Short answerKnow Your Agent (KYA) answers "who is this agent and whom does it act for?". A bank also needs "what has this customer allowed it to do, who approved this exception, and can we prove it?". That is the job of mandates, approvals and evidence.
What KYA does well
KYA services verify the agent, the company that runs it and the person or business it represents, often issuing a credential or trust score. A number of identity, fraud and bot-management vendors launched agent products through 2025 and 2026, so identity is fast becoming a commodity input.
What KYA does not do
- Record the customer's limits for this account.
- Stop a verified agent paying a new supplier without asking.
- Produce the record a dispute team or examiner needs.
- Give the customer an off switch at their bank.
Authentication versus authorisation
Identity is authentication: proving who is calling. A mandate is authorisation: what the caller may do, signed by the person whose money it is. Banks have always needed both, from signature cards for cheques to consent screens for open banking.
How the layers fit
| Layer | Question answered |
|---|---|
| Agent identity (KYA) | Which agent, run by whom, for whom? |
| Mandate | What may it do on this account? |
| Approval | Did the customer confirm this exception? |
| Evidence | Can we prove all of the above later? |
Assay uses identity signals from existing providers and adds the mandate, approval and evidence layers on the bank's side.