a16z Reconsidering KYC: Institutions Embrace On-Chain, No Longer Trapped in Traditional KYC Frameworks

Original Title: The key to getting more institutions onchain: Rethinking KYC

Original Authors: Maggie Hsu, Michele Korver, a16z

Original Compilation: Chopper, Foresight News

"Know Your Customer (KYC)" checks are often seen as obstacles to the integration of traditional finance into the on-chain ecosystem and the overall development of DeFi.

For those unfamiliar, these checks are a necessary component for financial institutions to fulfill their obligations to combat money laundering and terrorist financing under the Bank Secrecy Act (BSA). This process requires coordination between issuing institutions, verification agencies, and regulatory bodies, with varying incentives, timelines, and legal requirements for each party.

For banks, brokerages, and other institutions bound by the Bank Secrecy Act, the challenge of bringing tokenized products on-chain lies in how to reach more customers and gain liquidity while meeting compliance requirements, which may increase time and complexity. For example, when new customers register, institutions often need to repeat identity verification, even if the user has completed similar verification elsewhere. Fortunately, new KYC tools designed specifically for blockchain are expected to make identity verification results reusable, breaking free from the outdated models of traditional finance.

The starting point for discussion is to clarify the entities that institutions need to identify. In the traditional financial system, institutions conduct transactions through a network of intermediaries that have completed identity verification, with each institution independently fulfilling its own KYC obligations. This logic also applies to on-chain scenarios: a bank's customer identity verification obligations are only for its own customers, not for every participant in the underlying settlement infrastructure.

The core of customer identity verification rules is who opens an account at the bank. Under this interpretation, a user does not become a customer of the bank simply by transacting with a bank customer or exchanging with a liquidity pool provided by the bank. As long as the bank establishes a suitable compliance system covering its own customers and relevant transactions, it can meet the compliance obligations of the Bank Secrecy Act.

The U.S. Department of the Treasury is currently studying how financial institutions can leverage new technologies and methods to meet anti-money laundering/anti-terrorist financing (AML/CFT) requirements, including Customer Identification Programs (CIP) and KYC. With the implementation of the GENIUS Act, regulators need to explore and promote innovative solutions and standards to achieve modern anti-money laundering and anti-terrorist financing goals more efficiently.

This article will first analyze the legal conditions and practical prerequisites for implementing reusable KYC, and then discuss the roles that tools such as zero-knowledge proofs, verifiable credentials, non-transferable tokens, and on-chain data analysis can play. Finally, we will look forward to "Know Your Agent": identifying AI agents, the entities they represent, and the operational permissions granted.

Applying KYC to the On-Chain World

Traditional KYC processes are completed independently by various financial institutions. Each platform verifies identity through Customer Identification Programs (CIP) when users register for accounts, independently retaining records and continuously conducting customer due diligence. Identity information is kept by the institution, making it a trusted intermediary. When users open new accounts on a platform, they must repeat the verification process, even if assets are circulating between individuals and businesses that have already completed identity verification.

Blockchain transactions add another layer of complexity. Assets are transferred across chains, protocols, and wallets, often without intermediaries to perform KYC. A wallet address may come from a regulated exchange, a DeFi protocol, or a consumer application. Each of these services has its own risk frameworks and responsibilities, and rules vary across different jurisdictions. Some intermediaries themselves have no KYC obligations; even if KYC is mandatory, there is currently no unified regulatory framework that allows the verification results from Institution A to be directly transferred for use by Institution B. Institutions are forced to repeatedly verify the same user, increasing costs and delays.

Former SEC Commissioner Peirce recently stated, "The approach to combating illegal financial activities has remained unchanged: collect as much data as possible. This method has not been effective; technological development has far outpaced this outdated system, and the time for reform has come."

Financial institutions, blockchain developers, and regulators are creating new solutions to meet KYC and anti-money laundering, anti-terrorist financing goals. One direction is to allow institutions to reuse identity verifications already completed by other entities. To implement this mechanism, clear rules need to be established to define which entities' verification results can be trusted and who bears compliance responsibility.

Reusability and Trust Ecosystem

Users want to undergo KYC verification only once and be able to use it anywhere; this model is also known as reusable KYC, trust-based KYC, or custodial KYC.

In off-chain scenarios, users also undergo repeated verification. If a person opens accounts at two banks, both banks will require KYC completion, although ordinary users do not frequently open new bank accounts. However, in the crypto space, users continuously engage with new products, yet there is no trusted intermediary to ensure that KYC results remain valid throughout the transaction lifecycle.

Institutions do not want to eliminate KYC; they want to avoid redundant KYC. Each time a user connects to a new exchange or application, the KYC process starts over. This is costly for platforms and creates barriers for users; as deepfake tools become more widespread, the reliability of traditional verification methods continues to decline. Banks and other institutions bound by the Bank Secrecy Act are burdened by this costly, privacy-infringing, and ineffective identity verification mechanism that fails to curb illegal financial activities.

Redundant verification means users must submit sensitive personal information to more institutions. Even submitting identification documents in digital form poses personal safety risks, making users more vulnerable to targeted scams, tracking, identity theft, and other illegal uses of information. Mobile identity credentials often disclose a user's full name, address, date of birth, and photo all at once.

This type of centralized storage of personal identity information is a "honey pot" that is highly attractive to financial criminals. If information is intercepted, improperly stored, or if institutions retain data beyond the necessary period, the consequences can be severe. Coin Center points out that the existing system forces individuals to "repeatedly submit sensitive personal information to centralized databases, bearing significant personal risk." To avoid such unnecessary security hazards, privacy advocates urge regulators to consider alternative digital identity verification methods beyond government-issued identification records.

There is a reference case in the traditional financial market: SWIFT's KYC Registry. Global banks have long used the SWIFT communication network to transmit cross-border payment instructions. In 2014, SWIFT launched the KYC Registry, extending this infrastructure into the compliance realm: banks need only upload information once to share it with any trading counterpart that requires it. The registry now covers nearly 8,000 institutions in over 200 countries, and the mechanism works because transactions occur between institutions, with the identities of trading counterparts known.

The crypto industry currently lacks a corresponding centralized registry. If Coinbase has completed KYC for a user according to bank-level standards, can other platforms directly trust this verification result? If a user who has completed KYC with Robinhood wants to access an on-chain lending protocol, can Robinhood's prior compliance verification work transfer with the user?

This is what is referred to as "whitelist liquidity." Accessing pre-verified user funds pools essentially distributes compliance capabilities, but it is not a legal requirement. Whether customers trade in a whitelist fund pool or an unlicensed fund pool, the institution's own compliance obligations remain unchanged. For tokenized securities, managing access control to funds pools and setting trading access standards may trigger regulatory obligations under the latest innovation exemption provisions from the U.S. SEC. Asset issuers have proactively connected with major global exchanges, hoping to leverage the exchanges' compliance frameworks, but the corresponding business architecture is still being built.

Outsourcing and Compliance Trust

New solutions designed specifically for the crypto industry can reduce unnecessary data collection, providing auditable and verifiable alternatives, breaking free from the past "process-driven" KYC. In fact, there are increasingly more cases of trust-based KYC implementation in the crypto space.

KYC trust can also be understood as a "trust ecosystem": a trust network built by large-scale KYC service providers (or service provider alliances), similar to the concept of single sign-on. Service provider examples include Sumsub ID, World ID, MoonPay, and Stripe, which provides services through Privy. Initial verification typically charges the initiating platform $1-2, and subsequent platforms only need to conduct part of the KYC process (such as live detection), reducing the verification cost for individual users.

A recent example is Fireblocks' Open Trading Layer (OTL), an open protocol stack that unifies identity, compliance, and messaging standards for participants in on-chain finance. Notably, KYC is completed by regulated entities within the network, rather than by OTL itself. OTL builds a shared protocol, and once a certain institution within the network completes user verification, other participants can recognize that verification status without needing to repeat it.

Another similar solution is Privado ID (formerly Polygon ID, spun off from Polygon Labs in 2024, recently merged with Disco.xyz), which achieves reusable electronic KYC. Verifiable credentials are generated by issuers such as government agencies, banks, and KYC service providers; users apply for, collect, and store credentials in an identity wallet. Verifiers can query the corresponding credentials from the user's wallet, applicable in both on-chain and off-chain scenarios.

SpruceID is another solution built on identity standards. Trusted sources such as vehicle registration offices and state licensing agencies issue verifiable digital credentials, which users store on their phones. These tools simplify the reuse of verification results, but institutions must still be clear about their legal responsibilities when trusting third-party verification results.

Institutions can outsource KYC operations, but the legal characterization depends on the service provider and collaboration model. According to the FFIEC Bank Secrecy Act/Anti-Money Laundering Manual, trust is a specific legal provision that only applies to trusting the verification results of another regulated financial institution. If the partner is an identity verification supplier or credit agency that does not meet qualification requirements, it can only be considered outsourcing. In this case, the institution still needs to independently bear full responsibility for the Customer Identification Program.

Similarly, the Financial Action Task Force (FATF), which sets global anti-money laundering/anti-terrorist financing standards, stipulates that countries may allow financial institutions to delegate part of the customer due diligence work to third parties, but three conditions must be met:

1. The third party itself is subject to anti-money laundering and KYC-related regulation and supervision, and has corresponding compliance measures;
2. The trusting institution can, upon request, promptly retrieve the underlying KYC raw data;
3. The trusting institution bears full legal responsibility for the final compliance results.

These rules cannot be directly applied to the crypto industry. First, the requirement for "prompt retrieval of raw data" means that regulatory or law enforcement agencies need to be able to access users' personal identity information at any time. This directly conflicts with the privacy protection designs of most on-chain KYC solutions.

Furthermore, many crypto platforms do not meet the definition of "regulated entities" as defined by U.S. federal anti-money laundering and customer identification trust rules, even if they are registered money service businesses or state-chartered trust companies and bear their own anti-money laundering obligations. Therefore, they cannot serve as formal trusting counterparties.

This is an obstacle that must be addressed as the U.S. Department of the Treasury promotes a more flexible, native cryptocurrency customer identification solution. Decentralized solutions are lower in cost, more efficient, and better protect user privacy while reducing the risk of data breaches; however, law enforcement still requires a trusted source that can confirm the true identity of users and provide written evidence for investigations or court presentations.

In addition to anti-money laundering project requirements, financial institutions must also comply with funds transfer rules, commonly known as the "travel rule." Any financial institution or virtual asset service provider (VASP, which in the U.S. includes institutions subject to the Bank Secrecy Act that transfer amounts exceeding a threshold, typically $3,000; other jurisdictions may have lower thresholds) must collect and pass on the identity information of both the payer and the payee to the next institution in the chain. This process flows smoothly in traditional financial scenarios because banks already hold KYC data and have established messaging channels like SWIFT to transmit information. However, in the cryptocurrency space, on-chain transactions and KYC information are separated.

Several mature service providers offer compliance solutions for the travel rule specific to the cryptocurrency industry. This includes the TRUST (Travel Rule Universal Solution Technology) launched by the industry alliance Coinbase, as well as similar products from Notabene and Sumsub.

In the U.S., travel rule messaging is only required to be executed between financial institutions. Financial institutions and virtual asset service providers do not need to send such data to non-financial institutions or non-VASP entities (such as self-custody wallets).

Financial institutions do not need to overly worry about travel rule compliance when interacting with non-intermediary blockchain technologies like DeFi and self-custody wallets. Banks or exchanges can still require users to provide information for deposit and withdrawal transactions from self-custody wallets, which falls under the institution's own risk-based anti-money laundering/anti-terrorist financing project requirements, but the travel rule itself does not impose such a mandatory requirement.

However, positions in jurisdictions outside the U.S. vary regarding the threshold amounts that trigger the rules and whether VASPs must collect data from non-VASP individuals/entities. Policies in various countries are still being formulated. Regulatory agencies around the world are still exploring how to apply KYC, anti-money laundering, and travel rules to on-chain scenarios.

The good news is that the U.S. does not need to introduce new specialized legislation. Existing laws and regulatory frameworks can be adapted through regulatory guidance, rule amendments, or innovative exemptions. Congress has already recognized the responsibility allocation logic mentioned above. The GENIUS Act assigns anti-money laundering and sanctions obligations to licensed stablecoin issuers, which are identifiable entities at the application layer, rather than the unlicensed underlying networks through which stablecoins circulate. Regulators also recognize the value of new technologies in the compliance field. In a proposal from FinCEN in April 2026, machine learning, generative AI, digital identity, blockchain monitoring analysis, API interfaces, etc., are listed as innovative solutions to meet regulatory obligations.

FinCEN's proposal supports financial institutions in adopting emerging technologies, indicating that institutions "responsibly experimenting with innovative technologies in anti-money laundering/anti-terrorist financing projects will not face significant regulatory scrutiny or enforcement actions solely for using innovative technologies." To facilitate practical implementation for institutions, the cryptocurrency industry calls for FinCEN and banking regulators to clarify through formal rules or written guidance when digital identities can be used to meet anti-money laundering project requirements, including customer identification CIP/KYC.

Even if regulatory guidance becomes clearer, not all KYC judgments can be simplified into binary cryptographic proofs. Zero-knowledge proofs can demonstrate birth dates, nationalities, sanction screening results, and proof of possession; however, more complex anti-money laundering investigations that require human judgment still rely on traditional due diligence.

Verifiable credentials can assist or even replace certain aspects of customer identification CIP/KYC, but they will not completely replace risk-based customer due diligence. Current Treasury rules already allow non-documentary verification methods, and institutions can use a combination of various verification methods based on their own risk assessments. FinCEN's FAQ in September 2026 explicitly recognizes that qualified verifiable digital credentials can be used for banks' customer identification projects, but it does not fully endorse all decentralized identity or credential designs.

FinCEN and relevant banking regulators can improve guidance based on existing authority. Optional approaches include: issuing interpretive guidance, adding FAQs, targeted exemptions, pilot projects (approval for implementation after pilot completion), credential issuer standards, or amending regulations. This plan allows traditional financial institutions and qualified public or private entities to issue verification credentials according to unified standards, reducing the need for each bank to build the same identity profile repeatedly.

Before this, financial institutions could already use tools that comply with existing rules. Below are feasible implementation ideas.

Feasible Solutions

Institutions can rely on a trusted, compliant backend system to enable identity credentials to be reused across various on-chain applications. Trusted service providers verify user identities and generate digital signature credentials to record verification results. Users present this credential to other applications, which only need to verify the credential issuer's qualifications to confirm whether they meet their own verification standards.

This concept is not new and can be traced back to Vitalik Buterin's idea of soulbound tokens proposed in 2022. Supporting solutions also include W3C standards for decentralized identity (DID) and verifiable credentials, which are not exclusive to the cryptocurrency industry.

In practice, compliant KYC service providers, banks, or even governments act as trusted issuers to verify user identities and issue credentials. Credentials are stored in the user's wallet, and users can selectively disclose information to the applications they need.

Similarly, zero-knowledge succinct proof systems allow users to prove they have completed KYC without disclosing personal identity information, thus protecting privacy. Users can reuse this credential, provided it meets the receiving institution's customer identification CIP requirements, reducing the need for repeated verification.

The verification mechanism also needs to be composable, allowing applications to embed verification logic into their own compliance checks. More specifically, to achieve maximum effectiveness, issuers and platforms can embed this logic into token contracts or application layer smart contracts. Institutions can execute their own compliance requirements without needing external components or embedding compliance logic into the underlying public blockchain network.

Implementation Methods

There are other feasible tools to help financial institutions meet risk-based anti-money laundering project requirements: Know Your Wallet (KYW), Know Your Assets (KYA), and Know Your Transactions (KYT). Exchanges and money transfer service providers have already incorporated these methods into their overall anti-money laundering solutions.

Know Your Wallet (KYW)

KYW binds identity verification to the blockchain addresses used by customers, helping institutions confirm the actual controller of the wallet and what assets and services the customer is eligible to access. KYW includes:

• Identity Binding: Generally performed during the account opening KYC phase, binding real-world identity to the wallet address;
• Liveness and Uniqueness Verification: Confirming that the identity belongs to a real human being, with no duplicate identities across wallets; and regularly refreshing the binding relationship to ensure the same real-world identity continues to control the wallet;
• Access/Permission Control: After wallet verification is completed, specific access permissions are granted (whether the individual is a qualified investor, whether the region is compliant, whether they can hold specific types of assets), which is the compliance access layer.

KYC in the cryptocurrency space largely follows traditional models. Service providers like Onfido, Veriff, Trulioo, Socure, Incode, ID.me, Persona, Sumsub, and Sardine offer identity binding, document verification, liveness detection, and anti-money laundering screening. Most of this identity verification is completed off-chain, and verification alone cannot confirm which wallet address the user controls; binding the verified identity to the wallet address is an additional step.

On-chain applications can use non-transferable tokens to record verification results, employ zero-knowledge proofs to limit personal information disclosure, and use identity verification solutions to confirm that the user is an independent human being. Multiple solutions can be combined.

This approach utilizes non-transferable, non-sellable tokens, often referred to as soulbound tokens, permanently binding to a specific wallet address. Within the KYW system, compliant service providers complete user identity verification off-chain and mint a token in the user's wallet as a verification record. Quadrata is an example of this type of solution, generating soulbound tokens to verify attributes like nationality and age.

These tokens facilitate audit record verification, but their non-transferability alone cannot prevent others from taking over the wallet. For example, if a wallet's private key is stolen or control is transferred, the identity corresponding to the token no longer matches the current wallet controller. The system also needs to have mechanisms for credential expiration and revocation, depending on product implementation; Quadrata supports issuer revocation of credentials.

Related solutions embed compliance logic into asset tokens. DTCC's ComposerX, a tokenization platform for institutions, uses a Compliance-Aware Token Framework (CATF) to enforce regulatory and trading rules during transaction execution. The success of asset transfers depends on whether compliance conditions are met.

There are also startup projects planning to issue identity tokens, such as Burrata, whose technical solutions are feasible but lack market fit and have already shut down.

Zero-knowledge proofs address another layer of pain points: users can prove identity-related claims without disclosing the underlying raw data. Many solutions already exist that can generate zero-knowledge proofs through document scanning.

• Self.xyz offers a privacy-protecting "pre-KYC" solution: users scan physical passports to generate zero-knowledge proofs of passport information, proving they are over 18 and not on a sanctions list. This can serve as a preliminary screening layer before formal KYC, filtering out bots and sanctioned wallets, saving time.
• Ethereum privacy L2 Aztec acquired zkPassport, adopting a similar approach to scan passports and generate zero-knowledge proofs.
• Opacity Labs uses a zero-knowledge transport layer security protocol (zkTLS); its trusted data network VDN can generate verifiable proofs for any Web2 fact (such as account ownership, transaction history) and transmit them on-chain without disclosing the underlying raw data.

Finally, there are human verification solutions. These solutions do not verify who the user is but only confirm that the wallet is controlled by a unique, real human.

Worldcoin's World ID collects iris biometric information through dedicated hardware called Orb, proving human uniqueness. After capturing the iris image, the Orb encrypts and transmits it to the user's phone, deleting the original image from the device; it generates a hash value to compare with other hashes to complete the uniqueness verification. Users generate a key pair in the World App and create a zero-knowledge proof when they need to prove their unique human identity.

Human verification combined with identity binding (proving who this real person is) can strongly resist deepfakes and reduce identity impersonation in certain scenarios, such as bank account openings. World has partnered with Zoom to compare user video footage with World ID, marking Zoom accounts as "verified human." Another solution, Human Passport, was initially used to protect Gitcoin-funded projects, providing modular identity verification and witch attack defense tools.

Please note: human verification can only address witch attacks and deepfake issues; it cannot meet regulatory identity verification requirements. To form a complete solution, it still needs to be paired with other KYC methods.

The above solutions focus on the individuals behind the wallets. The assets themselves also bring another set of compliance issues, including asset sources, holding, and transfer permission restrictions.

Know Your Assets (KYA)

KYW focuses on who holds the assets, while KYA focuses on what can be done with those assets and who can trade with them.

Overall, the anti-money laundering legal provisions are broad. The Bank Secrecy Act does not concern itself with asset types; asset categories are more qualitatively assessed by market regulatory agencies: whether they belong to securities or commodities, etc. However, Know Your Asset (KYA) is an important tool for financial institutions to assess various compliance risks. KYA focuses on the source of assets: how assets are issued, by whom they are issued, including compliance attribute verification during the issuance phase and throughout the entire lifecycle.

The most direct implementation method is to write transfer restrictions into the token contract at the time of token issuance. The RWA tokenization platform Securitize embeds compliance logic at the token level. When it issues BlackRock BUIDL and Apollo ACRED, the token contract mandates that transfers can only occur between whitelisted wallets. Assets do not rely on external access layers; the token contract directly enforces transfer restrictions. Ondo's OUSG and Superstate's USTB adopt a similar model: with each transaction, the transfer hook verifies the on-chain whitelist, ensuring both the sender and receiver complete verification before settlement can proceed.

An unresolved challenge in the KYA domain is asset traceability: it is necessary not only to confirm token attributes but also to trace the source of assets. Tokens issued by regulated platforms with clean KYA records have clear origin records. However, when tokens bridge, are packaged, or used as collateral in DeFi protocols, the traceability chain may be compromised. The issuance phase can generate clear initial records; however, maintaining and interpreting this record during subsequent asset circulation remains a challenge, which is also related to the Know Your Transaction (KYT) due diligence discussed below.

However, this is more of an operational challenge rather than a liability trap. The U.S. Office of Foreign Assets Control (OFAC) does not require institutions to assume the sanction risk of every address that assets pass through. Blockchain analysis tools can distinguish between direct risk exposure (assets directly transferred from sanctioned addresses) and multi-hop indirect exposure. Institutions manage the latter through risk thresholds, asset isolation, and suspicious transaction reporting, rather than rejecting all assets that flow through unlicensed infrastructure.

Know Your Transaction (KYT)

KYT helps institutions assess the aforementioned risks, track associations between different wallets, and map the flow of assets between wallets.

Transaction monitoring is a fundamental tool for financial institutions to observe customer behavior and identify suspicious activities that need to be reported. For a specific asset, KYT can map the entire lifecycle transaction history of the asset, showing which wallets and protocols the asset has interacted with. In simple terms, KYT focuses on examining the transaction itself, which can be independent of or in conjunction with the identity verification of the transaction parties. This set of tools meets the requirements for Continuous Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD).

Blockchain analysis service providers like Chainalysis, Elliptic, and TRM can track wallet relationships and trace the flow of funds across chains and protocols. Coupled with on-chain and off-chain data and emerging AI tools, these products help financial institutions meet compliance obligations related to the Bank Secrecy Act and sanctions.

Examples of related AI tools include Eunice.ai, which processes risk monitoring and information disclosure based on an asset classification framework; Didit, which provides screening and transaction monitoring for real-time risk analysis by wallet; and Sardine.ai, which completes initial screening while providing daily ongoing transaction monitoring.

In addition to KYW, KYA, and KYT, some blockchains and protocols have built-in compliance control functions.

Blockchain Layer Solutions

Permissioned chains and permissionless public chains are increasingly providing tools for access control and privacy protection. These tools can intercept transactions before conditions are met while protecting sensitive information from disclosure, retaining regulatory verification channels.

The Bank Secrecy Act and sanction regulations do not require verification nodes to be permissioned, identify all participants in the network, or impose access controls across the entire network. Regardless of which network is used, institutions only need to be responsible for their own customers and transactions. Institutions can choose from the solutions below based on business and product needs, provided they meet compliance obligations.

For example, Canton is a public permissioned network where transaction details are only open to relevant parties who need to know under a transaction privacy model, with compliance logic deeply integrated with smart contracts. Another example is Circle's Arc, where verification nodes operate under a permissioned model, but the chain itself is a public chain; verification nodes are all real-name participants who have completed KYC/KYB verification. In contrast, permissionless protocols allow the protocol itself to choose verification nodes for each transaction. Processing this transaction does not make the verification node a counterparty to the institution or customer.

Some permissionless protocols also support access control funds, gateways, or rules, facilitating institutional users in managing access permissions. Solana achieves compliance through token expansion features, where each transfer is validated against an on-chain whitelist; only transfers between whitelisted parties can be executed. The asset layer enforces mandatory verification, while the underlying network remains permissionless, with whitelists typically generated off-chain.

Uniswap v4, as a permissionless protocol, comes with hook functionality that can mount custom logic at critical points in the exchange lifecycle, allowing for the creation of permissioned liquidity pools. The tokens themselves remain permissionless, with only the liquidity pool setting access thresholds. Third parties deploying liquidity pools with access restrictions do not turn the protocol itself into a permissioned chain; the entity deploying the liquidity pool and setting access rules assumes related obligations. Hyperliquid also supports the HIP-3 proposal, allowing deployers to limit transactions to approved addresses.

The decentralized lending protocol Morpho allows users to build compliance controls with market participants. The protocol itself does not execute KYC or identity verification. In the Morpho Blue variable rate lending protocol, if the market uses KYC-compliant USDC or similar whitelisted tokens as collateral, compliance controls can be implemented at the asset level, allowing only verified users to interact with that specific market.

Morpho Midnight, based on intent-based fixed-rate lending protocols, and Morpho Vaults V2, can set access permissions more flexibly. Morpho Vaults V2 allows independent managers to set custom access thresholds, restricting borrower qualifications, enabling capital to be allocated across networks to borrowers with specific compliance qualifications. This modular design allows institutions that prefer to transact only with verified counterparties to use permissioned markets and vaults without compromising the liquidity efficiency of the entire protocol ecosystem. This is a choice of product and risk preference, and the institution's own compliance obligations do not depend on whether other participants in the shared market have completed verification.

Cross-Chain Compliance Information Transmission

Access control determines who can participate in specific markets or vaults. When assets are transferred across chains, issuers and applications face another challenge: transmitting relevant compliance information and executing unified rules across multiple networks.

LayerZero supports cross-chain transmission of "compliance status," eliminating the need to rebuild and maintain compliance logic separately on each chain. Its Omnichain Fungible Token (OFT) standard supports custom logic hooks, requiring compliance verification to be completed on both the source and target chains before asset transfer settlement.

LayerZero V2 introduces a configurable Decentralized Verification Network (DVN) to verify cross-chain messages. The DVN can be configured to enforce compliance checks: verifying whether users/wallets have completed KYC, screening addresses against sanction lists, and confirming that messages include travel rule metadata before determining message validity.

Chainlink similarly connects off-chain verification with on-chain compliance requirements, using the Chainlink Automated Compliance Engine (ACE) to bring KYC service provider data on-chain. ACE enables reusable KYC, supporting cross-chain binding of user wallets: verification and registration can be done once and called multiple times.

Macro Perspective

These tools address different aspects of on-chain compliance. When implemented, they need to integrate with existing compliance systems to enable tokenized products to reach customers.

The simplest short-term approach is to collaborate with exchanges that already have mature compliance systems to reach more customers, but this is not a mandatory compliance requirement. Issuers can also directly embed control logic into the tokens themselves; BUIDL, OUSG, and USDC are examples of this type, where assets can flow on public chains while being constrained by rules within the contract.

The next opportunity is to make compliance verification results reusable within the DeFi ecosystem. This means that applications and institutions can rely on verification information provided by other service providers and assess it against their own standards. The implementation of this system will likely depend on unified protocol standards, compliance-focused software service providers, and traditional platforms with existing KYC users for distribution.

Future Direction: Know Your Agent

Reusable credentials can confirm the identity of human customers. However, when AI agents trade on-chain, manage vaults, or initiate payments on behalf of users, institutions still need to confirm: who authorized this agent and what operational permissions the agent has. Know Your Agent extends this discussion to software that performs operations on behalf of clients, defining its permission boundaries.

Just as humans need credit scores to apply for loans, AI agents also require cryptographic signature credentials for transactions. This is the emerging Know Your Agent framework: a KYC for AI agents. Without a comprehensive Know Your Agent framework, liability issues may arise, leading to situations where no one is accountable, yet everyone could potentially be held responsible.

The Know Your Agent framework requires new types of credentials to prove who authorized the agent, who they represent, and under what constraints they operate. Each agent must be identifiable, registrable (linked to individuals or corporate entities), have a reputation record, and verify permission constraints before interactions. Some solutions operate on-chain, while others operate off-chain, but an increasing number of solutions share the same cryptographic foundational primitives, including RFC 9421 signatures and W3C verifiable credentials.

On-Chain Solutions

The ERC-8004 standard will be deployed to the Ethereum mainnet in January 2026, marking the first significant on-chain standard for AI agent identity, with over 30,000 registrations in the first week. It provides an on-chain system to register AI agents, track reputations, and record independent verification results. Each agent is minted an ERC-721 token pointing to the agent's registration document. On-chain records are immutable, have trusted neutrality, and are composable, reducing reliance on a single platform.

Self.xyz's Self Agent ID, based on this standard, is an on-chain identity registration system that binds AI agent identities to human identity proofs from Self. Each agent possesses a non-transferable NFT backed by passport verification, allowing applications to reuse this credential to verify that the agent is a real human being.

Advantages of on-chain Know Your Agent solutions: immutable, trusted neutrality, composable.

Off-Chain Solutions

Many solutions use off-chain credentials and signed messages to identify agents and define permissions, even if payment actions occur on-chain.

• Google Proxy Payment Agreement AP2 uses signed messages to record user instructions, including spending limits and procurement conditions, retaining verifiable evidence of authorization obtained by the proxy.
• Catena Labs Proxy Business Toolkit proposes the ACK v2 solution, using signed authorization letters that specify who authorized the proxy and the scope of authorization. Each request is accompanied by an authorization letter and an HTTP message signature (RFC 9421).
• Skyfire KYAPay allows proxies to self-verify their identity and represent the principal; it uses a signed digital credential called JSON Web Token (JWT). Skyfire collaborates with Yibo Rui Agent Trust framework to bind proxies with verified consumers and devices.
• Circle Proxy Wallet focuses on custody and permission control. The signed key shards are invisible to the proxy, and users retain custody of their assets. Proxies can only transact autonomously within the spending limits and recipient restrictions set by the user.
• Anchorage Proxy Banking Services bind credentials to users or institutions, granting proxies the authority to spend from a designated budget. Transactions leave traces in the proxy's identity, and permissions can be revoked at any time.
• Mastercard Agent Pay registers proxies, binding proxy payments with consumer authorization and tokenized payment credentials. It collaborates with Cloudflare to use signed network requests to help merchants verify AI proxies accessing their websites.
• Visa Smart Commerce replaces card information with digital payment tokens, confirming that proxies have consumer operational authorization and setting spending limits.
• Zero Hash Proxy Financial Suite screens AI proxies and their underlying entities before transactions. It supports user delegation of permissions and transaction control.
• Ledger is building a solution to connect secure hardware with authorized humans. Its roadmap includes hardware-enforced spending rules, with sensitive transactions requiring manual approval.

Delegating financial operations to AI proxies raises issues related to authorization and control, returning to the fundamental topic of how institutions apply compliance verification to products and services.

Bringing the financial system onto the blockchain is also an opportunity to optimize the compliance system. Most of the above solutions do not require new legislation. Existing rules from the Treasury Department already recognize non-documentary verification methods, and the FAQ from September 2026 acknowledges verifiable digital credentials for Customer Identification Programs (CIP). FinCEN has stated that institutions will not face enforcement penalties as long as they responsibly experiment with new technologies. Institutions looking to avoid repetitive KYC processes can start with existing tools.