query corresponding credentials from the user's wallet, applicable in both on-chain and off-chain scenarios.

SpruceID is another solution built on identity standards. Trusted sources such as the Department of Motor Vehicles and state licensing agencies issue verifiable digital credentials, which users store on their phones. These tools simplify the reuse of verification results, but institutions must still be aware of their legal responsibilities when accepting third-party verification results.

Institutions can outsource KYC operations, but legal definitions depend on the service providers and cooperation models. According to the FFIEC's Bank Secrecy Act/Anti-Money Laundering Manual, acceptance is a specific legal term that only applies to accepting verification results from another regulated financial institution. If a partner is an identity verification vendor or credit agency that does not meet qualification standards, it is merely considered outsourcing. In this case, the institution must still independently bear all responsibilities for the Customer Identification Program.

Similarly, the Financial Action Task Force (FATF), which sets global AML/CFT standards, stipulates that countries may allow financial institutions to delegate parts of customer due diligence to third parties, but must meet three conditions:

1. The third party itself is subject to AML and KYC-related regulation and supervision, and has corresponding compliance measures;
2. The accepting institution can retrieve underlying KYC original data immediately upon request;
3. The accepting institution assumes full legal liability for the final compliance results.

This set of rules cannot be completely and directly applied to the crypto industry. Firstly, the requirement for "instant retrieval of original data" means that regulatory or enforcement agencies need to be able to access users' personal identification information at any time. This directly conflicts with the privacy designs of most on-chain KYC solutions.

Moreover, many crypto platforms do not meet the U.S. federal AML and customer identification acceptance rules' definition of "regulated entities," even though they are registered money service businesses, state-chartered trust companies, and carry their own AML obligations. Therefore, they cannot serve as formal parties in an accepted relationship.

This poses an obstacle that the U.S. Treasury must address when promoting more flexible, native crypto customer identification solutions. Decentralized solutions are lower in cost, higher in efficiency, and can better protect user privacy while reducing the risk of network breaches; yet enforcement agencies still need a credible source that can confirm user identities and provide written evidence for investigations or court presentations.

In addition to the requirements for AML programs, financial institutions must also comply with funds transfer rules, commonly known as the "Travel Rule." Any financial institution or virtual asset service provider (VASP, including entities subject to the Bank Secrecy Act transferring amounts over a threshold, which is typically $3000; lower thresholds exist in other jurisdictions) must collect and transmit identity information of both the payer and payee to the next entity in the chain. This process flows smoothly in traditional financial scenarios because banks already hold KYC data and possess established channels like SWIFT to transmit information. However, in the crypto realm, on-chain transactions and KYC information are separate.

Many mature service providers offer travel rule compliance solutions tailored for the crypto industry. This includes the TRUST (Travel Rule Universal Solution Technology) led by industry coalition Coinbase and similar products from Notabene and Sumsub.

In the U.S., travel rule messaging is only required between financial institutions. Financial institutions and virtual asset service providers are not required to submit this data to non-financial institutions or non-VASP entities (like self-custody wallets).

Financial institutions interacting with DeFi or self-custody wallets do not need to overly concern themselves with travel rule compliance issues. Banks or exchanges may still require users to provide information for transactions in and out of self-custody wallets, which forms part of the institution's AML/CFT project requirements based on their own risk; however, the travel rule itself does not impose such mandatory requirements.

However, positions vary in jurisdictions outside of the U.S. regarding the triggering monetary thresholds for the rule and whether VASPs must collect data from non-VASP individuals/entities; policies in various countries are still being formulated. Regulatory agencies around the world continue to explore how to apply KYC, AML, and travel rule compliance in on-chain scenarios.

The good news is that the U.S. does not need to introduce new specialized legislation. The existing laws and regulatory frameworks can be adapted through regulatory guidance, rule amendments, or innovative exemptions. Congress has already recognized the responsibility allocation logic mentioned above. The GENIUS Act assigns AML and sanctions obligations to licensed stablecoin issuers, which are identifiable entities at the application layer, rather than the unlicensed underlying networks through which stablecoins circulate. Regulatory agencies also acknowledge the value of new technologies in compliance areas. FinCEN's proposal in April 2026 lists innovative solutions such as machine learning, generative AI, digital identity, blockchain monitoring analysis, and API interfaces as means to meet regulatory obligations.

FinCEN supports financial institutions adopting emerging technologies, indicating that institutions "responsibly experimenting with innovative technologies in AML/CFT projects will not face significant regulatory scrutiny or enforcement actions solely for utilizing innovative technologies." To facilitate institutions in practical operations, the crypto industry calls on FinCEN and banking regulatory agencies to clearly define when digital identities may be used to meet AML project requirements, including Customer Identification Programs CIPs/KYC.

Even if regulatory guidance is clearer, not all KYC judgments can be simplified into binary cryptographic proofs. Zero-knowledge proofs can demonstrate a birth date, nationality, sanction screening results, and credential possession status; however, more complex anti-money laundering investigations requiring human judgment still rely on traditional due diligence.

Verifiable credentials can assist or even replace certain elements in Customer Identification Programs CIPs/KYC, but will not completely replace risk-based customer due diligence. Existing Treasury rules already permit non-documentary verification methods; institutions may use a combination of verification methods based on their own risk assessments. FinCEN's frequently asked questions (FAQ) in September 2026 explicitly recognized that qualifying verifiable digital credentials may be used for banks' Customer Identification Programs, but did not fully endorse all decentralized identity or credential designs.

FinCEN and relevant banking regulatory agencies could enhance guidance based on existing authority. Optional approaches include issuing interpretive guidance, adding FAQs, targeted exemptions, pilot programs (approval for implementation after completion), credential issuer standards, or revising regulations. This plan allows traditional financial institutions and eligible public or private entities to issue verification credentials according to unified standards, reducing the need for each bank to construct the same identity records repeatedly.

Before this, financial institutions could already adopt tools compliant with existing rules. Here are some feasible implementation ideas.

Feasible Solutions

Institutions can rely on a trusted and compliant back-end system, allowing identity credentials to be reused across various on-chain applications. Trusted service providers verify user identities, generate digital signature credential records of verification results. Users present this credential to other applications, which only need to verify the qualifications of the credential issuer to confirm if they meet their verification standards.

This concept is not novel and can be traced back to Vitalik Buterin's idea of soul-bound tokens in 2022. Supplementary solutions include W3C standards for decentralized identities (DIDs) and verifiable credentials, which are not exclusive to the crypto industry.

In practice, regulated KYC service providers, banks, or even governments act as trustworthy issuers who verify user identities and issue credentials. Credentials are stored in user wallets, and users can selectively disclose information to applications as needed.

Similarly, zero-knowledge simple proof systems allow users to prove they have completed KYC without disclosing personal identification information, thus protecting privacy. Users can reuse this credential as long as it meets the receiving institution's Customer Identification Program CIP requirements, thereby reducing redundant verifications.

The verification mechanism must also be composable, with applications able to integrate verification logic into their own compliance checks. More specifically, to achieve maximum effectiveness, issuers and platforms can embed this logic into token contracts and application-layer smart contracts. Institutions can execute their own compliance requirements without needing external components or embedding compliance logic deep into the underlying public blockchain network.

Implementation Methods

There are other feasible tools to help financial institutions meet risk-based AML project requirements: Know Your Wallet (KYW), Know Your Asset (KYA), and Know Your Transaction (KYT). Exchanges and money transfer service providers have already incorporated these methods into their overall AML solutions.

Know Your Wallet (KYW)

KYW binds identity verification to the blockchain address used by the customer, helping institutions confirm who actually controls the wallet and what assets and services the customer is qualified to access. KYW includes:

• Identity binding: Generally done during the account opening KYC phase, binding real-world identities to wallet addresses;
• Live and uniqueness verification: Confirming the identity is a real human being, with no duplicate identities across wallets; regularly refreshing binding relationships to ensure the same real-world identity continues to control the wallet;
• Access/permission control: After wallet verification is completed, obtaining specific access permissions (whether qualified investor status, compliance based on location, or the ability to hold specific asset types), which forms the compliance admission layer.

KYC in the crypto space largely retains traditional models. Service providers like Onfido, Veriff, Trulioo, Socure, Incode, ID.me, Persona, Sumsub, and Sardine provide identity binding, document verification, live detection, and AML screening. Most of these identity verifications occur off-chain, and solely relying on verification itself cannot determine which wallet address the user controls, adding the step of binding verified identity and wallet address.

On-chain applications can use non-transferable tokens to record verification results, limit personal information disclosure with zero-knowledge proofs, and verify users are independent real people with identity verification solutions. Multiple solutions can be used in combination.

This idea employs non-transferable and unsellable tokens, often referred to as soul-bound tokens, permanently binding a specific wallet address. Within the KYW framework, compliant service providers conduct off-chain user identity verification and mint a token for the user’s wallet to serve as a verification record. Quadrata is an example of such a solution that generates soul-bound tokens for verifying user nationality, age, and other attributes.

These tokens facilitate audit record verification, but their non-transferable nature does not prevent others from taking control of the wallet. For example: if a wallet's private key is stolen or control shifts, the token associated with the identity no longer matches the current wallet controller. The system also requires mechanisms for credential expiration and revocation, depending on product implementation; Quadrata supports revocation of credentials by issuers.

Related solutions involve embedding compliance logic into asset tokens. DTCC's ComposerX, an institutional tokenization platform, utilizes a compliance-aware token framework (CATF), enforcing regulations and transaction rules at the moment of execution. The success of asset transfers depends on whether compliance conditions are met.

There are also startup projects planning to issue identity tokens, such as Burrata, with technological feasibility but insufficient market fit, which has already been shut down.

Zero-knowledge proofs address another layer of pain points: users can prove identity-related claims without disclosing underlying raw data. Several solutions already exist that can generate zero-knowledge proofs through document scanning.

• Self.xyz provides a privacy-protecting "pre-KYC" solution: users scan physical passports to create zero-knowledge proofs of passport information, proving eligibility of age above 18 and not being on the sanctions list. This can serve as a pre-KYC admission screening layer to filter out bots and sanctioned wallets, saving time.
• Ethereum privacy L2 Aztec acquired zkPassport, utilizing a similar approach to generate zero-knowledge proofs from passport scanning.
• Opacity Labs employs a zero-knowledge transport layer security protocol (zkTLS); its trusted data network VDN can generate verifiable proofs for arbitrary Web2 facts (e.g., account ownership, transaction history), transmitted on-chain without disclosing raw underlying data.

Lastly, the identity verification solutions focus on proving that a wallet is controlled by a unique and real human being.

Worldcoin's World ID collects iris biometric information through a specialized hardware orb to prove human uniqueness. After collecting an iris image, it encrypts the transmission to the user's phone and deletes the original image on the device; a hash value is generated and compared, completing the uniqueness verification. Users generate a key pair in the World App, producing zero-knowledge proofs when proving their unique human identity.

Pairing identity verification with identity binding (proving who this real person is) can strongly resist deep forgery, reducing identity impersonation, such as when opening bank accounts. World has collaborated with Zoom to compare user video footage with World ID, marking Zoom accounts as "verified real person." Another solution, Human Passport, was originally used to safeguard Gitcoin funding projects, offering modular identity verification and witch attack defense tools.

Note: Identity verification can only address witch attacks and deep forgery problems, and cannot satisfy regulatory identity recognition requirements; a complete solution still needs to be paired with other KYC methods.

The above solutions focus on the person behind the wallet. The assets themselves also present another set of compliance issues, including source of the assets, holding, and transfer permission limitations.

Know Your Asset (KYA)

KYW focuses on who holds the assets, while KYA concentrates on what can be done with those assets and with whom they can be traded.

Overall, AML legal provisions are broad. The Bank Secrecy Act does not concern itself with the type of assets; asset categories are more qualitatively assessed by market regulators: whether they belong to securities or commodities, etc. However, KYA serves as an important tool for financial institutions to evaluate various compliance risks. KYA pays attention to asset origins: how assets are issued, by whom they are issued, including compliance attributes verification during the issuance phase and throughout the entire lifecycle.

The most direct implementation method is embedding transfer restrictions into token contracts at the time of issuance. RWA tokenization platform Securitize integrates compliance logic at the token level. When issuing BlackRock's BUIDL and Apollo's ACRED, the token contracts mandate that transfers can only occur between whitelisted wallets. The assets do not rely on an external admission layer; the token contracts directly enforce transfer restrictions. Ondo's OUSG and Superstate's USTB adopt a similar model: with each transaction, the transfer hooks check the on-chain whitelist; both senders and receivers must complete verification before settlement can proceed.

A challenge yet to be resolved in the KYA domain is asset provenance: confirming not only the token's attributes but also tracing the source of the assets. Tokens with clean KYA records issued by regulated platforms have clear origin records. However, token bridging, packaging, or use as collateral in DeFi protocols can damage tracing links. Initial records can be generated during the issuance phase; yet maintaining and interpreting this record during subsequent asset transfers remains a pending challenge, which is also related to the KYT transactional due diligence discussed below.

However, this is more of an operational challenge than a liability trap. The U.S. Office of Foreign Assets Control (OFAC) does not determine that institutions need to assume the sanction risks of every address an asset passes through. Blockchain analysis tools can differentiate between direct risk exposure (when assets are directly transferred from sanctioned addresses) and multiple-jump indirect exposure. Institutions manage the latter through risk thresholds, asset isolation, and suspicious transaction reporting rather than rejecting all assets that flow through unpermitted infrastructure.

Know Your Transaction (KYT)

KYT helps institutions assess the aforementioned risks by tracking associations between different wallets and mapping the flow paths of assets between wallets.

Transaction monitoring is a fundamental tool for financial institutions to observe customer behavior and identify activities that need to be reported as suspicious. For any given asset, KYT can chart its entire lifecycle of transaction history, illustrating which wallets and protocols the asset has interacted with. In simple terms, KYT focuses on examining the transaction itself, independent of or alongside reviews of the transaction parties' identities. This tool meets ongoing customer due diligence (CDD) and enhanced due diligence (EDD) requirements.

Chainalysis, Elliptic, TRM, and other on-chain analysis service providers can trace wallet associations and track the flow of funds across chains and protocols. Coupled with on-chain and off-chain data, as well as emerging AI tools, these products assist financial institutions in meeting compliance obligations related to the Bank Secrecy Act and sanctions.

Relevant AI tool examples include Eunice.ai, which processes risk monitoring and information disclosure using an asset classification framework; Didit provides screening and transaction monitoring for on-the-fly wallet risk analysis; Sardine.ai conducts initial screenings while offering daily continuous transaction monitoring.

In addition to KYW, KYA, and KYT, some blockchains and protocols incorporate built-in compliance control functions.

Blockchain Layer Solutions

Permissioned chains and permissionless public chains are increasingly providing tools for access control and privacy protection. These tools can intercept transactions before meeting conditions, while safeguarding sensitive information and maintaining regulatory audit channels.

The Bank Secrecy Act and sanction regulations do not require verifying nodes to be permissioned, identify all participants in the network, or impose access controls across the entire network. Regardless of which network is used, institutions need only to take responsibility for their own customers and transactions. Institutions can select from the following solutions based on their operational and product needs, as long as they fulfill compliance obligations.

For example, Canton is a public permissioned network where under its transaction privacy model, transaction details are only accessible to relevant parties who need to know, with compliance logic deeply integrated with smart contracts. Another example is Circle's Arc, where validating nodes operate in a permissioned mode, but the chain itself is public; these validating nodes are all real-name participants who have completed KYC/KYB verifications. In contrast, permissionless protocols allow the protocol itself to choose validating nodes for each transaction. Executing this transaction does not make the validating node a counterparty to the institution or customer.

Some permissionless protocols also support access-controlled fund pools, gateways, or rules, making it easier for institutional users to manage access permissions. Solana utilizes token expansion capabilities for compliance, where transfer hooks validate against the on-chain whitelist for each transfer, requiring both sending and receiving parties to be whitelisted for the transaction to proceed. Compliance checks are enforced at the asset level, while the underlying network remains permissionless, and whitelists are generally generated off-chain.

Uniswap v4, functioning as a permissionless protocol, comes with hook functionalities that can implement custom logic at critical nodes of the exchange lifecycle, allowing for the construction of permitted fund pools. The tokens themselves remain permissionless, with only entry thresholds set by the liquidity pool. Third parties can deploy funds pools with access restrictions, which will not convert the protocol itself into a permissioned chain; the entity deploying the pool and defining entry rules assumes related obligations. Hyperliquid also supports HIP-3 proposals, enabling deployers to limit transactions to approved addresses.

The decentralized lending protocol Morpho allows users to build compliance controls independently with market participants. The protocol itself does not execute KYC or identity verifications. In the Morpho Blue variable rate loan protocol, if the market utilizes a KYC version of USDC as collateral, compliance control can be implemented at the asset level, ensuring only verified users can interact with that specific market.

Based on intent, the Morpho Midnight fixed-rate loan protocol and Morpho Vaults V2 can flexibly set entry permissions. Morpho Vaults V2 allows independent managers to establish custom entry thresholds to limit lender qualifications, enabling capital to be allocated across networks to borrowers with specific compliance qualifications. This modular design allows institutions wishing to trade only with verified counterparties to do so without compromising the liquidity efficiency of the entire protocol ecosystem. This is a choice of product and risk preference; the institution's compliance obligations do not depend on whether other participants in the shared market have completed verifications.

Cross-Chain Compliance Information Transmission

Access control determines who can participate in specific markets or vaults. When assets are transferred cross-chain, issuers and applications face another challenge: transmitting relevant compliance information while executing uniform rules across multiple networks.

LayerZero enables cross-chain transmission of "compliance status," avoiding the need to rebuild and maintain compliance logic separately on each chain. Its Omni-Chain Fungible Token (OFT) standard supports customizable logic hooks, requiring both source and target chains to complete compliance checks before asset transfer settlements.

LayerZero V2 introduces a configurable decentralized validation network (DVN) for verifying cross-chain messages. DVN can be set to enforce compliance checks: confirming whether users/wallets have completed KYC, screening whether addresses hit sanction lists, and ensuring that messages include travel rule metadata before being deemed valid.

Chainlink also bridges off-chain verifications with on-chain compliance demands via Chainlink’s Automated Compliance Engine (ACE), integrating KYC service provider data on-chain. ACE enables reusable KYC, supporting cross-chain binding of user wallets: credentials can be verified and registered once, then called multiple times.

Macro Perspective

These tools address different aspects of on-chain compliance. When implemented in practice, they need to connect with existing compliance frameworks for tokenized products to reach customers.

The simplest short-term approach is to collaborate with exchanges that already have mature compliance systems to reach more customers, but this is not a mandatory compliance requirement. Issuers can also embed control logic directly into the tokens themselves; BUIDL, OUSG, and USDC are examples of this type, allowing assets to circulate on public chains while still being bound by rules defined within the contracts.

The next opportunity is to enable compliance verification results to be reused within the DeFi ecosystem. In other words, applications and institutions could rely on verification information provided by other service providers, assessing them against their own standards. For this system to be implemented, it will likely depend on creating unified protocol standards, focusing on compliance-oriented software service providers, and leveraging traditional platforms with existing KYC users for distribution.

Future Direction: Know Your Agent

Reusable credentials can confirm the identity of human customers. However, when AI agents transact on-chain, manage vaults, or initiate payments on behalf of users, institutions still need to confirm: who authorized this agent, and what operational permissions the agent possesses. Know Your Agent expands this discussion to software that performs operations on behalf of clients, delineating the boundaries of its permissions.

Just as humans need credit scores to apply for loans, AI agents also require cryptographic signatory credentials to engage in transactions. This is the emerging Know Your Agent framework: AI agent versions of KYC. Without a comprehensive Know Your Agent framework, once accountability issues arise, it can lead to an embarrassing situation where no one is responsible, but everyone could be held accountable.

The Know Your Agent framework requires new types of credentials to prove who has authorized the agent, whom they represent, and within what constraints they operate. Each agent must be identifiable, registrable (linked to individuals or corporate entities), and possess a reputation record, with permission verification conducted before interactions. Some solutions operate on-chain while others are off-chain, but increasingly, solutions share a common set of cryptographic primitives, including RFC 9421 signatures and W3C verifiable credentials.

On-Chain Solutions

The ERC-8004 standard deployed to the Ethereum mainnet in January 2026 is the first significant standard for AI agent identities on-chain, with over 30,000 registrations in the first week of launch. It provides an on-chain system to register AI agents, track reputation, and record independent verification results. An ERC-721 token is minted for each agent, pointing to the agent's registration file. The on-chain records are immutable, possess credible neutrality, and are composable, reducing reliance on a single platform.

Self.xyz's Self Agent ID is based on this standard, functioning as an on-chain identity registration system that binds AI agent identities to Self's human identity verifications. Each agent is assigned a non-transferable NFT backed by passport verification, allowing applications to reuse this credential to verify that a real human being is behind the agent.

The advantages of on-chain Know Your Agent solutions include: immutability, credible neutrality, and composability.

Off-Chain Solutions

Many solutions use off-chain credentials and signed messages to identify agents and define privileges, even if payment actions occur on-chain.

• Google's Agent Payment Protocol AP2 uses signed messages to record user instructions, including spending limits and procurement conditions, retaining verifiable evidence of the authorization the agent has received.
• Catena Labs' Agent Toolkit introduces the ACK v2 solution, using signed authorization letters specifying who authorized the agent and the scope of authority. Each request is accompanied by an authorization letter and an HTTP message signature (RFC 9421).
• Skyfire KYAPay enables agents to self-verify their identities while showing what they represent, using a signed digital credential called a JSON Web Token (JWT). Skyfire collaborates with Yubico's Agent Trust framework to link agents with verified consumers and devices.
• Circle's Agent Wallet focuses on hosting and permission management. The signing keys are invisible to the agent, while the user retains custody of their assets. Agents can only trade autonomously within the user-defined spending limits and recipient restrictions.
• Anchorage's Agent Banking Service binds credentialing to users or entities, granting agents permissions to spend from specified budgets. Transactions are traceable by the agent's identity, and permissions can be revoked at any time.
• Mastercard's Agent Pay registers agents, binding agent payments to consumer authorization and tokenized payment credentials. It collaborates with Cloudflare, using signed network requests to help merchants verify the AI agents accessing their websites.
• Visa's Smart Commerce uses digital payment tokens instead of card information, confirming that agents have operational authorization from consumers and setting spending limits.
• Zero Hash's Agent Finance Suite screens AI agents and their represented entities before transactions, enabling user delegation of authority and transaction control.
• Ledger is constructing a solution that connects secure hardware with authorized humans. Its roadmap includes hardware enforcement of spending rules, with sensitive transactions requiring manual approval.

Delegating financial actions to AI agents raises issues of authorization and control, returning to the fundamental topic of how institutions perform compliance verification on products and services.

Bringing the financial system onto the blockchain also presents an opportunity to optimize compliance systems. Most of the solutions mentioned above do not require new legislation. Existing Treasury rules already recognize non-documentary verification methods, and the September 2026 FAQ acknowledges that verifiable digital credentials may be used for Customer Identification Programs. FinCEN has stated that as long as institutions responsibly experiment with new technologies, they will not face enforcement penalties. Institutions looking to avoid redundant KYC processes can now begin utilizing existing tools.