a16z Rethinks KYC: Institutions Embrace On-Chain Without Being Stuck in Traditional KYC Frameworks

Traditional identity verification is hindering institutions from entering the on-chain space.

Written by: Maggie Hsu, Michele Korver, a16zcrypto
Compiled by: Chopper, Foresight News

"Know Your Customer (KYC)" checks are often seen as obstacles for traditional finance to access the on-chain ecosystem and drive the overall development of DeFi.

For those unfamiliar, these checks are a necessary part of financial institutions' obligations to combat money laundering and terrorist financing under the Bank Secrecy Act (BSA). This process requires coordination among issuing institutions, verification agencies, and regulatory bodies, each with different incentives, timelines, and legal requirements.

For banks, brokerages, and other institutions bound by the BSA, the challenge of bringing tokenized products on-chain lies in how to meet compliance requirements while reaching more customers and gaining liquidity, as compliance requirements can increase time and complexity. For example, when a new customer registers, institutions often need to repeat identity verification, even if the user has already completed similar checks elsewhere. Fortunately, new KYC tools designed specifically for blockchain hold the promise of making identity verification results reusable, freeing them from the outdated models of traditional finance.

The starting point of the discussion is to clarify whom institutions need to identify. In the traditional financial system, institutions conduct transactions through a network of intermediaries that have completed identity verification, with each institution independently fulfilling its own KYC obligations. This logic also applies to on-chain scenarios: a bank's customer identification obligations only pertain to its own customers, not to every participant in the underlying settlement infrastructure.

The core of customer identity verification rules is who opens an account at the bank. Under this interpretation, a user does not become a customer of the bank simply by transacting with a bank customer or exchanging with a liquidity pool provided by the bank. As long as the bank establishes a suitable compliance system that covers its customers and relevant transactions, it can fulfill its obligations under the BSA.

The U.S. Treasury is currently studying how financial institutions can leverage such new technologies and methods to meet anti-money laundering/anti-terrorist financing (AML/CFT) requirements, including Customer Identification Programs (CIP) and KYC. With the implementation of the GENIUS Act, regulators need to explore and promote innovative solutions and standards to achieve modern AML and CFT goals more efficiently.

This article will first analyze the legal conditions and practical prerequisites for reusable KYC implementation, and then discuss the roles that tools such as zero-knowledge proofs, verifiable credentials, non-transferable tokens, and on-chain data analysis can play. Finally, we will look ahead to "Know Your Agent": identifying AI agents, the entities they represent, and the operational permissions granted.

Applying KYC in the On-Chain World

Traditional KYC processes are completed independently by each financial institution. Each platform verifies identity through Customer Identification Programs (CIP) when users register for accounts, independently retaining records and continuously conducting customer due diligence. Identity information is kept by the institution, making it a trusted intermediary. When a user opens a new account on a platform, they must repeat the verification process, even if assets are circulating between individuals and businesses that have already completed identity verification.

Blockchain transactions add another layer of complexity. Assets are transferred across chains, protocols, and wallets, often without intermediaries to execute KYC. A wallet address may come from a BSA-regulated exchange, a DeFi protocol, or a consumer application. Each of these services has its own risk frameworks and responsibilities, and rules vary across different jurisdictions. Some intermediaries themselves have no KYC obligations; even if KYC is a mandatory requirement, there is currently no unified regulatory framework that allows verification results from Institution A to be directly transferred for use by Institution B. Institutions are forced to repeatedly verify the same user, increasing costs and delays.

Former SEC Commissioner Peirce recently stated, "The past approach to combating illegal financial activities has been unchanged: collect as much data as possible. This method has not been effective; technological development has far outpaced this outdated system, and the time for change has come."

Financial institutions, blockchain developers, and regulators are creating new solutions to meet KYC and AML/CFT goals. One direction is to allow institutions to reuse identity verifications already completed by other entities. To implement this mechanism, clear rules need to be established to define which entities' verification results can be trusted and who bears compliance responsibility.

Reusability and Trust Ecosystem

Users want to undergo KYC verification only once and be able to use it anywhere; this model is also known as reusable KYC, trust-based KYC, or custodial KYC.

In off-chain scenarios, users also undergo repeated verification. If a person opens accounts at two banks, both banks will require KYC completion, although ordinary users do not frequently open new bank accounts. However, in the crypto space, users continuously access new products, yet there is no trusted intermediary to ensure that KYC results remain valid throughout the entire transaction cycle.

Institutions do not want to eliminate KYC; they want to avoid redundant KYC. Each time a user accesses a new exchange or application, the KYC process must start from scratch. This is costly for platforms and creates barriers for users; as deepfake tools become more prevalent, the reliability of traditional verification methods continues to decline. Banks and other institutions bound by the BSA are burdened by this costly, privacy-infringing, and ineffective identity verification mechanism that fails to curb illegal financial activities.

Redundant verification means users must submit sensitive personal information to more institutions. Even submitting identification documents in digital form poses personal safety risks, making users more susceptible to targeted scams, stalking, identity theft, and other illegal uses of information. Mobile identity credentials often disclose users' full names, addresses, birth dates, and photos all at once.

This centralized storage of personal identity information is a "honeypot" that is highly attractive to financial criminals. If information is intercepted, improperly stored, or if institutions retain data beyond the appropriate duration, the consequences can be severe. Coin Center points out that the existing system forces individuals to "repeatedly submit sensitive personal information to centralized databases, bearing significant personal risks." To mitigate these unnecessary security hazards, privacy advocates urge regulators to consider alternative digital identity verification methods beyond government-issued ID records.

A reference case in the traditional financial market is SWIFT's KYC Registry. Global banks have long used the SWIFT communication network to transmit cross-border payment instructions. In 2014, SWIFT launched the KYC Registry, extending this infrastructure into the compliance realm: banks only need to upload their information once, which can then be shared with any trading counterpart in need. This registry now covers nearly 8,000 institutions across over 200 countries, and the mechanism operates effectively because transactions occur between institutions, with the identities of trading counterparts already known.

The crypto industry currently lacks a corresponding centralized registry. If Coinbase has completed KYC for a user according to bank-level standards, can other platforms directly accept that verification result? If a user who has completed KYC with Robinhood wants to access an on-chain lending protocol, can Robinhood's prior compliance verification work be transferred with the user?

This is what is referred to as "whitelist liquidity." Accessing pre-verified user funds pools essentially distributes compliance capabilities, but it is not a legal requirement. Whether customers trade in a whitelist fund pool or an unlicensed fund pool, the institution's own compliance obligations remain unchanged. For tokenized securities, managing access control for fund pools and setting trading access standards may trigger regulatory obligations under the latest innovation exemption provisions from the U.S. SEC. Asset issuers are proactively connecting with major exchanges worldwide, hoping to leverage the exchanges' compliance frameworks, but the corresponding business architecture is still being built.

Outsourcing and Compliance Trust

New solutions designed specifically for the crypto industry can reduce unnecessary data collection, providing auditable and verifiable alternatives that break free from the past "process-driven" KYC. In fact, there are already more and more trust-based KYC implementation cases emerging in the crypto space.

KYC trust can also be understood as a "trust ecosystem": a network of trust built by large-scale KYC service providers (or service provider alliances), similar to the concept of single sign-on. Service provider examples include Sumsub ID, World ID, MoonPay, and Stripe, which provides services through Privy. Initial verifications typically charge the initiating platform $1-2, and subsequent platforms only need to conduct part of the KYC process (e.g., live detection), reducing the verification cost for individual users.

A recent case is Fireblocks' Open Trading Layer (OTL), an open protocol stack that unifies identity, compliance, and messaging standards for participants in on-chain finance. Notably, KYC is completed by regulated entities within the network, rather than by OTL itself. OTL builds a shared protocol, and once a certain institution within the network completes user verification, other participants can recognize that verification status without needing to repeat the verification.

Another similar solution is Privado ID (formerly Polygon ID, spun off from Polygon Labs in 2024 and recently merged with Disco.xyz), which enables reusable electronic KYC. Verifiable credentials are generated by issuers such as government agencies, banks, and KYC service providers; users apply for, collect, and store these credentials in an identity wallet. Verifiers can query the corresponding credentials from the user wallet, applicable in both on-chain and off-chain scenarios.

SpruceID is another solution built on identity standards. Trusted sources such as vehicle registration offices and state licensing agencies issue verifiable digital credentials, which users store on their phones. These tools simplify the reuse of verification results, but institutions must still be clear about their legal responsibilities when accepting third-party verification results.

Institutions can outsource KYC operations, but the legal classification depends on the service provider and the collaboration model. According to the FFIEC's Bank Secrecy Act/Anti-Money Laundering Manual, trust is a specific legal term that only applies to accepting verification results from another regulated financial institution. If the partner is an identity verification supplier or credit agency that does not meet the qualifications, it can only be considered outsourcing. In this case, the institution still needs to independently bear full responsibility for the Customer Identification Program.

Similarly, the Financial Action Task Force (FATF), which sets global AML/CFT standards, stipulates that countries may allow financial institutions to delegate third parties to complete part of the customer due diligence work, but three conditions must be met simultaneously:

1. The third party itself is subject to AML and KYC-related regulation and supervision, and has corresponding compliance measures;
2. The accepting institution can, upon request, promptly retrieve the underlying KYC raw data;
3. The accepting institution bears full legal responsibility for the final compliance results.

These rules cannot be directly applied to the crypto industry. First, the requirement for "prompt retrieval of raw data" means that regulatory or law enforcement agencies need to be able to access users' personal identity information at any time. This directly conflicts with the privacy protection designs of most on-chain KYC solutions.

Additionally, many crypto platforms do not meet the definition of "regulated entities" as defined by U.S. federal AML and customer identification trust rules, even if they are registered money services businesses or state-chartered trust companies and bear their own AML obligations. Therefore, they cannot serve as formal trading counterparts in a trust relationship.

This is an obstacle that must be addressed as the U.S. Treasury advances more flexible, native cryptocurrency customer identification solutions. Decentralized solutions are cheaper, more efficient, and better protect user privacy while reducing the risk of data breaches; however, law enforcement agencies still require a trusted source that can confirm a user's true identity and provide written evidence for investigations or court proceedings.

In addition to anti-money laundering (AML) project requirements, financial institutions must also comply with funds transfer rules, commonly known as the "travel rule." Any financial institution or virtual asset service provider (VASP, which in the U.S. includes institutions subject to the Bank Secrecy Act that transfer amounts exceeding a threshold, typically $3,000; other jurisdictions have lower thresholds) must collect and pass on the identity information of both the payer and the payee to the next institution in the chain. This process flows smoothly in traditional financial scenarios because banks already hold KYC data and have established messaging channels like SWIFT to transmit information. However, in the cryptocurrency space, on-chain transactions and KYC information are separated.

Several mature service providers offer compliance solutions for the travel rule specific to the cryptocurrency industry. These include the TRUST (Travel Rule Universal Solution Technology) launched by industry alliance Coinbase, as well as similar products from Notabene and Sumsub.

In the U.S., travel rule messaging is only required to be executed between financial institutions. Financial institutions and virtual asset service providers are not required to send such data to non-financial institutions or non-VASP entities (such as self-custody wallets).

Financial institutions do not need to overly worry about travel rule compliance when interacting with non-intermediary blockchain technologies like DeFi and self-custody wallets. Banks or exchanges can still require users to provide information for deposits and withdrawals from self-custody wallets, which falls under the institution's own risk-based AML/Counter-Terrorism Financing (CTF) project requirements, but the travel rule itself does not impose such a mandatory requirement.

However, there are differences in the positions of jurisdictions outside the U.S. regarding the triggering amount thresholds for the rules and whether VASPs must collect data from non-VASP individuals/entities. Policies are still being formulated in various countries. Regulatory agencies around the world are still exploring how to apply KYC, AML, and the travel rule to on-chain scenarios.

The good news is that the U.S. does not need to introduce new specialized legislation. Existing laws and regulatory frameworks can be adapted through regulatory guidance, rule amendments, or innovative exemptions. Congress has already recognized the responsibility allocation logic mentioned above. The GENIUS Act assigns AML and sanctions obligations to licensed stablecoin issuers, which are identifiable entities at the application layer, rather than the unlicensed underlying networks through which stablecoins circulate. Regulatory agencies also recognize the value of new technologies in the compliance field. In a proposal by FinCEN in April 2026, machine learning, generative AI, digital identity, blockchain monitoring analysis, and API interfaces were listed as innovative solutions to meet regulatory obligations.

FinCEN's proposal supports financial institutions in adopting emerging technologies, indicating that institutions "responsibly experiment with innovative technologies in AML/CTF projects will not face significant regulatory scrutiny or enforcement actions solely for using innovative technologies." To facilitate practical implementation for institutions, the cryptocurrency industry calls on FinCEN and banking regulators to clarify through formal rules or written guidance when digital identities can be used to meet AML project requirements, including Customer Identification Program (CIP)/KYC.

Even with clearer regulatory guidance, not all KYC determinations can be simplified into binary cryptographic proofs. Zero-knowledge proofs can demonstrate birth dates, nationalities, sanctions screening results, and proof of possession; however, more complex AML investigations that require human judgment still rely on traditional due diligence.

Verifiable credentials can assist or even replace certain aspects of customer identification (CIP/KYC), but they will not completely replace risk-based customer due diligence. The Treasury's current rules already allow for non-documentary verification methods, and institutions can use a combination of various verification methods based on their own risk assessments. FinCEN's September 2026 FAQ explicitly recognizes that qualified verifiable digital credentials can be used for banks' customer identification projects, but it does not fully endorse all decentralized identity or credential designs.

FinCEN and relevant banking regulators can improve guidance based on existing authority. Optional approaches include: issuing interpretive guidance, adding FAQs, targeted exemptions, pilot projects (approval for implementation after pilot completion), credential issuer standards, or amending regulations. This plan allows traditional financial institutions and qualified public or private entities to issue verifiable credentials according to a unified standard, reducing the need for each bank to build the same identity profile repeatedly.

Before this, financial institutions have already been able to adopt tools that comply with current rules. Below are feasible implementation ideas.

Feasible Solutions

Institutions can rely on a trusted, compliant backend system that allows identity credentials to be reused across various on-chain applications. Trusted service providers verify user identities and generate digital signature credentials that record verification results. Users present this credential to other applications, which only need to verify the credential issuer's qualifications to confirm whether they meet their own verification standards.

This concept is not new and can be traced back at least to Vitalik Buterin's idea of soulbound tokens proposed in 2022. Supporting solutions also include W3C standards for decentralized identities (DID) and verifiable credentials, which are not exclusive to the cryptocurrency industry.

In practice, compliant KYC service providers, banks, or even governments act as trusted issuers to verify user identities and issue credentials. Credentials are stored in the user's wallet, and users can choose to disclose information to the applications they need.

Similarly, zero-knowledge succinct proof systems allow users to prove they have completed KYC without disclosing personal identity information, thus protecting privacy. Users can reuse this credential as long as it meets the customer identification (CIP) requirements of the receiving institution, reducing the need for repeated verification.

The verification mechanism also needs to be composable, allowing applications to embed verification logic into their own compliance checks. More specifically, to achieve maximum effectiveness, issuers and platforms can embed this logic into token contracts and application-layer smart contracts. Institutions can execute their own compliance requirements without needing external components or embedding compliance logic into the underlying public blockchain network.

Implementation Methods

There are also other feasible tools to help financial institutions meet risk-based AML project requirements: Know Your Wallet (KYW), Know Your Assets (KYA), and Know Your Transactions (KYT). Exchanges and money transfer service providers have already incorporated these methods into their overall AML strategies.

Know Your Wallet (KYW)

KYW binds identity verification to the blockchain addresses used by customers, helping institutions confirm the actual controller of the wallet and what assets and services the customer is eligible to access. KYW includes:

• Identity Binding: Generally done during the account opening KYC phase, binding real-world identities to wallet addresses;
• Liveness and Uniqueness Verification: Confirming that the identity belongs to a real human being, with no duplicate identities across wallets; and regularly refreshing the binding relationship to ensure the same real-world identity continues to control the wallet;
• Access/Permission Control: After wallet verification is completed, specific access permissions are granted (whether the investor is qualified, whether the region is compliant, whether they can hold specific asset types), which is the compliance access layer.

KYC in the cryptocurrency space largely follows traditional models. Service providers like Onfido, Veriff, Trulioo, Socure, Incode, ID.me, Persona, Sumsub, and Sardine offer identity binding, document verification, liveness detection, and AML screening. Most of this identity verification is done off-chain, and the verification itself cannot confirm which wallet address the user controls; binding the verified identity to the wallet address is an additional step.

On-chain applications can use non-transferable tokens to record verification results, employ zero-knowledge proofs to limit personal information disclosure, and use identity verification solutions to confirm that the user is an independent real person. Various solutions can be combined.

This approach uses non-transferable, non-sellable tokens, often referred to as soulbound tokens, permanently binding to a specific wallet address. Within the KYW system, compliant service providers complete user identity verification off-chain and mint a token in the user's wallet as a record of verification. Quadrata is an example of this type of solution, generating soulbound tokens to verify user nationality, age, and other attributes.

These tokens facilitate audit record verification, but their non-transferability does not prevent others from taking over the wallet. For example, if a wallet's private key is stolen and control is transferred, the identity corresponding to the token no longer matches the current wallet controller. The system also needs to have mechanisms for credential expiration and revocation, depending on product implementation; Quadrata supports issuers in revoking credentials.

Related solutions involve embedding compliance logic into asset tokens. DTCC's ComposerX, a tokenization platform for institutions, employs a compliance-aware token framework (CATF) that enforces regulatory and trading rules during transaction execution. Whether asset transfers can succeed depends on whether compliance conditions are met.

There are also startup projects planning to issue identity tokens, such as Burrata, whose technical solutions are feasible but lack product-market fit and have already shut down.

Zero-knowledge proofs address another layer of pain points: users can prove identity-related claims without disclosing the underlying raw data. Many solutions already exist that can generate zero-knowledge proofs through document scanning.

• Self.xyz offers a privacy-protecting "pre-KYC" solution: users scan physical passports to generate zero-knowledge proofs of passport information, proving they are over 18 years old and not on sanctions lists. This can serve as a preliminary screening layer before formal KYC, filtering out bots and sanctioned wallets, saving time.
• Ethereum privacy L2 Aztec acquired zkPassport, employing a similar approach to scan passports and generate zero-knowledge proofs.
• Opacity Labs uses a zero-knowledge transport layer security protocol (zkTLS); its trusted data network VDN can generate verifiable proofs for any Web2 facts (such as account ownership, transaction history) and transmit them on-chain without disclosing the underlying raw data.

Finally, there are identity verification solutions. These solutions do not verify who the user is but only confirm that the wallet is controlled by a unique, real human being.

Worldcoin's World ID collects iris biometric information through dedicated hardware called Orb to prove human uniqueness. After capturing the iris image, it is encrypted and transmitted to the user's phone, and the original image is deleted from the device; a hash value is generated and compared with other hashes to complete the uniqueness verification. Users generate a key pair in the World App and create zero-knowledge proofs when they need to prove their unique human identity.

Identity verification combined with identity binding (proving who this real person is) can strongly resist deep forgery and reduce identity impersonation in certain scenarios, such as bank account openings. World has partnered with Zoom to compare user video footage with World ID, marking Zoom accounts as "verified human." Another solution, Human Passport, was initially used to protect Gitcoin funding projects, providing modular identity verification and witch attack defense tools.

Please note: identity verification can only address witch attacks and deep forgery issues; it cannot meet regulatory identity recognition requirements. To form a complete solution, it still needs to be combined with other KYC methods.

The above solutions focus on the individuals behind the wallets. The assets themselves also bring another set of compliance issues, including asset sources, holding, and transfer permission restrictions.

Know Your Assets (KYA)

KYW focuses on who holds the assets, while KYA focuses on what can be done with those assets and who can trade with them.

Overall, anti-money laundering (AML) laws are broadly written. The Bank Secrecy Act does not concern itself with asset types; asset categories are more qualitatively assessed by market regulators: whether they belong to securities or commodities, etc. However, Know Your Asset (KYA) is an important tool for financial institutions to assess various compliance risks. KYA focuses on the source of assets: how assets are issued, by whom, and includes compliance attribute verification during the issuance phase and throughout the asset's lifecycle.

The most direct implementation method is to write transfer restrictions into the token contract at the time of issuance. The RWA tokenization platform Securitize embeds compliance logic at the token level. When issuing BlackRock's BUIDL and Apollo's ACRED, the token contracts mandate that transfers can only occur between whitelisted wallets. Assets do not rely on external access layers; the token contract directly enforces transfer restrictions. Ondo's OUSG and Superstate's USTB adopt a similar model: with each transaction, the transfer hooks verify the on-chain whitelist, ensuring both the sender and receiver are verified before settlement can proceed.

A challenge that remains unresolved in the KYA domain is asset traceability: it is necessary not only to confirm token attributes but also to trace the source of assets. Tokens issued by regulated platforms with clean KYA records have clear origin records. However, when tokens bridge, are wrapped, or used as collateral in DeFi protocols, the traceability chain can be compromised. Clear initial records can be generated during the issuance phase; however, maintaining and interpreting this record during subsequent asset transfers remains a challenge, which is also related to the Know Your Transaction (KYT) due diligence discussed below.

However, this is more of an operational challenge rather than a liability trap. The U.S. Office of Foreign Assets Control (OFAC) does not require institutions to assume sanction risks for every address that assets pass through. Blockchain analysis tools can distinguish between direct risk exposure (assets directly transferred from sanctioned addresses) and multi-hop indirect exposure. Institutions manage the latter through risk thresholds, asset isolation, and suspicious transaction reporting, rather than rejecting all assets that have passed through unlicensed infrastructure.

Know Your Transaction (KYT)

KYT helps institutions assess the aforementioned risks, track associations between different wallets, and map the flow of assets between wallets.

Transaction monitoring is a fundamental tool for financial institutions to observe customer behavior and identify suspicious activities that need to be reported. For a specific asset, KYT can map the entire lifecycle transaction history, showing which wallets and protocols the asset has interacted with. In simple terms, KYT focuses on examining the transaction itself, which can be independent of or in conjunction with the identity verification of the transaction parties. This tool meets the requirements for Continuous Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD).

On-chain analysis service providers like Chainalysis, Elliptic, and TRM can track wallet associations and trace fund flows across chains and protocols. Coupled with on-chain and off-chain data as well as emerging AI tools, these products help financial institutions meet compliance obligations related to the Bank Secrecy Act and sanctions.

Examples of related AI tools include Eunice.ai, which processes risk monitoring and information disclosure based on an asset classification framework; Didit, which provides screening and transaction monitoring for real-time risk analysis by wallet; and Sardine.ai, which completes initial screening while providing daily continuous transaction monitoring.

In addition to KYA, KYT, and KYW, some blockchains and protocols have built-in compliance control functions.

Blockchain Layer Solutions

Permissioned and permissionless public chains are increasingly providing tools for access control and privacy protection. These tools can intercept transactions before conditions are met while protecting sensitive information from exposure, retaining regulatory audit channels.

The Bank Secrecy Act and sanctions regulations do not require that validating nodes must be licensed, identify all participants in the network, or impose access controls across the entire network. Regardless of which network is used, institutions only need to be responsible for their own customers and transactions. Institutions can choose from the solutions below based on business and product needs, provided they meet compliance obligations.

For example, Canton is a public permissioned network where transaction details are only open to relevant parties who need to know under a transaction privacy model, deeply integrating compliance logic with smart contracts. Another example is Circle's Arc, where validating nodes operate under a permissioned model, but the chain itself is a public chain; validating nodes are all real-name participants who have completed KYC/KYB verification. In contrast, permissionless protocols allow the protocol itself to choose validating nodes for each transaction. Processing this transaction does not make the validating node a counterparty to the institution or customer.

Some permissionless protocols also support access control funds, gateways, or rules, making it easier for institutional users to manage access permissions. Solana achieves compliance through token expansion features, where each transfer is validated against the on-chain whitelist, allowing transactions to execute only if both the sender and receiver are on the whitelist. The asset layer enforces mandatory verification, while the underlying network remains permissionless, with whitelists typically generated off-chain.

Uniswap v4, as a permissionless protocol, comes with hook functionality that can mount custom logic at key points in the exchange lifecycle, enabling the construction of permissioned liquidity pools. The tokens themselves remain permissionless, with only the liquidity pool setting access thresholds. Third parties deploying liquidity pools with access restrictions do not turn the protocol itself into a permissioned chain; the entity deploying the liquidity pool and setting access rules assumes related obligations. Hyperliquid also supports the HIP-3 proposal, allowing deployers to limit transactions to approved addresses.

The decentralized lending protocol Morpho allows users to build compliance controls with market participants. The protocol itself does not execute KYC or identity verification. In the Morpho Blue variable interest rate lending protocol, if the market uses KYC-compliant USDC or similar whitelisted tokens as collateral, compliance controls can be implemented at the asset level, allowing only verified users to interact with that specific market.

Morpho Midnight, a fixed-rate lending protocol based on intent, and Morpho Vaults V2 can set access permissions more flexibly. Morpho Vaults V2 allows independent managers to set custom access thresholds, restricting borrower qualifications so that capital can be allocated across networks to borrowers with specific compliance qualifications. This modular design allows institutions that prefer to transact only with verified counterparties to use permissioned markets and vaults without compromising the liquidity efficiency of the entire protocol ecosystem. This is a product and risk preference choice, and the institution's own compliance obligations do not depend on whether other participants in the shared market have completed verification.

Cross-Chain Compliance Information Transfer

Access control determines who can participate in specific markets or vaults. When assets are transferred across chains, issuers and applications face another challenge: transmitting relevant compliance information and executing unified rules across multiple networks.

LayerZero supports cross-chain transmission of "compliance status," eliminating the need to rebuild and maintain compliance logic separately on each chain. Its Omnichain Fungible Token (OFT) standard supports custom logic hooks, requiring compliance verification to be completed on both the source and target chains before asset transfer settlement.

LayerZero V2 introduces a configurable Decentralized Validation Network (DVN) to verify cross-chain messages. DVN can be configured to enforce compliance checks: checking whether users/wallets have completed KYC, screening addresses against sanction lists, and confirming that messages include travel rule metadata before they are deemed valid.

Chainlink also bridges off-chain verification with on-chain compliance needs, using the Chainlink Automated Compliance Engine (ACE) to put KYC service provider data on-chain. ACE enables reusable KYC, supporting cross-chain binding of user wallets: verification and registration can be done once and called multiple times.

Macro Perspective

These tools address different aspects of on-chain compliance. In practical implementation, they need to integrate with existing compliance systems to reach customers with tokenized products.

The simplest short-term approach is to collaborate with exchanges that already have mature compliance systems to reach more customers, though this is not a mandatory compliance requirement. Issuers can also directly write control logic into the tokens themselves; BUIDL, OUSG, and USDC are examples of this type, allowing assets to flow on public chains while being bound by the rules within the contracts.

The next opportunity is to make compliance verification results reusable within the DeFi ecosystem. This means that applications and institutions can rely on verification information provided by other service providers and evaluate it against their own standards. The implementation of this system will likely depend on unified protocol standards, compliance-focused software service providers, and traditional platforms with existing KYC users for distribution.

Future Direction: Know Your Agent

Reusable credentials can confirm the identity of human customers. However, when AI agents trade on-chain, manage vaults, or initiate payments on behalf of users, institutions still need to confirm: who authorized this agent and what operational permissions the agent has. Know Your Agent extends this discussion to software that performs operations on behalf of clients, defining its permission boundaries.

Just as humans need credit scores to apply for loans, AI agents also require cryptographic signature credentials for transactions. This is the emerging Know Your Agent framework: a KYC for AI agents. Without a robust Know Your Agent framework, liability issues could lead to awkward situations where no one is accountable, yet everyone could potentially be held responsible.

The Know Your Agent framework requires new types of credentials to prove who authorized the agent, who they represent, and under what constraints they operate. Each agent must be identifiable, registrable (tied to an individual or corporate entity), and have a reputation record, with permission constraints verified before interactions. Some solutions operate on-chain, while others operate off-chain, but an increasing number of solutions share the same cryptographic foundational primitives, including RFC 9421 signatures and W3C verifiable credentials.

On-Chain Solutions

The ERC-8004 standard will be deployed to the Ethereum mainnet in January 2026, marking the first significant on-chain standard for AI agent identity, with over 30,000 registrations in the first week of launch. It provides an on-chain system for registering AI agents, tracking reputations, and recording independent verification results. Each agent is minted an ERC-721 token pointing to the agent's registration file. On-chain records are immutable, possess trusted neutrality, and are composable, reducing dependency on a single platform.

Self.xyz's Self Agent ID, based on this standard, is an on-chain identity registration system that binds AI agent identities to Self's human identity verification. Each agent possesses a non-transferable NFT backed by passport verification, allowing applications to reuse this credential to verify that a real human is behind the agent.

Advantages of on-chain Know Your Agent solutions: immutability, trusted neutrality, and composability.

Off-Chain Solutions

Many solutions use off-chain credentials and signed messages to identify agents and define permissions, even when payment actions occur on-chain.

• Google’s Proxy Payment Agreement AP2 uses signed messages to record user instructions, including spending limits and procurement conditions, retaining verifiable evidence of authorization obtained by the proxy.
• Catena Labs’ Proxy Business Toolkit proposes the ACK v2 solution, utilizing signed authorizations that specify who authorizes the proxy and the scope of authorization. Each request is accompanied by an authorization letter and an HTTP message signature (RFC 9421).
• Skyfire KYAPay allows proxies to self-verify their identity and represent the principal; it uses a signed digital credential called JSON Web Token (JWT). Skyfire collaborates with Yibolai’s Agent Trust framework to bind proxies with verified consumers and devices.
• Circle’s Proxy Wallet focuses on custody and permission control. The signature key shards are invisible to the proxy, and users retain custody of their assets. Proxies can only transact autonomously within the spending limits and recipient restrictions set by the user.
• Anchorage’s Proxy Banking Service binds credentials to users or institutions, granting proxies permission to spend from designated budgets. Transactions leave a trace under the proxy’s identity, and permissions can be revoked at any time.
• Mastercard’s Agent Pay registers proxies, binding proxy payments with consumer authorizations and tokenized payment credentials. It collaborates with Cloudflare to use signed network requests, helping merchants verify AI proxies accessing their websites.
• Visa’s Smart Commerce replaces card information with digital payment tokens, confirming that proxies have operational authorization from consumers and setting spending limits.
• Zero Hash’s Proxy Financial Suite screens AI proxies and their underlying principals before transactions. It supports user delegation of permissions and transaction control.
• Ledger is building solutions to connect secure hardware with authorized humans. Its roadmap includes hardware-enforced spending rules, with sensitive transactions requiring human approval.

Delegating financial operations to AI proxies raises issues related to authorization and control, returning to the fundamental topic of how institutions apply compliance verification to products and services.

Bringing the financial system onto the blockchain also presents an opportunity to optimize the compliance framework. Most of the aforementioned solutions do not require new legislation. The existing rules recognized by the Treasury already acknowledge non-documentary verification methods, and the FAQ from September 2026 recognizes verifiable digital credentials for Customer Identification Programs (CIP). FinCEN has stated that institutions will not face enforcement penalties as long as they responsibly experiment with new technologies. Institutions looking to avoid repeating KYC processes can start with existing tools.